Function at 0x10008f30
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x10089880]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1a0], 0x86b3efb8
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
sub eax, 0x865da5e2
je 0x10009c8f
jmp 0x10008f74
mov eax, dword [ebp - 0x1a8]
sub eax, 0x86b3efb8
je 0x10009407
jmp 0x10008f8a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8dc92d16
je 0x100095b6
jmp 0x10008fa0
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8dd8091b
je 0x10009fee
jmp 0x10008fb6
mov eax, dword [ebp - 0x1a8]
sub eax, 0x92004df0
je 0x10009525
jmp 0x10008fcc
mov eax, dword [ebp - 0x1a8]
sub eax, 0x92606ae0
je 0x10009e95
jmp 0x10008fe2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x92f40fb7
je 0x100097e3
jmp 0x10008ff8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x932f4d40
je 0x10009f24
jmp 0x1000900e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x99acde85
je 0x1000a160
jmp 0x10009024
mov eax, dword [ebp - 0x1a8]
sub eax, 0x99b66e4d
je 0x100097c2
jmp 0x1000903a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa6859409
je 0x10009aa6
jmp 0x10009050
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa8e91fc4
je 0x1000a1c4
jmp 0x10009066
mov eax, dword [ebp - 0x1a8]
sub eax, 0xae4640ac
je 0x1000956e
jmp 0x1000907c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xafef2ad5
je 0x10009795
jmp 0x10009092
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc195a175
je 0x10009f45
jmp 0x100090a8
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc30ecb69
je 0x10009dfb
jmp 0x100090be
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc4e4cd3b
je 0x10009ddb
jmp 0x100090d4
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc7e96ab9
je 0x10009735
jmp 0x100090ea
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd045427b
je 0x1000981f
jmp 0x10009100
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd2547c8b
je 0x100099ba
jmp 0x10009116
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdaa84784
je 0x100095d1
jmp 0x1000912c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdac74f13
je 0x10009e0a
jmp 0x10009142
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdd888af0
je 0x10009a30
jmp 0x10009158
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf7ca7b70
je 0x10009744
jmp 0x1000916e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2ac7a7a
je 0x10009bf7
jmp 0x10009184
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3b26e3c
je 0x1000a1f6
jmp 0x1000919a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe964ad7
je 0x10009e27
jmp 0x100091b0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xfb0ff52
je 0x1000955f
jmp 0x100091c6
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1739c59b
je 0x1000a1b5
jmp 0x100091dc
mov eax, dword [ebp - 0x1a8]
sub eax, 0x19283e6a
je 0x1000989c
jmp 0x100091f2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1eadc5a9
je 0x10009f78
jmp 0x10009208
mov eax, dword [ebp - 0x1a8]
sub eax, 0x20f39766
je 0x1000a064
jmp 0x1000921e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2934ab38
je 0x10009475
jmp 0x10009234
mov eax, dword [ebp - 0x1a8]
sub eax, 0x293e6c5c
je 0x10009ef8
jmp 0x1000924a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x295eabc2
je 0x1000a084
jmp 0x10009260
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2fb9f21b
je 0x10009982
jmp 0x10009276
mov eax, dword [ebp - 0x1a8]
sub eax, 0x366f79e8
je 0x1000a1d9
jmp 0x1000928c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x37154b1d
je 0x1000a0e3
jmp 0x100092a2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x382a8adf
je 0x10009bc0
jmp 0x100092b8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3bcffafc
je 0x10009973
jmp 0x100092ce
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4df29d87
je 0x10009b9f
jmp 0x100092e4
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4f158130
je 0x10009b90
jmp 0x100092fa
mov eax, dword [ebp - 0x1a8]
sub eax, 0x50324623
je 0x10009714
jmp 0x10009310
mov eax, dword [ebp - 0x1a8]
sub eax, 0x53a3efe4
je 0x10009f07
jmp 0x10009326
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5cd02fb1
je 0x100097fe
jmp 0x1000933c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5e04e505
je 0x10009622
jmp 0x10009352
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5f943765
je 0x10009534
jmp 0x10009368
mov eax, dword [ebp - 0x1a8]
sub eax, 0x69cf9ebe
je 0x10009d8e
jmp 0x1000937e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6c2a03ff
je 0x1000a073
jmp 0x10009394
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6c8588b2
je 0x10009ab5
jmp 0x100093aa
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6e94f9c1
je 0x10009ad1
jmp 0x100093c0
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7980cff1
je 0x10009c35
jmp 0x100093d6
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7c4e6ef5
je 0x1000982e
jmp 0x100093ec
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7d3d957f
je 0x10009b22
jmp 0x10009402
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x295eabc2
mov ecx, 0x2934ab38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x174], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10024570
add esp, 0xc
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x16c], eax
mov eax, dword [0x1008ad7c]
mov ecx, dword [0x1008ad78]
mov edx, eax
sub edx, 0xd0ae803d
sub edx, 1
add edx, 0xd0ae803d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x295eabc2
mov ecx, 0x92004df0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x5f943765
jmp 0x1000a200
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x17c], eax
mov eax, 0xfb0ff52
mov ecx, 0xae4640ac
cmp dword [ebp - 0x17c], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x6c2a03ff
jmp 0x1000a200
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x1a0], 0x8dc92d16
jmp 0x1000a200
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x1a0], 0xdaa84784
jmp 0x1000a200
mov eax, dword [0x1008ad7c]
mov ecx, dword [0x1008ad78]
mov edx, eax
sub edx, 0x425c355
sub edx, 1
add edx, 0x425c355
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37154b1d
mov ecx, 0x5e04e505
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x17c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x184], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x184], eax
sete al
and al, 1
mov byte [ebp - 0x161], al
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x37154b1d
mov ecx, 0x50324623
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dl, byte [ebp - 0x161]
mov eax, 0xf7ca7b70
mov ecx, 0xc7e96ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x6c2a03ff
jmp 0x1000a200
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x1a0], 0xafef2ad5
jmp 0x1000a200
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
setne al
and al, 1
mov byte [ebp - 0x159], al
mov dword [ebp - 0x1a0], 0x99b66e4d
jmp 0x1000a200
mov dl, byte [ebp - 0x159]
mov eax, 0x92f40fb7
mov ecx, 0x7c4e6ef5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1a0], 0x5cd02fb1
jmp 0x1000a200
mov eax, dword [ebp - 0x158]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xd045427b
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x6c2a03ff
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x99acde85
mov ecx, 0x19283e6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov eax, dword [ebp - 0x188]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
mov edx, ecx
sub edx, 0x5d7a677d
sub edx, 1
add edx, 0x5d7a677d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x99acde85
mov ecx, 0x3bcffafc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x2fb9f21b
jmp 0x1000a200
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x150]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov dword [ebp - 0x1a0], 0xd2547c8b
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
mov edx, ecx
sub edx, 0x8d8cb7ab
sub edx, 1
add edx, 0x8d8cb7ab
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1739c59b
mov ecx, 0xdd888af0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
mov edx, ecx
sub edx, 0x92ac4af9
sub edx, 1
add edx, 0x92ac4af9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1739c59b
mov ecx, 0xa6859409
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x6c8588b2
jmp 0x1000a200
movzx eax, word [ebp - 0x196]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x1a0], 0x6e94f9c1
jmp 0x1000a200
mov eax, dword [0x1008ad7c]
mov ecx, dword [0x1008ad78]
mov edx, eax
sub edx, 0x71bdba0f
sub edx, 1
add edx, 0x71bdba0f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8e91fc4
mov ecx, 0x7d3d957f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov eax, dword [ebp - 0x194]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x14c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x145], al
mov eax, dword [0x1008ad7c]
mov ecx, dword [0x1008ad78]
mov edx, eax
sub edx, 0xf767210e
sub edx, 1
add edx, 0xf767210e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8e91fc4
mov ecx, 0x4f158130
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x4df29d87
jmp 0x1000a200
mov dl, byte [ebp - 0x145]
mov eax, 0x932f4d40
mov ecx, 0x382a8adf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov eax, dword [ebp - 0x194]
add eax, 0xad89783e
add eax, 0x18
sub eax, 0xad89783e
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x194]
add eax, 4
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1a0], 0x2ac7a7a
jmp 0x1000a200
mov eax, dword [ebp - 0x140]
movzx ecx, word [eax + 0x10]
mov eax, dword [ebp - 0x144]
sub eax, 0x7c7c89f3
add eax, ecx
add eax, 0x7c7c89f3
mov dword [ebp - 0x13c], eax
movzx eax, word [ebp - 0x196]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1a0], 0x7980cff1
jmp 0x1000a200
mov eax, dword [ebp - 0x138]
imul ecx, eax, 0x28
mov eax, dword [ebp - 0x13c]
sub eax, 0x96878512
add eax, ecx
add eax, 0x96878512
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10031938
call fcn.10027ee0
add esp, 8
mov edx, eax
mov eax, 0x865da5e2
mov ecx, 0xc30ecb69
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0xc]
sub edx, 0x718ff708
add edx, eax
add edx, 0x718ff708
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x170]
mov byte [eax], cl
mov edx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0xc]
sub ecx, 0x6ed686d5
add ecx, eax
add ecx, 0x6ed686d5
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.100246d0
add esp, 0xc
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0xc]
add eax, 0x223b4239
add eax, ecx
sub eax, 0x223b4239
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1a0], 0x69cf9ebe
jmp 0x1000a200
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp - 0x130]
mov esi, dword [ebp - 0x12c]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x125], al
mov dword [ebp - 0x1a0], 0xc4e4cd3b
jmp 0x1000a200
mov cl, byte [ebp - 0x125]
and cl, 1
mov eax, dword [ebp - 0x170]
mov byte [eax], cl
mov dword [ebp - 0x1a0], 0xc30ecb69
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0xdac74f13
jmp 0x1000a200
mov ax, word [ebp - 0x196]
mov word [ebp - 0x124], ax
mov dword [ebp - 0x1a0], 0xe964ad7
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x366f79e8
mov ecx, 0x92606ae0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov ax, word [ebp - 0x124]
sub ax, 0x2e6a
add ax, 1
add ax, 0x2e6a
mov word [ebp - 0x122], ax
mov eax, dword [0x1008ad7c]
mov ecx, dword [0x1008ad78]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x366f79e8
mov ecx, 0x293e6c5c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x53a3efe4
jmp 0x1000a200
mov ax, word [ebp - 0x122]
mov word [ebp - 0x196], ax
mov dword [ebp - 0x1a0], 0x6c8588b2
jmp 0x1000a200
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xc195a175
jmp 0x1000a200
mov eax, dword [ebp - 0x188]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x178]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x1eadc5a9
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
mov edx, ecx
sub edx, 0x64474af
sub edx, 1
add edx, 0x64474af
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b26e3c
mov ecx, 0x8dd8091b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov ecx, dword [0x1008ad7c]
mov eax, dword [0x1008ad78]
mov edx, ecx
sub edx, 0xf2247a0a
sub edx, 1
add edx, 0xf2247a0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b26e3c
mov ecx, 0x20f39766
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x6c2a03ff
jmp 0x1000a200
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100237d0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x174], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10024570
add esp, 0xc
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1a0], 0x2934ab38
jmp 0x1000a200
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x17c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a0], 0x5e04e505
jmp 0x1000a200
mov eax, dword [ebp - 0x188]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1a0], 0x19283e6a
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0xdd888af0
jmp 0x1000a200
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1a0], 0x7d3d957f
jmp 0x1000a200
mov ax, word [ebp - 0x124]
mov ax, word [ebp - 0x124]
mov dword [ebp - 0x1a0], 0x92606ae0
jmp 0x1000a200
mov dword [ebp - 0x1a0], 0x8dd8091b
jmp 0x10008f58