Function at 0x100011b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x190
mov eax, dword [ebp + 8]
mov dword [ebp - 0x194], eax
mov eax, dword [0x10063400]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x190], 0xc4f27719
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x198], eax
sub eax, 0x80bd7da7
je 0x10001f39
jmp 0x100011f4
mov eax, dword [ebp - 0x198]
sub eax, 0x82077d9b
je 0x100019db
jmp 0x1000120a
mov eax, dword [ebp - 0x198]
sub eax, 0x8328d8c9
je 0x10001c92
jmp 0x10001220
mov eax, dword [ebp - 0x198]
sub eax, 0x8449e1f4
je 0x10001b65
jmp 0x10001236
mov eax, dword [ebp - 0x198]
sub eax, 0x854d7f50
je 0x10001b56
jmp 0x1000124c
mov eax, dword [ebp - 0x198]
sub eax, 0x8888a670
je 0x10001850
jmp 0x10001262
mov eax, dword [ebp - 0x198]
sub eax, 0x8b2fb6a1
je 0x10002411
jmp 0x10001278
mov eax, dword [ebp - 0x198]
sub eax, 0x938c33b2
je 0x10001bdb
jmp 0x1000128e
mov eax, dword [ebp - 0x198]
sub eax, 0x93e4af60
je 0x10001c2c
jmp 0x100012a4
mov eax, dword [ebp - 0x198]
sub eax, 0x94566ee4
je 0x100023aa
jmp 0x100012ba
mov eax, dword [ebp - 0x198]
sub eax, 0x9538237a
je 0x10001e3a
jmp 0x100012d0
mov eax, dword [ebp - 0x198]
sub eax, 0x9f7157a5
je 0x10002402
jmp 0x100012e6
mov eax, dword [ebp - 0x198]
sub eax, 0xa26d9645
je 0x10002279
jmp 0x100012fc
mov eax, dword [ebp - 0x198]
sub eax, 0xa54421ce
je 0x1000201f
jmp 0x10001312
mov eax, dword [ebp - 0x198]
sub eax, 0xa5aea2c9
je 0x1000189b
jmp 0x10001328
mov eax, dword [ebp - 0x198]
sub eax, 0xa7b23009
je 0x10001fbc
jmp 0x1000133e
mov eax, dword [ebp - 0x198]
sub eax, 0xa9778a10
je 0x10001f08
jmp 0x10001354
mov eax, dword [ebp - 0x198]
sub eax, 0xb44d9999
je 0x10001af7
jmp 0x1000136a
mov eax, dword [ebp - 0x198]
sub eax, 0xb901161c
je 0x10002591
jmp 0x10001380
mov eax, dword [ebp - 0x198]
sub eax, 0xc4f27719
je 0x100016c9
jmp 0x10001396
mov eax, dword [ebp - 0x198]
sub eax, 0xcb5f4a12
je 0x10002487
jmp 0x100013ac
mov eax, dword [ebp - 0x198]
sub eax, 0xcf25fbc2
je 0x1000237c
jmp 0x100013c2
mov eax, dword [ebp - 0x198]
sub eax, 0xd1b225fa
je 0x100024f9
jmp 0x100013d8
mov eax, dword [ebp - 0x198]
sub eax, 0xdb9923ca
je 0x10001a81
jmp 0x100013ee
mov eax, dword [ebp - 0x198]
sub eax, 0xde525b1a
je 0x100024e4
jmp 0x10001404
mov eax, dword [ebp - 0x198]
sub eax, 0xde7303ee
je 0x10001f63
jmp 0x1000141a
mov eax, dword [ebp - 0x198]
sub eax, 0xe34804bf
je 0x10001c83
jmp 0x10001430
mov eax, dword [ebp - 0x198]
sub eax, 0xea7bcf94
je 0x10002117
jmp 0x10001446
mov eax, dword [ebp - 0x198]
sub eax, 0xec5bff28
je 0x100022ef
jmp 0x1000145c
mov eax, dword [ebp - 0x198]
sub eax, 0xed474217
je 0x100023e1
jmp 0x10001472
mov eax, dword [ebp - 0x198]
sub eax, 0xf042e004
je 0x100019cc
jmp 0x10001488
mov eax, dword [ebp - 0x198]
sub eax, 0xf6863571
je 0x10001f80
jmp 0x1000149e
mov eax, dword [ebp - 0x198]
sub eax, 0xf7cb1e73
je 0x10001bba
jmp 0x100014b4
mov eax, dword [ebp - 0x198]
sub eax, 0xd53c1dc
je 0x10001761
jmp 0x100014ca
mov eax, dword [ebp - 0x198]
sub eax, 0xf0e52e6
je 0x10001f17
jmp 0x100014e0
mov eax, dword [ebp - 0x198]
sub eax, 0x13e2d1ce
je 0x10001cc2
jmp 0x100014f6
mov eax, dword [ebp - 0x198]
sub eax, 0x1777157a
je 0x10001911
jmp 0x1000150c
mov eax, dword [ebp - 0x198]
sub eax, 0x1c823e3f
je 0x1000225a
jmp 0x10001522
mov eax, dword [ebp - 0x198]
sub eax, 0x1eceffbb
je 0x10001a72
jmp 0x10001538
mov eax, dword [ebp - 0x198]
sub eax, 0x2719b02f
je 0x10002528
jmp 0x1000154e
mov eax, dword [ebp - 0x198]
sub eax, 0x27d479e6
je 0x10001871
jmp 0x10001564
mov eax, dword [ebp - 0x198]
sub eax, 0x2fa94b33
je 0x10001cdf
jmp 0x1000157a
mov eax, dword [ebp - 0x198]
sub eax, 0x3737ae7d
je 0x10001d61
jmp 0x10001590
mov eax, dword [ebp - 0x198]
sub eax, 0x429acb03
je 0x1000224b
jmp 0x100015a6
mov eax, dword [ebp - 0x198]
sub eax, 0x4764b276
je 0x1000223c
jmp 0x100015bc
mov eax, dword [ebp - 0x198]
sub eax, 0x4fcef497
je 0x10002422
jmp 0x100015d2
mov eax, dword [ebp - 0x198]
sub eax, 0x575c4323
je 0x10001e2b
jmp 0x100015e8
mov eax, dword [ebp - 0x198]
sub eax, 0x57d854ca
je 0x100016f3
jmp 0x100015fe
mov eax, dword [ebp - 0x198]
sub eax, 0x5bda2da1
je 0x10001db2
jmp 0x10001614
mov eax, dword [ebp - 0x198]
sub eax, 0x60b1e4fd
je 0x10001cb3
jmp 0x1000162a
mov eax, dword [ebp - 0x198]
sub eax, 0x652d8ddf
je 0x10002140
jmp 0x10001640
mov eax, dword [ebp - 0x198]
sub eax, 0x66befd92
je 0x1000238b
jmp 0x10001656
mov eax, dword [ebp - 0x198]
sub eax, 0x6c922c48
je 0x10002191
jmp 0x1000166c
mov eax, dword [ebp - 0x198]
sub eax, 0x6f4cf252
je 0x10001880
jmp 0x10001682
mov eax, dword [ebp - 0x198]
sub eax, 0x71b7a34f
je 0x10002513
jmp 0x10001698
mov eax, dword [ebp - 0x198]
sub eax, 0x72813b60
je 0x10001e8b
jmp 0x100016ae
mov eax, dword [ebp - 0x198]
sub eax, 0x76baa631
je 0x100024cf
jmp 0x100016c4
jmp 0x100025da
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x190], 0x57d854ca
jmp 0x100025da
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4fcef497
mov ecx, 0xd53c1dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x194]
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x160], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10008c10
add esp, 0xc
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
sub edx, 0x321759f8
sub edx, 1
add edx, 0x321759f8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4fcef497
mov ecx, 0x8888a670
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dl, byte [ebp - 0x155]
mov eax, 0x27d479e6
mov ecx, 0x6f4cf252
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x8b2fb6a1
jmp 0x100025da
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x190], 0xa5aea2c9
jmp 0x100025da
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
mov edx, ecx
sub edx, 0xa613d747
sub edx, 1
add edx, 0xa613d747
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcb5f4a12
mov ecx, 0x1777157a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov edx, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
mov edx, ecx
add edx, 0x4928c127
sub edx, 1
sub edx, 0x4928c127
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcb5f4a12
mov ecx, 0xf042e004
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x82077d9b
jmp 0x100025da
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x150]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x17c]
mov esi, 0xffffffff
mov eax, 0xdb9923ca
mov ecx, 0x1eceffbb
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x8b2fb6a1
jmp 0x100025da
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
mov edx, ecx
add edx, 0x171b9b59
sub edx, 1
sub edx, 0x171b9b59
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x76baa631
mov ecx, 0xb44d9999
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x14c], eax
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
sub edx, 0xb00612d3
sub edx, 1
add edx, 0xb00612d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76baa631
mov ecx, 0x854d7f50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x8449e1f4
jmp 0x100025da
mov eax, dword [ebp - 0x14c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov dword [ebp - 0x190], 0xf7cb1e73
jmp 0x100025da
mov edx, dword [ebp - 0x178]
mov eax, 0x938c33b2
mov ecx, 0x13e2d1ce
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
sub edx, 0xef550c0d
sub edx, 1
add edx, 0xef550c0d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde525b1a
mov ecx, 0x93e4af60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x148], eax
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde525b1a
mov ecx, 0xe34804bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x8328d8c9
jmp 0x100025da
mov eax, dword [ebp - 0x148]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x190], 0x60b1e4fd
jmp 0x100025da
mov dword [ebp - 0x190], 0x8b2fb6a1
jmp 0x100025da
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x190], 0x2fa94b33
jmp 0x100025da
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov dword [ebp - 0x190], 0x3737ae7d
jmp 0x100025da
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
sub edx, 0x242784e0
sub edx, 1
add edx, 0x242784e0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd1b225fa
mov ecx, 0x5bda2da1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x168]
mov word [eax], 0
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd1b225fa
mov ecx, 0x575c4323
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x9538237a
jmp 0x100025da
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
add edx, 0x63bf4205
sub edx, 1
sub edx, 0x63bf4205
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71b7a34f
mov ecx, 0x72813b60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x168]
movzx eax, word [eax]
mov dword [ebp - 0x140], eax
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x71b7a34f
mov ecx, 0xa9778a10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0xf0e52e6
jmp 0x100025da
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x13a], ax
mov dword [ebp - 0x190], 0x80bd7da7
jmp 0x100025da
mov ax, word [ebp - 0x13a]
movzx esi, ax
mov edx, dword [ebp - 0x140]
mov eax, 0x94566ee4
mov ecx, 0xde7303ee
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x190], 0xf6863571
jmp 0x100025da
mov eax, dword [ebp - 0x138]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x16c]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x190], 0xa7b23009
jmp 0x100025da
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x168]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100141a0
call fcn.1000af80
add esp, 8
mov edx, eax
mov eax, 0xa54421ce
mov ecx, 0x429acb03
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x137299f
add edx, eax
add edx, 0x137299f
mov eax, dword [ebp - 0x160]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], cl
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x933dd717
add edx, eax
sub edx, 0x933dd717
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x61f8446d
add ecx, eax
sub ecx, 0x61f8446d
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10008d70
add esp, 0xc
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x190], 0xea7bcf94
jmp 0x100025da
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x190], 0x652d8ddf
jmp 0x100025da
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
sub edx, 0x8cf2bf98
sub edx, 1
add edx, 0x8cf2bf98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2719b02f
mov ecx, 0x6c922c48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov esi, dword [ebp - 0x124]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xa4d28e70
add esi, eax
add esi, 0xa4d28e70
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x128]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], cl
mov eax, dword [0x10064750]
mov ecx, dword [0x1006474c]
mov edx, eax
add edx, 0x687e67a4
sub edx, 1
sub edx, 0x687e67a4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2719b02f
mov ecx, 0x4764b276
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x429acb03
jmp 0x100025da
mov dword [ebp - 0x190], 0x1c823e3f
jmp 0x100025da
mov eax, dword [ebp - 0x168]
mov ax, word [eax]
mov word [ebp - 0x120], ax
mov dword [ebp - 0x190], 0xa26d9645
jmp 0x100025da
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
mov edx, ecx
sub edx, 0xbf154aa7
sub edx, 1
add edx, 0xbf154aa7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb901161c
mov ecx, 0xec5bff28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov ax, word [ebp - 0x120]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x11e], ax
mov ecx, dword [0x10064750]
mov eax, dword [0x1006474c]
mov edx, ecx
sub edx, 0x7967692c
sub edx, 1
add edx, 0x7967692c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb901161c
mov ecx, 0xcf25fbc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x100025da
mov dword [ebp - 0x190], 0x66befd92
jmp 0x100025da
mov eax, dword [ebp - 0x168]
mov cx, word [ebp - 0x11e]
mov word [eax], cx
mov dword [ebp - 0x190], 0x9538237a
jmp 0x100025da
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x190], 0xed474217
jmp 0x100025da
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x190], 0x9f7157a5
jmp 0x100025da
mov dword [ebp - 0x190], 0x8b2fb6a1
jmp 0x100025da
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10007ff0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10008c10
add esp, 0xc
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x190], 0xd53c1dc
jmp 0x100025da
mov edx, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x190], 0x1777157a
jmp 0x100025da
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x190], 0xb44d9999
jmp 0x100025da
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x190], 0x93e4af60
jmp 0x100025da
mov eax, dword [ebp - 0x168]
mov word [eax], 0
mov dword [ebp - 0x190], 0x5bda2da1
jmp 0x100025da
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x190], 0x72813b60
jmp 0x100025da
mov esi, dword [ebp - 0x124]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x67d15f5d
add esi, eax
sub esi, 0x67d15f5d
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x128]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], cl
mov dword [ebp - 0x190], 0x6c922c48
jmp 0x100025da
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov ax, word [ebp - 0x120]
mov dword [ebp - 0x190], 0xec5bff28
jmp 0x100011d8