Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10035600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0xda7c9bbe
sub edx, 1
add edx, 0xda7c9bbe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x99], al
mov dword [ebp - 0xa0], 0x172dfa88
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], eax
sub eax, 0x834c308a
je 0x10001e6f
jmp 0x10001133
mov eax, dword [ebp - 0xa8]
sub eax, 0x93ee9fc1
je 0x100023c7
jmp 0x10001149
mov eax, dword [ebp - 0xa8]
sub eax, 0x9d42c9de
je 0x10002083
jmp 0x1000115f
mov eax, dword [ebp - 0xa8]
sub eax, 0x9f0473a8
je 0x100022e6
jmp 0x10001175
mov eax, dword [ebp - 0xa8]
sub eax, 0xa3e8a36b
je 0x10001a43
jmp 0x1000118b
mov eax, dword [ebp - 0xa8]
sub eax, 0xa4a4ae65
je 0x100025be
jmp 0x100011a1
mov eax, dword [ebp - 0xa8]
sub eax, 0xa4c1ccf4
je 0x100026a9
jmp 0x100011b7
mov eax, dword [ebp - 0xa8]
sub eax, 0xa9cd6ae4
je 0x100024e6
jmp 0x100011cd
mov eax, dword [ebp - 0xa8]
sub eax, 0xab502535
je 0x10002643
jmp 0x100011e3
mov eax, dword [ebp - 0xa8]
sub eax, 0xb5604aec
je 0x1000225f
jmp 0x100011f9
mov eax, dword [ebp - 0xa8]
sub eax, 0xb7bad029
je 0x10001be9
jmp 0x1000120f
mov eax, dword [ebp - 0xa8]
sub eax, 0xc6c0330f
je 0x10002537
jmp 0x10001225
mov eax, dword [ebp - 0xa8]
sub eax, 0xcfffbdde
je 0x10001cce
jmp 0x1000123b
mov eax, dword [ebp - 0xa8]
sub eax, 0xd0931c54
je 0x100024d7
jmp 0x10001251
mov eax, dword [ebp - 0xa8]
sub eax, 0xd88437e5
je 0x10002693
jmp 0x10001267
mov eax, dword [ebp - 0xa8]
sub eax, 0xe001ba8c
je 0x100018d3
jmp 0x1000127d
mov eax, dword [ebp - 0xa8]
sub eax, 0xe1aa54fc
je 0x10001c69
jmp 0x10001293
mov eax, dword [ebp - 0xa8]
sub eax, 0xe2339ed1
je 0x10002463
jmp 0x100012a9
mov eax, dword [ebp - 0xa8]
sub eax, 0xe414facf
je 0x10002701
jmp 0x100012bf
mov eax, dword [ebp - 0xa8]
sub eax, 0xeab5cf8b
je 0x10001ddf
jmp 0x100012d5
mov eax, dword [ebp - 0xa8]
sub eax, 0xebb88b75
je 0x10001ee5
jmp 0x100012eb
mov eax, dword [ebp - 0xa8]
sub eax, 0xf194067c
je 0x10001b26
jmp 0x10001301
mov eax, dword [ebp - 0xa8]
sub eax, 0xf1eeeaa2
je 0x10001b58
jmp 0x10001317
mov eax, dword [ebp - 0xa8]
sub eax, 0xf3da73fe
je 0x10001d75
jmp 0x1000132d
mov eax, dword [ebp - 0xa8]
sub eax, 0xf58adfc8
je 0x100026d3
jmp 0x10001343
mov eax, dword [ebp - 0xa8]
sub eax, 0xf8da043c
je 0x100023ed
jmp 0x10001359
mov eax, dword [ebp - 0xa8]
sub eax, 0xfcb816cb
je 0x100021eb
jmp 0x1000136f
mov eax, dword [ebp - 0xa8]
sub eax, 0xfd719502
je 0x10001713
jmp 0x10001385
mov eax, dword [ebp - 0xa8]
sub eax, 0xfef1f362
je 0x1000220e
jmp 0x1000139b
mov eax, dword [ebp - 0xa8]
sub eax, 0x500f2
je 0x10001cbf
jmp 0x100013b1
mov eax, dword [ebp - 0xa8]
sub eax, 0x1a903c3
je 0x1000235c
jmp 0x100013c7
mov eax, dword [ebp - 0xa8]
sub eax, 0x23f6bdd
je 0x10001832
jmp 0x100013dd
mov eax, dword [ebp - 0xa8]
sub eax, 0xa05102e
je 0x10001823
jmp 0x100013f3
mov eax, dword [ebp - 0xa8]
sub eax, 0xad30d62
je 0x10001b35
jmp 0x10001409
mov eax, dword [ebp - 0xa8]
sub eax, 0x12ba05db
je 0x10002032
jmp 0x1000141f
mov eax, dword [ebp - 0xa8]
sub eax, 0x1328e8bc
je 0x100026ec
jmp 0x10001435
mov eax, dword [ebp - 0xa8]
sub eax, 0x172dfa88
je 0x100016e4
jmp 0x1000144b
mov eax, dword [ebp - 0xa8]
sub eax, 0x189ae5d4
je 0x10001a34
jmp 0x10001461
mov eax, dword [ebp - 0xa8]
sub eax, 0x1e9dd971
je 0x100019e3
jmp 0x10001477
mov eax, dword [ebp - 0xa8]
sub eax, 0x1f2ee634
je 0x10002023
jmp 0x1000148d
mov eax, dword [ebp - 0xa8]
sub eax, 0x26687ec0
je 0x100025ad
jmp 0x100014a3
mov eax, dword [ebp - 0xa8]
sub eax, 0x288c4b5b
je 0x10001f4d
jmp 0x100014b9
mov eax, dword [ebp - 0xa8]
sub eax, 0x2a638041
je 0x100022d7
jmp 0x100014cf
mov eax, dword [ebp - 0xa8]
sub eax, 0x2e2df59b
je 0x100021c3
jmp 0x100014e5
mov eax, dword [ebp - 0xa8]
sub eax, 0x31ed1bd9
je 0x1000196d
jmp 0x100014fb
mov eax, dword [ebp - 0xa8]
sub eax, 0x3305e249
je 0x10001c12
jmp 0x10001511
mov eax, dword [ebp - 0xa8]
sub eax, 0x390a0871
je 0x10001d13
jmp 0x10001527
mov eax, dword [ebp - 0xa8]
sub eax, 0x3bab4de3
je 0x10001d8e
jmp 0x1000153d
mov eax, dword [ebp - 0xa8]
sub eax, 0x3cf07012
je 0x10001ca1
jmp 0x10001553
mov eax, dword [ebp - 0xa8]
sub eax, 0x4078b52a
je 0x10001c87
jmp 0x10001569
mov eax, dword [ebp - 0xa8]
sub eax, 0x4ecb18a6
je 0x10001d4a
jmp 0x1000157f
mov eax, dword [ebp - 0xa8]
sub eax, 0x5032877e
je 0x10001e9c
jmp 0x10001595
mov eax, dword [ebp - 0xa8]
sub eax, 0x53fc7dd6
je 0x1000194f
jmp 0x100015ab
mov eax, dword [ebp - 0xa8]
sub eax, 0x54c2c66f
je 0x10001a94
jmp 0x100015c1
mov eax, dword [ebp - 0xa8]
sub eax, 0x5a8fc840
je 0x10001bf8
jmp 0x100015d7
mov eax, dword [ebp - 0xa8]
sub eax, 0x5ba72546
je 0x10002126
jmp 0x100015ed
mov eax, dword [ebp - 0xa8]
sub eax, 0x616b0031
je 0x10001f9e
jmp 0x10001603
mov eax, dword [ebp - 0xa8]
sub eax, 0x61e3ef4a
je 0x100026bb
jmp 0x10001619
mov eax, dword [ebp - 0xa8]
sub eax, 0x6409b98f
je 0x100023b8
jmp 0x1000162f
mov eax, dword [ebp - 0xa8]
sub eax, 0x6d026ee2
je 0x10001865
jmp 0x10001645
mov eax, dword [ebp - 0xa8]
sub eax, 0x6febb7d4
je 0x10001e7e
jmp 0x1000165b
mov eax, dword [ebp - 0xa8]
sub eax, 0x70a0bdc4
je 0x10002733
jmp 0x10001671
mov eax, dword [ebp - 0xa8]
sub eax, 0x725e369a
je 0x10001f3e
jmp 0x10001687
mov eax, dword [ebp - 0xa8]
sub eax, 0x73e6ccfc
je 0x100020e3
jmp 0x1000169d
mov eax, dword [ebp - 0xa8]
sub eax, 0x7652471c
je 0x10002634
mov al, byte [ebp - 0x9a]
mov cl, byte [ebp - 0x99]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4a4ae65
mov ecx, 0xfd719502
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov ecx, dword [ebp - 0xa4]
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov edx, esp
mov dword [ebp - 0x98], edx
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0x94], edx
push eax
mov edx, esp
mov dword [ebp - 0x90], edx
push eax
mov edx, esp
mov dword [ebp - 0x8c], edx
sub esp, 0x104
mov edx, esp
mov dword [ebp - 0x88], edx
push eax
mov edx, esp
mov dword [ebp - 0x84], edx
push eax
mov edx, esp
mov dword [ebp - 0x80], edx
push eax
mov edx, esp
mov dword [ebp - 0x7c], edx
push eax
mov edx, esp
mov dword [ebp - 0x78], edx
push eax
mov edx, esp
mov dword [ebp - 0x74], edx
push eax
mov edx, esp
mov dword [ebp - 0x70], edx
push eax
mov edx, esp
mov dword [ebp - 0x6c], edx
push eax
mov edx, esp
mov dword [ebp - 0x68], edx
push eax
mov edx, esp
mov dword [ebp - 0x64], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100078d0
mov eax, dword [ebp - 0xac]
add esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0xf64c58a9
sub edx, 1
sub edx, 0xf64c58a9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4a4ae65
mov ecx, 0xa05102e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0x23f6bdd
jmp 0x1000273d
mov eax, dword [ebp - 0x60]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xa0], 0x6d026ee2
jmp 0x1000273d
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7e4389df
mov ecx, 0xe001ba8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x5c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7e4389df
mov ecx, 0x53fc7dd6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dl, byte [ebp - 0x55]
mov eax, 0x31ed1bd9
mov ecx, 0xa3e8a36b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x4d90b110
sub edx, 1
add edx, 0x4d90b110
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7652471c
mov ecx, 0x1e9dd971
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
sub edx, 0xd633d492
sub edx, 1
add edx, 0xd633d492
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7652471c
mov ecx, 0x189ae5d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xa9cd6ae4
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0x3390ebd8
sub edx, 1
sub edx, 0x3390ebd8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab502535
mov ecx, 0x54c2c66f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0xa424fb8f
sub edx, 1
sub edx, 0xa424fb8f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab502535
mov ecx, 0xf194067c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xad30d62
jmp 0x1000273d
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa0], 0xf1eeeaa2
jmp 0x1000273d
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov edx, dword [ebp - 0x84]
mov esi, 0xffffffff
mov eax, 0x5a8fc840
mov ecx, 0xb7bad029
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xa9cd6ae4
jmp 0x1000273d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xa0], 0x3305e249
jmp 0x1000273d
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xa0], 0xe1aa54fc
jmp 0x1000273d
mov edx, dword [ebp - 0x48]
mov eax, 0x4078b52a
mov ecx, 0xcfffbdde
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xa0], 0x3cf07012
jmp 0x1000273d
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0], 0x500f2
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xa9cd6ae4
jmp 0x1000273d
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xa0], 0x390a0871
jmp 0x1000273d
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x4ecb18a6
jmp 0x1000273d
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov dword [ebp - 0xa0], 0xf3da73fe
jmp 0x1000273d
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x34], ax
mov dword [ebp - 0xa0], 0x3bab4de3
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
sub edx, 0x4ea37cb
sub edx, 1
add edx, 0x4ea37cb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd88437e5
mov ecx, 0xeab5cf8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov ax, word [ebp - 0x34]
movzx eax, ax
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x5298bfdf
sub edx, 1
add edx, 0x5298bfdf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd88437e5
mov ecx, 0x834c308a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0x6febb7d4
jmp 0x1000273d
mov dl, byte [ebp - 0x31]
mov eax, 0x9f0473a8
mov ecx, 0x5032877e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4c1ccf4
mov ecx, 0xebb88b75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0xbf629d54
sub edx, 1
sub edx, 0xbf629d54
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4c1ccf4
mov ecx, 0x725e369a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0x288c4b5b
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0x858a8e42
sub edx, 1
sub edx, 0x858a8e42
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61e3ef4a
mov ecx, 0x616b0031
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x30]
add eax, 0xe46c4f86
add eax, 0x18
sub eax, 0xe46c4f86
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, 0x4ab14e2f
add eax, ecx
sub eax, 0x4ab14e2f
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
imul eax, eax, 0x28
mov dword [ebp - 0x28], eax
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
sub edx, 0x9ef22e6a
sub edx, 1
add edx, 0x9ef22e6a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61e3ef4a
mov ecx, 0x1f2ee634
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0x12ba05db
jmp 0x1000273d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add ecx, 0xe6f02752
add ecx, eax
sub ecx, 0xe6f02752
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10013190
call fcn.10009c40
add esp, 8
mov edx, eax
mov eax, 0x9d42c9de
mov ecx, 0x2e2df59b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov dword [ebp - 0xa0], 0x73e6ccfc
jmp 0x1000273d
mov cl, byte [ebp - 0x21]
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa0], 0x5ba72546
jmp 0x1000273d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10007a30
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x1472eced
add esi, eax
sub esi, 0x1472eced
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov dword [ebp - 0xa0], 0x2e2df59b
jmp 0x1000273d
mov dword [ebp - 0xa0], 0x7955066c
jmp 0x1000273d
mov ax, word [ebp - 0x18]
sub ax, 0xb25c
add ax, 1
add ax, 0xb25c
mov word [ebp - 0x16], ax
mov dword [ebp - 0xa0], 0xfef1f362
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
sub edx, 0x9b5161b2
sub edx, 1
add edx, 0x9b5161b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf58adfc8
mov ecx, 0xb5604aec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x70]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf58adfc8
mov ecx, 0x2a638041
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xf3da73fe
jmp 0x1000273d
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0xd9ee2a21
sub edx, 1
add edx, 0xd9ee2a21
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1328e8bc
mov ecx, 0x1a903c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
sub edx, 0x151a8755
sub edx, 1
add edx, 0x151a8755
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1328e8bc
mov ecx, 0x6409b98f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0x93ee9fc1
jmp 0x1000273d
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa0], 0xf8da043c
jmp 0x1000273d
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x75ba0c34
sub edx, 1
add edx, 0x75ba0c34
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe414facf
mov ecx, 0xe2339ed1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0xe97506fd
sub edx, 1
sub edx, 0xe97506fd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe414facf
mov ecx, 0xd0931c54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xa9cd6ae4
jmp 0x1000273d
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0x5f35cd6e
sub edx, 1
sub edx, 0x5f35cd6e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70a0bdc4
mov ecx, 0xc6c0330f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
add edx, 0x2755db01
sub edx, 1
sub edx, 0x2755db01
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x70a0bdc4
mov ecx, 0x26687ec0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000273d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10006cd0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0xa4]
push eax
mov eax, esp
push eax
mov edx, esp
mov dword [ebp - 0xb4], edx
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0xb0], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0xb4]
mov edx, eax
mov eax, dword [ebp - 0xb0]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100078d0
add esp, 0xc
mov dword [ebp - 0xa0], 0xfd719502
jmp 0x1000273d
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov dword [ebp - 0xa0], 0x54c2c66f
jmp 0x1000273d
mov ax, word [ebp - 0x34]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa0], 0xeab5cf8b
jmp 0x1000273d
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa0], 0xebb88b75
jmp 0x1000273d
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa0], 0x616b0031
jmp 0x1000273d
mov eax, dword [ebp - 0x70]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0xa0], 0xb5604aec
jmp 0x1000273d
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa0], 0x1a903c3
jmp 0x1000273d
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0], 0xe2339ed1
jmp 0x1000273d
mov dword [ebp - 0xa0], 0xc6c0330f
jmp 0x10001117