Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x88
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x1003a600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x88], 0xbd667986
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x90], eax
sub eax, 0x81173e2f
je 0x10001d6c
jmp 0x100010f4
mov eax, dword [ebp - 0x90]
sub eax, 0x849dbf18
je 0x1000205a
jmp 0x1000110a
mov eax, dword [ebp - 0x90]
sub eax, 0x87dd29c7
je 0x10001d20
jmp 0x10001120
mov eax, dword [ebp - 0x90]
sub eax, 0x889bc70f
je 0x10002039
jmp 0x10001136
mov eax, dword [ebp - 0x90]
sub eax, 0x8940522d
je 0x10001a35
jmp 0x1000114c
mov eax, dword [ebp - 0x90]
sub eax, 0x8c985eee
je 0x100020cd
jmp 0x10001162
mov eax, dword [ebp - 0x90]
sub eax, 0xa151eb07
je 0x10001806
jmp 0x10001178
mov eax, dword [ebp - 0x90]
sub eax, 0xa1cbc14f
je 0x10001ab3
jmp 0x1000118e
mov eax, dword [ebp - 0x90]
sub eax, 0xb0c5f3b7
je 0x10001be6
jmp 0x100011a4
mov eax, dword [ebp - 0x90]
sub eax, 0xbca60a5b
je 0x10001ea6
jmp 0x100011ba
mov eax, dword [ebp - 0x90]
sub eax, 0xbd667986
je 0x10001545
jmp 0x100011d0
mov eax, dword [ebp - 0x90]
sub eax, 0xc1688053
je 0x10001fd3
jmp 0x100011e6
mov eax, dword [ebp - 0x90]
sub eax, 0xc5f65a33
je 0x10001f86
jmp 0x100011fc
mov eax, dword [ebp - 0x90]
sub eax, 0xc79de473
je 0x10001fad
jmp 0x10001212
mov eax, dword [ebp - 0x90]
sub eax, 0xc7c488e5
je 0x10001d8f
jmp 0x10001228
mov eax, dword [ebp - 0x90]
sub eax, 0xcedb5391
je 0x10001c0a
jmp 0x1000123e
mov eax, dword [ebp - 0x90]
sub eax, 0xcf4c8520
je 0x1000171d
jmp 0x10001254
mov eax, dword [ebp - 0x90]
sub eax, 0xd20806e4
je 0x100017d5
jmp 0x1000126a
mov eax, dword [ebp - 0x90]
sub eax, 0xd5549a32
je 0x10001ba9
jmp 0x10001280
mov eax, dword [ebp - 0x90]
sub eax, 0xd759c5fc
je 0x10001b55
jmp 0x10001296
mov eax, dword [ebp - 0x90]
sub eax, 0xd7f8afbb
je 0x10001a26
jmp 0x100012ac
mov eax, dword [ebp - 0x90]
sub eax, 0xda1a8730
je 0x1000175e
jmp 0x100012c2
mov eax, dword [ebp - 0x90]
sub eax, 0xdbcf76d3
je 0x1000186c
jmp 0x100012d8
mov eax, dword [ebp - 0x90]
sub eax, 0xe5b9c402
je 0x10001e37
jmp 0x100012ee
mov eax, dword [ebp - 0x90]
sub eax, 0xf1a4e9fc
je 0x10001fbc
jmp 0x10001304
mov eax, dword [ebp - 0x90]
sub eax, 0xf25acb89
je 0x1000169b
jmp 0x1000131a
mov eax, dword [ebp - 0x90]
sub eax, 0xf4c0c6a6
je 0x1000168c
jmp 0x10001330
mov eax, dword [ebp - 0x90]
sub eax, 0xf4f519dc
je 0x10001e97
jmp 0x10001346
mov eax, dword [ebp - 0x90]
sub eax, 0xf737df80
je 0x10001ef7
jmp 0x1000135c
mov eax, dword [ebp - 0x90]
sub eax, 0xfeb729b1
je 0x10001914
jmp 0x10001372
mov eax, dword [ebp - 0x90]
sub eax, 0x2018447
je 0x10002028
jmp 0x10001388
mov eax, dword [ebp - 0x90]
sub eax, 0x10ea39e9
je 0x10001a62
jmp 0x1000139e
mov eax, dword [ebp - 0x90]
sub eax, 0x16e2769c
je 0x10002048
jmp 0x100013b4
mov eax, dword [ebp - 0x90]
sub eax, 0x19175e26
je 0x1000200a
jmp 0x100013ca
mov eax, dword [ebp - 0x90]
sub eax, 0x1ff6d5be
je 0x10001bcc
jmp 0x100013e0
mov eax, dword [ebp - 0x90]
sub eax, 0x2aab6c8c
je 0x100020b8
jmp 0x100013f6
mov eax, dword [ebp - 0x90]
sub eax, 0x2e508a49
je 0x100018b5
jmp 0x1000140c
mov eax, dword [ebp - 0x90]
sub eax, 0x3212f568
je 0x10001a53
jmp 0x10001422
mov eax, dword [ebp - 0x90]
sub eax, 0x32fcd8af
je 0x1000170e
jmp 0x10001438
mov eax, dword [ebp - 0x90]
sub eax, 0x3792b8e7
je 0x1000181d
jmp 0x1000144e
mov eax, dword [ebp - 0x90]
sub eax, 0x458e0a21
je 0x100015bb
jmp 0x10001464
mov eax, dword [ebp - 0x90]
sub eax, 0x46f6dad9
je 0x10001f77
jmp 0x1000147a
mov eax, dword [ebp - 0x90]
sub eax, 0x57530d4b
je 0x10001d02
jmp 0x10001490
mov eax, dword [ebp - 0x90]
sub eax, 0x5bbe2733
je 0x1000206c
jmp 0x100014a6
mov eax, dword [ebp - 0x90]
sub eax, 0x62730f95
je 0x10001c5b
jmp 0x100014bc
mov eax, dword [ebp - 0x90]
sub eax, 0x63e1d23c
je 0x10001932
jmp 0x100014d2
mov eax, dword [ebp - 0x90]
sub eax, 0x6514b872
je 0x10001b74
jmp 0x100014e8
mov eax, dword [ebp - 0x90]
sub eax, 0x65fc039e
je 0x100017f7
jmp 0x100014fe
mov eax, dword [ebp - 0x90]
sub eax, 0x68819741
je 0x10001b46
jmp 0x10001514
mov eax, dword [ebp - 0x90]
sub eax, 0x6da0e82b
je 0x10001cf3
jmp 0x1000152a
mov eax, dword [ebp - 0x90]
sub eax, 0x77b86403
je 0x100019a8
jmp 0x10001540
jmp 0x100020da
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x15de1204
sub edx, 1
sub edx, 0x15de1204
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x889bc70f
mov ecx, 0x458e0a21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xa2fcf573
sub edx, 1
add edx, 0xa2fcf573
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x889bc70f
mov ecx, 0xf4c0c6a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0xf25acb89
jmp 0x100020da
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c340
add esp, 0xc
mov eax, dword [ebp - 0x84]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov edx, dword [ebp - 0x78]
mov eax, 0x32fcd8af
mov ecx, 0xcf4c8520
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0x2018447
jmp 0x100020da
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x7c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x88], 0xda1a8730
jmp 0x100020da
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x70]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0x88], 0xd20806e4
jmp 0x100020da
mov edx, dword [ebp - 0x6c]
mov esi, 0xffffffff
mov eax, 0xa151eb07
mov ecx, 0x65fc039e
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0x2018447
jmp 0x100020da
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x88], 0x3792b8e7
jmp 0x100020da
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov dword [ebp - 0x88], 0xdbcf76d3
jmp 0x100020da
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x16e2769c
mov ecx, 0x2e508a49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [ebp - 0x68]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0x2e031c8d
sub edx, 1
sub edx, 0x2e031c8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x16e2769c
mov ecx, 0xfeb729b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dl, byte [ebp - 0x41]
mov eax, 0x63e1d23c
mov ecx, 0x10ea39e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x1a2ccfa9
sub edx, 1
sub edx, 0x1a2ccfa9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x849dbf18
mov ecx, 0x77b86403
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xc283850
sub edx, 1
add edx, 0xc283850
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x849dbf18
mov ecx, 0xd7f8afbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0x8940522d
jmp 0x100020da
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x88], 0x3212f568
jmp 0x100020da
mov dword [ebp - 0x88], 0x2018447
jmp 0x100020da
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
sub edx, 0x342ac344
sub edx, 1
add edx, 0x342ac344
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bbe2733
mov ecx, 0xa1cbc14f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
sub edx, 0xd4f3fc98
sub edx, 1
add edx, 0xd4f3fc98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bbe2733
mov ecx, 0x68819741
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0xd759c5fc
jmp 0x100020da
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x88], 0x6514b872
jmp 0x100020da
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov word [eax], 0
mov dword [ebp - 0x88], 0xd5549a32
jmp 0x100020da
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x88], 0x1ff6d5be
jmp 0x100020da
mov eax, dword [ebp - 0x30]
mov ax, word [eax + 2]
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x88], 0xb0c5f3b7
jmp 0x100020da
mov ax, word [ebp - 0x2a]
movzx esi, ax
mov edx, dword [ebp - 0x34]
mov eax, 0xf1a4e9fc
mov ecx, 0xcedb5391
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0xf6202aef
sub edx, 1
sub edx, 0xf6202aef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2aab6c8c
mov ecx, 0x62730f95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
sub eax, 0x5c4733e0
add eax, 0x18
add eax, 0x5c4733e0
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
sub eax, 0xefbebf20
add eax, ecx
add eax, 0xefbebf20
mov dword [ebp - 0x28], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2aab6c8c
mov ecx, 0x6da0e82b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0x57530d4b
jmp 0x100020da
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x88], 0x87dd29c7
jmp 0x100020da
mov eax, dword [ebp - 0x20]
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e6b0
add esp, 8
mov edx, eax
mov eax, 0x81173e2f
mov ecx, 0xf4f519dc
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x88], 0xc7c488e5
jmp 0x100020da
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x6407655e
add edx, eax
add edx, 0x6407655e
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c4a0
add esp, 0xc
mov dword [ebp - 0x88], 0xe5b9c402
jmp 0x100020da
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x74]
mov esi, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xea297aaa
add esi, eax
add esi, 0xea297aaa
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov dword [ebp - 0x88], 0xf4f519dc
jmp 0x100020da
mov dword [ebp - 0x88], 0xbca60a5b
jmp 0x100020da
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0xc4c315b
sub edx, 1
sub edx, 0xc4c315b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8c985eee
mov ecx, 0xf737df80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov eax, dword [ebp - 0x58]
mov ax, word [eax]
mov word [ebp - 0x16], ax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xc8848048
sub edx, 1
add edx, 0xc8848048
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8c985eee
mov ecx, 0x46f6dad9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x100020da
mov dword [ebp - 0x88], 0xc5f65a33
jmp 0x100020da
mov cx, word [ebp - 0x16]
add cx, 0x678b
add cx, 1
sub cx, 0x678b
mov eax, dword [ebp - 0x58]
mov word [eax], cx
mov dword [ebp - 0x88], 0xc79de473
jmp 0x100020da
mov dword [ebp - 0x88], 0xd5549a32
jmp 0x100020da
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x88], 0xc1688053
jmp 0x100020da
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x88], 0x19175e26
jmp 0x100020da
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x88], 0x2018447
jmp 0x100020da
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000b740
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x88], 0x458e0a21
jmp 0x100020da
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x88], 0x2e508a49
jmp 0x100020da
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x88], 0x77b86403
jmp 0x100020da
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x88], 0xa1cbc14f
jmp 0x100020da
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x88], 0x62730f95
jmp 0x100020da
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x88], 0xf737df80
jmp 0x100010d8