Function at 0x10001530
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x10070c04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0x45dc95f2
sub edx, 1
sub edx, 0x45dc95f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa6], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0xac], 0x11c67855
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x80a10177
je 0x10003472
jmp 0x100015b4
mov eax, dword [ebp - 0xb4]
sub eax, 0x8197fe15
je 0x10003dba
jmp 0x100015ca
mov eax, dword [ebp - 0xb4]
sub eax, 0x83944aad
je 0x1000336f
jmp 0x100015e0
mov eax, dword [ebp - 0xb4]
sub eax, 0x853a2294
je 0x10002d7b
jmp 0x100015f6
mov eax, dword [ebp - 0xb4]
sub eax, 0x8831ce55
je 0x10003463
jmp 0x1000160c
mov eax, dword [ebp - 0xb4]
sub eax, 0x8853e85e
je 0x10003c16
jmp 0x10001622
mov eax, dword [ebp - 0xb4]
sub eax, 0x89538e17
je 0x100048cf
jmp 0x10001638
mov eax, dword [ebp - 0xb4]
sub eax, 0x8be377fb
je 0x10002cc2
jmp 0x1000164e
mov eax, dword [ebp - 0xb4]
sub eax, 0x8d42c023
je 0x10003ff4
jmp 0x10001664
mov eax, dword [ebp - 0xb4]
sub eax, 0x8f73a591
je 0x10002b73
jmp 0x1000167a
mov eax, dword [ebp - 0xb4]
sub eax, 0x8f748623
je 0x10002fae
jmp 0x10001690
mov eax, dword [ebp - 0xb4]
sub eax, 0x9068a427
je 0x100036d6
jmp 0x100016a6
mov eax, dword [ebp - 0xb4]
sub eax, 0x90f08d90
je 0x100026aa
jmp 0x100016bc
mov eax, dword [ebp - 0xb4]
sub eax, 0x910cae71
je 0x100022f1
jmp 0x100016d2
mov eax, dword [ebp - 0xb4]
sub eax, 0x957d8837
je 0x10003afb
jmp 0x100016e8
mov eax, dword [ebp - 0xb4]
sub eax, 0x95a32e44
je 0x10002df5
jmp 0x100016fe
mov eax, dword [ebp - 0xb4]
sub eax, 0x96508e7e
je 0x10002afd
jmp 0x10001714
mov eax, dword [ebp - 0xb4]
sub eax, 0x97036e65
je 0x100026c8
jmp 0x1000172a
mov eax, dword [ebp - 0xb4]
sub eax, 0x9b18139c
je 0x100039d8
jmp 0x10001740
mov eax, dword [ebp - 0xb4]
sub eax, 0x9b5b59ae
je 0x10003727
jmp 0x10001756
mov eax, dword [ebp - 0xb4]
sub eax, 0x9d2a1eb3
je 0x100027fe
jmp 0x1000176c
mov eax, dword [ebp - 0xb4]
sub eax, 0x9d835060
je 0x1000269b
jmp 0x10001782
mov eax, dword [ebp - 0xb4]
sub eax, 0x9e19a649
je 0x10003203
jmp 0x10001798
mov eax, dword [ebp - 0xb4]
sub eax, 0x9effd0cd
je 0x100049d2
jmp 0x100017ae
mov eax, dword [ebp - 0xb4]
sub eax, 0xa1eab20d
je 0x100044b9
jmp 0x100017c4
mov eax, dword [ebp - 0xb4]
sub eax, 0xa270ebc3
je 0x100038c2
jmp 0x100017da
mov eax, dword [ebp - 0xb4]
sub eax, 0xa76a8b58
je 0x10004b9f
jmp 0x100017f0
mov eax, dword [ebp - 0xb4]
sub eax, 0xaa072893
je 0x10002448
jmp 0x10001806
mov eax, dword [ebp - 0xb4]
sub eax, 0xaa3d25d3
je 0x100048de
jmp 0x1000181c
mov eax, dword [ebp - 0xb4]
sub eax, 0xacecf584
je 0x10003ef2
jmp 0x10001832
mov eax, dword [ebp - 0xb4]
sub eax, 0xae9af8a9
je 0x10002aee
jmp 0x10001848
mov eax, dword [ebp - 0xb4]
sub eax, 0xaf1b994c
je 0x10003c07
jmp 0x1000185e
mov eax, dword [ebp - 0xb4]
sub eax, 0xaf93fb0b
je 0x10004a3b
jmp 0x10001874
mov eax, dword [ebp - 0xb4]
sub eax, 0xb3766c56
je 0x10003778
jmp 0x1000188a
mov eax, dword [ebp - 0xb4]
sub eax, 0xb4dba5b8
je 0x10004ad7
jmp 0x100018a0
mov eax, dword [ebp - 0xb4]
sub eax, 0xb7dbf5d2
je 0x10003e9a
jmp 0x100018b6
mov eax, dword [ebp - 0xb4]
sub eax, 0xb7e8c21c
je 0x10003c8c
jmp 0x100018cc
mov eax, dword [ebp - 0xb4]
sub eax, 0xb83688ee
je 0x10002818
jmp 0x100018e2
mov eax, dword [ebp - 0xb4]
sub eax, 0xb8d2e1d1
je 0x10003b5b
jmp 0x100018f8
mov eax, dword [ebp - 0xb4]
sub eax, 0xb9a08d06
je 0x10004bae
jmp 0x1000190e
mov eax, dword [ebp - 0xb4]
sub eax, 0xbc6f50df
je 0x10004788
jmp 0x10001924
mov eax, dword [ebp - 0xb4]
sub eax, 0xbcb495ca
je 0x10002a03
jmp 0x1000193a
mov eax, dword [ebp - 0xb4]
sub eax, 0xbdf86374
je 0x1000233a
jmp 0x10001950
mov eax, dword [ebp - 0xb4]
sub eax, 0xbfc52d1c
je 0x10003a6c
jmp 0x10001966
mov eax, dword [ebp - 0xb4]
sub eax, 0xc34d9afc
je 0x10002bfb
jmp 0x1000197c
mov eax, dword [ebp - 0xb4]
sub eax, 0xc5109f7a
je 0x10002909
jmp 0x10001992
mov eax, dword [ebp - 0xb4]
sub eax, 0xc7cb9a82
je 0x100049bd
jmp 0x100019a8
mov eax, dword [ebp - 0xb4]
sub eax, 0xcc347f9c
je 0x100030a8
jmp 0x100019be
mov eax, dword [ebp - 0xb4]
sub eax, 0xcc784a6a
je 0x10003862
jmp 0x100019d4
mov eax, dword [ebp - 0xb4]
sub eax, 0xce21b07b
je 0x10002a9d
jmp 0x100019ea
mov eax, dword [ebp - 0xb4]
sub eax, 0xcf19b37d
je 0x100048ba
jmp 0x10001a00
mov eax, dword [ebp - 0xb4]
sub eax, 0xcfbbf3f0
je 0x10004716
jmp 0x10001a16
mov eax, dword [ebp - 0xb4]
sub eax, 0xd1a9b2e1
je 0x10003923
jmp 0x10001a2c
mov eax, dword [ebp - 0xb4]
sub eax, 0xd2240fe1
je 0x10003f43
jmp 0x10001a42
mov eax, dword [ebp - 0xb4]
sub eax, 0xd2c67c2e
je 0x100049ae
jmp 0x10001a58
mov eax, dword [ebp - 0xb4]
sub eax, 0xd47c8734
je 0x100043f2
jmp 0x10001a6e
mov eax, dword [ebp - 0xb4]
sub eax, 0xd628d531
je 0x100026d7
jmp 0x10001a84
mov eax, dword [ebp - 0xb4]
sub eax, 0xd64d78ea
je 0x1000499f
jmp 0x10001a9a
mov eax, dword [ebp - 0xb4]
sub eax, 0xd8286350
je 0x10004a63
jmp 0x10001ab0
mov eax, dword [ebp - 0xb4]
sub eax, 0xdb338a45
je 0x1000298d
jmp 0x10001ac6
mov eax, dword [ebp - 0xb4]
sub eax, 0xe1db1618
je 0x100033cf
jmp 0x10001adc
mov eax, dword [ebp - 0xb4]
sub eax, 0xe64a03b4
je 0x100037fd
jmp 0x10001af2
mov eax, dword [ebp - 0xb4]
sub eax, 0xe70b75ad
je 0x10004725
jmp 0x10001b08
mov eax, dword [ebp - 0xb4]
sub eax, 0xe8dcae75
je 0x10003117
jmp 0x10001b1e
mov eax, dword [ebp - 0xb4]
sub eax, 0xe9856bb6
je 0x1000252d
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x19b52135
mov ecx, 0xbdf86374
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0xc86fc1d4
sub edx, 1
sub edx, 0xc86fc1d4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x19b52135
mov ecx, 0xec8dd09a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x139bb6ea
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x90f08d90
jmp 0x10004c0e
mov dl, byte [ebp - 0x65]
mov eax, 0x97036e65
mov ecx, 0xd628d531
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0xf571826e
jmp 0x10004c0e
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x48725fcb
mov ecx, 0xfc69d661
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xac], 0xb83688ee
jmp 0x10004c0e
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0x2db8aedf
jmp 0x10004c0e
mov eax, dword [ebp - 0x8c]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x59], al
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x990bd82a
sub edx, 1
add edx, 0x990bd82a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcf19b37d
mov ecx, 0x1691b68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
sub edx, 0x28f2c230
sub edx, 1
add edx, 0x28f2c230
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x418d5ec8
mov ecx, 0xbcb495ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x6d89d2db
sub edx, 1
add edx, 0x6d89d2db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89538e17
mov ecx, 0x667905ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x1fea11a7
sub edx, 1
add edx, 0x1fea11a7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x418d5ec8
mov ecx, 0xae9af8a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0xf571826e
jmp 0x10004c0e
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0x7faf1ab
sub edx, 1
sub edx, 0x7faf1ab
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaa3d25d3
mov ecx, 0x8f73a591
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaa3d25d3
mov ecx, 0x5b4d7717
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
add edx, 0x2d560615
sub edx, 1
sub edx, 0x2d560615
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7be29228
mov ecx, 0x37cf9cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0x2fa3e1f0
sub edx, 1
sub edx, 0x2fa3e1f0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xefc67878
mov ecx, 0x853a2294
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x37b31c8e
sub edx, 1
add edx, 0x37b31c8e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7be29228
mov ecx, 0x66d0325e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x299a8062
mov ecx, 0x4680449d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x3f543700
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
add edx, 0x800bed77
sub edx, 1
sub edx, 0x800bed77
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeaad5863
mov ecx, 0xfbe01bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0x9ea7bc8e
sub edx, 1
sub edx, 0x9ea7bc8e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4d5cebb
mov ecx, 0x1a4d540a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
add edx, 0x39c2b8ae
sub edx, 1
sub edx, 0x39c2b8ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b2d1a0f
mov ecx, 0x2cc79909
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x234f5b46
jmp 0x10004c0e
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
sub edx, 0x3c46a29b
sub edx, 1
add edx, 0x3c46a29b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x69438b90
mov ecx, 0x6894f197
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0xf571826e
jmp 0x10004c0e
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xac], 0x71379904
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x97fc964d
sub edx, 1
add edx, 0x97fc964d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2c67c2e
mov ecx, 0x9b5b59ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x220be09a
sub edx, 1
add edx, 0x220be09a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2c67c2e
mov ecx, 0xb3766c56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x62ac2698
jmp 0x10004c0e
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x40], eax
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
add edx, 0xab7a0790
sub edx, 1
sub edx, 0xab7a0790
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7cb9a82
mov ecx, 0xcc784a6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x7cc040ac
jmp 0x10004c0e
mov eax, dword [ebp - 0x40]
add eax, 2
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe70b75ad
mov ecx, 0x37876efe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x240a3690
sub edx, 1
add edx, 0x240a3690
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30c59657
mov ecx, 0x2643fd9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dl, byte [ebp - 0x35]
mov eax, 0x3148a832
mov ecx, 0x34f808f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub eax, 0xdf9bcd63
xor ecx, ecx
add ecx, 0x18
add eax, ecx
add eax, 0xdf9bcd63
mov dword [ebp - 0x34], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
sub edx, 0x5feaea0f
sub edx, 1
add edx, 0x5feaea0f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9effd0cd
mov ecx, 0x957d8837
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x2a2a6cb5
jmp 0x10004c0e
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x34]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0xd21a56
add ecx, eax
sub ecx, 0xd21a56
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4572d476
mov ecx, 0xaf1b994c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x8853e85e
jmp 0x10004c0e
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0x265b6e02
sub edx, 1
sub edx, 0x265b6e02
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaf93fb0b
mov ecx, 0xb7e8c21c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov ecx, dword [ebp - 0x30]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001c190
call fcn.10013300
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
sub edx, 0xd3cf4f2f
sub edx, 1
add edx, 0xd3cf4f2f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaf93fb0b
mov ecx, 0x2ccf9303
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x31ad4399
add edx, eax
add edx, 0x31ad4399
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd8286350
mov ecx, 0xb7dbf5d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x1b07e54b
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0xe02c1418
sub edx, 1
add edx, 0xe02c1418
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4dba5b8
mov ecx, 0xd2240fe1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x28]
sub eax, 0xedd1985b
add eax, ecx
add eax, 0xedd1985b
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0x4652555
sub edx, 1
sub edx, 0x4652555
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb4dba5b8
mov ecx, 0x8d42c023
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov ecx, dword [0x10071ea8]
mov eax, dword [0x10071ea4]
mov edx, ecx
add edx, 0xfa74bc42
sub edx, 1
sub edx, 0xfa74bc42
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3627b9e2
mov ecx, 0x3977732b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
sub edx, 0x1962c721
sub edx, 1
add edx, 0x1962c721
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa76a8b58
mov ecx, 0x1b46782c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x6e53ee94
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x9c1fc3d
jmp 0x10004c0e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xac], 0xa270ebc3
jmp 0x10004c0e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [0x10071ea8]
mov ecx, dword [0x10071ea4]
mov edx, eax
add edx, 0xc8a11844
sub edx, 1
sub edx, 0xc8a11844
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a6ce089
mov ecx, 0x1abe3d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10004c0e
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xac], 0xc5109f7a
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x667905ca
jmp 0x10004c0e
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xac], 0x8f73a591
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x438996fd
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x9b5b59ae
jmp 0x10004c0e
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0xe64a03b4
jmp 0x10004c0e
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0xbfc52d1c
jmp 0x10004c0e
mov ecx, dword [ebp - 0x30]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001c190
call fcn.10013300
add esp, 8
mov dword [ebp - 0xac], 0xb7e8c21c
jmp 0x10004c0e
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x2069738d
add edx, eax
sub edx, 0x2069738d
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xac], 0x8197fe15
jmp 0x10004c0e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xac], 0xd2240fe1
jmp 0x10004c0e
mov dword [ebp - 0xac], 0x1b46782c
jmp 0x10004c0e
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x9c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0x36e5e4ee
jmp 0x10004c0e
jmp 0x10001598