Function at 0x100010a0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10069800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0x7625ca53
sub edx, 1
sub edx, 0x7625ca53
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x89], al
mov dword [ebp - 0x90], 0x4c8e1605
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x98], eax
sub eax, 0x86052dc7
je 0x10002027
jmp 0x10001123
mov eax, dword [ebp - 0x98]
sub eax, 0x8bb8dd6a
je 0x10001a7f
jmp 0x10001139
mov eax, dword [ebp - 0x98]
sub eax, 0x8c8e65b0
je 0x1000174e
jmp 0x1000114f
mov eax, dword [ebp - 0x98]
sub eax, 0x9274641c
je 0x100022c8
jmp 0x10001165
mov eax, dword [ebp - 0x98]
sub eax, 0x9bea19f1
je 0x10001f7c
jmp 0x1000117b
mov eax, dword [ebp - 0x98]
sub eax, 0x9dcef4e0
je 0x10001f0e
jmp 0x10001191
mov eax, dword [ebp - 0x98]
sub eax, 0xa1a19cb0
je 0x100017bd
jmp 0x100011a7
mov eax, dword [ebp - 0x98]
sub eax, 0xa35a4019
je 0x10001866
jmp 0x100011bd
mov eax, dword [ebp - 0x98]
sub eax, 0xa51d4eda
je 0x100016b4
jmp 0x100011d3
mov eax, dword [ebp - 0x98]
sub eax, 0xb0b38fe7
je 0x1000213d
jmp 0x100011e9
mov eax, dword [ebp - 0x98]
sub eax, 0xb107ec67
je 0x1000205d
jmp 0x100011ff
mov eax, dword [ebp - 0x98]
sub eax, 0xb4431fc8
je 0x10001d14
jmp 0x10001215
mov eax, dword [ebp - 0x98]
sub eax, 0xb8e2b895
je 0x10001e3c
jmp 0x1000122b
mov eax, dword [ebp - 0x98]
sub eax, 0xbb4ec388
je 0x10001bcb
jmp 0x10001241
mov eax, dword [ebp - 0x98]
sub eax, 0xbbdbb7af
je 0x10001c9e
jmp 0x10001257
mov eax, dword [ebp - 0x98]
sub eax, 0xbdfa674b
je 0x100020c0
jmp 0x1000126d
mov eax, dword [ebp - 0x98]
sub eax, 0xce16a63b
je 0x1000206c
jmp 0x10001283
mov eax, dword [ebp - 0x98]
sub eax, 0xd1aca845
je 0x100020cf
jmp 0x10001299
mov eax, dword [ebp - 0x98]
sub eax, 0xd7668a44
je 0x10001dd2
jmp 0x100012af
mov eax, dword [ebp - 0x98]
sub eax, 0xda30b13e
je 0x10001c18
jmp 0x100012c5
mov eax, dword [ebp - 0x98]
sub eax, 0xde28ba7f
je 0x100017d4
jmp 0x100012db
mov eax, dword [ebp - 0x98]
sub eax, 0xe33b9595
je 0x1000191c
jmp 0x100012f1
mov eax, dword [ebp - 0x98]
sub eax, 0xeb18a590
je 0x100021d3
jmp 0x10001307
mov eax, dword [ebp - 0x98]
sub eax, 0xf4dca2b5
je 0x100019b7
jmp 0x1000131d
mov eax, dword [ebp - 0x98]
sub eax, 0xf53354a0
je 0x10001f8b
jmp 0x10001333
mov eax, dword [ebp - 0x98]
sub eax, 0xf78dc35e
je 0x10001774
jmp 0x10001349
mov eax, dword [ebp - 0x98]
sub eax, 0xf9b9664f
je 0x10001de1
jmp 0x1000135f
mov eax, dword [ebp - 0x98]
sub eax, 0xfc9dcac1
je 0x1000224b
jmp 0x10001375
mov eax, dword [ebp - 0x98]
sub eax, 0xff2cad96
je 0x10001783
jmp 0x1000138b
mov eax, dword [ebp - 0x98]
sub eax, 0xa826a7
je 0x100018c2
jmp 0x100013a1
mov eax, dword [ebp - 0x98]
sub eax, 0xdadb76
je 0x1000222c
jmp 0x100013b7
mov eax, dword [ebp - 0x98]
sub eax, 0x14218f2
je 0x100021b3
jmp 0x100013cd
mov eax, dword [ebp - 0x98]
sub eax, 0x6764c72
je 0x10002036
jmp 0x100013e3
mov eax, dword [ebp - 0x98]
sub eax, 0xe109b1e
je 0x100015fb
jmp 0x100013f9
mov eax, dword [ebp - 0x98]
sub eax, 0x11644608
je 0x10001b65
jmp 0x1000140f
mov eax, dword [ebp - 0x98]
sub eax, 0x13aefc83
je 0x10001875
jmp 0x10001425
mov eax, dword [ebp - 0x98]
sub eax, 0x183b5fca
je 0x10001a8e
jmp 0x1000143b
mov eax, dword [ebp - 0x98]
sub eax, 0x1aa2c5a6
je 0x10001be9
jmp 0x10001451
mov eax, dword [ebp - 0x98]
sub eax, 0x1b85db72
je 0x10001c32
jmp 0x10001467
mov eax, dword [ebp - 0x98]
sub eax, 0x1d4da92f
je 0x10001e98
jmp 0x1000147d
mov eax, dword [ebp - 0x98]
sub eax, 0x243a44af
je 0x10001fd4
jmp 0x10001493
mov eax, dword [ebp - 0x98]
sub eax, 0x24c8e037
je 0x10001905
jmp 0x100014a9
mov eax, dword [ebp - 0x98]
sub eax, 0x2e7e8cfc
je 0x1000209d
jmp 0x100014bf
mov eax, dword [ebp - 0x98]
sub eax, 0x3be679ad
je 0x100016c3
jmp 0x100014d5
mov eax, dword [ebp - 0x98]
sub eax, 0x3d3c412d
je 0x10001ba9
jmp 0x100014eb
mov eax, dword [ebp - 0x98]
sub eax, 0x435bb26f
je 0x10001949
jmp 0x10001501
mov eax, dword [ebp - 0x98]
sub eax, 0x45c7f107
je 0x1000193a
jmp 0x10001517
mov eax, dword [ebp - 0x98]
sub eax, 0x4c0a194c
je 0x10001b83
jmp 0x1000152d
mov eax, dword [ebp - 0x98]
sub eax, 0x4c8e1605
je 0x100015cc
jmp 0x10001543
mov eax, dword [ebp - 0x98]
sub eax, 0x4cac38a8
je 0x10001b74
jmp 0x10001559
mov eax, dword [ebp - 0x98]
sub eax, 0x59da7d64
je 0x100022b9
jmp 0x1000156f
mov eax, dword [ebp - 0x98]
sub eax, 0x6ca8a751
je 0x100018e7
jmp 0x10001585
mov eax, dword [ebp - 0x98]
sub eax, 0x6d2ccb31
je 0x10001adf
jmp 0x1000159b
mov eax, dword [ebp - 0x98]
sub eax, 0x77d8f3e0
je 0x100021c4
jmp 0x100015b1
mov eax, dword [ebp - 0x98]
sub eax, 0x7d0d31e5
je 0x100022da
jmp 0x100015c7
jmp 0x100022e4
mov al, byte [ebp - 0x8a]
mov cl, byte [ebp - 0x89]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x77d8f3e0
mov ecx, 0xe109b1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0x7a4e2a33
sub edx, 1
sub edx, 0x7a4e2a33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x77d8f3e0
mov ecx, 0xa51d4eda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0x3be679ad
jmp 0x100022e4
mov ecx, dword [ebp - 0x94]
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000ca80
add esp, 0xc
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x90], 0x8c8e65b0
jmp 0x100022e4
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x7c]
mov eax, 0xf78dc35e
mov ecx, 0xff2cad96
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0xd1aca845
jmp 0x100022e4
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0x80]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x90], 0xa1a19cb0
jmp 0x100022e4
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x90], 0xde28ba7f
jmp 0x100022e4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x74]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov edx, dword [ebp - 0x70]
mov esi, 0xffffffff
mov eax, 0x13aefc83
mov ecx, 0xa35a4019
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0xd1aca845
jmp 0x100022e4
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x90], 0xa826a7
jmp 0x100022e4
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x90], 0x6ca8a751
jmp 0x100022e4
mov dl, byte [ebp - 0x3d]
mov eax, 0x24c8e037
mov ecx, 0x435bb26f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x90], 0xe33b9595
jmp 0x100022e4
mov eax, dword [ebp - 0x3c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0x45c7f107
jmp 0x100022e4
mov dword [ebp - 0x90], 0xd1aca845
jmp 0x100022e4
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeb18a590
mov ecx, 0xf4dca2b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeb18a590
mov ecx, 0x8bb8dd6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0x183b5fca
jmp 0x100022e4
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
add edx, 0x7170b186
sub edx, 1
sub edx, 0x7170b186
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdadb76
mov ecx, 0x6d2ccb31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov word [eax], 0
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0xfe7b7b7c
sub edx, 1
sub edx, 0xfe7b7b7c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdadb76
mov ecx, 0x11644608
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0x4cac38a8
jmp 0x100022e4
mov dword [ebp - 0x90], 0x4c0a194c
jmp 0x100022e4
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x90], 0x3d3c412d
jmp 0x100022e4
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x29], al
mov dword [ebp - 0x90], 0xbb4ec388
jmp 0x100022e4
mov dl, byte [ebp - 0x29]
mov eax, 0xce16a63b
mov ecx, 0x1aa2c5a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub eax, 0x9c4de422
add eax, 0x18
add eax, 0x9c4de422
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x90], 0xda30b13e
jmp 0x100022e4
mov eax, dword [ebp - 0x24]
mov ax, word [eax + 0x10]
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x90], 0x1b85db72
jmp 0x100022e4
mov ax, word [ebp - 0x1e]
movzx eax, ax
mov ecx, dword [ebp - 0x28]
add ecx, 0x45b77021
add ecx, eax
sub ecx, 0x45b77021
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0xaf7c380
add ecx, eax
sub ecx, 0xaf7c380
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000edf0
add esp, 8
mov edx, eax
mov eax, 0xbbdbb7af
mov ecx, 0x1d4da92f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x4cbf37ae
sub edx, 1
add edx, 0x4cbf37ae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc9dcac1
mov ecx, 0xb4431fc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x1a962ade
add edx, eax
add edx, 0x1a962ade
mov eax, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0xe1ae2ca
add eax, ecx
sub eax, 0xe1ae2ca
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfc9dcac1
mov ecx, 0xd7668a44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0xf9b9664f
jmp 0x100022e4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x20913f9
add ecx, eax
sub ecx, 0x20913f9
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cbe0
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x90], 0xb8e2b895
jmp 0x100022e4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x78]
mov esi, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x522b0d66
add esi, eax
add esi, 0x522b0d66
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov dword [ebp - 0x90], 0x1d4da92f
jmp 0x100022e4
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0xbdbfe16c
sub edx, 1
sub edx, 0xbdbfe16c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59da7d64
mov ecx, 0x9dcef4e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x59da7d64
mov ecx, 0x9bea19f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0xf53354a0
jmp 0x100022e4
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9274641c
mov ecx, 0x243a44af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov eax, dword [ebp - 0x5c]
mov ax, word [eax]
mov word [ebp - 0xe], ax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9274641c
mov ecx, 0x86052dc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov dword [ebp - 0x90], 0x6764c72
jmp 0x100022e4
mov cx, word [ebp - 0xe]
add cx, 0x6be0
add cx, 1
sub cx, 0x6be0
mov eax, dword [ebp - 0x5c]
mov word [eax], cx
mov dword [ebp - 0x90], 0xb107ec67
jmp 0x100022e4
mov dword [ebp - 0x90], 0x4c0a194c
jmp 0x100022e4
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0x2e7e8cfc
jmp 0x100022e4
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0xbdfa674b
jmp 0x100022e4
mov dword [ebp - 0x90], 0xd1aca845
jmp 0x100022e4
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7d0d31e5
mov ecx, 0xb0b38fe7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x4e6a446e
sub edx, 1
add edx, 0x4e6a446e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7d0d31e5
mov ecx, 0x14218f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x100022e4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000be80
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x90], 0xe109b1e
jmp 0x100022e4
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x90], 0xf4dca2b5
jmp 0x100022e4
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov word [eax], 0
mov dword [ebp - 0x90], 0x6d2ccb31
jmp 0x100022e4
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x90], 0xb4431fc8
jmp 0x100022e4
mov dword [ebp - 0x90], 0x9dcef4e0
jmp 0x100022e4
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x90], 0x243a44af
jmp 0x100022e4
mov dword [ebp - 0x90], 0xb0b38fe7
jmp 0x10001107