Function at 0x100011f0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x1006d800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a0], 0xff50622c
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
sub eax, 0x855ffa24
je 0x10001e20
jmp 0x10001235
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8889a622
je 0x10002700
jmp 0x1000124b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8da2686e
je 0x10001d53
jmp 0x10001261
mov eax, dword [ebp - 0x1a8]
sub eax, 0x931fd830
je 0x10001f94
jmp 0x10001277
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9865620e
je 0x100018a0
jmp 0x1000128d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa23ab8ec
je 0x100026ac
jmp 0x100012a3
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa269cea0
je 0x1000260a
jmp 0x100012b9
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa2be0e79
je 0x10002432
jmp 0x100012cf
mov eax, dword [ebp - 0x1a8]
sub eax, 0xad44a8a8
je 0x10001bfe
jmp 0x100012e5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xaf52286b
je 0x100024e5
jmp 0x100012fb
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb777d6ed
je 0x10001ce3
jmp 0x10001311
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb8594d78
je 0x10001ab4
jmp 0x10001327
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbd3ff04e
je 0x100018af
jmp 0x1000133d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcbd0a401
je 0x10002173
jmp 0x10001353
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcbdb5874
je 0x10002339
jmp 0x10001369
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd2596088
je 0x10001bdd
jmp 0x1000137f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd4a5082a
je 0x10001ede
jmp 0x10001395
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd6a8afa1
je 0x10002655
jmp 0x100013ab
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd7db1ff5
je 0x100018f5
jmp 0x100013c1
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdd721746
je 0x10001ba7
jmp 0x100013d7
mov eax, dword [ebp - 0x1a8]
sub eax, 0xde02593a
je 0x100024c4
jmp 0x100013ed
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe1a0ddc6
je 0x10002423
jmp 0x10001403
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe2cf965f
je 0x100018e6
jmp 0x10001419
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe4e3b04c
je 0x1000269d
jmp 0x1000142f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe5c59087
je 0x10001cfe
jmp 0x10001445
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe7ee71b4
je 0x1000259c
jmp 0x1000145b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe8de95a7
je 0x100026df
jmp 0x10001471
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe9cb1ee4
je 0x10001cd4
jmp 0x10001487
mov eax, dword [ebp - 0x1a8]
sub eax, 0xed0dd610
je 0x100025fb
jmp 0x1000149d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xed40edc2
je 0x100019cf
jmp 0x100014b3
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf037c893
je 0x100025ae
jmp 0x100014c9
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf47321cd
je 0x100020ee
jmp 0x100014df
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf68c2302
je 0x1000232a
jmp 0x100014f5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xfcf7704d
je 0x10001c19
jmp 0x1000150b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xff50622c
je 0x1000178e
jmp 0x10001521
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8a5cf0
je 0x10001b14
jmp 0x10001537
mov eax, dword [ebp - 0x1a8]
sub eax, 0x29a3253
je 0x100020a6
jmp 0x1000154d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x591b2ff
je 0x10001f85
jmp 0x10001563
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7ccfc5c
je 0x10001a85
jmp 0x10001579
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa17fb3c
je 0x10002277
jmp 0x1000158f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc4377a4
je 0x10001ac3
jmp 0x100015a5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf360647
je 0x10001e8d
jmp 0x100015bb
mov eax, dword [ebp - 0x1a8]
sub eax, 0x13f74a64
je 0x100021e1
jmp 0x100015d1
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1492de46
je 0x100023a7
jmp 0x100015e7
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2b2e36e6
je 0x10001bb6
jmp 0x100015fd
mov eax, dword [ebp - 0x1a8]
sub eax, 0x30e0cb33
je 0x10001804
jmp 0x10001613
mov eax, dword [ebp - 0x1a8]
sub eax, 0x35327dd7
je 0x1000246a
jmp 0x10001629
mov eax, dword [ebp - 0x1a8]
sub eax, 0x358fc567
je 0x10001e48
jmp 0x1000163f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3a340e14
je 0x100020b5
jmp 0x10001655
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3d1a8c12
je 0x10001963
jmp 0x1000166b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x431080b0
je 0x10001e11
jmp 0x10001681
mov eax, dword [ebp - 0x1a8]
sub eax, 0x45c32008
je 0x1000252e
jmp 0x10001697
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4a2b51b8
je 0x10002497
jmp 0x100016ad
mov eax, dword [ebp - 0x1a8]
sub eax, 0x511c9311
je 0x10001d9c
jmp 0x100016c3
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5eb5c45a
je 0x10001c83
jmp 0x100016d9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5ecd9e71
je 0x100019c0
jmp 0x100016ef
mov eax, dword [ebp - 0x1a8]
sub eax, 0x66374a44
je 0x10001c3a
jmp 0x10001705
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6bcf6de4
je 0x10002286
jmp 0x1000171b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6e594d43
je 0x1000270f
jmp 0x10001731
mov eax, dword [ebp - 0x1a8]
sub eax, 0x74c11650
je 0x10001e67
jmp 0x10001747
mov eax, dword [ebp - 0x1a8]
sub eax, 0x783c9bb6
je 0x1000245b
jmp 0x1000175d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x794ec0ce
je 0x10002002
jmp 0x10001773
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7aa0b844
je 0x10002664
jmp 0x10001789
jmp 0x10002719
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
mov edx, ecx
add edx, 0x6925402a
sub edx, 1
sub edx, 0x6925402a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf037c893
mov ecx, 0x30e0cb33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x174], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10008ae0
add esp, 0xc
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x16c], eax
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf037c893
mov ecx, 0x9865620e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xbd3ff04e
jmp 0x10002719
mov eax, dword [ebp - 0x16c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x17c], eax
mov eax, 0xe2cf965f
mov ecx, 0xd7db1ff5
cmp dword [ebp - 0x17c], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xaf52286b
jmp 0x10002719
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xed0dd610
mov ecx, 0x3d1a8c12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x168], eax
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
mov edx, eax
add edx, 0x4a4bf9f2
sub edx, 1
sub edx, 0x4a4bf9f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed0dd610
mov ecx, 0x5ecd9e71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xed40edc2
jmp 0x10002719
mov edx, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x168]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x17c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1a0], 0x7ccfc5c
jmp 0x10002719
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x184], eax
mov edx, 0xffffffff
mov eax, 0xc4377a4
mov ecx, 0xb8594d78
cmp dword [ebp - 0x184], edx
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xaf52286b
jmp 0x10002719
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
mov edx, eax
add edx, 0xac3a03ce
sub edx, 1
sub edx, 0xac3a03ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa269cea0
mov ecx, 0x8a5cf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x160], eax
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
mov edx, eax
add edx, 0xf3e49d1a
sub edx, 1
sub edx, 0xf3e49d1a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa269cea0
mov ecx, 0xdd721746
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x2b2e36e6
jmp 0x10002719
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x1a0], 0xd2596088
jmp 0x10002719
mov edx, dword [ebp - 0x15c]
mov eax, 0xad44a8a8
mov ecx, 0xb777d6ed
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1a0], 0xfcf7704d
jmp 0x10002719
mov eax, dword [ebp - 0x158]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x66374a44
jmp 0x10002719
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6a8afa1
mov ecx, 0x5eb5c45a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
mov edx, eax
add edx, 0xab8b8771
sub edx, 1
sub edx, 0xab8b8771
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6a8afa1
mov ecx, 0xe9cb1ee4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xaf52286b
jmp 0x10002719
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x1a0], 0xe5c59087
jmp 0x10002719
mov eax, dword [ebp - 0x154]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1a0], 0x8da2686e
jmp 0x10002719
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7aa0b844
mov ecx, 0x511c9311
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x190]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
mov edx, eax
add edx, 0x6cb7235c
sub edx, 1
sub edx, 0x6cb7235c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7aa0b844
mov ecx, 0x431080b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x855ffa24
jmp 0x10002719
movzx eax, word [ebp - 0x196]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x1a0], 0x358fc567
jmp 0x10002719
mov eax, dword [ebp - 0x14c]
movzx eax, word [eax + 6]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1a0], 0x74c11650
jmp 0x10002719
mov edx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x148]
mov eax, 0x35327dd7
mov ecx, 0xf360647
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
mov edx, eax
sub edx, 0xd9b57f0c
sub edx, 1
add edx, 0xd9b57f0c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe4e3b04c
mov ecx, 0xd4a5082a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x194]
add eax, 0x9122fdab
add eax, 0x18
sub eax, 0x9122fdab
mov ecx, dword [ebp - 0x194]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x144], eax
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
mov edx, ecx
add edx, 0xd4a24c35
sub edx, 1
sub edx, 0xd4a24c35
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe4e3b04c
mov ecx, 0x591b2ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x931fd830
jmp 0x10002719
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa23ab8ec
mov ecx, 0x794ec0ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x144]
movzx ecx, word [ebp - 0x196]
imul ecx, ecx, 0x28
add eax, 0x84885952
add eax, ecx
sub eax, 0x84885952
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x140], eax
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
mov edx, ecx
add edx, 0xae25212c
sub edx, 1
sub edx, 0xae25212c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa23ab8ec
mov ecx, 0x29a3253
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x3a340e14
jmp 0x10002719
mov ecx, dword [ebp - 0x140]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100141a0
call fcn.1000ae50
add esp, 8
mov edx, eax
mov eax, 0xf47321cd
mov ecx, 0xf68c2302
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x19c]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
lea eax, [ebp - 0x124]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x170]
mov byte [eax], cl
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x19c]
add eax, 0xc
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1a0], 0xcbd0a401
jmp 0x10002719
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe8de95a7
mov ecx, 0x13f74a64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x13c]
sub eax, 0x337e4c6d
add eax, ecx
add eax, 0x337e4c6d
mov dword [ebp - 0x134], eax
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
mov edx, ecx
add edx, 0x8dace2ac
sub edx, 1
sub edx, 0x8dace2ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe8de95a7
mov ecx, 0xa17fb3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x6bcf6de4
jmp 0x10002719
mov edx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0xc]
sub ecx, 0x3b423278
add ecx, eax
add ecx, 0x3b423278
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10008c40
add esp, 0xc
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x19c]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x180]
mov eax, dword [ebp - 0x19c]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
lea eax, [ebp - 0x124]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x170]
mov byte [eax], cl
mov dword [ebp - 0x1a0], 0xf68c2302
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xcbdb5874
jmp 0x10002719
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8889a622
mov ecx, 0x1492de46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov ax, word [ebp - 0x196]
mov word [ebp - 0x12e], ax
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8889a622
mov ecx, 0xe1a0ddc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xa2be0e79
jmp 0x10002719
mov ax, word [ebp - 0x12e]
add ax, 0x502e
add ax, 1
sub ax, 0x502e
mov word [ebp - 0x196], ax
mov dword [ebp - 0x1a0], 0x783c9bb6
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x855ffa24
jmp 0x10002719
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1a0], 0x4a2b51b8
jmp 0x10002719
mov eax, dword [ebp - 0x12c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1a0], 0xde02593a
jmp 0x10002719
mov eax, dword [ebp - 0x128]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xaf52286b
jmp 0x10002719
mov eax, dword [0x1006eb58]
mov ecx, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6e594d43
mov ecx, 0x45c32008
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov ecx, dword [0x1006eb58]
mov eax, dword [0x1006eb54]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e594d43
mov ecx, 0xe7ee71b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002719
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007ec0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x174], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10008ae0
add esp, 0xc
mov dword [ebp - 0x1a0], 0x30e0cb33
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x3d1a8c12
jmp 0x10002719
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x1a0], 0x8a5cf0
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x5eb5c45a
jmp 0x10002719
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x190]
mov ecx, dword [ecx + 0x3c]
add eax, 0x70ea91af
add eax, ecx
sub eax, 0x70ea91af
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov dword [ebp - 0x1a0], 0x511c9311
jmp 0x10002719
mov dword [ebp - 0x1a0], 0xd4a5082a
jmp 0x10002719
mov eax, dword [ebp - 0x144]
movzx ecx, word [ebp - 0x196]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1a0], 0x794ec0ce
jmp 0x10002719
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1a0], 0x13f74a64
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x1492de46
jmp 0x10002719
mov dword [ebp - 0x1a0], 0x45c32008
jmp 0x10001219