Function at 0x10001760
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb8], eax
mov eax, dword [0x1006f004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xae], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xad], al
mov dword [ebp - 0xb4], 0xc0fd2e6f
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xbc], eax
sub eax, 0x80364f63
je 0x10003de3
jmp 0x100017dc
mov eax, dword [ebp - 0xbc]
sub eax, 0x80c49465
je 0x10004e49
jmp 0x100017f2
mov eax, dword [ebp - 0xbc]
sub eax, 0x8807c1f8
je 0x10003770
jmp 0x10001808
mov eax, dword [ebp - 0xbc]
sub eax, 0x8852ee08
je 0x10002d63
jmp 0x1000181e
mov eax, dword [ebp - 0xbc]
sub eax, 0x897b0b04
je 0x10004810
jmp 0x10001834
mov eax, dword [ebp - 0xbc]
sub eax, 0x89d9537d
je 0x10003650
jmp 0x1000184a
mov eax, dword [ebp - 0xbc]
sub eax, 0x8a641e9b
je 0x1000469f
jmp 0x10001860
mov eax, dword [ebp - 0xbc]
sub eax, 0x8e97d085
je 0x100051e2
jmp 0x10001876
mov eax, dword [ebp - 0xbc]
sub eax, 0x915a03a6
je 0x1000402d
jmp 0x1000188c
mov eax, dword [ebp - 0xbc]
sub eax, 0x91df943c
je 0x10003641
jmp 0x100018a2
mov eax, dword [ebp - 0xbc]
sub eax, 0x95923648
je 0x10004280
jmp 0x100018b8
mov eax, dword [ebp - 0xbc]
sub eax, 0x95b4fb6e
je 0x10002977
jmp 0x100018ce
mov eax, dword [ebp - 0xbc]
sub eax, 0x95c6811e
je 0x10003942
jmp 0x100018e4
mov eax, dword [ebp - 0xbc]
sub eax, 0x986974ae
je 0x10004edd
jmp 0x100018fa
mov eax, dword [ebp - 0xbc]
sub eax, 0x9872c8a4
je 0x10004ba6
jmp 0x10001910
mov eax, dword [ebp - 0xbc]
sub eax, 0x98ecaf18
je 0x100026c6
jmp 0x10001926
mov eax, dword [ebp - 0xbc]
sub eax, 0x9ac6063e
je 0x100051be
jmp 0x1000193c
mov eax, dword [ebp - 0xbc]
sub eax, 0x9aee4fbe
je 0x10002b2c
jmp 0x10001952
mov eax, dword [ebp - 0xbc]
sub eax, 0x9ce4092a
je 0x10003465
jmp 0x10001968
mov eax, dword [ebp - 0xbc]
sub eax, 0x9d19ac3d
je 0x100045b3
jmp 0x1000197e
mov eax, dword [ebp - 0xbc]
sub eax, 0x9d863142
je 0x10003b10
jmp 0x10001994
mov eax, dword [ebp - 0xbc]
sub eax, 0x9f9a49e1
je 0x10003710
jmp 0x100019aa
mov eax, dword [ebp - 0xbc]
sub eax, 0xa10389e7
je 0x100036a1
jmp 0x100019c0
mov eax, dword [ebp - 0xbc]
sub eax, 0xa144ea5e
je 0x100051af
jmp 0x100019d6
mov eax, dword [ebp - 0xbc]
sub eax, 0xa72c68f9
je 0x10002c53
jmp 0x100019ec
mov eax, dword [ebp - 0xbc]
sub eax, 0xa8054470
je 0x10003c80
jmp 0x10001a02
mov eax, dword [ebp - 0xbc]
sub eax, 0xaa446120
je 0x10004e9e
jmp 0x10001a18
mov eax, dword [ebp - 0xbc]
sub eax, 0xaa91ad64
je 0x1000437a
jmp 0x10001a2e
mov eax, dword [ebp - 0xbc]
sub eax, 0xac0af872
je 0x10004d7f
jmp 0x10001a44
mov eax, dword [ebp - 0xbc]
sub eax, 0xada539e8
je 0x10004d94
jmp 0x10001a5a
mov eax, dword [ebp - 0xbc]
sub eax, 0xaeb721c4
je 0x10005037
jmp 0x10001a70
mov eax, dword [ebp - 0xbc]
sub eax, 0xaeeeda3c
je 0x10003e8c
jmp 0x10001a86
mov eax, dword [ebp - 0xbc]
sub eax, 0xb052c40b
je 0x10002ca4
jmp 0x10001a9c
mov eax, dword [ebp - 0xbc]
sub eax, 0xb2f4e349
je 0x10002901
jmp 0x10001ab2
mov eax, dword [ebp - 0xbc]
sub eax, 0xb4146ed4
je 0x10004a4e
jmp 0x10001ac8
mov eax, dword [ebp - 0xbc]
sub eax, 0xb69231ed
je 0x10003aab
jmp 0x10001ade
mov eax, dword [ebp - 0xbc]
sub eax, 0xb7ad26ec
je 0x10004945
jmp 0x10001af4
mov eax, dword [ebp - 0xbc]
sub eax, 0xb7ba4489
je 0x100050eb
jmp 0x10001b0a
mov eax, dword [ebp - 0xbc]
sub eax, 0xb9250122
je 0x10004acb
jmp 0x10001b20
mov eax, dword [ebp - 0xbc]
sub eax, 0xb9a4a009
je 0x1000371f
jmp 0x10001b36
mov eax, dword [ebp - 0xbc]
sub eax, 0xba7f8191
je 0x1000317e
jmp 0x10001b4c
mov eax, dword [ebp - 0xbc]
sub eax, 0xbab7d3e5
je 0x1000385e
jmp 0x10001b62
mov eax, dword [ebp - 0xbc]
sub eax, 0xbdad5040
je 0x10004cd6
jmp 0x10001b78
mov eax, dword [ebp - 0xbc]
sub eax, 0xbeefc9db
je 0x100026d5
jmp 0x10001b8e
mov eax, dword [ebp - 0xbc]
sub eax, 0xbfb632a7
je 0x10003a3d
jmp 0x10001ba4
mov eax, dword [ebp - 0xbc]
sub eax, 0xc0fd2e6f
je 0x1000260f
jmp 0x10001bba
mov eax, dword [ebp - 0xbc]
sub eax, 0xc2a99b00
je 0x1000354a
jmp 0x10001bd0
mov eax, dword [ebp - 0xbc]
sub eax, 0xc58de80b
je 0x10004d70
jmp 0x10001be6
mov eax, dword [ebp - 0xbc]
sub eax, 0xcbd1a274
je 0x100029fe
jmp 0x10001bfc
mov eax, dword [ebp - 0xbc]
sub eax, 0xcc10df07
je 0x10003d2c
jmp 0x10001c12
mov eax, dword [ebp - 0xbc]
sub eax, 0xcc9090cd
je 0x10003d75
jmp 0x10001c28
mov eax, dword [ebp - 0xbc]
sub eax, 0xcd167e7c
je 0x10005112
jmp 0x10001c3e
mov eax, dword [ebp - 0xbc]
sub eax, 0xcec6c398
je 0x10004f65
jmp 0x10001c54
mov eax, dword [ebp - 0xbc]
sub eax, 0xcf028e7f
je 0x10004eb6
jmp 0x10001c6a
mov eax, dword [ebp - 0xbc]
sub eax, 0xcfaf5da2
je 0x10004fce
jmp 0x10001c80
mov eax, dword [ebp - 0xbc]
sub eax, 0xcfe47149
je 0x10004d27
jmp 0x10001c96
mov eax, dword [ebp - 0xbc]
sub eax, 0xd3fbb121
je 0x10004194
jmp 0x10001cac
mov eax, dword [ebp - 0xbc]
sub eax, 0xd424ce97
je 0x10005229
jmp 0x10001cc2
mov eax, dword [ebp - 0xbc]
sub eax, 0xd858a2b8
je 0x100035cb
jmp 0x10001cd8
mov eax, dword [ebp - 0xbc]
sub eax, 0xd92b88d0
je 0x10002a6d
jmp 0x10001cee
mov eax, dword [ebp - 0xbc]
sub eax, 0xd9d9c942
je 0x100050af
jmp 0x10001d04
mov eax, dword [ebp - 0xbc]
sub eax, 0xdba85bc8
je 0x10003483
jmp 0x10001d1a
mov eax, dword [ebp - 0xbc]
sub eax, 0xdbe2269e
je 0x10003f12
jmp 0x10001d30
mov eax, dword [ebp - 0xbc]
sub eax, 0xdc14dd54
je 0x100050a0
jmp 0x10001d46
mov eax, dword [ebp - 0xbc]
sub eax, 0xdf6ef391
je 0x100051a0
mov al, byte [ebp - 0xae]
mov cl, byte [ebp - 0xad]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9872c8a4
mov ecx, 0x535f736
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0xbeefc9db
jmp 0x10005233
mov ecx, dword [ebp - 0xb8]
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0xb4], 0xf42ec851
jmp 0x10005233
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov dword [ebp - 0xb4], 0xfed37c64
jmp 0x10005233
mov eax, dword [ebp - 0xa0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x6d], al
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x2efa05c8
sub edx, 1
sub edx, 0x2efa05c8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x189b7fb
mov ecx, 0xcbd1a274
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dl, byte [ebp - 0x6d]
mov eax, 0x5c4c1df1
mov ecx, 0xa72c68f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0xb7f63026
sub edx, 1
add edx, 0xb7f63026
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7135335a
mov ecx, 0x504aecb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0x49eb11d
sub edx, 1
add edx, 0x49eb11d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcfaf5da2
mov ecx, 0x4cf24af5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x90b280a9
sub edx, 1
add edx, 0x90b280a9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa596ad7
mov ecx, 0xb052c40b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0xb59a4412
sub edx, 1
sub edx, 0xb59a4412
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa596ad7
mov ecx, 0x575145c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x22794a7d
sub edx, 1
add edx, 0x22794a7d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52a394d
mov ecx, 0x2b12c96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0x9b1c6ce9
sub edx, 1
sub edx, 0x9b1c6ce9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff68133e
mov ecx, 0x2e92749e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dl, byte [ebp - 0x4d]
mov eax, 0xdba85bc8
mov ecx, 0xb9a4a009
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x75f08b8e
sub edx, 1
add edx, 0x75f08b8e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54c4aa2f
mov ecx, 0xe75fe017
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0xed296424
sub edx, 1
sub edx, 0xed296424
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x61c8aaf0
mov ecx, 0xd858a2b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0x2694b1c5
sub edx, 1
add edx, 0x2694b1c5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54c4aa2f
mov ecx, 0x91df943c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0x89d9537d
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0x2c7c98df
sub edx, 1
sub edx, 0x2c7c98df
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe476986
mov ecx, 0xa10389e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x8fab975f
sub edx, 1
add edx, 0x8fab975f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe476986
mov ecx, 0x3d31b377
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0xf2e96260
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0xb40aa3d7
sub edx, 1
add edx, 0xb40aa3d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80c49465
mov ecx, 0x8807c1f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80c49465
mov ecx, 0xe49cf030
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdc14dd54
mov ecx, 0x709f1f61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0xfe073113
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaa446120
mov ecx, 0xb69231ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [ebp - 0x80]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x40976029
sub edx, 1
add edx, 0x40976029
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaa446120
mov ecx, 0x9d863142
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0xccf49e96
sub edx, 1
add edx, 0xccf49e96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x450a047e
mov ecx, 0x7e12b7ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0xe6d8761f
sub edx, 1
add edx, 0xe6d8761f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcf028e7f
mov ecx, 0x20bff121
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x529e9d34
mov ecx, 0xcc9090cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x529e9d34
mov ecx, 0x80364f63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0xec4ebe85
jmp 0x10005233
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0xac4383e
sub edx, 1
sub edx, 0xac4383e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb7ba4489
mov ecx, 0xdbe2269e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0x178d9c51
sub edx, 1
sub edx, 0x178d9c51
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf018556a
mov ecx, 0x74767854
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [ebp - 0x30]
mov ax, word [eax]
mov word [ebp - 0x2a], ax
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x49a297bb
sub edx, 1
sub edx, 0x49a297bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf291a039
mov ecx, 0xd960a50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x1e468f64
sub edx, 1
sub edx, 0x1e468f64
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcd167e7c
mov ecx, 0x707b1449
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x278feb7a
add eax, ecx
sub eax, 0x278feb7a
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0xf4112844
add eax, ecx
add eax, 0xf4112844
mov dword [ebp - 0x20], eax
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0x6034f7bb
sub edx, 1
add edx, 0x6034f7bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x986974ae
mov ecx, 0xaa91ad64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0x3a36d477
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0xf282c949
sub edx, 1
sub edx, 0xf282c949
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdf6ef391
mov ecx, 0x105971e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0xf832ff5a
jmp 0x10005233
mov eax, dword [ebp - 0x80]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x1a], ax
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0xd9a05250
sub edx, 1
add edx, 0xd9a05250
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17a2afb6
mov ecx, 0x694eeec6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0xf52ec80a
jmp 0x10005233
mov dword [ebp - 0xb4], 0x25995125
jmp 0x10005233
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8e97d085
mov ecx, 0x3649b8cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e0bff5a
mov ecx, 0x868506e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0x18a71f57
sub edx, 1
sub edx, 0x18a71f57
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd424ce97
mov ecx, 0xcfe47149
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd424ce97
mov ecx, 0xc58de80b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10005233
mov dword [ebp - 0xb4], 0x9aee4fbe
jmp 0x10005233
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb4], 0x8852ee08
jmp 0x10005233
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xb4], 0xedbe97a1
jmp 0x10005233
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xb4], 0x8807c1f8
jmp 0x10005233
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xb4], 0xb69231ed
jmp 0x10005233
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb4], 0x20bff121
jmp 0x10005233
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xb4], 0x95923648
jmp 0x10005233
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10011d90
add esp, 0xc
mov dword [ebp - 0xb4], 0x631805c4
jmp 0x10005233
mov dword [ebp - 0xb4], 0x4cf24af5
jmp 0x10005233
mov dword [ebp - 0xb4], 0x167f95f1
jmp 0x10005233
mov dword [ebp - 0xb4], 0x709f1f61
jmp 0x10005233
mov dword [ebp - 0xb4], 0x3b1f774e
jmp 0x10005233
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb4], 0xaeeeda3c
jmp 0x10005233
mov dword [ebp - 0xb4], 0xd3fbb121
jmp 0x10005233
mov dword [ebp - 0xb4], 0x4ba5e484
jmp 0x10005233
mov dword [ebp - 0xb4], 0x6d9bcf27
jmp 0x10005233
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb4], 0xb9250122
jmp 0x10005233
mov dword [ebp - 0xb4], 0xcfe47149
jmp 0x100017c0