Function at 0x10008b30
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x10092280]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0xe54de8d
sub edx, 1
add edx, 0xe54de8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x92], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x91], al
mov dword [ebp - 0x98], 0x554b0ed9
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x8217d8a3
je 0x1000a3c9
jmp 0x10008bb3
mov eax, dword [ebp - 0xa0]
sub eax, 0x87c2c3e0
je 0x10009f02
jmp 0x10008bc9
mov eax, dword [ebp - 0xa0]
sub eax, 0x87ed117a
je 0x10009a00
jmp 0x10008bdf
mov eax, dword [ebp - 0xa0]
sub eax, 0x8c327cc0
je 0x1000a2b4
jmp 0x10008bf5
mov eax, dword [ebp - 0xa0]
sub eax, 0x8f1cd698
je 0x1000970a
jmp 0x10008c0b
mov eax, dword [ebp - 0xa0]
sub eax, 0x93f2d4f3
je 0x10009fbf
jmp 0x10008c21
mov eax, dword [ebp - 0xa0]
sub eax, 0x95eff235
je 0x10009e08
jmp 0x10008c37
mov eax, dword [ebp - 0xa0]
sub eax, 0x9a0b7630
je 0x1000a3a2
jmp 0x10008c4d
mov eax, dword [ebp - 0xa0]
sub eax, 0x9a53164a
je 0x10009b48
jmp 0x10008c63
mov eax, dword [ebp - 0xa0]
sub eax, 0x9d136bb2
je 0x100095d2
jmp 0x10008c79
mov eax, dword [ebp - 0xa0]
sub eax, 0x9f3f8306
je 0x1000a232
jmp 0x10008c8f
mov eax, dword [ebp - 0xa0]
sub eax, 0xa2dbbd57
je 0x1000a360
jmp 0x10008ca5
mov eax, dword [ebp - 0xa0]
sub eax, 0xa51b221c
je 0x100099e9
jmp 0x10008cbb
mov eax, dword [ebp - 0xa0]
sub eax, 0xa9e81c8f
je 0x10009c48
jmp 0x10008cd1
mov eax, dword [ebp - 0xa0]
sub eax, 0xacbfb769
je 0x1000a3b4
jmp 0x10008ce7
mov eax, dword [ebp - 0xa0]
sub eax, 0xad4302e4
je 0x1000a0a6
jmp 0x10008cfd
mov eax, dword [ebp - 0xa0]
sub eax, 0xae2552b4
je 0x1000949a
jmp 0x10008d13
mov eax, dword [ebp - 0xa0]
sub eax, 0xaec1630f
je 0x1000a272
jmp 0x10008d29
mov eax, dword [ebp - 0xa0]
sub eax, 0xaed20efd
je 0x1000a30e
jmp 0x10008d3f
mov eax, dword [ebp - 0xa0]
sub eax, 0xb1db4e72
je 0x1000a12d
jmp 0x10008d55
mov eax, dword [ebp - 0xa0]
sub eax, 0xb3ea8097
je 0x10009f73
jmp 0x10008d6b
mov eax, dword [ebp - 0xa0]
sub eax, 0xb8b978f9
je 0x1000a212
jmp 0x10008d81
mov eax, dword [ebp - 0xa0]
sub eax, 0xbf1612bf
je 0x10009780
jmp 0x10008d97
mov eax, dword [ebp - 0xa0]
sub eax, 0xc5340d9b
je 0x100093aa
jmp 0x10008dad
mov eax, dword [ebp - 0xa0]
sub eax, 0xc77aa013
je 0x1000a38d
jmp 0x10008dc3
mov eax, dword [ebp - 0xa0]
sub eax, 0xc86c2eeb
je 0x10009bbe
jmp 0x10008dd9
mov eax, dword [ebp - 0xa0]
sub eax, 0xcd0c00d9
je 0x100095c3
jmp 0x10008def
mov eax, dword [ebp - 0xa0]
sub eax, 0xd0516717
je 0x1000a14b
jmp 0x10008e05
mov eax, dword [ebp - 0xa0]
sub eax, 0xd3b15816
je 0x1000a446
jmp 0x10008e1b
mov eax, dword [ebp - 0xa0]
sub eax, 0xda060c74
je 0x1000a437
jmp 0x10008e31
mov eax, dword [ebp - 0xa0]
sub eax, 0xebb8e07f
je 0x100098e6
jmp 0x10008e47
mov eax, dword [ebp - 0xa0]
sub eax, 0xf1d6bb26
je 0x10009d62
jmp 0x10008e5d
mov eax, dword [ebp - 0xa0]
sub eax, 0xf3b87b6a
je 0x10009c19
jmp 0x10008e73
mov eax, dword [ebp - 0xa0]
sub eax, 0xfbbbaf3c
je 0x1000a010
jmp 0x10008e89
mov eax, dword [ebp - 0xa0]
sub eax, 0x32a11b
je 0x10009adf
jmp 0x10008e9f
mov eax, dword [ebp - 0xa0]
sub eax, 0x4482d3
je 0x10009973
jmp 0x10008eb5
mov eax, dword [ebp - 0xa0]
sub eax, 0x18ccb3b
je 0x10009a8e
jmp 0x10008ecb
mov eax, dword [ebp - 0xa0]
sub eax, 0x198ae7b
je 0x10009b39
jmp 0x10008ee1
mov eax, dword [ebp - 0xa0]
sub eax, 0x279e80d
je 0x100096f3
jmp 0x10008ef7
mov eax, dword [ebp - 0xa0]
sub eax, 0x72ad280
je 0x1000981f
jmp 0x10008f0d
mov eax, dword [ebp - 0xa0]
sub eax, 0xbea24a6
je 0x1000939b
jmp 0x10008f23
mov eax, dword [ebp - 0xa0]
sub eax, 0xcc7c890
je 0x10009d2d
jmp 0x10008f39
mov eax, dword [ebp - 0xa0]
sub eax, 0xe1ebede
je 0x1000a08d
jmp 0x10008f4f
mov eax, dword [ebp - 0xa0]
sub eax, 0x10b9cc82
je 0x1000a36f
jmp 0x10008f65
mov eax, dword [ebp - 0xa0]
sub eax, 0x13261734
je 0x10009cbe
jmp 0x10008f7b
mov eax, dword [ebp - 0xa0]
sub eax, 0x152d5d68
je 0x10009d9a
jmp 0x10008f91
mov eax, dword [ebp - 0xa0]
sub eax, 0x1a474b80
je 0x1000a223
jmp 0x10008fa7
mov eax, dword [ebp - 0xa0]
sub eax, 0x1fde47e7
je 0x1000a102
jmp 0x10008fbd
mov eax, dword [ebp - 0xa0]
sub eax, 0x201a8b62
je 0x100094a9
jmp 0x10008fd3
mov eax, dword [ebp - 0xa0]
sub eax, 0x226c65fe
je 0x10009418
jmp 0x10008fe9
mov eax, dword [ebp - 0xa0]
sub eax, 0x27788c20
je 0x100096c6
jmp 0x10008fff
mov eax, dword [ebp - 0xa0]
sub eax, 0x2ac75a7c
je 0x10009c28
jmp 0x10009015
mov eax, dword [ebp - 0xa0]
sub eax, 0x2b60d510
je 0x1000982e
jmp 0x1000902b
mov eax, dword [ebp - 0xa0]
sub eax, 0x2ced8176
je 0x10009ef3
jmp 0x10009041
mov eax, dword [ebp - 0xa0]
sub eax, 0x2dbdfe0f
je 0x10009217
jmp 0x10009057
mov eax, dword [ebp - 0xa0]
sub eax, 0x303932fb
je 0x1000a0c9
jmp 0x1000906d
mov eax, dword [ebp - 0xa0]
sub eax, 0x30f1f5f6
je 0x100099cb
jmp 0x10009083
mov eax, dword [ebp - 0xa0]
sub eax, 0x320b3358
je 0x100098fd
jmp 0x10009099
mov eax, dword [ebp - 0xa0]
sub eax, 0x362c6385
je 0x100098c8
jmp 0x100090af
mov eax, dword [ebp - 0xa0]
sub eax, 0x3726d51a
je 0x10009d3c
jmp 0x100090c5
mov eax, dword [ebp - 0xa0]
sub eax, 0x40901ad3
je 0x1000961b
jmp 0x100090db
mov eax, dword [ebp - 0xa0]
sub eax, 0x415ca866
je 0x1000987f
jmp 0x100090f1
mov eax, dword [ebp - 0xa0]
sub eax, 0x4a02c90d
je 0x1000a07e
jmp 0x10009107
mov eax, dword [ebp - 0xa0]
sub eax, 0x4d048ae1
je 0x10009a59
jmp 0x1000911d
mov eax, dword [ebp - 0xa0]
sub eax, 0x502f61ac
je 0x100096e4
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0x82473866
sub edx, 1
add edx, 0x82473866
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a474b80
mov ecx, 0x58b0bea2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0xd0516717
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9f3f8306
mov ecx, 0x226c65fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
sub edx, 0xd31403ee
sub edx, 1
add edx, 0xd31403ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f3f8306
mov ecx, 0xae2552b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x201a8b62
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaec1630f
mov ecx, 0x66fc19d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x9d136bb2
jmp 0x1000a450
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8c327cc0
mov ecx, 0x40901ad3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x54]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x4d], al
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
add edx, 0x3092062c
sub edx, 1
sub edx, 0x3092062c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8c327cc0
mov ecx, 0x27788c20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dl, byte [ebp - 0x4d]
mov eax, 0x279e80d
mov ecx, 0x502f61ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x98], 0x8f1cd698
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0x756e5001
sub edx, 1
add edx, 0x756e5001
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaed20efd
mov ecx, 0xbf1612bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
add edx, 0x5cfed6e7
sub edx, 1
sub edx, 0x5cfed6e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaed20efd
mov ecx, 0x72ad280
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x2b60d510
jmp 0x1000a450
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
sub edx, 0x7301b73d
sub edx, 1
add edx, 0x7301b73d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2dbbd57
mov ecx, 0x415ca866
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2dbbd57
mov ecx, 0x362c6385
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dl, byte [ebp - 0x45]
mov eax, 0xebb8e07f
mov ecx, 0xa51b221c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x98], 0x320b3358
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0x27380ef3
sub edx, 1
add edx, 0x27380ef3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x10b9cc82
mov ecx, 0x4482d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10b9cc82
mov ecx, 0x30f1f5f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x55e0174a
jmp 0x1000a450
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x98], 0x87ed117a
jmp 0x1000a450
mov eax, dword [ebp - 0x40]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x98], 0x4d048ae1
jmp 0x1000a450
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x898e635b
add ecx, eax
add ecx, 0x898e635b
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov dword [ebp - 0x98], 0x18ccb3b
jmp 0x1000a450
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
sub edx, 0xf1868c5a
sub edx, 1
add edx, 0xf1868c5a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc77aa013
mov ecx, 0x32a11b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc77aa013
mov ecx, 0x198ae7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x9a53164a
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0xa25609d3
sub edx, 1
add edx, 0xa25609d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9a0b7630
mov ecx, 0xc86c2eeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 6]
mov dword [ebp - 0x30], eax
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
sub edx, 0x9b35054c
sub edx, 1
add edx, 0x9b35054c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a0b7630
mov ecx, 0xf3b87b6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x2ac75a7c
jmp 0x1000a450
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov eax, 0x7634dcc7
mov ecx, 0xa9e81c8f
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0x9457c0c9
sub edx, 1
add edx, 0x9457c0c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xacbfb769
mov ecx, 0x13261734
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
sub edx, 0xe6974037
sub edx, 1
add edx, 0xe6974037
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xacbfb769
mov ecx, 0xcc7c890
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x3726d51a
jmp 0x1000a450
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0xf1d6bb26
jmp 0x1000a450
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10032938
call fcn.100286c0
add esp, 8
mov edx, eax
mov eax, 0x152d5d68
mov ecx, 0x93f2d4f3
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8217d8a3
mov ecx, 0x95eff235
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xe03a25cc
add edx, eax
sub edx, 0xe03a25cc
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0xa9b36d41
add eax, ecx
sub eax, 0xa9b36d41
mov dword [ebp - 0x28], eax
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
add edx, 0x7f5b6c0d
sub edx, 1
sub edx, 0x7f5b6c0d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8217d8a3
mov ecx, 0x2ced8176
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0x87c2c3e0
jmp 0x1000a450
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x7393e952
add ecx, eax
add ecx, 0x7393e952
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10024ec0
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x98], 0xb3ea8097
jmp 0x1000a450
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov esi, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov dword [ebp - 0x98], 0x93f2d4f3
jmp 0x1000a450
mov eax, dword [0x1009378c]
mov ecx, dword [0x10093788]
mov edx, eax
sub edx, 0x781e186e
sub edx, 1
add edx, 0x781e186e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda060c74
mov ecx, 0xfbbbaf3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xda060c74
mov ecx, 0x4a02c90d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov dword [ebp - 0x98], 0xe1ebede
jmp 0x1000a450
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x98], 0xad4302e4
jmp 0x1000a450
mov ax, word [ebp - 0x14]
sub ax, 0xc51d
add ax, 1
add ax, 0xc51d
mov word [ebp - 0x12], ax
mov dword [ebp - 0x98], 0x303932fb
jmp 0x1000a450
mov eax, dword [ebp - 0x64]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x98], 0x18ccb3b
jmp 0x1000a450
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x98], 0xb1db4e72
jmp 0x1000a450
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xd0516717
jmp 0x1000a450
mov ecx, dword [0x1009378c]
mov eax, dword [0x10093788]
mov edx, ecx
sub edx, 0xd1c53046
sub edx, 1
add edx, 0xd1c53046
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd3b15816
mov ecx, 0x6f525ba4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a450
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10023fc0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x98], 0x2dbdfe0f
jmp 0x1000a450
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x98], 0x226c65fe
jmp 0x1000a450
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x98], 0x66fc19d6
jmp 0x1000a450
mov eax, dword [ebp - 0x54]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x98], 0x40901ad3
jmp 0x1000a450
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x98], 0xbf1612bf
jmp 0x1000a450
mov dword [ebp - 0x98], 0x415ca866
jmp 0x1000a450
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x4482d3
jmp 0x1000a450
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x98], 0x32a11b
jmp 0x1000a450
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x98], 0xc86c2eeb
jmp 0x1000a450
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x98], 0x13261734
jmp 0x1000a450
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x98], 0x95eff235
jmp 0x1000a450
mov dword [ebp - 0x98], 0xfbbbaf3c
jmp 0x1000a450
mov dword [ebp - 0x98], 0x6f525ba4
jmp 0x10008b97