Function at 0x100010a0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x10073200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0x238ea31c
sub edx, 1
sub edx, 0x238ea31c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0xa4], 0xd7fa0c16
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
sub eax, 0x80541060
je 0x10001fcb
jmp 0x10001123
mov eax, dword [ebp - 0xac]
sub eax, 0x84be8416
je 0x10002590
jmp 0x10001139
mov eax, dword [ebp - 0xac]
sub eax, 0x8bf98d5d
je 0x100021a6
jmp 0x1000114f
mov eax, dword [ebp - 0xac]
sub eax, 0x8ca01553
je 0x10001f6b
jmp 0x10001165
mov eax, dword [ebp - 0xac]
sub eax, 0x8d7970a5
je 0x100028ef
jmp 0x1000117b
mov eax, dword [ebp - 0xac]
sub eax, 0x927c4dcb
je 0x10002852
jmp 0x10001191
mov eax, dword [ebp - 0xac]
sub eax, 0x9336f0a8
je 0x1000201f
jmp 0x100011a7
mov eax, dword [ebp - 0xac]
sub eax, 0x94daba47
je 0x1000206e
jmp 0x100011bd
mov eax, dword [ebp - 0xac]
sub eax, 0x9e262f4f
je 0x100027bd
jmp 0x100011d3
mov eax, dword [ebp - 0xac]
sub eax, 0xac094a69
je 0x10002087
jmp 0x100011e9
mov eax, dword [ebp - 0xac]
sub eax, 0xb610c8d5
je 0x10001fbc
jmp 0x100011ff
mov eax, dword [ebp - 0xac]
sub eax, 0xb655a803
je 0x100027cc
jmp 0x10001215
mov eax, dword [ebp - 0xac]
sub eax, 0xb65ab8c9
je 0x10001bf4
jmp 0x1000122b
mov eax, dword [ebp - 0xac]
sub eax, 0xb7a18902
je 0x100019cb
jmp 0x10001241
mov eax, dword [ebp - 0xac]
sub eax, 0xb7f428a2
je 0x10001be5
jmp 0x10001257
mov eax, dword [ebp - 0xac]
sub eax, 0xb979397b
je 0x10001f04
jmp 0x1000126d
mov eax, dword [ebp - 0xac]
sub eax, 0xbaa1c706
je 0x10001ad5
jmp 0x10001283
mov eax, dword [ebp - 0xac]
sub eax, 0xbc025e98
je 0x10002123
jmp 0x10001299
mov eax, dword [ebp - 0xac]
sub eax, 0xc51b1de7
je 0x100018e7
jmp 0x100012af
mov eax, dword [ebp - 0xac]
sub eax, 0xc535942c
je 0x10001ecc
jmp 0x100012c5
mov eax, dword [ebp - 0xac]
sub eax, 0xc7fb3531
je 0x10001c6a
jmp 0x100012db
mov eax, dword [ebp - 0xac]
sub eax, 0xc8d328b0
je 0x1000277f
jmp 0x100012f1
mov eax, dword [ebp - 0xac]
sub eax, 0xcb087957
je 0x1000278e
jmp 0x10001307
mov eax, dword [ebp - 0xac]
sub eax, 0xd2c78202
je 0x10002041
jmp 0x1000131d
mov eax, dword [ebp - 0xac]
sub eax, 0xd742a2a9
je 0x10002483
jmp 0x10001333
mov eax, dword [ebp - 0xac]
sub eax, 0xd7fa0c16
je 0x10001716
jmp 0x10001349
mov eax, dword [ebp - 0xac]
sub eax, 0xd9e7fbdf
je 0x10001e52
jmp 0x1000135f
mov eax, dword [ebp - 0xac]
sub eax, 0xdb2e0df7
je 0x10001838
jmp 0x10001375
mov eax, dword [ebp - 0xac]
sub eax, 0xdb6f84c0
je 0x10001b5a
jmp 0x1000138b
mov eax, dword [ebp - 0xac]
sub eax, 0xdcb352b9
je 0x10001e61
jmp 0x100013a1
mov eax, dword [ebp - 0xac]
sub eax, 0xe192059d
je 0x10002868
jmp 0x100013b7
mov eax, dword [ebp - 0xac]
sub eax, 0xe4465da7
je 0x10002474
jmp 0x100013cd
mov eax, dword [ebp - 0xac]
sub eax, 0xe7d3bf3d
je 0x1000272e
jmp 0x100013e3
mov eax, dword [ebp - 0xac]
sub eax, 0xea0a597b
je 0x1000261f
jmp 0x100013f9
mov eax, dword [ebp - 0xac]
sub eax, 0xebe201de
je 0x1000234a
jmp 0x1000140f
mov eax, dword [ebp - 0xac]
sub eax, 0xed665511
je 0x1000176a
jmp 0x10001425
mov eax, dword [ebp - 0xac]
sub eax, 0xf0f6904c
je 0x1000239b
jmp 0x1000143b
mov eax, dword [ebp - 0xac]
sub eax, 0xf3c37c3c
je 0x100019e9
jmp 0x10001451
mov eax, dword [ebp - 0xac]
sub eax, 0xf3dd20dc
je 0x10002642
jmp 0x10001467
mov eax, dword [ebp - 0xac]
sub eax, 0xf3ec3d69
je 0x1000279f
jmp 0x1000147d
mov eax, dword [ebp - 0xac]
sub eax, 0xf582b525
je 0x1000287d
jmp 0x10001493
mov eax, dword [ebp - 0xac]
sub eax, 0xfa9f7b30
je 0x10001f22
jmp 0x100014a9
mov eax, dword [ebp - 0xac]
sub eax, 0xfb1cf4a6
je 0x10001847
jmp 0x100014bf
mov eax, dword [ebp - 0xac]
sub eax, 0xfb290775
je 0x100022b4
jmp 0x100014d5
mov eax, dword [ebp - 0xac]
sub eax, 0xfde345e6
je 0x10001a5f
jmp 0x100014eb
mov eax, dword [ebp - 0xac]
sub eax, 0x120933a
je 0x100026b8
jmp 0x10001501
mov eax, dword [ebp - 0xac]
sub eax, 0x1a2e9fc
je 0x100024ac
jmp 0x10001517
mov eax, dword [ebp - 0xac]
sub eax, 0x1cb5da9
je 0x10001e01
jmp 0x1000152d
mov eax, dword [ebp - 0xac]
sub eax, 0x77dab35
je 0x10001eb5
jmp 0x10001543
mov eax, dword [ebp - 0xac]
sub eax, 0x24b3a306
je 0x10001d93
jmp 0x10001559
mov eax, dword [ebp - 0xac]
sub eax, 0x2a94bf16
je 0x10001eea
jmp 0x1000156f
mov eax, dword [ebp - 0xac]
sub eax, 0x2c5b6680
je 0x10002530
jmp 0x10001585
mov eax, dword [ebp - 0xac]
sub eax, 0x2efd8b96
je 0x10001cfd
jmp 0x1000159b
mov eax, dword [ebp - 0xac]
sub eax, 0x30c6f439
je 0x10001cee
jmp 0x100015b1
mov eax, dword [ebp - 0xac]
sub eax, 0x314f01f6
je 0x1000269a
jmp 0x100015c7
mov eax, dword [ebp - 0xac]
sub eax, 0x33603beb
je 0x1000265b
jmp 0x100015dd
mov eax, dword [ebp - 0xac]
sub eax, 0x3614d8f3
je 0x1000221c
jmp 0x100015f3
mov eax, dword [ebp - 0xac]
sub eax, 0x4358442b
je 0x1000253f
jmp 0x10001609
mov eax, dword [ebp - 0xac]
sub eax, 0x49dcf320
je 0x10002843
jmp 0x1000161f
mov eax, dword [ebp - 0xac]
sub eax, 0x4ddb67a7
je 0x100020ad
jmp 0x10001635
mov eax, dword [ebp - 0xac]
sub eax, 0x53d1ccae
je 0x100027ae
jmp 0x1000164b
mov eax, dword [ebp - 0xac]
sub eax, 0x54256a10
je 0x10002812
jmp 0x10001661
mov eax, dword [ebp - 0xac]
sub eax, 0x59bc7273
je 0x100022c3
jmp 0x10001677
mov eax, dword [ebp - 0xac]
sub eax, 0x5a0158ec
je 0x10001955
jmp 0x1000168d
mov eax, dword [ebp - 0xac]
sub eax, 0x633a6b0a
je 0x10002188
mov bl, byte [ebp - 0x9e]
mov dh, byte [ebp - 0x9d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf3ec3d69
mov ecx, 0xed665511
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
sub edx, 0xe590c141
sub edx, 1
add edx, 0xe590c141
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf3ec3d69
mov ecx, 0xdb2e0df7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xfb1cf4a6
jmp 0x1000290b
mov ecx, dword [ebp - 0xa8]
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cbc0
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0xa4], 0xc51b1de7
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x53d1ccae
mov ecx, 0x5a0158ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0xe54ed991
sub edx, 1
sub edx, 0xe54ed991
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x53d1ccae
mov ecx, 0xb7a18902
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dl, byte [ebp - 0x5d]
mov eax, 0xf3c37c3c
mov ecx, 0x7a2e67fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
sub edx, 0xb6ed527c
sub edx, 1
add edx, 0xb6ed527c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9e262f4f
mov ecx, 0xfde345e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0x3c1de0e2
sub edx, 1
sub edx, 0x3c1de0e2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e262f4f
mov ecx, 0xbaa1c706
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xcb087957
jmp 0x1000290b
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
add edx, 0xa46e94ff
sub edx, 1
sub edx, 0xa46e94ff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb655a803
mov ecx, 0xb7f428a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xb65ab8c9
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0x78dee25e
sub edx, 1
sub edx, 0x78dee25e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54256a10
mov ecx, 0xc7fb3531
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54256a10
mov ecx, 0x30c6f439
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0x2efd8b96
jmp 0x1000290b
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov edx, dword [ebp - 0x84]
mov esi, 0xffffffff
mov eax, 0xdcb352b9
mov ecx, 0x24b3a306
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7cff00ae
mov ecx, 0x1cb5da9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
add edx, 0xe6ccc011
sub edx, 1
sub edx, 0xe6ccc011
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7cff00ae
mov ecx, 0xd9e7fbdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xcb087957
jmp 0x1000290b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0xa4], 0x77dab35
jmp 0x1000290b
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa4], 0xc535942c
jmp 0x1000290b
mov edx, dword [ebp - 0x54]
mov eax, 0x2a94bf16
mov ecx, 0x80541060
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa4], 0xb979397b
jmp 0x1000290b
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xfa9f7b30
jmp 0x1000290b
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x49dcf320
mov ecx, 0x8ca01553
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
add edx, 0xe2c9b5b9
sub edx, 1
sub edx, 0xe2c9b5b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x49dcf320
mov ecx, 0xb610c8d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xcb087957
jmp 0x1000290b
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xa4], 0x9336f0a8
jmp 0x1000290b
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xa4], 0xd2c78202
jmp 0x1000290b
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov dword [ebp - 0xa4], 0x94daba47
jmp 0x1000290b
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov dword [ebp - 0xa4], 0xac094a69
jmp 0x1000290b
mov ax, word [ebp - 0x42]
movzx eax, ax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x3c], ax
mov dword [ebp - 0xa4], 0x4ddb67a7
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
sub edx, 0xfe8ce67
sub edx, 1
add edx, 0xfe8ce67
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x927c4dcb
mov ecx, 0xbc025e98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ax, word [ebp - 0x3c]
movzx ecx, ax
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
sub edx, 0xc872db48
sub edx, 1
add edx, 0xc872db48
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x927c4dcb
mov ecx, 0x633a6b0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0x69b96059
sub edx, 1
sub edx, 0x69b96059
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe192059d
mov ecx, 0x3614d8f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x34], eax
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0xffd624d9
sub edx, 1
sub edx, 0xffd624d9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe192059d
mov ecx, 0xfb290775
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0x59bc7273
jmp 0x1000290b
mov eax, dword [ebp - 0x34]
movzx edx, word [eax + 0x10]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
imul eax, eax, 0x28
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa4], 0x79dd8122
jmp 0x1000290b
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
sub edx, 0x1393c1bf
sub edx, 1
add edx, 0x1393c1bf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf582b525
mov ecx, 0xf0f6904c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x403116f0
add edx, eax
add edx, 0x403116f0
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
add edx, 0x6d19b45c
sub edx, 1
sub edx, 0x6d19b45c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf582b525
mov ecx, 0xe4465da7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xd742a2a9
jmp 0x1000290b
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa4], 0x1a2e9fc
jmp 0x1000290b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cd20
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xaea6850d
add esi, eax
sub esi, 0xaea6850d
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov dword [ebp - 0xa4], 0x2c5b6680
jmp 0x1000290b
mov dword [ebp - 0xa4], 0x4358442b
jmp 0x1000290b
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
sub edx, 0x366da17e
sub edx, 1
add edx, 0x366da17e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d7970a5
mov ecx, 0x84be8416
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
sub edx, 0x37c2f810
sub edx, 1
add edx, 0x37c2f810
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d7970a5
mov ecx, 0x74f9e155
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov ax, word [ebp - 0x14]
add ax, 0xed30
add ax, 1
sub ax, 0xed30
mov word [ebp - 0x12], ax
mov dword [ebp - 0xa4], 0xf3dd20dc
jmp 0x1000290b
mov eax, dword [ebp - 0x70]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0xa4], 0x94daba47
jmp 0x1000290b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa4], 0x314f01f6
jmp 0x1000290b
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0x120933a
jmp 0x1000290b
mov ecx, dword [0x10074540]
mov eax, dword [0x1007453c]
mov edx, ecx
add edx, 0x56e71460
sub edx, 1
sub edx, 0x56e71460
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6a9533b8
mov ecx, 0xe7d3bf3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov eax, dword [0x10074540]
mov ecx, dword [0x1007453c]
mov edx, eax
sub edx, 0x1b5d0dd4
sub edx, 1
add edx, 0x1b5d0dd4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a9533b8
mov ecx, 0xc8d328b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xcb087957
jmp 0x1000290b
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bfc0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa4], 0xed665511
jmp 0x1000290b
mov dword [ebp - 0xa4], 0x5a0158ec
jmp 0x1000290b
mov dword [ebp - 0xa4], 0xfde345e6
jmp 0x1000290b
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa4], 0xdb6f84c0
jmp 0x1000290b
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xa4], 0xc7fb3531
jmp 0x1000290b
mov dword [ebp - 0xa4], 0x8ca01553
jmp 0x1000290b
mov ax, word [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa4], 0xbc025e98
jmp 0x1000290b
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa4], 0x3614d8f3
jmp 0x1000290b
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa4], 0xf0f6904c
jmp 0x1000290b
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa4], 0x84be8416
jmp 0x1000290b
jmp 0x10001107