Function at 0x10001300
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x190
mov eax, dword [ebp + 8]
mov dword [ebp - 0x194], eax
mov eax, dword [0x10088200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x190], 0x67b97c22
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x198], eax
sub eax, 0x8120bb08
je 0x10001db9
jmp 0x10001344
mov eax, dword [ebp - 0x198]
sub eax, 0x822c194d
je 0x100026fa
jmp 0x1000135a
mov eax, dword [ebp - 0x198]
sub eax, 0x8885c70f
je 0x10001acc
jmp 0x10001370
mov eax, dword [ebp - 0x198]
sub eax, 0x92c0d388
je 0x10002e45
jmp 0x10001386
mov eax, dword [ebp - 0x198]
sub eax, 0x963d4355
je 0x10001c60
jmp 0x1000139c
mov eax, dword [ebp - 0x198]
sub eax, 0x9865550a
je 0x10002080
jmp 0x100013b2
mov eax, dword [ebp - 0x198]
sub eax, 0xa345095e
je 0x10002967
jmp 0x100013c8
mov eax, dword [ebp - 0x198]
sub eax, 0xaa238779
je 0x10002b26
jmp 0x100013de
mov eax, dword [ebp - 0x198]
sub eax, 0xacee3a22
je 0x10001f57
jmp 0x100013f4
mov eax, dword [ebp - 0x198]
sub eax, 0xb8e6d203
je 0x100020d1
jmp 0x1000140a
mov eax, dword [ebp - 0x198]
sub eax, 0xba268b27
je 0x10001ec0
jmp 0x10001420
mov eax, dword [ebp - 0x198]
sub eax, 0xbc42a64a
je 0x10002d51
jmp 0x10001436
mov eax, dword [ebp - 0x198]
sub eax, 0xbcd04eea
je 0x10002393
jmp 0x1000144c
mov eax, dword [ebp - 0x198]
sub eax, 0xbe2356f9
je 0x10001abd
jmp 0x10001462
mov eax, dword [ebp - 0x198]
sub eax, 0xbf4e9dc4
je 0x10002bbc
jmp 0x10001478
mov eax, dword [ebp - 0x198]
sub eax, 0xc15e264a
je 0x10002473
jmp 0x1000148e
mov eax, dword [ebp - 0x198]
sub eax, 0xc48080ae
je 0x10001e52
jmp 0x100014a4
mov eax, dword [ebp - 0x198]
sub eax, 0xc8d9354f
je 0x10001d02
jmp 0x100014ba
mov eax, dword [ebp - 0x198]
sub eax, 0xce9efa09
je 0x10002874
jmp 0x100014d0
mov eax, dword [ebp - 0x198]
sub eax, 0xd023924a
je 0x10002365
jmp 0x100014e6
mov eax, dword [ebp - 0x198]
sub eax, 0xd0898253
je 0x10001b98
jmp 0x100014fc
mov eax, dword [ebp - 0x198]
sub eax, 0xd4fd95fc
je 0x10002041
jmp 0x10001512
mov eax, dword [ebp - 0x198]
sub eax, 0xd507e58d
je 0x1000290e
jmp 0x10001528
mov eax, dword [ebp - 0x198]
sub eax, 0xda77977a
je 0x100019f6
jmp 0x1000153e
mov eax, dword [ebp - 0x198]
sub eax, 0xdd5c479d
je 0x100022a6
jmp 0x10001554
mov eax, dword [ebp - 0x198]
sub eax, 0xdd87010d
je 0x10002050
jmp 0x1000156a
mov eax, dword [ebp - 0x198]
sub eax, 0xdf10845a
je 0x10002c8f
jmp 0x10001580
mov eax, dword [ebp - 0x198]
sub eax, 0xe03f180c
je 0x10001fc5
jmp 0x10001596
mov eax, dword [ebp - 0x198]
sub eax, 0xe9f02619
je 0x10002cba
jmp 0x100015ac
mov eax, dword [ebp - 0x198]
sub eax, 0xea7f62e1
je 0x10002aa1
jmp 0x100015c2
mov eax, dword [ebp - 0x198]
sub eax, 0xeb99651b
je 0x10002235
jmp 0x100015d8
mov eax, dword [ebp - 0x198]
sub eax, 0xf1076347
je 0x10002482
jmp 0x100015ee
mov eax, dword [ebp - 0x198]
sub eax, 0xf73be078
je 0x10002374
jmp 0x10001604
mov eax, dword [ebp - 0x198]
sub eax, 0xf7a0f739
je 0x100026d9
jmp 0x1000161a
mov eax, dword [ebp - 0x198]
sub eax, 0xf8c13792
je 0x10002b9c
jmp 0x10001630
mov eax, dword [ebp - 0x198]
sub eax, 0xfb80f7bd
je 0x10002e54
jmp 0x10001646
mov eax, dword [ebp - 0x198]
sub eax, 0xff32ad5a
je 0x10002be0
jmp 0x1000165c
mov eax, dword [ebp - 0x198]
sub eax, 0x17cb117
je 0x10002c04
jmp 0x10001672
mov eax, dword [ebp - 0x198]
sub eax, 0x27f7fa3
je 0x10001b41
jmp 0x10001688
mov eax, dword [ebp - 0x198]
sub eax, 0x355f52f
je 0x100029da
jmp 0x1000169e
mov eax, dword [ebp - 0x198]
sub eax, 0x7b7abf9
je 0x10001d68
jmp 0x100016b4
mov eax, dword [ebp - 0x198]
sub eax, 0xd4b18a4
je 0x10002401
jmp 0x100016ca
mov eax, dword [ebp - 0x198]
sub eax, 0xfff7536
je 0x100025ef
jmp 0x100016e0
mov eax, dword [ebp - 0x198]
sub eax, 0x12037a37
je 0x10002883
jmp 0x100016f6
mov eax, dword [ebp - 0x198]
sub eax, 0x1268f987
je 0x10002ab0
jmp 0x1000170c
mov eax, dword [ebp - 0x198]
sub eax, 0x161ad224
je 0x10001e43
jmp 0x10001722
mov eax, dword [ebp - 0x198]
sub eax, 0x1ac5ffb3
je 0x10002976
jmp 0x10001738
mov eax, dword [ebp - 0x198]
sub eax, 0x1b10e2cf
je 0x10002d66
jmp 0x1000174e
mov eax, dword [ebp - 0x198]
sub eax, 0x1c6cbed2
je 0x10002bcb
jmp 0x10001764
mov eax, dword [ebp - 0x198]
sub eax, 0x22cee318
je 0x10002071
jmp 0x1000177a
mov eax, dword [ebp - 0x198]
sub eax, 0x25252d66
je 0x1000253a
jmp 0x10001790
mov eax, dword [ebp - 0x198]
sub eax, 0x26019d8f
je 0x10002c9e
jmp 0x100017a6
mov eax, dword [ebp - 0x198]
sub eax, 0x268a1e97
je 0x10001d11
jmp 0x100017bc
mov eax, dword [ebp - 0x198]
sub eax, 0x28955a31
je 0x10001f36
jmp 0x100017d2
mov eax, dword [ebp - 0x198]
sub eax, 0x296e36dd
je 0x100025fe
jmp 0x100017e8
mov eax, dword [ebp - 0x198]
sub eax, 0x3db9b771
je 0x10002297
jmp 0x100017fe
mov eax, dword [ebp - 0x198]
sub eax, 0x4326cc00
je 0x100021b8
jmp 0x10001814
mov eax, dword [ebp - 0x198]
sub eax, 0x432c706b
je 0x10002bef
jmp 0x1000182a
mov eax, dword [ebp - 0x198]
sub eax, 0x4d287001
je 0x1000291d
jmp 0x10001840
mov eax, dword [ebp - 0x198]
sub eax, 0x4d7bfec1
je 0x100021c7
jmp 0x10001856
mov eax, dword [ebp - 0x198]
sub eax, 0x52365e82
je 0x10002a2b
jmp 0x1000186c
mov eax, dword [ebp - 0x198]
sub eax, 0x56afa819
je 0x10002314
jmp 0x10001882
mov eax, dword [ebp - 0x198]
sub eax, 0x58816a5d
je 0x10001b50
jmp 0x10001898
mov eax, dword [ebp - 0x198]
sub eax, 0x5cad602c
je 0x1000274b
jmp 0x100018ae
mov eax, dword [ebp - 0x198]
sub eax, 0x5e75a386
je 0x100024ac
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
sub edx, 0x334a6fe7
sub edx, 1
add edx, 0x334a6fe7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x70978c46
mov ecx, 0xbe2356f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x8885c70f
jmp 0x10002e5e
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c3e0
add esp, 0xc
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x188], eax
mov eax, 0x27f7fa3
mov ecx, 0x58816a5d
cmp dword [ebp - 0x188], 0
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x1268f987
jmp 0x10002e5e
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x184]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x190], 0xd0898253
jmp 0x10002e5e
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x188]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x152], al
mov dword [ebp - 0x190], 0x6073f0e8
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0x47a4e07f
sub edx, 1
sub edx, 0x47a4e07f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbf4e9dc4
mov ecx, 0x7f11a64c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x1268f987
jmp 0x10002e5e
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov dword [ebp - 0x190], 0x7b7abf9
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0xdb19f0f2
sub edx, 1
sub edx, 0xdb19f0f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c6cbed2
mov ecx, 0x8120bb08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [ebp - 0x178]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x151], al
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
add edx, 0x389b82a
sub edx, 1
sub edx, 0x389b82a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c6cbed2
mov ecx, 0x161ad224
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xc48080ae
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xff32ad5a
mov ecx, 0xba268b27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
add edx, 0xcd382001
sub edx, 1
sub edx, 0xcd382001
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff32ad5a
mov ecx, 0x28955a31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dl, byte [ebp - 0x151]
mov eax, 0xacee3a22
mov ecx, 0x9865550a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x432c706b
mov ecx, 0xe03f180c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x432c706b
mov ecx, 0xd4fd95fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xdd87010d
jmp 0x10002e5e
mov eax, dword [ebp - 0x150]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x190], 0x22cee318
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x1268f987
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0xf2801f4d
sub edx, 1
sub edx, 0xf2801f4d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17cb117
mov ecx, 0xb8e6d203
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
add eax, 0xe00fe693
add eax, ecx
sub eax, 0xe00fe693
mov dword [ebp - 0x14c], eax
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
sub edx, 0x4de58695
sub edx, 1
add edx, 0x4de58695
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x17cb117
mov ecx, 0x4326cc00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x4d7bfec1
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x740014fe
mov ecx, 0xeb99651b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov word [eax], 0
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x740014fe
mov ecx, 0x3db9b771
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xdd5c479d
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdf10845a
mov ecx, 0x56afa819
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0x91299d57
sub edx, 1
sub edx, 0x91299d57
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf10845a
mov ecx, 0xd023924a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xf73be078
jmp 0x10002e5e
mov eax, dword [ebp - 0x168]
mov ax, word [eax]
mov word [ebp - 0x146], ax
mov dword [ebp - 0x190], 0xbcd04eea
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x26019d8f
mov ecx, 0xd4b18a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ax, word [ebp - 0x146]
movzx eax, ax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x140], eax
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0x9d8eaac4
sub edx, 1
sub edx, 0x9d8eaac4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26019d8f
mov ecx, 0xc15e264a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xf1076347
jmp 0x10002e5e
mov eax, dword [ebp - 0x140]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x144]
mov eax, 0x1ac5ffb3
mov ecx, 0x5e75a386
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ax, word [ebp - 0x136]
movzx edx, ax
mov ecx, dword [ebp - 0x13c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x168]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x82ed9c66
add ecx, eax
add ecx, 0x82ed9c66
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e750
add esp, 8
mov dword [ebp - 0x134], eax
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0xf824b7c2
sub edx, 1
sub edx, 0xf824b7c2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9f02619
mov ecx, 0xfff7536
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x296e36dd
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
sub edx, 0x99812ab7
sub edx, 1
add edx, 0x99812ab7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc42a64a
mov ecx, 0x71ae7b7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dl, byte [ebp - 0x12d]
mov eax, 0x822c194d
mov ecx, 0xd507e58d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
sub edx, 0xf6f1ee00
sub edx, 1
add edx, 0xf6f1ee00
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b10e2cf
mov ecx, 0x5cad602c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x7cb5e4d2
add edx, eax
sub edx, 0x7cb5e4d2
mov eax, dword [ebp - 0x160]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], cl
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x9f971ddd
add edx, eax
add edx, 0x9f971ddd
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x43267b12
add ecx, eax
add ecx, 0x43267b12
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c540
add esp, 0xc
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
sub edx, 0x13a3dee9
sub edx, 1
add edx, 0x13a3dee9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b10e2cf
mov ecx, 0xce9efa09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x12037a37
jmp 0x10002e5e
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x190], 0x7edf3527
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x4d287001
jmp 0x10002e5e
mov eax, dword [ebp - 0x168]
mov ax, word [eax]
sub ax, 0xfa72
add ax, 1
add ax, 0xfa72
mov word [ebp - 0x122], ax
mov dword [ebp - 0x190], 0x730316d0
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xf73be078
jmp 0x10002e5e
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x190], 0x70791a79
jmp 0x10002e5e
mov eax, dword [0x10089540]
mov ecx, dword [0x1008953c]
mov edx, eax
add edx, 0x7000daea
sub edx, 1
sub edx, 0x7000daea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92c0d388
mov ecx, 0x52365e82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
sub edx, 0x8bc13cda
sub edx, 1
add edx, 0x8bc13cda
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92c0d388
mov ecx, 0xea7f62e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x1268f987
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
sub edx, 0x6e88b5f2
sub edx, 1
add edx, 0x6e88b5f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb80f7bd
mov ecx, 0xaa238779
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ecx, dword [0x10089540]
mov eax, dword [0x1008953c]
mov edx, ecx
sub edx, 0xee109fbb
sub edx, 1
add edx, 0xee109fbb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb80f7bd
mov ecx, 0xf8c13792
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10002e5e
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000b7e0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x190], 0x7f11a64c
jmp 0x10002e5e
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x190], 0x8120bb08
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xba268b27
jmp 0x10002e5e
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x190], 0xe03f180c
jmp 0x10002e5e
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x190], 0xb8e6d203
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x56afa819
jmp 0x10002e5e
mov ax, word [ebp - 0x146]
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x190], 0xd4b18a4
jmp 0x10002e5e
mov ax, word [ebp - 0x136]
movzx eax, ax
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
add ecx, 0x564a88c2
add ecx, eax
sub ecx, 0x564a88c2
mov eax, dword [ebp - 0x168]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x3f4bcfe8
add ecx, eax
sub ecx, 0x3f4bcfe8
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e750
add esp, 8
mov dword [ebp - 0x190], 0x25252d66
jmp 0x10002e5e
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x190], 0x71ae7b7c
jmp 0x10002e5e
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x170bd1b3
add edx, eax
add edx, 0x170bd1b3
mov eax, dword [ebp - 0x160]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xd1d99782
add ecx, eax
add ecx, 0xd1d99782
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c540
add esp, 0xc
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x190], 0x5cad602c
jmp 0x10002e5e
mov dword [ebp - 0x190], 0x52365e82
jmp 0x10002e5e
mov dword [ebp - 0x190], 0xaa238779
jmp 0x10001328