Function at 0x100010d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x198
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x10068800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x198], 0xe2af8efe
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
sub eax, 0x87c83110
je 0x10001c9c
jmp 0x10001114
mov eax, dword [ebp - 0x1a0]
sub eax, 0x91899df4
je 0x1000181a
jmp 0x1000112a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9c29a9df
je 0x10001a3c
jmp 0x10001140
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9e0b9f18
je 0x1000220c
jmp 0x10001156
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9e44655a
je 0x10001eb9
jmp 0x1000116c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9f46b7e9
je 0x1000221b
jmp 0x10001182
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa25234ea
je 0x10001a21
jmp 0x10001198
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa4b53154
je 0x1000229f
jmp 0x100011ae
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb89cc7a8
je 0x100023eb
jmp 0x100011c4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc2497ed3
je 0x10001d10
jmp 0x100011da
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc49aef78
je 0x10001b0d
jmp 0x100011f0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xced06dfd
je 0x10001f1f
jmp 0x10001206
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd0e83118
je 0x10001c4b
jmp 0x1000121c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd63f1f8c
je 0x100024bb
jmp 0x10001232
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdca80935
je 0x10001a00
jmp 0x10001248
mov eax, dword [ebp - 0x1a0]
sub eax, 0xde960db3
je 0x10001902
jmp 0x1000125e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdf4c5e12
je 0x10001f5c
jmp 0x10001274
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe2af8efe
je 0x1000162b
jmp 0x1000128a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xee3e312d
je 0x100020b4
jmp 0x100012a0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf7e86b78
je 0x1000253a
jmp 0x100012b6
mov eax, dword [ebp - 0x1a0]
sub eax, 0xfb675f1d
je 0x10001c3c
jmp 0x100012cc
mov eax, dword [ebp - 0x1a0]
sub eax, 0xfb7bce98
je 0x1000179e
jmp 0x100012e2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4bd28a
je 0x1000227e
jmp 0x100012f8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6a39dae
je 0x10002261
jmp 0x1000130e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7e8e26f
je 0x100018b1
jmp 0x10001324
mov eax, dword [ebp - 0x1a0]
sub eax, 0xef453a4
je 0x10001e8c
jmp 0x1000133a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf35fbb5
je 0x10001e22
jmp 0x10001350
mov eax, dword [ebp - 0x1a0]
sub eax, 0x125906a8
je 0x10002398
jmp 0x10001366
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1500920b
je 0x10001730
jmp 0x1000137c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1a6bc384
je 0x10001978
jmp 0x10001392
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1b9a068e
je 0x10001dd1
jmp 0x100013a8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1e460b5d
je 0x10001d1f
jmp 0x100013be
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1facc714
je 0x10002238
jmp 0x100013d4
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2a799d56
je 0x10001fd2
jmp 0x100013ea
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2b0dc26f
je 0x10001896
jmp 0x10001400
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2b78404e
je 0x10001ee3
jmp 0x10001416
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2cad65b2
je 0x10002309
jmp 0x1000142c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2e481644
je 0x100021a2
jmp 0x10001442
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2e5e2c23
je 0x100024ca
jmp 0x10001458
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2e89dcf8
je 0x10002461
jmp 0x1000146e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x30fdc213
je 0x10001b99
jmp 0x10001484
mov eax, dword [ebp - 0x1a0]
sub eax, 0x318a8a2c
je 0x100022c0
jmp 0x1000149a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x31a3d683
je 0x10001b2b
jmp 0x100014b0
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3e504658
je 0x10001ab2
jmp 0x100014c6
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3e8ead16
je 0x1000240c
jmp 0x100014dc
mov eax, dword [ebp - 0x1a0]
sub eax, 0x46ffe548
je 0x10001dc2
jmp 0x100014f2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x47285f53
je 0x1000212c
jmp 0x10001508
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4796183c
je 0x10001e9b
jmp 0x1000151e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4d079360
je 0x10001887
jmp 0x10001534
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4d5ee577
je 0x100016c1
jmp 0x1000154a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x50050539
je 0x1000180b
jmp 0x10001560
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5795b4a9
je 0x100016d0
jmp 0x10001576
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5969a1fb
je 0x10001b1c
jmp 0x1000158c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5c08ab27
je 0x100023dc
jmp 0x100015a2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6216216a
je 0x100016a2
jmp 0x100015b8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x716d0e29
je 0x10002093
jmp 0x100015ce
mov eax, dword [ebp - 0x1a0]
sub eax, 0x71e82a31
je 0x100023a9
jmp 0x100015e4
mov eax, dword [ebp - 0x1a0]
sub eax, 0x769ce6c3
je 0x100024a3
jmp 0x100015fa
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7efc7c36
je 0x10001d70
jmp 0x10001610
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7f8d3150
je 0x10002389
jmp 0x10001626
jmp 0x10002556
mov eax, dword [ebp - 0x19c]
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x16c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000bd50
add esp, 0xc
mov eax, dword [ebp - 0x16c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x198], 0x6216216a
jmp 0x10002556
mov eax, 0x4d5ee577
mov ecx, 0x5795b4a9
cmp dword [ebp - 0x174], 0
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x125906a8
jmp 0x10002556
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x198], 0x1500920b
jmp 0x10002556
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x71e82a31
mov ecx, 0xfb7bce98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71e82a31
mov ecx, 0x50050539
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x91899df4
jmp 0x10002556
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x17c], eax
mov edx, 0xffffffff
mov eax, 0x2b0dc26f
mov ecx, 0x4d079360
cmp dword [ebp - 0x17c], edx
cmove eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x125906a8
jmp 0x10002556
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x198], 0x7e8e26f
jmp 0x10002556
mov eax, dword [ebp - 0x158]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x198], 0xde960db3
jmp 0x10002556
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
mov edx, ecx
add edx, 0x8db4e364
sub edx, 1
sub edx, 0x8db4e364
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c08ab27
mov ecx, 0x1a6bc384
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
cmp dword [ebp - 0x180], 0
setne al
and al, 1
mov byte [ebp - 0x151], al
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
mov edx, ecx
sub edx, 0x6f5214f8
sub edx, 1
add edx, 0x6f5214f8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c08ab27
mov ecx, 0xdca80935
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dl, byte [ebp - 0x151]
mov eax, 0xa25234ea
mov ecx, 0x31a3d683
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x198], 0x9c29a9df
jmp 0x10002556
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
mov edx, ecx
sub edx, 0x36b36a98
sub edx, 1
add edx, 0x36b36a98
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb89cc7a8
mov ecx, 0x3e504658
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x150]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb89cc7a8
mov ecx, 0xc49aef78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x5969a1fb
jmp 0x10002556
mov dword [ebp - 0x198], 0x125906a8
jmp 0x10002556
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e8ead16
mov ecx, 0x30fdc213
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x14c], eax
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
mov edx, eax
add edx, 0x347fab7f
sub edx, 1
sub edx, 0x347fab7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e8ead16
mov ecx, 0xfb675f1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0xd0e83118
jmp 0x10002556
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
mov edx, eax
sub edx, 0x1016e1b6
sub edx, 1
add edx, 0x1016e1b6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e89dcf8
mov ecx, 0x87c83110
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x14c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18c], eax
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
mov edx, eax
add edx, 0xf629c80
sub edx, 1
sub edx, 0xf629c80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e89dcf8
mov ecx, 0xc2497ed3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x1e460b5d
jmp 0x10002556
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
mov edx, eax
sub edx, 0x7e2a6531
sub edx, 1
add edx, 0x7e2a6531
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x769ce6c3
mov ecx, 0x7efc7c36
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov word [ebp - 0x18e], 0
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x769ce6c3
mov ecx, 0x46ffe548
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x1b9a068e
jmp 0x10002556
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
mov edx, eax
add edx, 0xdb3eec8f
sub edx, 1
sub edx, 0xdb3eec8f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd63f1f8c
mov ecx, 0xf35fbb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
movzx eax, word [ebp - 0x18e]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x144], eax
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
mov edx, eax
sub edx, 0x9aa00e4e
sub edx, 1
add edx, 0x9aa00e4e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd63f1f8c
mov ecx, 0xef453a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x4796183c
jmp 0x10002556
mov eax, dword [ebp - 0x144]
add eax, 4
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x198], 0x9e44655a
jmp 0x10002556
mov eax, dword [ebp - 0x140]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x148]
mov eax, 0x4bd28a
mov ecx, 0x2b78404e
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x18c]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x198], 0xced06dfd
jmp 0x10002556
mov eax, dword [ebp - 0x138]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x13c]
add eax, 0xc1e63d3e
add eax, ecx
sub eax, 0xc1e63d3e
mov dword [ebp - 0x134], eax
movzx eax, word [ebp - 0x18e]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x198], 0xdf4c5e12
jmp 0x10002556
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
mov edx, ecx
sub edx, 0x41116e59
sub edx, 1
add edx, 0x41116e59
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2e5e2c23
mov ecx, 0x2a799d56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x130]
imul ecx, eax, 0x28
mov eax, dword [ebp - 0x134]
sub eax, 0x4cd71aa6
add eax, ecx
add eax, 0x4cd71aa6
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000e0c0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x129], al
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
mov edx, ecx
add edx, 0xc46eaab0
sub edx, 1
sub edx, 0xc46eaab0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2e5e2c23
mov ecx, 0x716d0e29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dl, byte [ebp - 0x129]
mov eax, 0xee3e312d
mov ecx, 0x9e0b9f18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x194]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x168]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x198], 0x47285f53
jmp 0x10002556
mov eax, dword [ebp - 0x194]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x128]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x194]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x194]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000beb0
add esp, 0xc
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x198], 0x2e481644
jmp 0x10002556
mov eax, dword [ebp - 0x194]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x178]
mov eax, dword [ebp - 0x194]
mov eax, dword [eax + 0xc]
add esi, 0x6ec2af9
add esi, eax
sub esi, 0x6ec2af9
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x124]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov dword [ebp - 0x198], 0x9e0b9f18
jmp 0x10002556
mov dword [ebp - 0x198], 0x9f46b7e9
jmp 0x10002556
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x120], ax
mov dword [ebp - 0x198], 0x1facc714
jmp 0x10002556
mov ax, word [ebp - 0x120]
sub ax, 0x812a
add ax, 1
add ax, 0x812a
mov word [ebp - 0x11e], ax
mov dword [ebp - 0x198], 0x6a39dae
jmp 0x10002556
mov ax, word [ebp - 0x11e]
mov word [ebp - 0x18e], ax
mov dword [ebp - 0x198], 0x1b9a068e
jmp 0x10002556
mov eax, dword [ebp - 0x17c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0xa4b53154
jmp 0x10002556
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0x318a8a2c
jmp 0x10002556
mov eax, dword [0x10069b30]
mov ecx, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf7e86b78
mov ecx, 0x2cad65b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10069b30]
mov eax, dword [0x10069b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf7e86b78
mov ecx, 0x7f8d3150
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002556
mov dword [ebp - 0x198], 0x125906a8
jmp 0x10002556
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000b150
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x198], 0xfb7bce98
jmp 0x10002556
mov dword [ebp - 0x198], 0x1a6bc384
jmp 0x10002556
mov eax, dword [ebp - 0x150]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0x3e504658
jmp 0x10002556
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x198], 0x30fdc213
jmp 0x10002556
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
sub eax, 0x4c30f4ad
add eax, ecx
add eax, 0x4c30f4ad
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x198], 0x87c83110
jmp 0x10002556
mov word [ebp - 0x18e], 0
mov dword [ebp - 0x198], 0x7efc7c36
jmp 0x10002556
mov dword [ebp - 0x198], 0xf35fbb5
jmp 0x10002556
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
imul ecx, eax, 0x28
mov eax, dword [ebp - 0x134]
sub eax, 0xb1220e67
add eax, ecx
add eax, 0xb1220e67
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000e0c0
add esp, 8
mov dword [ebp - 0x198], 0x2a799d56
jmp 0x10002556
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0x2cad65b2
jmp 0x100010f8