Function at 0x10001300
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x1006e604]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa8], 0x6daf5cbb
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x80c053a2
je 0x10003940
jmp 0x10001345
mov eax, dword [ebp - 0xb0]
sub eax, 0x8290b7f3
je 0x1000493e
jmp 0x1000135b
mov eax, dword [ebp - 0xb0]
sub eax, 0x85dd4a0c
je 0x10003bde
jmp 0x10001371
mov eax, dword [ebp - 0xb0]
sub eax, 0x88d2517c
je 0x10002702
jmp 0x10001387
mov eax, dword [ebp - 0xb0]
sub eax, 0x8b5ad9d8
je 0x10004267
jmp 0x1000139d
mov eax, dword [ebp - 0xb0]
sub eax, 0x8d145dc3
je 0x1000457d
jmp 0x100013b3
mov eax, dword [ebp - 0xb0]
sub eax, 0x8ecc4690
je 0x100033ec
jmp 0x100013c9
mov eax, dword [ebp - 0xb0]
sub eax, 0x905532e5
je 0x100036fc
jmp 0x100013df
mov eax, dword [ebp - 0xb0]
sub eax, 0x91ead4b1
je 0x1000230e
jmp 0x100013f5
mov eax, dword [ebp - 0xb0]
sub eax, 0x939c0b83
je 0x100045eb
jmp 0x1000140b
mov eax, dword [ebp - 0xb0]
sub eax, 0x95f88b63
je 0x10003626
jmp 0x10001421
mov eax, dword [ebp - 0xb0]
sub eax, 0x9727b0ea
je 0x100027fa
jmp 0x10001437
mov eax, dword [ebp - 0xb0]
sub eax, 0x99a3908c
je 0x10003471
jmp 0x1000144d
mov eax, dword [ebp - 0xb0]
sub eax, 0x9a2ae5d8
je 0x100029b4
jmp 0x10001463
mov eax, dword [ebp - 0xb0]
sub eax, 0x9b053017
je 0x10004e16
jmp 0x10001479
mov eax, dword [ebp - 0xb0]
sub eax, 0x9c7d1b50
je 0x10002ce2
jmp 0x1000148f
mov eax, dword [ebp - 0xb0]
sub eax, 0x9d0ce8d5
je 0x1000470d
jmp 0x100014a5
mov eax, dword [ebp - 0xb0]
sub eax, 0x9e82f811
je 0x10004d6c
jmp 0x100014bb
mov eax, dword [ebp - 0xb0]
sub eax, 0x9fe8a67e
je 0x1000383a
jmp 0x100014d1
mov eax, dword [ebp - 0xb0]
sub eax, 0xa111896e
je 0x10003686
jmp 0x100014e7
mov eax, dword [ebp - 0xb0]
sub eax, 0xa64ccab7
je 0x10002711
jmp 0x100014fd
mov eax, dword [ebp - 0xb0]
sub eax, 0xacba4a58
je 0x100042d6
jmp 0x10001513
mov eax, dword [ebp - 0xb0]
sub eax, 0xad741580
je 0x10004df8
jmp 0x10001529
mov eax, dword [ebp - 0xb0]
sub eax, 0xae0ad0ab
je 0x1000471c
jmp 0x1000153f
mov eax, dword [ebp - 0xb0]
sub eax, 0xae7062ff
je 0x1000415e
jmp 0x10001555
mov eax, dword [ebp - 0xb0]
sub eax, 0xaf1f5802
je 0x100048b7
jmp 0x1000156b
mov eax, dword [ebp - 0xb0]
sub eax, 0xb0b04802
je 0x10004507
jmp 0x10001581
mov eax, dword [ebp - 0xb0]
sub eax, 0xb1f2af45
je 0x10003362
jmp 0x10001597
mov eax, dword [ebp - 0xb0]
sub eax, 0xb2d94a45
je 0x10004c15
jmp 0x100015ad
mov eax, dword [ebp - 0xb0]
sub eax, 0xb54aa37c
je 0x100049c0
jmp 0x100015c3
mov eax, dword [ebp - 0xb0]
sub eax, 0xba18c076
je 0x100041b1
jmp 0x100015d9
mov eax, dword [ebp - 0xb0]
sub eax, 0xbb59a1a0
je 0x10003d77
jmp 0x100015ef
mov eax, dword [ebp - 0xb0]
sub eax, 0xbd13562d
je 0x100025f2
jmp 0x10001605
mov eax, dword [ebp - 0xb0]
sub eax, 0xbe03a4bc
je 0x100037bd
jmp 0x1000161b
mov eax, dword [ebp - 0xb0]
sub eax, 0xbf435b70
je 0x10002af4
jmp 0x10001631
mov eax, dword [ebp - 0xb0]
sub eax, 0xbf88d8ec
je 0x10003114
jmp 0x10001647
mov eax, dword [ebp - 0xb0]
sub eax, 0xbfb770d2
je 0x10003677
jmp 0x1000165d
mov eax, dword [ebp - 0xb0]
sub eax, 0xc06b82a6
je 0x10004d06
jmp 0x10001673
mov eax, dword [ebp - 0xb0]
sub eax, 0xc151c15a
je 0x10002425
jmp 0x10001689
mov eax, dword [ebp - 0xb0]
sub eax, 0xc18293b1
je 0x10003e11
jmp 0x1000169f
mov eax, dword [ebp - 0xb0]
sub eax, 0xc18ce19b
je 0x10004413
jmp 0x100016b5
mov eax, dword [ebp - 0xb0]
sub eax, 0xc1df2db2
je 0x100031f1
jmp 0x100016cb
mov eax, dword [ebp - 0xb0]
sub eax, 0xc21b643d
je 0x10004c24
jmp 0x100016e1
mov eax, dword [ebp - 0xb0]
sub eax, 0xc23ae12a
je 0x10002e04
jmp 0x100016f7
mov eax, dword [ebp - 0xb0]
sub eax, 0xc2712440
je 0x10002b3d
jmp 0x1000170d
mov eax, dword [ebp - 0xb0]
sub eax, 0xc27c5189
je 0x10004216
jmp 0x10001723
mov eax, dword [ebp - 0xb0]
sub eax, 0xc29ab232
je 0x10002809
jmp 0x10001739
mov eax, dword [ebp - 0xb0]
sub eax, 0xc2ec0d3e
je 0x10004e07
jmp 0x1000174f
mov eax, dword [ebp - 0xb0]
sub eax, 0xc3146cac
je 0x10004792
jmp 0x10001765
mov eax, dword [ebp - 0xb0]
sub eax, 0xc8b01889
je 0x10004c33
jmp 0x1000177b
mov eax, dword [ebp - 0xb0]
sub eax, 0xc9f07461
je 0x10002dbb
jmp 0x10001791
mov eax, dword [ebp - 0xb0]
sub eax, 0xcdcba759
je 0x10002838
jmp 0x100017a7
mov eax, dword [ebp - 0xb0]
sub eax, 0xcf4a960a
je 0x10004d4b
jmp 0x100017bd
mov eax, dword [ebp - 0xb0]
sub eax, 0xd0d29297
je 0x10004c9f
jmp 0x100017d3
mov eax, dword [ebp - 0xb0]
sub eax, 0xd3863080
je 0x10004872
jmp 0x100017e9
mov eax, dword [ebp - 0xb0]
sub eax, 0xd654ab21
je 0x100021f5
jmp 0x100017ff
mov eax, dword [ebp - 0xb0]
sub eax, 0xd8717433
je 0x1000317b
jmp 0x10001815
mov eax, dword [ebp - 0xb0]
sub eax, 0xdaaadc60
je 0x100038ef
jmp 0x1000182b
mov eax, dword [ebp - 0xb0]
sub eax, 0xdbc8d67f
je 0x1000275a
jmp 0x10001841
mov eax, dword [ebp - 0xb0]
sub eax, 0xdc43f29e
je 0x10004088
jmp 0x10001857
mov eax, dword [ebp - 0xb0]
sub eax, 0xdf991fcc
je 0x10004012
jmp 0x1000186d
mov eax, dword [ebp - 0xb0]
sub eax, 0xe23bde8e
je 0x10003f05
jmp 0x10001883
mov eax, dword [ebp - 0xb0]
sub eax, 0xe29bf7f6
je 0x100041fc
jmp 0x10001899
mov eax, dword [ebp - 0xb0]
sub eax, 0xe3a672b6
je 0x1000281e
jmp 0x100018af
mov eax, dword [ebp - 0xb0]
sub eax, 0xe4734ab3
je 0x10004abe
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x31138f94
sub edx, 1
add edx, 0x31138f94
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xec60fa43
mov ecx, 0x11cb7ae4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2d94a45
mov ecx, 0x17b4e72e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0x9f212608
sub edx, 1
add edx, 0x9f212608
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc21b643d
mov ecx, 0x7744518d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae0ad0ab
mov ecx, 0x5e8f4644
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x34b773bf
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4c18e109
mov ecx, 0xdbc8d67f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x1a4eda58
sub edx, 1
add edx, 0x1a4eda58
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4c18e109
mov ecx, 0x9727b0ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0xc29ab232
jmp 0x10004eb3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xa8], 0xe3a672b6
jmp 0x10004eb3
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0xcdcba759
jmp 0x10004eb3
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xa4]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xa8], 0x78d7ba4a
jmp 0x10004eb3
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xefce972d
mov ecx, 0xe517d2e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc6acb27
mov ecx, 0xc2712440
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x2317e970
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0xcc0a0c7f
sub edx, 1
add edx, 0xcc0a0c7f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f2df96e
mov ecx, 0x19dab15f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3146cac
mov ecx, 0xc23ae12a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
add edx, 0xd89e00fa
sub edx, 1
sub edx, 0xd89e00fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc06b82a6
mov ecx, 0x1ebeb94e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [ebp - 0x5c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0x48ee0f3c
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0xd18087fd
sub edx, 1
add edx, 0xd18087fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x759cdde
mov ecx, 0xc1df2db2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x85276200
sub edx, 1
add edx, 0x85276200
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b709a41
mov ecx, 0x5cd628d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x58], eax
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0x8cc1218a
sub edx, 1
add edx, 0x8cc1218a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3863080
mov ecx, 0x8ecc4690
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x387305f4
jmp 0x10004eb3
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf1f5802
mov ecx, 0x6556c61a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0xb9cabf66
sub edx, 1
add edx, 0xb9cabf66
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcf4a960a
mov ecx, 0xbfb770d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0xa111896e
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x50f35c46
sub edx, 1
add edx, 0x50f35c46
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb54aa37c
mov ecx, 0x905532e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xff01f886
mov ecx, 0xa4794e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb54aa37c
mov ecx, 0x4cde5c0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ax, word [ebp - 0x4a]
movzx eax, ax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xa8], 0xef375f57
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
add edx, 0x727af73b
sub edx, 1
sub edx, 0x727af73b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e82f811
mov ecx, 0x80c053a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
mov edx, eax
add edx, 0x18
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x7c]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0xf7fdcb11
sub edx, 1
add edx, 0xf7fdcb11
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e82f811
mov ecx, 0x387dddfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [ebp - 0x3c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001b190
call fcn.10012980
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x35], al
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67661aab
mov ecx, 0x15632ebb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x236a129d
mov ecx, 0xea35b161
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
sub ecx, 0xf429aab4
add ecx, eax
add ecx, 0xf429aab4
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011b50
add esp, 0xc
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x74]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2b80be4
mov ecx, 0xe23bde8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x38804c78
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0xd3608a05
sub edx, 1
add edx, 0xd3608a05
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x531e7a
mov ecx, 0xdc43f29e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x853e7711
sub edx, 1
add edx, 0x853e7711
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x531e7a
mov ecx, 0x5571d1a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [ebp - 0x7c]
mov ax, word [eax]
mov word [ebp - 0x24], ax
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8090274
mov ecx, 0xba18c076
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x6007cf0b
jmp 0x10004eb3
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa8], 0xc27c5189
jmp 0x10004eb3
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0x23e7359b
sub edx, 1
add edx, 0x23e7359b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1984319
mov ecx, 0x8b5ad9d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0x2d9f9892
sub edx, 1
add edx, 0x2d9f9892
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1984319
mov ecx, 0xf0d21c37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x12bffa54
sub edx, 1
add edx, 0x12bffa54
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x32c33b56
mov ecx, 0xf89cd882
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa0]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
mov edx, eax
sub edx, 0x1d3d6a9a
sub edx, 1
add edx, 0x1d3d6a9a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f8bac25
mov ecx, 0x4578e9b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
add edx, 0x51d6f82
sub edx, 1
sub edx, 0x51d6f82
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ca54656
mov ecx, 0x8d145dc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc557b42
mov ecx, 0x939c0b83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc557b42
mov ecx, 0x58d2a834
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0xb168f62
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x36ffc13c
jmp 0x10004eb3
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa8], 0xc23ae12a
jmp 0x10004eb3
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xa8], 0xb1f2af45
jmp 0x10004eb3
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa8], 0x99a3908c
jmp 0x10004eb3
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
add ecx, 0x84fba765
add ecx, eax
sub ecx, 0x84fba765
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov word [eax], 0
mov eax, dword [0x1006f8a8]
mov ecx, dword [0x1006f8a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b053017
mov ecx, 0x7f506f5b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov ecx, dword [0x1006f8a8]
mov eax, dword [0x1006f8a4]
mov edx, ecx
sub edx, 0x8339b8f6
sub edx, 1
add edx, 0x8339b8f6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf444a5c6
mov ecx, 0xf8bfd534
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x17b4e72e
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0xc151c15a
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x3aa64902
jmp 0x10004eb3
mov eax, dword [ebp - 0x68]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x5393326
jmp 0x10004eb3
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa8], 0x1ebeb94e
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x95f88b63
jmp 0x10004eb3
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xa8], 0x80c053a2
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0x521311ff
jmp 0x10004eb3
mov dword [ebp - 0xa8], 0xd1dcdc6
jmp 0x10004eb3
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
sub ecx, 0x36ba00d8
add ecx, eax
add ecx, 0x36ba00d8
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov word [eax], 0
mov dword [ebp - 0xa8], 0x8290b7f3
jmp 0x10004eb3
jmp 0x10001329