Function at 0x100011d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x1006be00]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0xace454d2
sub edx, 1
sub edx, 0xace454d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x96], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x95], al
mov dword [ebp - 0x9c], 0x76e1ffa6
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
sub eax, 0x885c0b13
je 0x100023f1
jmp 0x10001253
mov eax, dword [ebp - 0xa4]
sub eax, 0x8d23c961
je 0x10002467
jmp 0x10001269
mov eax, dword [ebp - 0xa4]
sub eax, 0x8f6a5f0a
je 0x100027c3
jmp 0x1000127f
mov eax, dword [ebp - 0xa4]
sub eax, 0x8fc0d2e5
je 0x10002957
jmp 0x10001295
mov eax, dword [ebp - 0xa4]
sub eax, 0x939fe285
je 0x100021f8
jmp 0x100012ab
mov eax, dword [ebp - 0xa4]
sub eax, 0x9c174926
je 0x10001fc7
jmp 0x100012c1
mov eax, dword [ebp - 0xa4]
sub eax, 0x9ff88cad
je 0x10002259
jmp 0x100012d7
mov eax, dword [ebp - 0xa4]
sub eax, 0xa2554310
je 0x10002b7e
jmp 0x100012ed
mov eax, dword [ebp - 0xa4]
sub eax, 0xa71207b8
je 0x100027eb
jmp 0x10001303
mov eax, dword [ebp - 0xa4]
sub eax, 0xa868affa
je 0x100023bf
jmp 0x10001319
mov eax, dword [ebp - 0xa4]
sub eax, 0xa9480e02
je 0x1000228b
jmp 0x1000132f
mov eax, dword [ebp - 0xa4]
sub eax, 0xa971bb77
je 0x100029f1
jmp 0x10001345
mov eax, dword [ebp - 0xa4]
sub eax, 0xb2f8f26a
je 0x10002b4d
jmp 0x1000135b
mov eax, dword [ebp - 0xa4]
sub eax, 0xb4f6bff7
je 0x10001a1b
jmp 0x10001371
mov eax, dword [ebp - 0xa4]
sub eax, 0xb928ddcb
je 0x10001b45
jmp 0x10001387
mov eax, dword [ebp - 0xa4]
sub eax, 0xb9955e15
je 0x10002bce
jmp 0x1000139d
mov eax, dword [ebp - 0xa4]
sub eax, 0xc165fc07
je 0x10001e2b
jmp 0x100013b3
mov eax, dword [ebp - 0xa4]
sub eax, 0xc27348b8
je 0x10001f42
jmp 0x100013c9
mov eax, dword [ebp - 0xa4]
sub eax, 0xc2f351ad
je 0x10001ee9
jmp 0x100013df
mov eax, dword [ebp - 0xa4]
sub eax, 0xc55902eb
je 0x100027d2
jmp 0x100013f5
mov eax, dword [ebp - 0xa4]
sub eax, 0xd2524023
je 0x10002884
jmp 0x1000140b
mov eax, dword [ebp - 0xa4]
sub eax, 0xd2a0f423
je 0x100025b7
jmp 0x10001421
mov eax, dword [ebp - 0xa4]
sub eax, 0xd4673ee5
je 0x1000236c
jmp 0x10001437
mov eax, dword [ebp - 0xa4]
sub eax, 0xd4b7e44a
je 0x10002541
jmp 0x1000144d
mov eax, dword [ebp - 0xa4]
sub eax, 0xd839a7a5
je 0x10002608
jmp 0x10001463
mov eax, dword [ebp - 0xa4]
sub eax, 0xe2f2e2b1
je 0x100028ee
jmp 0x10001479
mov eax, dword [ebp - 0xa4]
sub eax, 0xe6fe2d1a
je 0x1000191e
jmp 0x1000148f
mov eax, dword [ebp - 0xa4]
sub eax, 0xeac7a4ec
je 0x10002bf2
jmp 0x100014a5
mov eax, dword [ebp - 0xa4]
sub eax, 0xec476802
je 0x10002772
jmp 0x100014bb
mov eax, dword [ebp - 0xa4]
sub eax, 0xeee2d793
je 0x10002905
jmp 0x100014d1
mov eax, dword [ebp - 0xa4]
sub eax, 0xf0eb4b95
je 0x10001e98
jmp 0x100014e7
mov eax, dword [ebp - 0xa4]
sub eax, 0xf10b5d34
je 0x10002679
jmp 0x100014fd
mov eax, dword [ebp - 0xa4]
sub eax, 0xf2b47270
je 0x10002a66
jmp 0x10001513
mov eax, dword [ebp - 0xa4]
sub eax, 0xf6d80207
je 0x1000266a
jmp 0x10001529
mov eax, dword [ebp - 0xa4]
sub eax, 0xf76df163
je 0x10001d19
jmp 0x1000153f
mov eax, dword [ebp - 0xa4]
sub eax, 0xfb08fc8e
je 0x10002abb
jmp 0x10001555
mov eax, dword [ebp - 0xa4]
sub eax, 0x4b98ed
je 0x10001d9e
jmp 0x1000156b
mov eax, dword [ebp - 0xa4]
sub eax, 0x1a1baec
je 0x10002948
jmp 0x10001581
mov eax, dword [ebp - 0xa4]
sub eax, 0x9660b4a
je 0x10001e1c
jmp 0x10001597
mov eax, dword [ebp - 0xa4]
sub eax, 0x186e0bee
je 0x10002523
jmp 0x100015ad
mov eax, dword [ebp - 0xa4]
sub eax, 0x18f2e751
je 0x10002b6c
jmp 0x100015c3
mov eax, dword [ebp - 0xa4]
sub eax, 0x1965e33e
je 0x10001f6f
jmp 0x100015d9
mov eax, dword [ebp - 0xa4]
sub eax, 0x1a189a07
je 0x10001e7a
jmp 0x100015ef
mov eax, dword [ebp - 0xa4]
sub eax, 0x1a7345c1
je 0x100022dc
jmp 0x10001605
mov eax, dword [ebp - 0xa4]
sub eax, 0x1c49721c
je 0x10001ad7
jmp 0x1000161b
mov eax, dword [ebp - 0xa4]
sub eax, 0x20ebbeae
je 0x10002be3
jmp 0x10001631
mov eax, dword [ebp - 0xa4]
sub eax, 0x2393ceeb
je 0x1000235d
jmp 0x10001647
mov eax, dword [ebp - 0xa4]
sub eax, 0x273fd6a1
je 0x100028df
jmp 0x1000165d
mov eax, dword [ebp - 0xa4]
sub eax, 0x3246b48b
je 0x10002093
jmp 0x10001673
mov eax, dword [ebp - 0xa4]
sub eax, 0x3760d4b9
je 0x10001a68
jmp 0x10001689
mov eax, dword [ebp - 0xa4]
sub eax, 0x39f085aa
je 0x10001c57
jmp 0x1000169f
mov eax, dword [ebp - 0xa4]
sub eax, 0x3a543a54
je 0x10002a75
jmp 0x100016b5
mov eax, dword [ebp - 0xa4]
sub eax, 0x3cf85342
je 0x10002c0b
jmp 0x100016cb
mov eax, dword [ebp - 0xa4]
sub eax, 0x43656f3b
je 0x10001f7e
jmp 0x100016e1
mov eax, dword [ebp - 0xa4]
sub eax, 0x44f7628c
je 0x100021a7
jmp 0x100016f7
mov eax, dword [ebp - 0xa4]
sub eax, 0x492074ba
je 0x10002268
jmp 0x1000170d
mov eax, dword [ebp - 0xa4]
sub eax, 0x49d90066
je 0x10002adf
jmp 0x10001723
mov eax, dword [ebp - 0xa4]
sub eax, 0x49e42248
je 0x10001bca
jmp 0x10001739
mov eax, dword [ebp - 0xa4]
sub eax, 0x4a8b127d
je 0x10002084
jmp 0x1000174f
mov eax, dword [ebp - 0xa4]
sub eax, 0x53ba445c
je 0x10002198
jmp 0x10001765
mov eax, dword [ebp - 0xa4]
sub eax, 0x562dd07b
je 0x10001c91
jmp 0x1000177b
mov eax, dword [ebp - 0xa4]
sub eax, 0x56558dd4
je 0x10001a86
jmp 0x10001791
mov eax, dword [ebp - 0xa4]
sub eax, 0x5b32f32e
je 0x10001f51
jmp 0x100017a7
mov eax, dword [ebp - 0xa4]
sub eax, 0x5bd0cffd
je 0x10002acd
jmp 0x100017bd
mov eax, dword [ebp - 0xa4]
sub eax, 0x6183d205
je 0x10002b35
mov ecx, dword [ebp - 0xa0]
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cae0
add esp, 0xc
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x771c5e09
mov ecx, 0xb4f6bff7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x794cbe3f
jmp 0x10002c15
mov dl, byte [ebp - 0x55]
mov eax, 0x56558dd4
mov ecx, 0x6fe491a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x5e58337
sub edx, 1
add edx, 0x5e58337
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2b47270
mov ecx, 0x1c49721c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf2b47270
mov ecx, 0xb928ddcb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x8fc0d2e5
jmp 0x10002c15
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x46c197aa
sub edx, 1
add edx, 0x46c197aa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a543a54
mov ecx, 0x39f085aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x662dd542
jmp 0x10002c15
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x7c]
mov esi, 0xffffffff
mov eax, 0x723c7cae
mov ecx, 0xf76df163
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x8fc0d2e5
jmp 0x10002c15
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
sub edx, 0xd9ffeb32
sub edx, 1
add edx, 0xd9ffeb32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfb08fc8e
mov ecx, 0x9660b4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0xc165fc07
jmp 0x10002c15
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x9c], 0x1a189a07
jmp 0x10002c15
mov edx, dword [ebp - 0x78]
mov eax, 0xf0eb4b95
mov ecx, 0x43656f3b
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
add edx, 0x24f3b931
sub edx, 1
sub edx, 0x24f3b931
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bd0cffd
mov ecx, 0xc2f351ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0xa0566066
sub edx, 1
add edx, 0xa0566066
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bd0cffd
mov ecx, 0xc27348b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x5b32f32e
jmp 0x10002c15
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0x1965e33e
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x8fc0d2e5
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x49d90066
mov ecx, 0x9c174926
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x47b04c4d
sub edx, 1
sub edx, 0x47b04c4d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x49d90066
mov ecx, 0x4a8b127d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x3246b48b
jmp 0x10002c15
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0xc35ea2ee
sub edx, 1
sub edx, 0xc35ea2ee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6183d205
mov ecx, 0x6eabaab2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x44f7628c
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x1691cf9a
sub edx, 1
add edx, 0x1691cf9a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2f8f26a
mov ecx, 0x939fe285
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x685b5928
sub edx, 1
add edx, 0x685b5928
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2f8f26a
mov ecx, 0x9ff88cad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x492074ba
jmp 0x10002c15
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x9c], 0xa9480e02
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x34e83ed5
sub edx, 1
add edx, 0x34e83ed5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18f2e751
mov ecx, 0x1a7345c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [ebp - 0x38]
mov ax, word [eax + 2]
mov word [ebp - 0x32], ax
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x3a664109
sub edx, 1
sub edx, 0x3a664109
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x18f2e751
mov ecx, 0x2393ceeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0xd4673ee5
jmp 0x10002c15
mov ax, word [ebp - 0x32]
movzx esi, ax
mov edx, dword [ebp - 0x3c]
mov eax, 0xe2f2e2b1
mov ecx, 0x70cc622d
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax + 0x10]
mov eax, dword [ebp - 0x30]
add eax, 0x75ef5f66
add eax, ecx
sub eax, 0x75ef5f66
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x68]
mov ax, word [eax]
mov word [ebp - 0x24], ax
mov dword [ebp - 0x9c], 0x885c0b13
jmp 0x10002c15
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x6e7719e9
sub edx, 1
sub edx, 0x6e7719e9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa2554310
mov ecx, 0x8d23c961
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov ax, word [ebp - 0x24]
movzx eax, ax
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ee50
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x5889b7a8
sub edx, 1
sub edx, 0x5889b7a8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa2554310
mov ecx, 0x186e0bee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dl, byte [ebp - 0x21]
mov eax, 0xd4b7e44a
mov ecx, 0x648242d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x9f762e30
add edx, eax
add edx, 0x9f762e30
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x9c], 0xd2a0f423
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
add edx, 0xaddabbc4
sub edx, 1
sub edx, 0xaddabbc4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9955e15
mov ecx, 0xd839a7a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0xc7c10668
sub edx, 1
add edx, 0xc7c10668
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9955e15
mov ecx, 0xf6d80207
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0xf10b5d34
jmp 0x10002c15
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x7d102fdd
add ecx, eax
add ecx, 0x7d102fdd
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cc40
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov esi, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xfda12cb7
add esi, eax
add esi, 0xfda12cb7
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov dword [ebp - 0x9c], 0x648242d6
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0xd4df9d70
sub edx, 1
add edx, 0xd4df9d70
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20ebbeae
mov ecx, 0x8f6a5f0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0xc55902eb
jmp 0x10002c15
mov eax, dword [ebp - 0x68]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x9c], 0xa71207b8
jmp 0x10002c15
mov ax, word [ebp - 0x14]
add ax, 0xca02
add ax, 1
sub ax, 0xca02
mov word [ebp - 0x12], ax
mov dword [ebp - 0x9c], 0x640e120b
jmp 0x10002c15
mov eax, dword [ebp - 0x68]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
add edx, 0x672f2941
sub edx, 1
sub edx, 0x672f2941
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeac7a4ec
mov ecx, 0x273fd6a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x492074ba
jmp 0x10002c15
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x9c], 0xeee2d793
jmp 0x10002c15
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0x1a1baec
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x8fc0d2e5
jmp 0x10002c15
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3cf85342
mov ecx, 0x7e52ed9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002c15
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bee0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x9c], 0x1c49721c
jmp 0x10002c15
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x9c], 0x49e42248
jmp 0x10002c15
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x9c], 0x4b98ed
jmp 0x10002c15
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x9c], 0xc2f351ad
jmp 0x10002c15
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x9c], 0x9c174926
jmp 0x10002c15
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov dword [ebp - 0x9c], 0x939fe285
jmp 0x10002c15
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9c], 0x1a7345c1
jmp 0x10002c15
mov ax, word [ebp - 0x24]
movzx eax, ax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
sub ecx, 0x4d7e453
add ecx, eax
add ecx, 0x4d7e453
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ee50
add esp, 8
mov dword [ebp - 0x9c], 0x8d23c961
jmp 0x10002c15
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9c], 0xd839a7a5
jmp 0x10002c15
mov dword [ebp - 0x9c], 0xec476802
jmp 0x10002c15
mov eax, dword [ebp - 0x68]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x9c], 0xd2524023
jmp 0x10002c15
mov dword [ebp - 0x9c], 0x7e52ed9d
jmp 0x10001237