Function at 0x10008390
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1a8
mov eax, dword [ebp + 8]
mov eax, dword [0x1008f080]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x190], 0xef889c37
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x194], eax
sub eax, 0x81a70fa4
je 0x10009545
jmp 0x100083da
mov eax, dword [ebp - 0x194]
sub eax, 0x840f6751
je 0x100093c4
jmp 0x100083f0
mov eax, dword [ebp - 0x194]
sub eax, 0x85c02c2e
je 0x10009524
jmp 0x10008406
mov eax, dword [ebp - 0x194]
sub eax, 0x89327cce
je 0x10008eda
jmp 0x1000841c
mov eax, dword [ebp - 0x194]
sub eax, 0x8d660335
je 0x10009133
jmp 0x10008432
mov eax, dword [ebp - 0x194]
sub eax, 0x8e7d8f8a
je 0x10008ba7
jmp 0x10008448
mov eax, dword [ebp - 0x194]
sub eax, 0x944f5e33
je 0x10008e9d
jmp 0x1000845e
mov eax, dword [ebp - 0x194]
sub eax, 0x9746422c
je 0x100095d9
jmp 0x10008474
mov eax, dword [ebp - 0x194]
sub eax, 0x98482404
je 0x10008ad1
jmp 0x1000848a
mov eax, dword [ebp - 0x194]
sub eax, 0x9e08d247
je 0x100092dc
jmp 0x100084a0
mov eax, dword [ebp - 0x194]
sub eax, 0xa41f9e39
je 0x10009276
jmp 0x100084b6
mov eax, dword [ebp - 0x194]
sub eax, 0xa543990e
je 0x10009460
jmp 0x100084cc
mov eax, dword [ebp - 0x194]
sub eax, 0xa90d3ea7
je 0x10008eac
jmp 0x100084e2
mov eax, dword [ebp - 0x194]
sub eax, 0xab394c4a
je 0x1000918a
jmp 0x100084f8
mov eax, dword [ebp - 0x194]
sub eax, 0xac4e6a9e
je 0x1000959a
jmp 0x1000850e
mov eax, dword [ebp - 0x194]
sub eax, 0xaf67c119
je 0x1000932d
jmp 0x10008524
mov eax, dword [ebp - 0x194]
sub eax, 0xb09762aa
je 0x100093d3
jmp 0x1000853a
mov eax, dword [ebp - 0x194]
sub eax, 0xb649809b
je 0x100094e0
jmp 0x10008550
mov eax, dword [ebp - 0x194]
sub eax, 0xb791df0d
je 0x10008db1
jmp 0x10008566
mov eax, dword [ebp - 0x194]
sub eax, 0xb813f51c
je 0x10009095
jmp 0x1000857c
mov eax, dword [ebp - 0x194]
sub eax, 0xbbfb703c
je 0x100092cd
jmp 0x10008592
mov eax, dword [ebp - 0x194]
sub eax, 0xcfb72eb5
je 0x10008da2
jmp 0x100085a8
mov eax, dword [ebp - 0x194]
sub eax, 0xd21bfa8a
je 0x10008a37
jmp 0x100085be
mov eax, dword [ebp - 0x194]
sub eax, 0xd2f7b211
je 0x1000940f
jmp 0x100085d4
mov eax, dword [ebp - 0x194]
sub eax, 0xd413d582
je 0x100094ef
jmp 0x100085ea
mov eax, dword [ebp - 0x194]
sub eax, 0xde05485e
je 0x10008b3d
jmp 0x10008600
mov eax, dword [ebp - 0x194]
sub eax, 0xde131fb4
je 0x10008f05
jmp 0x10008616
mov eax, dword [ebp - 0x194]
sub eax, 0xe9c330c0
je 0x10008e27
jmp 0x1000862c
mov eax, dword [ebp - 0x194]
sub eax, 0xec97e67f
je 0x1000963d
jmp 0x10008642
mov eax, dword [ebp - 0x194]
sub eax, 0xee0ec180
je 0x10008a16
jmp 0x10008658
mov eax, dword [ebp - 0x194]
sub eax, 0xef889c37
je 0x100088af
jmp 0x1000866e
mov eax, dword [ebp - 0x194]
sub eax, 0xfaed6d21
je 0x10009007
jmp 0x10008684
mov eax, dword [ebp - 0x194]
sub eax, 0xfb60feff
je 0x1000892d
jmp 0x1000869a
mov eax, dword [ebp - 0x194]
sub eax, 0xfe9b1d11
je 0x100095f7
jmp 0x100086b0
mov eax, dword [ebp - 0x194]
sub eax, 0xfea5dfba
je 0x10008d2f
jmp 0x100086c6
mov eax, dword [ebp - 0x194]
sub eax, 0xffb84de2
je 0x10008b98
jmp 0x100086dc
mov eax, dword [ebp - 0x194]
sub eax, 0x2425ef9
je 0x10008ab2
jmp 0x100086f2
mov eax, dword [ebp - 0x194]
sub eax, 0x440a0a0
je 0x100095e8
jmp 0x10008708
mov eax, dword [ebp - 0x194]
sub eax, 0xad0e115
je 0x10008fc4
jmp 0x1000871e
mov eax, dword [ebp - 0x194]
sub eax, 0x14abb8c3
je 0x100089ef
jmp 0x10008734
mov eax, dword [ebp - 0x194]
sub eax, 0x1ccc6968
je 0x10008aec
jmp 0x1000874a
mov eax, dword [ebp - 0x194]
sub eax, 0x1db93bc0
je 0x10008fe5
jmp 0x10008760
mov eax, dword [ebp - 0x194]
sub eax, 0x2f68181a
je 0x100091f1
jmp 0x10008776
mov eax, dword [ebp - 0x194]
sub eax, 0x328cb6a4
je 0x10008a46
jmp 0x1000878c
mov eax, dword [ebp - 0x194]
sub eax, 0x3bfe5807
je 0x10008bb6
jmp 0x100087a2
mov eax, dword [ebp - 0x194]
sub eax, 0x4953555c
je 0x10008f56
jmp 0x100087b8
mov eax, dword [ebp - 0x194]
sub eax, 0x4988b645
je 0x100093e2
jmp 0x100087ce
mov eax, dword [ebp - 0x194]
sub eax, 0x59921f66
je 0x10008cde
jmp 0x100087e4
mov eax, dword [ebp - 0x194]
sub eax, 0x646ccc49
je 0x10008ccf
jmp 0x100087fa
mov eax, dword [ebp - 0x194]
sub eax, 0x66863af8
je 0x100088ff
jmp 0x10008810
mov eax, dword [ebp - 0x194]
sub eax, 0x672261bb
je 0x10009200
jmp 0x10008826
mov eax, dword [ebp - 0x194]
sub eax, 0x673eb25c
je 0x1000891e
jmp 0x1000883c
mov eax, dword [ebp - 0x194]
sub eax, 0x6f2db7f3
je 0x10008a97
jmp 0x10008852
mov eax, dword [ebp - 0x194]
sub eax, 0x73e11787
je 0x10009606
jmp 0x10008868
mov eax, dword [ebp - 0x194]
sub eax, 0x767db23f
je 0x10009510
jmp 0x1000887e
mov eax, dword [ebp - 0x194]
sub eax, 0x7ad790f0
je 0x10008c2c
jmp 0x10008894
mov eax, dword [ebp - 0x194]
sub eax, 0x7f987575
je 0x10009074
jmp 0x100088aa
jmp 0x10009659
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10023620
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x190], 0x66863af8
jmp 0x10009659
mov eax, 0x673eb25c
mov ecx, 0xfb60feff
cmp dword [ebp - 0x168], 0
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0x767db23f
jmp 0x10009659
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x11c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x168]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x110]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x190], 0x14abb8c3
jmp 0x10009659
mov eax, dword [ebp - 0x15c]
mov ecx, 0xffffffff
cmp eax, ecx
sete al
and al, 1
mov byte [ebp - 0x155], al
mov dword [ebp - 0x190], 0xee0ec180
jmp 0x10009659
mov dl, byte [ebp - 0x155]
mov eax, 0x328cb6a4
mov ecx, 0xd21bfa8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0x767db23f
jmp 0x10009659
mov eax, dword [ebp - 0x170]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x190], 0x6f2db7f3
jmp 0x10009659
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x190], 0x2425ef9
jmp 0x10009659
mov eax, 0x98482404
mov ecx, 0x3bfe5807
cmp dword [ebp - 0x174], 0
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x190], 0x1ccc6968
jmp 0x10009659
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
mov edx, eax
sub edx, 0xaadfe3f2
sub edx, 1
add edx, 0xaadfe3f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85c02c2e
mov ecx, 0xde05485e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85c02c2e
mov ecx, 0xffb84de2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0x8e7d8f8a
jmp 0x10009659
mov dword [ebp - 0x190], 0x767db23f
jmp 0x10009659
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
mov edx, ecx
sub edx, 0x245c6133
sub edx, 1
add edx, 0x245c6133
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x81a70fa4
mov ecx, 0x7ad790f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov eax, dword [ebp - 0x174]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x14c], eax
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
mov edx, eax
sub edx, 0xa14f209f
sub edx, 1
add edx, 0xa14f209f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81a70fa4
mov ecx, 0x646ccc49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0x59921f66
jmp 0x10009659
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
mov edx, eax
add edx, 0x8e8574ec
sub edx, 1
sub edx, 0x8e8574ec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac4e6a9e
mov ecx, 0xfea5dfba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x14c]
sub eax, 0x793af029
add eax, ecx
add eax, 0x793af029
mov dword [ebp - 0x180], eax
mov word [ebp - 0x182], 0
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac4e6a9e
mov ecx, 0xcfb72eb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0xb791df0d
jmp 0x10009659
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
mov edx, ecx
add edx, 0x5d89cdde
sub edx, 1
sub edx, 0x5d89cdde
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9746422c
mov ecx, 0xe9c330c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
mov edx, ecx
sub edx, 0xe85ed98c
sub edx, 1
add edx, 0xe85ed98c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9746422c
mov ecx, 0x944f5e33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0xa90d3ea7
jmp 0x10009659
movzx eax, word [ebp - 0x182]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x180]
add eax, 4
add eax, 2
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x190], 0x89327cce
jmp 0x10009659
mov eax, dword [ebp - 0x144]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x148]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x13d], al
mov dword [ebp - 0x190], 0xde131fb4
jmp 0x10009659
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
mov edx, eax
sub edx, 0x23d8c211
sub edx, 1
add edx, 0x23d8c211
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x440a0a0
mov ecx, 0x4953555c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x440a0a0
mov ecx, 0xad0e115
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dl, byte [ebp - 0x13d]
mov eax, 0x4988b645
mov ecx, 0x1db93bc0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x190], 0xfaed6d21
jmp 0x10009659
mov eax, dword [ebp - 0x180]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
movzx ecx, word [ebp - 0x182]
imul ecx, ecx, 0x28
add eax, 0x65f07b0c
add eax, ecx
sub eax, 0x65f07b0c
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10030930
call fcn.10026f80
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x135], al
mov dword [ebp - 0x190], 0x7f987575
jmp 0x10009659
mov dl, byte [ebp - 0x135]
mov eax, 0xb813f51c
mov ecx, 0x2f68181a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 0xc]
add edx, 0x9b0df293
add edx, eax
sub edx, 0x9b0df293
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x189], al
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x190], 0x8d660335
jmp 0x10009659
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x130]
add ecx, 0x5ae7f78d
add ecx, eax
sub ecx, 0x5ae7f78d
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x134]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10023780
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x190], 0xab394c4a
jmp 0x10009659
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 0xc]
add esi, 0x36ff059b
add esi, eax
sub esi, 0x36ff059b
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x120]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x189], al
mov dword [ebp - 0x190], 0x2f68181a
jmp 0x10009659
mov dword [ebp - 0x190], 0x672261bb
jmp 0x10009659
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
mov edx, ecx
add edx, 0xa2a04e82
sub edx, 1
sub edx, 0xa2a04e82
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe9b1d11
mov ecx, 0xa41f9e39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov ax, word [ebp - 0x182]
mov word [ebp - 0x126], ax
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe9b1d11
mov ecx, 0xbbfb703c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0x9e08d247
jmp 0x10009659
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
mov edx, eax
add edx, 0x5ee1e887
sub edx, 1
sub edx, 0x5ee1e887
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73e11787
mov ecx, 0xaf67c119
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov ax, word [ebp - 0x126]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x182], ax
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
mov edx, ecx
sub edx, 0x9d71e23f
sub edx, 1
add edx, 0x9d71e23f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x73e11787
mov ecx, 0x840f6751
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0xb09762aa
jmp 0x10009659
mov dword [ebp - 0x190], 0xa90d3ea7
jmp 0x10009659
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x190], 0xd2f7b211
jmp 0x10009659
mov eax, dword [0x1009053c]
mov ecx, dword [0x10090538]
mov edx, eax
add edx, 0x37e9da02
sub edx, 1
sub edx, 0x37e9da02
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec97e67f
mov ecx, 0xa543990e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [0x1009053c]
mov eax, dword [0x10090538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec97e67f
mov ecx, 0xb649809b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x10009659
mov dword [ebp - 0x190], 0xd413d582
jmp 0x10009659
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x190], 0x767db23f
jmp 0x10009659
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10022880
add esp, 0x1a8
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x190], 0xde05485e
jmp 0x10009659
mov eax, dword [ebp - 0x174]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x190], 0x7ad790f0
jmp 0x10009659
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
sub eax, 0xbeb4b731
add eax, ecx
add eax, 0xbeb4b731
mov dword [ebp - 0x180], eax
mov word [ebp - 0x182], 0
mov dword [ebp - 0x190], 0xfea5dfba
jmp 0x10009659
mov dword [ebp - 0x190], 0xe9c330c0
jmp 0x10009659
mov dword [ebp - 0x190], 0x4953555c
jmp 0x10009659
mov dword [ebp - 0x190], 0xa41f9e39
jmp 0x10009659
mov ax, word [ebp - 0x126]
mov ax, word [ebp - 0x126]
mov ax, word [ebp - 0x126]
add ax, 0xd30b
add ax, 1
sub ax, 0xd30b
mov word [ebp - 0x182], ax
mov dword [ebp - 0x190], 0xaf67c119
jmp 0x10009659
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x190], 0xa543990e
jmp 0x100083be