Function at 0x1000eae0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1ac
mov eax, dword [ebp + 8]
mov eax, dword [0x1008b080]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x194], 0xb8052493
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
sub eax, 0x874762a7
je 0x1000fb7f
jmp 0x1000eb2a
mov eax, dword [ebp - 0x198]
sub eax, 0x8c3ed3ff
je 0x1000f986
jmp 0x1000eb40
mov eax, dword [ebp - 0x198]
sub eax, 0x93585a0d
je 0x1000f7a4
jmp 0x1000eb56
mov eax, dword [ebp - 0x198]
sub eax, 0x956628f1
je 0x1000f6e9
jmp 0x1000eb6c
mov eax, dword [ebp - 0x198]
sub eax, 0x9ba4cd4d
je 0x1000f3d1
jmp 0x1000eb82
mov eax, dword [ebp - 0x198]
sub eax, 0x9ccdb41e
je 0x1000f2f3
jmp 0x1000eb98
mov eax, dword [ebp - 0x198]
sub eax, 0x9ce7f576
je 0x1000f55c
jmp 0x1000ebae
mov eax, dword [ebp - 0x198]
sub eax, 0xa1c7f8fb
je 0x1000f7ed
jmp 0x1000ebc4
mov eax, dword [ebp - 0x198]
sub eax, 0xa8398c70
je 0x1000f2aa
jmp 0x1000ebda
mov eax, dword [ebp - 0x198]
sub eax, 0xa9e0f6b2
je 0x1000f61e
jmp 0x1000ebf0
mov eax, dword [ebp - 0x198]
sub eax, 0xae525fbb
je 0x1000fdf0
jmp 0x1000ec06
mov eax, dword [ebp - 0x198]
sub eax, 0xafbfaaec
je 0x1000f374
jmp 0x1000ec1c
mov eax, dword [ebp - 0x198]
sub eax, 0xb2ab268b
je 0x1000f471
jmp 0x1000ec32
mov eax, dword [ebp - 0x198]
sub eax, 0xb4147d9d
je 0x1000f9f5
jmp 0x1000ec48
mov eax, dword [ebp - 0x198]
sub eax, 0xb8052493
je 0x1000f041
jmp 0x1000ec5e
mov eax, dword [ebp - 0x198]
sub eax, 0xb8cafe0c
je 0x1000fa59
jmp 0x1000ec74
mov eax, dword [ebp - 0x198]
sub eax, 0xbb3ebe4d
je 0x1000fbd0
jmp 0x1000ec8a
mov eax, dword [ebp - 0x198]
sub eax, 0xbd69824f
je 0x1000fa98
jmp 0x1000eca0
mov eax, dword [ebp - 0x198]
sub eax, 0xc2a9ea34
je 0x1000f50b
jmp 0x1000ecb6
mov eax, dword [ebp - 0x198]
sub eax, 0xc3853611
je 0x1000fb5e
jmp 0x1000eccc
mov eax, dword [ebp - 0x198]
sub eax, 0xc5792109
je 0x1000f0bf
jmp 0x1000ece2
mov eax, dword [ebp - 0x198]
sub eax, 0xcb82ff88
je 0x1000f935
jmp 0x1000ecf8
mov eax, dword [ebp - 0x198]
sub eax, 0xd43e7934
je 0x1000f5f0
jmp 0x1000ed0e
mov eax, dword [ebp - 0x198]
sub eax, 0xdb1df4c2
je 0x1000fb4f
jmp 0x1000ed24
mov eax, dword [ebp - 0x198]
sub eax, 0xdb2a113e
je 0x1000fe05
jmp 0x1000ed3a
mov eax, dword [ebp - 0x198]
sub eax, 0xe7ea3f9b
je 0x1000fb06
jmp 0x1000ed50
mov eax, dword [ebp - 0x198]
sub eax, 0xe7fa77b1
je 0x1000f4fc
jmp 0x1000ed66
mov eax, dword [ebp - 0x198]
sub eax, 0xea7c5ce4
je 0x1000f05c
jmp 0x1000ed7c
mov eax, dword [ebp - 0x198]
sub eax, 0xed7f18f6
je 0x1000fa68
jmp 0x1000ed92
mov eax, dword [ebp - 0x198]
sub eax, 0xee6bb47c
je 0x1000f16d
jmp 0x1000eda8
mov eax, dword [ebp - 0x198]
sub eax, 0xf129d994
je 0x1000f232
jmp 0x1000edbe
mov eax, dword [ebp - 0x198]
sub eax, 0xfab9b1a0
je 0x1000f63c
jmp 0x1000edd4
mov eax, dword [ebp - 0x198]
sub eax, 0x10c755b
je 0x1000fc99
jmp 0x1000edea
mov eax, dword [ebp - 0x198]
sub eax, 0x7785d6f
je 0x1000f3b0
jmp 0x1000ee00
mov eax, dword [ebp - 0x198]
sub eax, 0xd1a57c3
je 0x1000f3e0
jmp 0x1000ee16
mov eax, dword [ebp - 0x198]
sub eax, 0xdeedcd6
je 0x1000f110
jmp 0x1000ee2c
mov eax, dword [ebp - 0x198]
sub eax, 0xfa3e0df
je 0x1000f3fb
jmp 0x1000ee42
mov eax, dword [ebp - 0x198]
sub eax, 0x11b4393c
je 0x1000f67d
jmp 0x1000ee58
mov eax, dword [ebp - 0x198]
sub eax, 0x173fe597
je 0x1000fcdc
jmp 0x1000ee6e
mov eax, dword [ebp - 0x198]
sub eax, 0x1776c879
je 0x1000fd3e
jmp 0x1000ee84
mov eax, dword [ebp - 0x198]
sub eax, 0x19d075df
je 0x1000fab5
jmp 0x1000ee9a
mov eax, dword [ebp - 0x198]
sub eax, 0x21fd6ef0
je 0x1000fc67
jmp 0x1000eeb0
mov eax, dword [ebp - 0x198]
sub eax, 0x26e56b06
je 0x1000f261
jmp 0x1000eec6
mov eax, dword [ebp - 0x198]
sub eax, 0x27544925
je 0x1000f783
jmp 0x1000eedc
mov eax, dword [ebp - 0x198]
sub eax, 0x28b94f2d
je 0x1000f9e6
jmp 0x1000eef2
mov eax, dword [ebp - 0x198]
sub eax, 0x2a07a426
je 0x1000f926
jmp 0x1000ef08
mov eax, dword [ebp - 0x198]
sub eax, 0x2cccdc5c
je 0x1000fc8a
jmp 0x1000ef1e
mov eax, dword [ebp - 0x198]
sub eax, 0x38870a6f
je 0x1000f395
jmp 0x1000ef34
mov eax, dword [ebp - 0x198]
sub eax, 0x3e7a203f
je 0x1000fc25
jmp 0x1000ef4a
mov eax, dword [ebp - 0x198]
sub eax, 0x4093ecbc
je 0x1000f662
jmp 0x1000ef60
mov eax, dword [ebp - 0x198]
sub eax, 0x45164341
je 0x1000fc34
jmp 0x1000ef76
mov eax, dword [ebp - 0x198]
sub eax, 0x4e1ea690
je 0x1000f17c
jmp 0x1000ef8c
mov eax, dword [ebp - 0x198]
sub eax, 0x4f2ffb34
je 0x1000fc7b
jmp 0x1000efa2
mov eax, dword [ebp - 0x198]
sub eax, 0x50a2b2a0
je 0x1000fe14
jmp 0x1000efb8
mov eax, dword [ebp - 0x198]
sub eax, 0x513a85bb
je 0x1000f0b0
jmp 0x1000efce
mov eax, dword [ebp - 0x198]
sub eax, 0x52b8bc96
je 0x1000f5e1
jmp 0x1000efe4
mov eax, dword [ebp - 0x198]
sub eax, 0x57a60b74
je 0x1000fd2f
jmp 0x1000effa
mov eax, dword [ebp - 0x198]
sub eax, 0x5a6e84f9
je 0x1000f73a
jmp 0x1000f010
mov eax, dword [ebp - 0x198]
sub eax, 0x66fb6c8e
je 0x1000f353
jmp 0x1000f026
mov eax, dword [ebp - 0x198]
sub eax, 0x7abec13d
je 0x1000f302
jmp 0x1000f03c
jmp 0x1000fe1e
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x194], 0xea7c5ce4
jmp 0x1000fe1e
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002b140
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x16c], eax
mov eax, 0x513a85bb
mov ecx, 0xc5792109
cmp dword [ebp - 0x16c], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0x21fd6ef0
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
add edx, 0x2dc4d788
sub edx, 1
sub edx, 0x2dc4d788
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f2ffb34
mov ecx, 0xdeedcd6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x160], eax
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
add edx, 0xbbb028da
sub edx, 1
sub edx, 0xbbb028da
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f2ffb34
mov ecx, 0xee6bb47c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0x4e1ea690
jmp 0x1000fe1e
mov edx, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x160]
lea eax, [ebp - 0x11c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x16c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x110]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x194], 0xf129d994
jmp 0x1000fe1e
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x174], eax
mov edx, 0xffffffff
mov eax, 0x7abec13d
mov ecx, 0x26e56b06
cmp dword [ebp - 0x174], edx
cmove eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2cccdc5c
mov ecx, 0xa8398c70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2cccdc5c
mov ecx, 0x9ccdb41e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0x21fd6ef0
jmp 0x1000fe1e
mov eax, dword [ebp - 0x174]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x194], 0x66fb6c8e
jmp 0x1000fe1e
cmp dword [ebp - 0x178], 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov dword [ebp - 0x194], 0xafbfaaec
jmp 0x1000fe1e
mov dl, byte [ebp - 0x155]
mov eax, 0x38870a6f
mov ecx, 0xd1a57c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x194], 0x7785d6f
jmp 0x1000fe1e
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x194], 0x9ba4cd4d
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0x21fd6ef0
jmp 0x1000fe1e
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x194], 0xfa3e0df
jmp 0x1000fe1e
mov ecx, dword [0x1008c544]
mov eax, dword [0x1008c540]
mov edx, ecx
add edx, 0x97f7c028
sub edx, 1
sub edx, 0x97f7c028
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x10c755b
mov ecx, 0xb2ab268b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x150]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x14c], eax
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
add edx, 0x3ca511c1
sub edx, 1
sub edx, 0x3ca511c1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10c755b
mov ecx, 0xe7fa77b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xc2a9ea34
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
sub edx, 0x38c786d1
sub edx, 1
add edx, 0x38c786d1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x173fe597
mov ecx, 0x9ce7f576
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x180]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x184], eax
mov word [ebp - 0x186], 0
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x173fe597
mov ecx, 0x52b8bc96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xd43e7934
jmp 0x1000fe1e
movzx eax, word [ebp - 0x186]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x184]
add eax, 4
add eax, 2
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x194], 0xa9e0f6b2
jmp 0x1000fe1e
mov eax, dword [ebp - 0x144]
movzx eax, word [eax]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x194], 0xfab9b1a0
jmp 0x1000fe1e
mov edx, dword [ebp - 0x148]
mov esi, dword [ebp - 0x140]
mov eax, 0xc3853611
mov ecx, 0x4093ecbc
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x194], 0x11b4393c
jmp 0x1000fe1e
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x184]
movzx ecx, word [ecx + 0x14]
sub eax, 0xc4a12e91
add eax, ecx
add eax, 0xc4a12e91
movzx ecx, word [ebp - 0x186]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x18c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100388ee
call fcn.1002eaa0
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x135], al
mov dword [ebp - 0x194], 0x956628f1
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
sub edx, 0xab8e6b04
sub edx, 1
add edx, 0xab8e6b04
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57a60b74
mov ecx, 0x5a6e84f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57a60b74
mov ecx, 0x27544925
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dl, byte [ebp - 0x135]
mov eax, 0x93585a0d
mov ecx, 0xb8cafe0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1776c879
mov ecx, 0xa1c7f8fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0xc]
add edx, 0x36c527d7
add edx, eax
sub edx, 0x36c527d7
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x18d], al
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x18c]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0xc]
sub ecx, 0xca34e6b3
add ecx, eax
add ecx, 0xca34e6b3
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002b2a0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x130], eax
mov ecx, dword [0x1008c544]
mov eax, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1776c879
mov ecx, 0x2a07a426
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xcb82ff88
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
sub edx, 0x39d523c4
sub edx, 1
add edx, 0x39d523c4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae525fbb
mov ecx, 0x8c3ed3ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
sub edx, 0x3a61ab09
sub edx, 1
add edx, 0x3a61ab09
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae525fbb
mov ecx, 0x28b94f2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xb4147d9d
jmp 0x1000fe1e
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x18c]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x120]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x18d], al
mov dword [ebp - 0x194], 0xb8cafe0c
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xed7f18f6
jmp 0x1000fe1e
mov ax, word [ebp - 0x186]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x126], ax
mov dword [ebp - 0x194], 0xbd69824f
jmp 0x1000fe1e
mov ax, word [ebp - 0x126]
mov word [ebp - 0x186], ax
mov dword [ebp - 0x194], 0x19d075df
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
sub edx, 0x51265b72
sub edx, 1
add edx, 0x51265b72
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb2a113e
mov ecx, 0xe7ea3f9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb2a113e
mov ecx, 0xdb1df4c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xd43e7934
jmp 0x1000fe1e
mov eax, dword [ebp - 0x174]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x194], 0x874762a7
jmp 0x1000fe1e
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
mov edx, eax
sub edx, 0xda44ce4e
sub edx, 1
add edx, 0xda44ce4e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50a2b2a0
mov ecx, 0xbb3ebe4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x124], eax
mov eax, dword [0x1008c544]
mov ecx, dword [0x1008c540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50a2b2a0
mov ecx, 0x3e7a203f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0x45164341
jmp 0x1000fe1e
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x194], 0x21fd6ef0
jmp 0x1000fe1e
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002a3a0
add esp, 0x1ac
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x194], 0xdeedcd6
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xa8398c70
jmp 0x1000fe1e
mov eax, dword [ebp - 0x150]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x194], 0xb2ab268b
jmp 0x1000fe1e
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x180]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x184], eax
mov word [ebp - 0x186], 0
mov dword [ebp - 0x194], 0x9ce7f576
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0x5a6e84f9
jmp 0x1000fe1e
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x18c]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x18d], al
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0xc]
sub ecx, 0x41044435
add ecx, eax
add ecx, 0x41044435
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002b2a0
mov dword [ebp - 0x194], 0xa1c7f8fb
jmp 0x1000fe1e
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x194], 0x8c3ed3ff
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xe7ea3f9b
jmp 0x1000fe1e
mov dword [ebp - 0x194], 0xbb3ebe4d
jmp 0x1000eb0e