Function at 0x1000e310
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10091600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x90], 0xab300d8
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x98], eax
sub eax, 0x84a6f638
je 0x1000ed2d
jmp 0x1000e354
mov eax, dword [ebp - 0x98]
sub eax, 0x85a16165
je 0x1000eb9e
jmp 0x1000e36a
mov eax, dword [ebp - 0x98]
sub eax, 0x8603c3fb
je 0x1000ecdb
jmp 0x1000e380
mov eax, dword [ebp - 0x98]
sub eax, 0x8634b1d4
je 0x1000e8d6
jmp 0x1000e396
mov eax, dword [ebp - 0x98]
sub eax, 0x89f078f1
je 0x1000ef14
jmp 0x1000e3ac
mov eax, dword [ebp - 0x98]
sub eax, 0x8da0a93d
je 0x1000ed16
jmp 0x1000e3c2
mov eax, dword [ebp - 0x98]
sub eax, 0x8f32fd51
je 0x1000ec14
jmp 0x1000e3d8
mov eax, dword [ebp - 0x98]
sub eax, 0x94315f17
je 0x1000eccc
jmp 0x1000e3ee
mov eax, dword [ebp - 0x98]
sub eax, 0x97e8981d
je 0x1000e935
jmp 0x1000e404
mov eax, dword [ebp - 0x98]
sub eax, 0x9df84f5d
je 0x1000ed4b
jmp 0x1000e41a
mov eax, dword [ebp - 0x98]
sub eax, 0xaaa5f657
je 0x1000ee8f
jmp 0x1000e430
mov eax, dword [ebp - 0x98]
sub eax, 0xb3f2db3e
je 0x1000f132
jmp 0x1000e446
mov eax, dword [ebp - 0x98]
sub eax, 0xbd48562a
je 0x1000f412
jmp 0x1000e45c
mov eax, dword [ebp - 0x98]
sub eax, 0xbe33ec50
je 0x1000f463
jmp 0x1000e472
mov eax, dword [ebp - 0x98]
sub eax, 0xc173c978
je 0x1000f0a8
jmp 0x1000e488
mov eax, dword [ebp - 0x98]
sub eax, 0xc33008ef
je 0x1000f1ed
jmp 0x1000e49e
mov eax, dword [ebp - 0x98]
sub eax, 0xc383771d
je 0x1000f315
jmp 0x1000e4b4
mov eax, dword [ebp - 0x98]
sub eax, 0xc8c9b4d0
je 0x1000ef34
jmp 0x1000e4ca
mov eax, dword [ebp - 0x98]
sub eax, 0xcfa35a9c
je 0x1000f141
jmp 0x1000e4e0
mov eax, dword [ebp - 0x98]
sub eax, 0xd2699169
je 0x1000f2bb
jmp 0x1000e4f6
mov eax, dword [ebp - 0x98]
sub eax, 0xd9357d7e
je 0x1000ee2f
jmp 0x1000e50c
mov eax, dword [ebp - 0x98]
sub eax, 0xd9e9299d
je 0x1000f259
jmp 0x1000e522
mov eax, dword [ebp - 0x98]
sub eax, 0xe4ebe6cb
je 0x1000ecf8
jmp 0x1000e538
mov eax, dword [ebp - 0x98]
sub eax, 0xec74d419
je 0x1000f4a0
jmp 0x1000e54e
mov eax, dword [ebp - 0x98]
sub eax, 0xf5da4429
je 0x1000f3d4
jmp 0x1000e564
mov eax, dword [ebp - 0x98]
sub eax, 0xf6448286
je 0x1000e8e5
jmp 0x1000e57a
mov eax, dword [ebp - 0x98]
sub eax, 0xab300d8
je 0x1000e7e7
jmp 0x1000e590
mov eax, dword [ebp - 0x98]
sub eax, 0x14f28da4
je 0x1000ea85
jmp 0x1000e5a6
mov eax, dword [ebp - 0x98]
sub eax, 0x1502a948
je 0x1000f2ac
jmp 0x1000e5bc
mov eax, dword [ebp - 0x98]
sub eax, 0x16f361b6
je 0x1000edc1
jmp 0x1000e5d2
mov eax, dword [ebp - 0x98]
sub eax, 0x1ec249fe
je 0x1000ef9d
jmp 0x1000e5e8
mov eax, dword [ebp - 0x98]
sub eax, 0x1ee264e1
je 0x1000f3f4
jmp 0x1000e5fe
mov eax, dword [ebp - 0x98]
sub eax, 0x2056894a
je 0x1000efd3
jmp 0x1000e614
mov eax, dword [ebp - 0x98]
sub eax, 0x24de653f
je 0x1000e9be
jmp 0x1000e62a
mov eax, dword [ebp - 0x98]
sub eax, 0x257be874
je 0x1000f05f
jmp 0x1000e640
mov eax, dword [ebp - 0x98]
sub eax, 0x2a378d8a
je 0x1000eefb
jmp 0x1000e656
mov eax, dword [ebp - 0x98]
sub eax, 0x2d26d758
je 0x1000f403
jmp 0x1000e66c
mov eax, dword [ebp - 0x98]
sub eax, 0x2f96f823
je 0x1000f1d4
jmp 0x1000e682
mov eax, dword [ebp - 0x98]
sub eax, 0x36628084
je 0x1000eeae
jmp 0x1000e698
mov eax, dword [ebp - 0x98]
sub eax, 0x372bcd52
je 0x1000ea0f
jmp 0x1000e6ae
mov eax, dword [ebp - 0x98]
sub eax, 0x3ab55e7b
je 0x1000f487
jmp 0x1000e6c4
mov eax, dword [ebp - 0x98]
sub eax, 0x3dd25d8a
je 0x1000ef5e
jmp 0x1000e6da
mov eax, dword [ebp - 0x98]
sub eax, 0x43ab00d6
je 0x1000f366
jmp 0x1000e6f0
mov eax, dword [ebp - 0x98]
sub eax, 0x4480962c
je 0x1000eedb
jmp 0x1000e706
mov eax, dword [ebp - 0x98]
sub eax, 0x46f1f9d1
je 0x1000eaa3
jmp 0x1000e71c
mov eax, dword [ebp - 0x98]
sub eax, 0x4a28170e
je 0x1000ee3e
jmp 0x1000e732
mov eax, dword [ebp - 0x98]
sub eax, 0x4b1976ad
je 0x1000eb8f
jmp 0x1000e748
mov eax, dword [ebp - 0x98]
sub eax, 0x5d295d1c
je 0x1000e8a2
jmp 0x1000e75e
mov eax, dword [ebp - 0x98]
sub eax, 0x659bd3f4
je 0x1000f3e3
jmp 0x1000e774
mov eax, dword [ebp - 0x98]
sub eax, 0x69531697
je 0x1000f472
jmp 0x1000e78a
mov eax, dword [ebp - 0x98]
sub eax, 0x6e64354d
je 0x1000f210
jmp 0x1000e7a0
mov eax, dword [ebp - 0x98]
sub eax, 0x707cbddc
je 0x1000f2d2
jmp 0x1000e7b6
mov eax, dword [ebp - 0x98]
sub eax, 0x76bd33b2
je 0x1000eb19
jmp 0x1000e7cc
mov eax, dword [ebp - 0x98]
sub eax, 0x78e4fa9f
je 0x1000f1c5
jmp 0x1000e7e2
jmp 0x1000f4aa
mov eax, dword [ebp - 0x94]
push eax
mov ecx, esp
mov dword [ebp - 0x88], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
sub esp, 0x104
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x58], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002aed0
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x90], 0x5d295d1c
jmp 0x1000f4aa
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov edx, dword [ebp - 0x80]
mov eax, 0x8634b1d4
mov ecx, 0xf6448286
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x659bd3f4
jmp 0x1000f4aa
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x90], 0x97e8981d
jmp 0x1000f4aa
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x46], al
mov dword [ebp - 0x90], 0x24de653f
jmp 0x1000f4aa
mov eax, dword [0x10092acc]
mov ecx, dword [0x10092ac8]
mov edx, eax
add edx, 0x1ad39bfd
sub edx, 1
sub edx, 0x1ad39bfd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1ee264e1
mov ecx, 0x372bcd52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
mov edx, ecx
add edx, 0xf00da803
sub edx, 1
sub edx, 0xf00da803
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ee264e1
mov ecx, 0x14f28da4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dl, byte [ebp - 0x46]
mov eax, 0x85a16165
mov ecx, 0x46f1f9d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
mov edx, ecx
add edx, 0xb4f8edfd
sub edx, 1
sub edx, 0xb4f8edfd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2d26d758
mov ecx, 0x76bd33b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
mov edx, ecx
sub edx, 0xb800e159
sub edx, 1
add edx, 0xb800e159
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2d26d758
mov ecx, 0x4b1976ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x659bd3f4
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
mov edx, ecx
sub edx, 0xc0337692
sub edx, 1
add edx, 0xc0337692
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd48562a
mov ecx, 0x8f32fd51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
mov edx, ecx
sub edx, 0x763c5950
sub edx, 1
add edx, 0x763c5950
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd48562a
mov ecx, 0x94315f17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x8603c3fb
jmp 0x1000f4aa
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0x90], 0xe4ebe6cb
jmp 0x1000f4aa
mov dl, byte [ebp - 0x45]
mov eax, 0x8da0a93d
mov ecx, 0x4a28170e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x90], 0x84a6f638
jmp 0x1000f4aa
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0x9df84f5d
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
mov edx, ecx
add edx, 0x9a251719
sub edx, 1
sub edx, 0x9a251719
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbe33ec50
mov ecx, 0x16f361b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbe33ec50
mov ecx, 0xd9357d7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x659bd3f4
jmp 0x1000f4aa
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x90], 0xaaa5f657
jmp 0x1000f4aa
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x90], 0x36628084
jmp 0x1000f4aa
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x90], 0x4480962c
jmp 0x1000f4aa
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x90], 0x2a378d8a
jmp 0x1000f4aa
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 6]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x90], 0x89f078f1
jmp 0x1000f4aa
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov eax, 0xd2699169
mov ecx, 0xc8c9b4d0
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x90], 0x3dd25d8a
jmp 0x1000f4aa
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
sub ecx, 0x4e4b3b99
add ecx, eax
add ecx, 0x4e4b3b99
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x90], 0x1ec249fe
jmp 0x1000f4aa
mov ecx, dword [ebp - 0x24]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100388de
call fcn.1002e830
add esp, 8
mov edx, eax
mov eax, 0x2056894a
mov ecx, 0x78e4fa9f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x3425b21b
add eax, ecx
add eax, 0x3425b21b
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x90], 0x257be874
jmp 0x1000f4aa
mov eax, dword [0x10092acc]
mov ecx, dword [0x10092ac8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69531697
mov ecx, 0xc173c978
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x69531697
mov ecx, 0xb3f2db3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0xcfa35a9c
jmp 0x1000f4aa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002b030
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xf10e385a
add esi, eax
add esi, 0xf10e385a
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov dword [ebp - 0x90], 0x78e4fa9f
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x2f96f823
jmp 0x1000f4aa
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x90], 0xc33008ef
jmp 0x1000f4aa
mov ax, word [ebp - 0x14]
add ax, 0x4df2
add ax, 1
sub ax, 0x4df2
mov word [ebp - 0x12], ax
mov dword [ebp - 0x90], 0x6e64354d
jmp 0x1000f4aa
mov eax, dword [0x10092acc]
mov ecx, dword [0x10092ac8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ab55e7b
mov ecx, 0xd9e9299d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov eax, dword [0x10092acc]
mov ecx, dword [0x10092ac8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ab55e7b
mov ecx, 0x1502a948
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x4480962c
jmp 0x1000f4aa
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x90], 0x707cbddc
jmp 0x1000f4aa
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0xc383771d
jmp 0x1000f4aa
mov eax, dword [0x10092acc]
mov ecx, dword [0x10092ac8]
mov edx, eax
sub edx, 0x80f29a2a
sub edx, 1
add edx, 0x80f29a2a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec74d419
mov ecx, 0x43ab00d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov ecx, dword [0x10092acc]
mov eax, dword [0x10092ac8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xec74d419
mov ecx, 0xf5da4429
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x659bd3f4
jmp 0x1000f4aa
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002a130
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x90], 0x372bcd52
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x76bd33b2
jmp 0x1000f4aa
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x90], 0x8f32fd51
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x16f361b6
jmp 0x1000f4aa
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x90], 0xc173c978
jmp 0x1000f4aa
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x90], 0xd9e9299d
jmp 0x1000f4aa
mov dword [ebp - 0x90], 0x43ab00d6
jmp 0x1000e338