Function at 0x100011e0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b0
mov eax, dword [ebp + 8]
mov eax, dword [0x10068800]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x19c], 0xc2ba0f7e
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], eax
sub eax, 0x83799e61
je 0x10001a78
jmp 0x1000122b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x843c4e75
je 0x10002762
jmp 0x10001241
mov eax, dword [ebp - 0x1a0]
sub eax, 0x85a222b4
je 0x10002630
jmp 0x10001257
mov eax, dword [ebp - 0x1a0]
sub eax, 0x897ffed5
je 0x10001fc5
jmp 0x1000126d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x89fee134
je 0x10001dce
jmp 0x10001283
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8deb00a5
je 0x10002131
jmp 0x10001299
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8e3f03a7
je 0x10002a9f
jmp 0x100012af
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9364d3fa
je 0x10002867
jmp 0x100012c5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x93ea2b8c
je 0x10001ec0
jmp 0x100012db
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9757f21f
je 0x10001a20
jmp 0x100012f1
mov eax, dword [ebp - 0x1a0]
sub eax, 0x99eb3fb6
je 0x10001d56
jmp 0x10001307
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9c4aef3d
je 0x10001c05
jmp 0x1000131d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9dc3f1a5
je 0x10002440
jmp 0x10001333
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9dd8c365
je 0x10001d47
jmp 0x10001349
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa2bef29d
je 0x10001a69
jmp 0x1000135f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa3674a07
je 0x10002bcb
jmp 0x10001375
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa4c5b669
je 0x10001c46
jmp 0x1000138b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa5c33dd8
je 0x10002b4d
jmp 0x100013a1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa600390f
je 0x100021f8
jmp 0x100013b7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa6bb452c
je 0x100025a1
jmp 0x100013cd
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaa7ecad9
je 0x10002753
jmp 0x100013e3
mov eax, dword [ebp - 0x1a0]
sub eax, 0xad5dd6f1
je 0x1000294b
jmp 0x100013f9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb35a1247
je 0x10001e6f
jmp 0x1000140f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb4fae3ab
je 0x10002621
jmp 0x10001425
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb800e497
je 0x1000293c
jmp 0x1000143b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbcc7f5c8
je 0x100020a8
jmp 0x10001451
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbced598b
je 0x100029ae
jmp 0x10001467
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbec78cb7
je 0x1000201d
jmp 0x1000147d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbf15dd3b
je 0x10002550
jmp 0x10001493
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc2ba0f7e
je 0x1000188c
jmp 0x100014a9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc368f993
je 0x1000200e
jmp 0x100014bf
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc752e99f
je 0x100020e0
jmp 0x100014d5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc7b47145
je 0x1000296c
jmp 0x100014eb
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc9b535e8
je 0x100019a9
jmp 0x10001501
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd2f4a7ae
je 0x10001f57
jmp 0x10001517
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd39e72ee
je 0x10001c37
jmp 0x1000152d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd428b42d
je 0x1000239c
jmp 0x10001543
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf44d3c1d
je 0x10001c14
jmp 0x10001559
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf6066075
je 0x1000282f
jmp 0x1000156f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf6b0d1d1
je 0x10002219
jmp 0x10001585
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf7d68b2f
je 0x10001f48
jmp 0x1000159b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xfc6c1a21
je 0x100019d7
jmp 0x100015b1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xfd81452e
je 0x10002bb2
jmp 0x100015c7
mov eax, dword [ebp - 0x1a0]
sub eax, 0x15984c4
je 0x100024ae
jmp 0x100015dd
mov eax, dword [ebp - 0x1a0]
sub eax, 0x25165d8
je 0x10002b81
jmp 0x100015f3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4aacf33
je 0x1000283e
jmp 0x10001609
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4feba82
je 0x10001d7d
jmp 0x1000161f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xafdd407
je 0x1000298d
jmp 0x10001635
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd98fe87
je 0x10001e54
jmp 0x1000164b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x12c1ffa5
je 0x10002aea
jmp 0x10001661
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1862a484
je 0x100028dd
jmp 0x10001677
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1c7487a6
je 0x10002aff
jmp 0x1000168d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x23830543
je 0x10002317
jmp 0x100016a3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x23e9619b
je 0x10001b21
jmp 0x100016b9
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2f2e8ce6
je 0x10002bda
jmp 0x100016cf
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3a0552be
je 0x1000252f
jmp 0x100016e5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3deccd7b
je 0x100019b8
jmp 0x100016fb
mov eax, dword [ebp - 0x1a0]
sub eax, 0x447ca94b
je 0x100018fa
jmp 0x10001711
mov eax, dword [ebp - 0x1a0]
sub eax, 0x451e7c36
je 0x100027d0
jmp 0x10001727
mov eax, dword [ebp - 0x1a0]
sub eax, 0x470e61db
je 0x1000228f
jmp 0x1000173d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4c025694
je 0x10001e33
jmp 0x10001753
mov eax, dword [ebp - 0x1a0]
sub eax, 0x58c3aaa3
je 0x1000208a
jmp 0x10001769
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5ce73e40
je 0x100029c3
jmp 0x1000177f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5d073912
je 0x10002a22
jmp 0x10001795
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5f0d2364
je 0x10001cb4
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5ce73e40
mov ecx, 0x447ca94b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cd40
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x174], eax
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5ce73e40
mov ecx, 0xc9b535e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x3deccd7b
jmp 0x10002bf2
mov eax, 0xfc6c1a21
mov ecx, 0x83799e61
cmp dword [ebp - 0x174], 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a6b5f2d
mov ecx, 0x9757f21f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a6b5f2d
mov ecx, 0xa2bef29d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0xbced598b
jmp 0x10002bf2
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x19c], 0x61ff33bf
jmp 0x10002bf2
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x164]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x114]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x17c], eax
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
mov edx, ecx
add edx, 0xb0cc8297
sub edx, 1
sub edx, 0xb0cc8297
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d073912
mov ecx, 0x9c4aef3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0xf44d3c1d
jmp 0x10002bf2
mov edx, 0xffffffff
mov eax, 0xa4c5b669
mov ecx, 0xd39e72ee
cmp dword [ebp - 0x17c], edx
cmove eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0xbced598b
jmp 0x10002bf2
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8e3f03a7
mov ecx, 0x5f0d2364
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x99eb3fb6
jmp 0x10002bf2
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x19c], 0x4feba82
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0x812a3e87
sub edx, 1
add edx, 0x812a3e87
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12c1ffa5
mov ecx, 0x89fee134
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [ebp - 0x15c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0x364b03db
sub edx, 1
add edx, 0x364b03db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12c1ffa5
mov ecx, 0x4c025694
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dl, byte [ebp - 0x155]
mov eax, 0xd98fe87
mov ecx, 0xbec78cb7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x19c], 0xb35a1247
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0x409f928d
sub edx, 1
add edx, 0x409f928d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c7487a6
mov ecx, 0x93ea2b8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
mov edx, ecx
sub edx, 0x2d3ea242
sub edx, 1
add edx, 0x2d3ea242
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c7487a6
mov ecx, 0xf7d68b2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0xd2f4a7ae
jmp 0x10002bf2
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x76dc16a7
mov ecx, 0x897ffed5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76dc16a7
mov ecx, 0xc368f993
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0xbced598b
jmp 0x10002bf2
mov eax, dword [ebp - 0x180]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x19c], 0x58c3aaa3
jmp 0x10002bf2
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x19c], 0xbcc7f5c8
jmp 0x10002bf2
mov eax, dword [ebp - 0x150]
mov edx, dword [ebp - 0x148]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18c], eax
mov word [ebp - 0x18e], 0
mov dword [ebp - 0x19c], 0xc752e99f
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0xc70259e7
sub edx, 1
add edx, 0xc70259e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69bd71e6
mov ecx, 0x8deb00a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
movzx eax, word [ebp - 0x18e]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x18c]
mov ax, word [eax + 6]
mov word [ebp - 0x140], ax
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x69bd71e6
mov ecx, 0x73edf398
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dl, byte [ebp - 0x13d]
mov eax, 0xad5dd6f1
mov ecx, 0xf6b0d1d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
mov edx, ecx
add edx, 0x10f5336d
sub edx, 1
sub edx, 0x10f5336d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x73abed45
mov ecx, 0x470e61db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x18c]
movzx ecx, word [ecx + 0x14]
sub eax, 0x43ec9cd5
add eax, ecx
add eax, 0x43ec9cd5
mov dword [ebp - 0x13c], eax
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x136], ax
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73abed45
mov ecx, 0x23830543
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x736ebef8
jmp 0x10002bf2
mov ax, word [ebp - 0x136]
movzx eax, ax
imul edx, eax, 0x28
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x134], eax
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
mov edx, ecx
add edx, 0x1e18a2a2
sub edx, 1
sub edx, 0x1e18a2a2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa5c33dd8
mov ecx, 0x7872af75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x25165d8
mov ecx, 0x15984c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000f0b0
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x12d], al
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0xe0e1f458
sub edx, 1
add edx, 0xe0e1f458
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x25165d8
mov ecx, 0x3a0552be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dl, byte [ebp - 0x12d]
mov eax, 0xbf15dd3b
mov ecx, 0xaa7ecad9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0xdbe0f491
sub edx, 1
add edx, 0xdbe0f491
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfd81452e
mov ecx, 0xa6bb452c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x124], 0
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
mov edx, ecx
add edx, 0x41fe90e0
sub edx, 1
sub edx, 0x41fe90e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfd81452e
mov ecx, 0xb4fae3ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x85a222b4
jmp 0x10002bf2
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x194]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x195], al
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x19c], 0x7c9259fc
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x843c4e75
jmp 0x10002bf2
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa3674a07
mov ecx, 0x451e7c36
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x128], ax
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0x5efc7657
sub edx, 1
add edx, 0x5efc7657
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3674a07
mov ecx, 0xf6066075
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x4aacf33
jmp 0x10002bf2
mov ax, word [ebp - 0x128]
sub ax, 0x5f68
add ax, 1
add ax, 0x5f68
mov word [ebp - 0x126], ax
mov dword [ebp - 0x19c], 0x9364d3fa
jmp 0x10002bf2
mov ecx, dword [0x10069b40]
mov eax, dword [0x10069b3c]
mov edx, ecx
sub edx, 0x8d179e49
sub edx, 1
add edx, 0x8d179e49
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f2e8ce6
mov ecx, 0x1862a484
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov ax, word [ebp - 0x126]
mov word [ebp - 0x18e], ax
mov eax, dword [0x10069b40]
mov ecx, dword [0x10069b3c]
mov edx, eax
sub edx, 0x2aedb591
sub edx, 1
add edx, 0x2aedb591
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f2e8ce6
mov ecx, 0xb800e497
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0xc752e99f
jmp 0x10002bf2
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0xc7b47145
jmp 0x10002bf2
mov eax, dword [ebp - 0x180]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0xafdd407
jmp 0x10002bf2
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0xbced598b
jmp 0x10002bf2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000c140
add esp, 0x1b0
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cd40
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x19c], 0x447ca94b
jmp 0x10002bf2
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x164]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x114]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x19c], 0x23e9619b
jmp 0x10002bf2
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x19c], 0x5f0d2364
jmp 0x10002bf2
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x19c], 0x89fee134
jmp 0x10002bf2
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0x93ea2b8c
jmp 0x10002bf2
mov ax, word [ebp - 0x136]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x19c], 0xd428b42d
jmp 0x10002bf2
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000f0b0
mov dword [ebp - 0x19c], 0x15984c4
jmp 0x10002bf2
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x19c], 0xa6bb452c
jmp 0x10002bf2
mov dword [ebp - 0x19c], 0x451e7c36
jmp 0x10002bf2
mov ax, word [ebp - 0x126]
mov word [ebp - 0x18e], ax
mov dword [ebp - 0x19c], 0x1862a484
jmp 0x1000120f