Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1003a600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x24ebd18d
sub edx, 1
sub edx, 0x24ebd18d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x94], 0xfa8e9937
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x80cc9eab
je 0x100017ee
jmp 0x10001134
mov eax, dword [ebp - 0x9c]
sub eax, 0x8103f609
je 0x10001d43
jmp 0x1000114a
mov eax, dword [ebp - 0x9c]
sub eax, 0x838e1166
je 0x100019c2
jmp 0x10001160
mov eax, dword [ebp - 0x9c]
sub eax, 0x8777d67c
je 0x100017b2
jmp 0x10001176
mov eax, dword [ebp - 0x9c]
sub eax, 0x88f1fe7a
je 0x10001d34
jmp 0x1000118c
mov eax, dword [ebp - 0x9c]
sub eax, 0x8cac12a5
je 0x1000227f
jmp 0x100011a2
mov eax, dword [ebp - 0x9c]
sub eax, 0x8cda7933
je 0x100018db
jmp 0x100011b8
mov eax, dword [ebp - 0x9c]
sub eax, 0x8e98586a
je 0x10001b42
jmp 0x100011ce
mov eax, dword [ebp - 0x9c]
sub eax, 0x9cabd001
je 0x1000250c
jmp 0x100011e4
mov eax, dword [ebp - 0x9c]
sub eax, 0x9cae7942
je 0x1000228e
jmp 0x100011fa
mov eax, dword [ebp - 0x9c]
sub eax, 0x9e55e084
je 0x1000184d
jmp 0x10001210
mov eax, dword [ebp - 0x9c]
sub eax, 0xa30f6ad7
je 0x10001e28
jmp 0x10001226
mov eax, dword [ebp - 0x9c]
sub eax, 0xa7d7e7cd
je 0x1000222e
jmp 0x1000123c
mov eax, dword [ebp - 0x9c]
sub eax, 0xac8b93f2
je 0x10001954
jmp 0x10001252
mov eax, dword [ebp - 0x9c]
sub eax, 0xb2be9a4c
je 0x100017c1
jmp 0x10001268
mov eax, dword [ebp - 0x9c]
sub eax, 0xb58c4db9
je 0x10001b9b
jmp 0x1000127e
mov eax, dword [ebp - 0x9c]
sub eax, 0xb70ba744
je 0x100021e5
jmp 0x10001294
mov eax, dword [ebp - 0x9c]
sub eax, 0xb9362237
je 0x10001bd7
jmp 0x100012aa
mov eax, dword [ebp - 0x9c]
sub eax, 0xbb50ce2b
je 0x10001d5b
jmp 0x100012c0
mov eax, dword [ebp - 0x9c]
sub eax, 0xbb651880
je 0x1000236b
jmp 0x100012d6
mov eax, dword [ebp - 0x9c]
sub eax, 0xbbb0c924
je 0x10001f7d
jmp 0x100012ec
mov eax, dword [ebp - 0x9c]
sub eax, 0xbeeb30f6
je 0x100024ca
jmp 0x10001302
mov eax, dword [ebp - 0x9c]
sub eax, 0xbf4ca6ba
je 0x10001d9b
jmp 0x10001318
mov eax, dword [ebp - 0x9c]
sub eax, 0xc4b144af
je 0x10001edb
jmp 0x1000132e
mov eax, dword [ebp - 0x9c]
sub eax, 0xc50d958c
je 0x100024bb
jmp 0x10001344
mov eax, dword [ebp - 0x9c]
sub eax, 0xca4c4c2b
je 0x10002489
jmp 0x1000135a
mov eax, dword [ebp - 0x9c]
sub eax, 0xce511e71
je 0x1000214b
jmp 0x10001370
mov eax, dword [ebp - 0x9c]
sub eax, 0xcff79279
je 0x10001d77
jmp 0x10001386
mov eax, dword [ebp - 0x9c]
sub eax, 0xd2824fec
je 0x10002304
jmp 0x1000139c
mov eax, dword [ebp - 0x9c]
sub eax, 0xdd364123
je 0x100024eb
jmp 0x100013b2
mov eax, dword [ebp - 0x9c]
sub eax, 0xe19aa9f0
je 0x10002067
jmp 0x100013c8
mov eax, dword [ebp - 0x9c]
sub eax, 0xed9f631d
je 0x1000237a
jmp 0x100013de
mov eax, dword [ebp - 0x9c]
sub eax, 0xf1845c08
je 0x100025ce
jmp 0x100013f4
mov eax, dword [ebp - 0x9c]
sub eax, 0xf67b0a04
je 0x10001bee
jmp 0x1000140a
mov eax, dword [ebp - 0x9c]
sub eax, 0xf9a77e29
je 0x1000213c
jmp 0x10001420
mov eax, dword [ebp - 0x9c]
sub eax, 0xfa1bddcb
je 0x10001bc8
jmp 0x10001436
mov eax, dword [ebp - 0x9c]
sub eax, 0xfa8e9937
je 0x100016a3
jmp 0x1000144c
mov eax, dword [ebp - 0x9c]
sub eax, 0x5fab16e
je 0x100016d2
jmp 0x10001462
mov eax, dword [ebp - 0x9c]
sub eax, 0xd641ea0
je 0x10001ecc
jmp 0x10001478
mov eax, dword [ebp - 0x9c]
sub eax, 0xdc33c21
je 0x10002418
jmp 0x1000148e
mov eax, dword [ebp - 0x9c]
sub eax, 0x10a960c0
je 0x10001cd3
jmp 0x100014a4
mov eax, dword [ebp - 0x9c]
sub eax, 0x1768da30
je 0x10001db2
jmp 0x100014ba
mov eax, dword [ebp - 0x9c]
sub eax, 0x2349dc4e
je 0x100019a5
jmp 0x100014d0
mov eax, dword [ebp - 0x9c]
sub eax, 0x2bd3ccdb
je 0x100024fa
jmp 0x100014e6
mov eax, dword [ebp - 0x9c]
sub eax, 0x2c07c07b
je 0x100025dd
jmp 0x100014fc
mov eax, dword [ebp - 0x9c]
sub eax, 0x2dd59b62
je 0x10001f2c
jmp 0x10001512
mov eax, dword [ebp - 0x9c]
sub eax, 0x2e251bb8
je 0x10001aae
jmp 0x10001528
mov eax, dword [ebp - 0x9c]
sub eax, 0x30eea4d2
je 0x10002543
jmp 0x1000153e
mov eax, dword [ebp - 0x9c]
sub eax, 0x3239132a
je 0x10002393
jmp 0x10001554
mov eax, dword [ebp - 0x9c]
sub eax, 0x33aea893
je 0x10001baa
jmp 0x1000156a
mov eax, dword [ebp - 0x9c]
sub eax, 0x347da180
je 0x10001acc
jmp 0x10001580
mov eax, dword [ebp - 0x9c]
sub eax, 0x34a5b6f0
je 0x10001899
jmp 0x10001596
mov eax, dword [ebp - 0x9c]
sub eax, 0x3eaa9332
je 0x10001945
jmp 0x100015ac
mov eax, dword [ebp - 0x9c]
sub eax, 0x41b4d0af
je 0x1000185c
jmp 0x100015c2
mov eax, dword [ebp - 0x9c]
sub eax, 0x41c04972
je 0x10001c5d
jmp 0x100015d8
mov eax, dword [ebp - 0x9c]
sub eax, 0x44f85f08
je 0x1000247a
jmp 0x100015ee
mov eax, dword [ebp - 0x9c]
sub eax, 0x47d591cd
je 0x10001a38
jmp 0x10001604
mov eax, dword [ebp - 0x9c]
sub eax, 0x4d02a7ac
je 0x100025ef
jmp 0x1000161a
mov eax, dword [ebp - 0x9c]
sub eax, 0x510e568d
je 0x10002007
jmp 0x10001630
mov eax, dword [ebp - 0x9c]
sub eax, 0x59f6d49d
je 0x100024dc
jmp 0x10001646
mov eax, dword [ebp - 0x9c]
sub eax, 0x5ee144d0
je 0x100023a2
jmp 0x1000165c
mov eax, dword [ebp - 0x9c]
sub eax, 0x6ecc69d5
je 0x1000252b
jmp 0x10001672
mov eax, dword [ebp - 0x9c]
sub eax, 0x7b718f86
je 0x10002561
jmp 0x10001688
mov eax, dword [ebp - 0x9c]
sub eax, 0x7c2fe49b
je 0x10002016
jmp 0x1000169e
jmp 0x1000260d
mov al, byte [ebp - 0x8e]
mov cl, byte [ebp - 0x8d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59f6d49d
mov ecx, 0x5fab16e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xe893ad89
sub edx, 1
add edx, 0xe893ad89
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x59f6d49d
mov ecx, 0x8777d67c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xb2be9a4c
jmp 0x1000260d
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x80cc9eab
jmp 0x1000260d
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c9c0
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov edx, dword [ebp - 0x80]
mov eax, 0x9e55e084
mov ecx, 0x41b4d0af
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xbeeb30f6
jmp 0x1000260d
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x94], 0x34a5b6f0
jmp 0x1000260d
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x94], 0x8cda7933
jmp 0x1000260d
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov edx, dword [ebp - 0x74]
mov esi, 0xffffffff
mov eax, 0xac8b93f2
mov ecx, 0x3eaa9332
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xbeeb30f6
jmp 0x1000260d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x2349dc4e
jmp 0x1000260d
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov dword [ebp - 0x94], 0x838e1166
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0x41db457
sub edx, 1
add edx, 0x41db457
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdd364123
mov ecx, 0x47d591cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xa0c4ab69
sub edx, 1
add edx, 0xa0c4ab69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdd364123
mov ecx, 0x2e251bb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dl, byte [ebp - 0x49]
mov eax, 0x347da180
mov ecx, 0xb9362237
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x34826992
sub edx, 1
sub edx, 0x34826992
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2bd3ccdb
mov ecx, 0x8e98586a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0xee2e75b7
sub edx, 1
sub edx, 0xee2e75b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2bd3ccdb
mov ecx, 0xb58c4db9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0x33aea893
jmp 0x1000260d
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xfa1bddcb
jmp 0x1000260d
mov dword [ebp - 0x94], 0xbeeb30f6
jmp 0x1000260d
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x94], 0xf67b0a04
jmp 0x1000260d
mov eax, dword [ebp - 0x44]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x94], 0x41c04972
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xd0f44d6c
sub edx, 1
add edx, 0xd0f44d6c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9cabd001
mov ecx, 0x10a960c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0xe6e804dd
sub edx, 1
sub edx, 0xe6e804dd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9cabd001
mov ecx, 0x88f1fe7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0x8103f609
jmp 0x1000260d
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x94], 0xbb50ce2b
jmp 0x1000260d
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x36], ax
mov dword [ebp - 0x94], 0xcff79279
jmp 0x1000260d
mov ax, word [ebp - 0x36]
movzx esi, ax
mov edx, dword [ebp - 0x3c]
mov eax, 0x5ee144d0
mov ecx, 0xbf4ca6ba
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x94], 0x1768da30
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x34fab7d7
sub edx, 1
sub edx, 0x34fab7d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6ecc69d5
mov ecx, 0xa30f6ad7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, 0x2399e69e
add eax, ecx
sub eax, 0x2399e69e
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
imul eax, eax, 0x28
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xf5306d02
sub edx, 1
add edx, 0xf5306d02
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6ecc69d5
mov ecx, 0xd641ea0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xc4b144af
jmp 0x1000260d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
add ecx, 0xcb8f40c4
add ecx, eax
sub ecx, 0xcb8f40c4
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ed30
add esp, 8
mov edx, eax
mov eax, 0x2dd59b62
mov ecx, 0xb70ba744
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
sub edx, 0x35c78d88
sub edx, 1
add edx, 0x35c78d88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30eea4d2
mov ecx, 0xbbb0c924
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x30eea4d2
mov ecx, 0x510e568d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0x7c2fe49b
jmp 0x1000260d
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
sub edx, 0xbd2f5399
sub edx, 1
add edx, 0xbd2f5399
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b718f86
mov ecx, 0xe19aa9f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x24]
add edx, 0x53a72272
add edx, eax
sub edx, 0x53a72272
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b718f86
mov ecx, 0xf9a77e29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xce511e71
jmp 0x1000260d
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cb20
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov dword [ebp - 0x94], 0xb70ba744
jmp 0x1000260d
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1845c08
mov ecx, 0xa7d7e7cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
sub edx, 0xcaa9612b
sub edx, 1
add edx, 0xcaa9612b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1845c08
mov ecx, 0x8cac12a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0x9cae7942
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x29b421ba
sub edx, 1
sub edx, 0x29b421ba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2c07c07b
mov ecx, 0xd2824fec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
sub ax, 0x682
add ax, 1
add ax, 0x682
mov word [ebp - 0x16], ax
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0x84dfbca3
sub edx, 1
sub edx, 0x84dfbca3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c07c07b
mov ecx, 0xbb651880
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xed9f631d
jmp 0x1000260d
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0x94], 0x3239132a
jmp 0x1000260d
mov dword [ebp - 0x94], 0x8103f609
jmp 0x1000260d
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0xcfdc75c7
sub edx, 1
sub edx, 0xcfdc75c7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4d02a7ac
mov ecx, 0xdc33c21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4d02a7ac
mov ecx, 0x44f85f08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000260d
mov dword [ebp - 0x94], 0xca4c4c2b
jmp 0x1000260d
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xc50d958c
jmp 0x1000260d
mov dword [ebp - 0x94], 0xbeeb30f6
jmp 0x1000260d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bdc0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x94], 0x5fab16e
jmp 0x1000260d
mov dword [ebp - 0x94], 0x47d591cd
jmp 0x1000260d
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x8e98586a
jmp 0x1000260d
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x94], 0x10a960c0
jmp 0x1000260d
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x94], 0xa30f6ad7
jmp 0x1000260d
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x94], 0xbbb0c924
jmp 0x1000260d
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x94], 0xe19aa9f0
jmp 0x1000260d
mov dword [ebp - 0x94], 0xa7d7e7cd
jmp 0x1000260d
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x94], 0xd2824fec
jmp 0x1000260d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], 0xdc33c21
jmp 0x10001118