Function at 0x10007260
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x10085080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xac], 0x8f9caa9a
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x87184eb9
je 0x10007c2f
jmp 0x100072a4
mov eax, dword [ebp - 0xb4]
sub eax, 0x89d4bede
je 0x100082ae
jmp 0x100072ba
mov eax, dword [ebp - 0xb4]
sub eax, 0x8f9caa9a
je 0x100077fd
jmp 0x100072d0
mov eax, dword [ebp - 0xb4]
sub eax, 0x99db23d8
je 0x10008817
jmp 0x100072e6
mov eax, dword [ebp - 0xb4]
sub eax, 0xa203c974
je 0x10007c9d
jmp 0x100072fc
mov eax, dword [ebp - 0xb4]
sub eax, 0xaa5775a9
je 0x100083ba
jmp 0x10007312
mov eax, dword [ebp - 0xb4]
sub eax, 0xae70c56f
je 0x100085dd
jmp 0x10007328
mov eax, dword [ebp - 0xb4]
sub eax, 0xb5a9a4f6
je 0x10008788
jmp 0x1000733e
mov eax, dword [ebp - 0xb4]
sub eax, 0xba46a5ba
je 0x10007a98
jmp 0x10007354
mov eax, dword [ebp - 0xb4]
sub eax, 0xbe8323f0
je 0x10007aaf
jmp 0x1000736a
mov eax, dword [ebp - 0xb4]
sub eax, 0xbf3f2436
je 0x1000850c
jmp 0x10007380
mov eax, dword [ebp - 0xb4]
sub eax, 0xbf45b5c0
je 0x100082e6
jmp 0x10007396
mov eax, dword [ebp - 0xb4]
sub eax, 0xc17d920b
je 0x10008273
jmp 0x100073ac
mov eax, dword [ebp - 0xb4]
sub eax, 0xc30655f5
je 0x10008868
jmp 0x100073c2
mov eax, dword [ebp - 0xb4]
sub eax, 0xc702cb1a
je 0x10007e24
jmp 0x100073d8
mov eax, dword [ebp - 0xb4]
sub eax, 0xc8e520c2
je 0x100087b2
jmp 0x100073ee
mov eax, dword [ebp - 0xb4]
sub eax, 0xca2e8940
je 0x100083ab
jmp 0x10007404
mov eax, dword [ebp - 0xb4]
sub eax, 0xcc309dc2
je 0x100080c6
jmp 0x1000741a
mov eax, dword [ebp - 0xb4]
sub eax, 0xce4e5472
je 0x1000800a
jmp 0x10007430
mov eax, dword [ebp - 0xb4]
sub eax, 0xceec84eb
je 0x10008155
jmp 0x10007446
mov eax, dword [ebp - 0xb4]
sub eax, 0xd033b42c
je 0x1000879d
jmp 0x1000745c
mov eax, dword [ebp - 0xb4]
sub eax, 0xd310ce5c
je 0x10008829
jmp 0x10007472
mov eax, dword [ebp - 0xb4]
sub eax, 0xd99d533c
je 0x10007dae
jmp 0x10007488
mov eax, dword [ebp - 0xb4]
sub eax, 0xdd93edb6
je 0x10007eb4
jmp 0x1000749e
mov eax, dword [ebp - 0xb4]
sub eax, 0xe1ae1548
je 0x10008629
jmp 0x100074b4
mov eax, dword [ebp - 0xb4]
sub eax, 0xf1547b00
je 0x1000855d
jmp 0x100074ca
mov eax, dword [ebp - 0xb4]
sub eax, 0xf3d6e27f
je 0x10008668
jmp 0x100074e0
mov eax, dword [ebp - 0xb4]
sub eax, 0xf8652628
je 0x10007a48
jmp 0x100074f6
mov eax, dword [ebp - 0xb4]
sub eax, 0xfa587488
je 0x1000796b
jmp 0x1000750c
mov eax, dword [ebp - 0xb4]
sub eax, 0xfbeaa61c
je 0x1000817f
jmp 0x10007522
mov eax, dword [ebp - 0xb4]
sub eax, 0xfed925ec
je 0x10007ea5
jmp 0x10007538
mov eax, dword [ebp - 0xb4]
sub eax, 0x2a0787
je 0x100081f3
jmp 0x1000754e
mov eax, dword [ebp - 0xb4]
sub eax, 0x3ecc410
je 0x10007d90
jmp 0x10007564
mov eax, dword [ebp - 0xb4]
sub eax, 0x837e3f2
je 0x100086f4
jmp 0x1000757a
mov eax, dword [ebp - 0xb4]
sub eax, 0x99361ac
je 0x10008688
jmp 0x10007590
mov eax, dword [ebp - 0xb4]
sub eax, 0x13600c6f
je 0x1000786b
jmp 0x100075a6
mov eax, dword [ebp - 0xb4]
sub eax, 0x17c32ef3
je 0x10007c20
jmp 0x100075bc
mov eax, dword [ebp - 0xb4]
sub eax, 0x1b393b67
je 0x10008036
jmp 0x100075d2
mov eax, dword [ebp - 0xb4]
sub eax, 0x1c74d50e
je 0x10008844
jmp 0x100075e8
mov eax, dword [ebp - 0xb4]
sub eax, 0x1daebeaa
je 0x100085ec
jmp 0x100075fe
mov eax, dword [ebp - 0xb4]
sub eax, 0x1fa9b89f
je 0x100084e0
jmp 0x10007614
mov eax, dword [ebp - 0xb4]
sub eax, 0x219a548d
je 0x10007d2d
jmp 0x1000762a
mov eax, dword [ebp - 0xb4]
sub eax, 0x2819caf5
je 0x10008146
jmp 0x10007640
mov eax, dword [ebp - 0xb4]
sub eax, 0x28fff719
je 0x10007ee1
jmp 0x10007656
mov eax, dword [ebp - 0xb4]
sub eax, 0x3083dd56
je 0x10008659
jmp 0x1000766c
mov eax, dword [ebp - 0xb4]
sub eax, 0x36a953ab
je 0x10008058
jmp 0x10007682
mov eax, dword [ebp - 0xb4]
sub eax, 0x371786dc
je 0x1000847c
jmp 0x10007698
mov eax, dword [ebp - 0xb4]
sub eax, 0x38295a34
je 0x10007922
jmp 0x100076ae
mov eax, dword [ebp - 0xb4]
sub eax, 0x41f29111
je 0x10007c02
jmp 0x100076c4
mov eax, dword [ebp - 0xb4]
sub eax, 0x430c9611
je 0x10008679
jmp 0x100076da
mov eax, dword [ebp - 0xb4]
sub eax, 0x4e3bdbd2
je 0x10007f57
jmp 0x100076f0
mov eax, dword [ebp - 0xb4]
sub eax, 0x5159e3ab
je 0x10007af8
jmp 0x10007706
mov eax, dword [ebp - 0xb4]
sub eax, 0x52b5923d
je 0x10007913
jmp 0x1000771c
mov eax, dword [ebp - 0xb4]
sub eax, 0x533d6540
je 0x10007a57
jmp 0x10007732
mov eax, dword [ebp - 0xb4]
sub eax, 0x53517066
je 0x10007ffb
jmp 0x10007748
mov eax, dword [ebp - 0xb4]
sub eax, 0x56ac68e5
je 0x100085fb
jmp 0x1000775e
mov eax, dword [ebp - 0xb4]
sub eax, 0x5fa2d878
je 0x10007a2a
jmp 0x10007774
mov eax, dword [ebp - 0xb4]
sub eax, 0x63bd146a
je 0x100081a2
jmp 0x1000778a
mov eax, dword [ebp - 0xb4]
sub eax, 0x665d0b04
je 0x1000832f
jmp 0x100077a0
mov eax, dword [ebp - 0xb4]
sub eax, 0x6b1b3eb7
je 0x100084d1
jmp 0x100077b6
mov eax, dword [ebp - 0xb4]
sub eax, 0x72725b40
je 0x10008264
jmp 0x100077cc
mov eax, dword [ebp - 0xb4]
sub eax, 0x7422dd0b
je 0x10007ed2
jmp 0x100077e2
mov eax, dword [ebp - 0xb4]
sub eax, 0x7b1d2f3d
je 0x10007d1e
jmp 0x100077f8
jmp 0x1000887c
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x430c9611
mov ecx, 0x13600c6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x430c9611
mov ecx, 0x52b5923d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0x38295a34
jmp 0x1000887c
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99361ac
mov ecx, 0xfa587488
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10018b00
add esp, 0xc
mov eax, dword [ebp - 0xa4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x6d], al
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
mov edx, eax
sub edx, 0x9ca7d2c3
sub edx, 1
add edx, 0x9ca7d2c3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99361ac
mov ecx, 0x5fa2d878
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dl, byte [ebp - 0x6d]
mov eax, 0xf8652628
mov ecx, 0x533d6540
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xf3d6e27f
jmp 0x1000887c
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
lea eax, [ebp - 0x18]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xac], 0xba46a5ba
jmp 0x1000887c
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xac], 0xbe8323f0
jmp 0x1000887c
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x837e3f2
mov ecx, 0x5159e3ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x61], al
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
sub edx, 0xfb25bfd4
sub edx, 1
add edx, 0xfb25bfd4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x837e3f2
mov ecx, 0x41f29111
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dl, byte [ebp - 0x61]
mov eax, 0x87184eb9
mov ecx, 0x17c32ef3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xf3d6e27f
jmp 0x1000887c
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb5a9a4f6
mov ecx, 0xa203c974
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
add edx, 0x63e36e7f
sub edx, 1
sub edx, 0x63e36e7f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb5a9a4f6
mov ecx, 0x7b1d2f3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0x219a548d
jmp 0x1000887c
mov eax, dword [ebp - 0x60]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x59], al
mov dword [ebp - 0xac], 0x3ecc410
jmp 0x1000887c
mov dl, byte [ebp - 0x59]
mov eax, 0xd99d533c
mov ecx, 0x28fff719
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
add edx, 0xcdcc8d8f
sub edx, 1
sub edx, 0xcdcc8d8f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd033b42c
mov ecx, 0xc702cb1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
sub edx, 0xf8c420f6
sub edx, 1
add edx, 0xf8c420f6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd033b42c
mov ecx, 0xfed925ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xdd93edb6
jmp 0x1000887c
mov eax, dword [ebp - 0x58]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x7422dd0b
jmp 0x1000887c
mov dword [ebp - 0xac], 0xf3d6e27f
jmp 0x1000887c
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
add edx, 0xbca2f558
sub edx, 1
sub edx, 0xbca2f558
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc8e520c2
mov ecx, 0x4e3bdbd2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8e520c2
mov ecx, 0x53517066
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xce4e5472
jmp 0x1000887c
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x54]
add eax, 0xef956241
add eax, ecx
sub eax, 0xef956241
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xac], 0x1b393b67
jmp 0x1000887c
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov word [eax], 0
mov dword [ebp - 0xac], 0x36a953ab
jmp 0x1000887c
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x99db23d8
mov ecx, 0xcc309dc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x80]
mov ax, word [eax]
mov word [ebp - 0x4a], ax
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
add edx, 0xc269af25
sub edx, 1
sub edx, 0xc269af25
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x99db23d8
mov ecx, 0x2819caf5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xceec84eb
jmp 0x1000887c
mov ax, word [ebp - 0x4a]
movzx eax, ax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xac], 0xfbeaa61c
jmp 0x1000887c
mov eax, dword [ebp - 0x44]
movzx esi, word [eax]
mov edx, dword [ebp - 0x48]
mov eax, 0x56ac68e5
mov ecx, 0x63bd146a
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
mov edx, eax
add edx, 0x6e4f7a87
sub edx, 1
sub edx, 0x6e4f7a87
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd310ce5c
mov ecx, 0x2a0787
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
add eax, 0x2f427892
add eax, 0x18
sub eax, 0x2f427892
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x3a], ax
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd310ce5c
mov ecx, 0x72725b40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xc17d920b
jmp 0x1000887c
mov ax, word [ebp - 0x3a]
movzx eax, ax
mov ecx, dword [ebp - 0x40]
add ecx, 0x8c4ed7b9
add ecx, eax
sub ecx, 0x8c4ed7b9
mov eax, dword [ebp - 0x80]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0x89d4bede
jmp 0x1000887c
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10026b3d
call fcn.1001c460
add esp, 8
mov edx, eax
mov eax, 0xbf45b5c0
mov ecx, 0x6b1b3eb7
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c74d50e
mov ecx, 0x665d0b04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x78]
mov dword [eax], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x1a64934d
add eax, ecx
sub eax, 0x1a64934d
mov dword [ebp - 0x34], eax
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c74d50e
mov ecx, 0xca2e8940
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0xaa5775a9
jmp 0x1000887c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x38]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xb5dbb602
add edx, eax
add edx, 0xb5dbb602
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10018c60
add esp, 0xc
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xac], 0x371786dc
jmp 0x1000887c
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov dword [ebp - 0xac], 0x6b1b3eb7
jmp 0x1000887c
mov dword [ebp - 0xac], 0x1fa9b89f
jmp 0x1000887c
mov eax, dword [ebp - 0x80]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x1e], ax
mov dword [ebp - 0xac], 0xbf3f2436
jmp 0x1000887c
mov eax, dword [0x10086564]
mov ecx, dword [0x10086560]
mov edx, eax
add edx, 0xf5d47351
sub edx, 1
sub edx, 0xf5d47351
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc30655f5
mov ecx, 0xf1547b00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov eax, dword [ebp - 0x80]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov ecx, dword [0x10086564]
mov eax, dword [0x10086560]
mov edx, ecx
add edx, 0x64ad173a
sub edx, 1
sub edx, 0x64ad173a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc30655f5
mov ecx, 0xae70c56f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000887c
mov dword [ebp - 0xac], 0x1daebeaa
jmp 0x1000887c
mov dword [ebp - 0xac], 0x36a953ab
jmp 0x1000887c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xac], 0xe1ae1548
jmp 0x1000887c
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x3083dd56
jmp 0x1000887c
mov dword [ebp - 0xac], 0xf3d6e27f
jmp 0x1000887c
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10017d60
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xac], 0x13600c6f
jmp 0x1000887c
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10018b00
add esp, 0xc
mov eax, dword [ebp - 0xa4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xac], 0xfa587488
jmp 0x1000887c
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xac], 0x5159e3ab
jmp 0x1000887c
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xac], 0xa203c974
jmp 0x1000887c
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xac], 0xc702cb1a
jmp 0x1000887c
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xac], 0x4e3bdbd2
jmp 0x1000887c
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xac], 0xcc309dc2
jmp 0x1000887c
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xac], 0x2a0787
jmp 0x1000887c
mov eax, dword [ebp - 0x78]
mov dword [eax], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0x665d0b04
jmp 0x1000887c
mov eax, dword [ebp - 0x80]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov dword [ebp - 0xac], 0xf1547b00
jmp 0x10007288