Function at 0x10001370
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x1006de04]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
add edx, 0xcef4b0e4
sub edx, 1
sub edx, 0xcef4b0e4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa6], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0xac], 0xf909128b
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x805899c1
je 0x10004655
jmp 0x100013f3
mov eax, dword [ebp - 0xb4]
sub eax, 0x806e6030
je 0x10002f78
jmp 0x10001409
mov eax, dword [ebp - 0xb4]
sub eax, 0x81f0ed12
je 0x1000419f
jmp 0x1000141f
mov eax, dword [ebp - 0xb4]
sub eax, 0x82d0cb97
je 0x1000565c
jmp 0x10001435
mov eax, dword [ebp - 0xb4]
sub eax, 0x86296714
je 0x100028d2
jmp 0x1000144b
mov eax, dword [ebp - 0xb4]
sub eax, 0x87636bb0
je 0x100054a1
jmp 0x10001461
mov eax, dword [ebp - 0xb4]
sub eax, 0x8769dde0
je 0x1000389a
jmp 0x10001477
mov eax, dword [ebp - 0xb4]
sub eax, 0x88e0ccc7
je 0x10003029
jmp 0x1000148d
mov eax, dword [ebp - 0xb4]
sub eax, 0x8baa2835
je 0x10005474
jmp 0x100014a3
mov eax, dword [ebp - 0xb4]
sub eax, 0x8dc2006e
je 0x10003a06
jmp 0x100014b9
mov eax, dword [ebp - 0xb4]
sub eax, 0x908376ee
je 0x10005558
jmp 0x100014cf
mov eax, dword [ebp - 0xb4]
sub eax, 0x91b95a63
je 0x10004fd9
jmp 0x100014e5
mov eax, dword [ebp - 0xb4]
sub eax, 0x93f4070d
je 0x10004e1e
jmp 0x100014fb
mov eax, dword [ebp - 0xb4]
sub eax, 0x96e49763
je 0x1000503e
jmp 0x10001511
mov eax, dword [ebp - 0xb4]
sub eax, 0x972ed799
je 0x10005465
jmp 0x10001527
mov eax, dword [ebp - 0xb4]
sub eax, 0x98ce0841
je 0x1000514c
jmp 0x1000153d
mov eax, dword [ebp - 0xb4]
sub eax, 0x9ad29d39
je 0x1000248c
jmp 0x10001553
mov eax, dword [ebp - 0xb4]
sub eax, 0x9ccdf7ea
je 0x10005506
jmp 0x10001569
mov eax, dword [ebp - 0xb4]
sub eax, 0x9d4e3a4f
je 0x10005235
jmp 0x1000157f
mov eax, dword [ebp - 0xb4]
sub eax, 0x9ea9e326
je 0x10003394
jmp 0x10001595
mov eax, dword [ebp - 0xb4]
sub eax, 0x9f1913f8
je 0x10005699
jmp 0x100015ab
mov eax, dword [ebp - 0xb4]
sub eax, 0x9f47743e
je 0x10005403
jmp 0x100015c1
mov eax, dword [ebp - 0xb4]
sub eax, 0x9fcae4e4
je 0x10002cc8
jmp 0x100015d7
mov eax, dword [ebp - 0xb4]
sub eax, 0xa17c531e
je 0x10003943
jmp 0x100015ed
mov eax, dword [ebp - 0xb4]
sub eax, 0xa1b9fc19
je 0x1000454e
jmp 0x10001603
mov eax, dword [ebp - 0xb4]
sub eax, 0xa3225ba3
je 0x10004c7b
jmp 0x10001619
mov eax, dword [ebp - 0xb4]
sub eax, 0xa6bbe9d6
je 0x10003a49
jmp 0x1000162f
mov eax, dword [ebp - 0xb4]
sub eax, 0xa6dac5f2
je 0x10004b49
jmp 0x10001645
mov eax, dword [ebp - 0xb4]
sub eax, 0xa7f46cb6
je 0x10004bce
jmp 0x1000165b
mov eax, dword [ebp - 0xb4]
sub eax, 0xaa5900b2
je 0x1000285c
jmp 0x10001671
mov eax, dword [ebp - 0xb4]
sub eax, 0xab58612f
je 0x10002db7
jmp 0x10001687
mov eax, dword [ebp - 0xb4]
sub eax, 0xacb4cd06
je 0x10002a0f
jmp 0x1000169d
mov eax, dword [ebp - 0xb4]
sub eax, 0xae40f658
je 0x10004f14
jmp 0x100016b3
mov eax, dword [ebp - 0xb4]
sub eax, 0xb0c9e6dc
je 0x1000406b
jmp 0x100016c9
mov eax, dword [ebp - 0xb4]
sub eax, 0xb469b836
je 0x10003df7
jmp 0x100016df
mov eax, dword [ebp - 0xb4]
sub eax, 0xb78b9e3b
je 0x10003c29
jmp 0x100016f5
mov eax, dword [ebp - 0xb4]
sub eax, 0xb848d7aa
je 0x1000500b
jmp 0x1000170b
mov eax, dword [ebp - 0xb4]
sub eax, 0xb84fc77f
je 0x100053d0
jmp 0x10001721
mov eax, dword [ebp - 0xb4]
sub eax, 0xb9c592df
je 0x100055db
jmp 0x10001737
mov eax, dword [ebp - 0xb4]
sub eax, 0xbae9fabb
je 0x1000453f
jmp 0x1000174d
mov eax, dword [ebp - 0xb4]
sub eax, 0xbc91f7a9
je 0x10002770
jmp 0x10001763
mov eax, dword [ebp - 0xb4]
sub eax, 0xbcf362ed
je 0x100040bc
jmp 0x10001779
mov eax, dword [ebp - 0xb4]
sub eax, 0xbd700376
je 0x10003da6
jmp 0x1000178f
mov eax, dword [ebp - 0xb4]
sub eax, 0xbeb09a98
je 0x10002ad3
jmp 0x100017a5
mov eax, dword [ebp - 0xb4]
sub eax, 0xc0a49407
je 0x1000350c
jmp 0x100017bb
mov eax, dword [ebp - 0xb4]
sub eax, 0xc2a7c99c
je 0x10004ff9
jmp 0x100017d1
mov eax, dword [ebp - 0xb4]
sub eax, 0xc2bcaf42
je 0x10003653
jmp 0x100017e7
mov eax, dword [ebp - 0xb4]
sub eax, 0xc2cd373f
je 0x10002ae2
jmp 0x100017fd
mov eax, dword [ebp - 0xb4]
sub eax, 0xc4c39113
je 0x1000284d
jmp 0x10001813
mov eax, dword [ebp - 0xb4]
sub eax, 0xc5f0733e
je 0x1000531d
jmp 0x10001829
mov eax, dword [ebp - 0xb4]
sub eax, 0xc789aa1b
je 0x10003a2a
jmp 0x1000183f
mov eax, dword [ebp - 0xb4]
sub eax, 0xca88555c
je 0x1000504d
jmp 0x10001855
mov eax, dword [ebp - 0xb4]
sub eax, 0xcb1a9351
je 0x100029be
jmp 0x1000186b
mov eax, dword [ebp - 0xb4]
sub eax, 0xd0125ad0
je 0x1000247d
jmp 0x10001881
mov eax, dword [ebp - 0xb4]
sub eax, 0xd01f37a1
je 0x1000519d
jmp 0x10001897
mov eax, dword [ebp - 0xb4]
sub eax, 0xd1573d5d
je 0x10004ad1
jmp 0x100018ad
mov eax, dword [ebp - 0xb4]
sub eax, 0xd1a0a708
je 0x10002537
jmp 0x100018c3
mov eax, dword [ebp - 0xb4]
sub eax, 0xd1a16ad3
je 0x10003c9f
jmp 0x100018d9
mov eax, dword [ebp - 0xb4]
sub eax, 0xd3a6e4b1
je 0x10004c8a
jmp 0x100018ef
mov eax, dword [ebp - 0xb4]
sub eax, 0xd78a7a57
je 0x10002f0a
jmp 0x10001905
mov eax, dword [ebp - 0xb4]
sub eax, 0xd7d25ec5
je 0x10004287
jmp 0x1000191b
mov eax, dword [ebp - 0xb4]
sub eax, 0xd88df6e6
je 0x10005128
jmp 0x10001931
mov eax, dword [ebp - 0xb4]
sub eax, 0xd9369e51
je 0x10005456
jmp 0x10001947
mov eax, dword [ebp - 0xb4]
sub eax, 0xdd67c2bc
je 0x100044d1
jmp 0x1000195d
mov eax, dword [ebp - 0xb4]
sub eax, 0xe0f56989
je 0x1000530e
mov dword [ebp - 0xac], 0x9ad29d39
jmp 0x100057c3
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xac], 0xf0d81419
jmp 0x100057c3
push eax
sub esp, 0x100
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb1f4989
mov ecx, 0x69131f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dl, byte [ebp - 0x65]
mov eax, 0x3dd30721
mov ecx, 0xaa5900b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0x4654efe9
jmp 0x100057c3
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x9c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xac], 0x86296714
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
sub edx, 0xce5e7b44
sub edx, 1
add edx, 0xce5e7b44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb84fc77f
mov ecx, 0x488ca901
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
sub edx, 0x4fb130c2
sub edx, 1
add edx, 0x4fb130c2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4364e55f
mov ecx, 0xacb4cd06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
sub edx, 0xaf8ff073
sub edx, 1
add edx, 0xaf8ff073
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4364e55f
mov ecx, 0xbeb09a98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0xc2cd373f
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
sub edx, 0xfed7603c
sub edx, 1
add edx, 0xfed7603c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x280d8790
mov ecx, 0x5a147268
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9f47743e
mov ecx, 0x4a5fa4ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0xf3e11cd9
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xed7f21ec
mov ecx, 0x806e6030
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0x755146dc
jmp 0x100057c3
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
add edx, 0xf345daad
sub edx, 1
sub edx, 0xf345daad
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30836644
mov ecx, 0x6805c133
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dl, byte [ebp - 0x4d]
mov eax, 0xf5ddccab
mov ecx, 0xfec06e40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
add edx, 0x94cce4df
sub edx, 1
sub edx, 0x94cce4df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb848d7aa
mov ecx, 0x6cc3401f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
add edx, 0x4f2822ee
sub edx, 1
sub edx, 0x4f2822ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8baa2835
mov ecx, 0x71f4d984
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
sub edx, 0x47965016
sub edx, 1
add edx, 0x47965016
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96e49763
mov ecx, 0x12607af2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
add edx, 0x2ff3e364
sub edx, 1
sub edx, 0x2ff3e364
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87636bb0
mov ecx, 0x410a190
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
sub eax, 0xab25ba24
add eax, ecx
add eax, 0xab25ba24
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xac], 0xc789aa1b
jmp 0x100057c3
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov word [eax], 0
mov dword [ebp - 0xac], 0xa6bbe9d6
jmp 0x100057c3
mov eax, dword [ebp - 0x78]
mov ax, word [eax]
mov word [ebp - 0x3a], ax
mov dword [ebp - 0xac], 0x119cb106
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
add edx, 0x75680560
sub edx, 1
sub edx, 0x75680560
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xca88555c
mov ecx, 0xd1a16ad3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0x179d4203
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
sub edx, 0x5058c97c
sub edx, 1
add edx, 0x5058c97c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5fd0a55
mov ecx, 0xb469b836
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
add edx, 0xf8c75b98
sub edx, 1
sub edx, 0xf8c75b98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5fd0a55
mov ecx, 0xcde06d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
add edx, 0xd2fb0234
sub edx, 1
sub edx, 0xd2fb0234
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29ab7d48
mov ecx, 0xbcf362ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0x1df6fc09
jmp 0x100057c3
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
sub edx, 0x53cf4d3a
sub edx, 1
add edx, 0x53cf4d3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x908376ee
mov ecx, 0xd7d25ec5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0xe31c6a8b
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x98ce0841
mov ecx, 0xbae9fabb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0xa1b9fc19
jmp 0x100057c3
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011bd0
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov esi, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xc6528486
add esi, eax
sub esi, 0xc6528486
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov dword [ebp - 0xac], 0x4d92d551
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
sub edx, 0xb11bdaa1
sub edx, 1
add edx, 0xb11bdaa1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdca7630
mov ecx, 0x5d947b3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x78]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x11df33c0
mov ecx, 0xa6dac5f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
mov edx, ecx
sub edx, 0x489a5d6b
sub edx, 1
add edx, 0x489a5d6b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x31e65a81
mov ecx, 0x7d5628e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
add edx, 0xab3304ce
sub edx, 1
sub edx, 0xab3304ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bf75e05
mov ecx, 0x54c8b4a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0xd3a6e4b1
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1371600
mov ecx, 0x23c09fdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x4654efe9
jmp 0x100057c3
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10010e40
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xac], 0xeb2645c3
jmp 0x100057c3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xac], 0xe4ca16f2
jmp 0x100057c3
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xac], 0xc0a49407
jmp 0x100057c3
mov dword [ebp - 0xac], 0x8769dde0
jmp 0x100057c3
mov ax, word [ebp - 0x3a]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0xf5365255
jmp 0x100057c3
mov dword [ebp - 0xac], 0xee972f6d
jmp 0x100057c3
mov eax, dword [0x1006f0a8]
mov ecx, dword [0x1006f0a4]
mov edx, eax
sub edx, 0xefddaea1
sub edx, 1
add edx, 0xefddaea1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2efb3444
mov ecx, 0xd01f37a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov ecx, dword [0x1006f0a8]
mov eax, dword [0x1006f0a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2efb3444
mov ecx, 0x9d4e3a4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100057c3
mov dword [ebp - 0xac], 0xe68343b5
jmp 0x100057c3
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov dword [ebp - 0xac], 0xfe360ccd
jmp 0x100057c3
mov dword [ebp - 0xac], 0x488ca901
jmp 0x100057c3
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xac], 0x4a5fa4ae
jmp 0x100057c3
mov dword [ebp - 0xac], 0x3cd03f23
jmp 0x100057c3
mov dword [ebp - 0xac], 0xa04fdbc
jmp 0x100057c3
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0xc2bcaf42
jmp 0x100057c3
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xac], 0xa17c531e
jmp 0x100057c3
mov dword [ebp - 0xac], 0x4f18e0d4
jmp 0x100057c3
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xac], 0x81f0ed12
jmp 0x100057c3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xac], 0x724649e2
jmp 0x100057c3
mov dword [ebp - 0xac], 0x7976a586
jmp 0x100057c3
mov dword [ebp - 0xac], 0x1a9cea0c
jmp 0x100057c3
jmp 0x100013d7