Function at 0x412790
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x446080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0xa4], 0x962f4d05
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
sub eax, 0x809337a3
je 0x4136b3
jmp 0x41280b
mov eax, dword [ebp - 0xac]
sub eax, 0x83b08e06
je 0x414567
jmp 0x412821
mov eax, dword [ebp - 0xac]
sub eax, 0x84f5626d
je 0x413498
jmp 0x412837
mov eax, dword [ebp - 0xac]
sub eax, 0x89d8c53d
je 0x413888
jmp 0x41284d
mov eax, dword [ebp - 0xac]
sub eax, 0x8a804d00
je 0x4142a7
jmp 0x412863
mov eax, dword [ebp - 0xac]
sub eax, 0x8b1126b5
je 0x413e04
jmp 0x412879
mov eax, dword [ebp - 0xac]
sub eax, 0x8bb0344f
je 0x413425
jmp 0x41288f
mov eax, dword [ebp - 0xac]
sub eax, 0x8d212a13
je 0x414427
jmp 0x4128a5
mov eax, dword [ebp - 0xac]
sub eax, 0x8f15b17d
je 0x4138f2
jmp 0x4128bb
mov eax, dword [ebp - 0xac]
sub eax, 0x905544bf
je 0x413f7b
jmp 0x4128d1
mov eax, dword [ebp - 0xac]
sub eax, 0x9121cf8a
je 0x414660
jmp 0x4128e7
mov eax, dword [ebp - 0xac]
sub eax, 0x950f1541
je 0x413392
jmp 0x4128fd
mov eax, dword [ebp - 0xac]
sub eax, 0x962f4d05
je 0x412f8a
jmp 0x412913
mov eax, dword [ebp - 0xac]
sub eax, 0x9782ec8a
je 0x413205
jmp 0x412929
mov eax, dword [ebp - 0xac]
sub eax, 0x9d42d16a
je 0x413c81
jmp 0x41293f
mov eax, dword [ebp - 0xac]
sub eax, 0xa557922c
je 0x414298
jmp 0x412955
mov eax, dword [ebp - 0xac]
sub eax, 0xa5646bb0
je 0x413282
jmp 0x41296b
mov eax, dword [ebp - 0xac]
sub eax, 0xa70864ce
je 0x413dbd
jmp 0x412981
mov eax, dword [ebp - 0xac]
sub eax, 0xa935508b
je 0x41374d
jmp 0x412997
mov eax, dword [ebp - 0xac]
sub eax, 0xaea262f9
je 0x413c9f
jmp 0x4129ad
mov eax, dword [ebp - 0xac]
sub eax, 0xb0dbf08d
je 0x413628
jmp 0x4129c3
mov eax, dword [ebp - 0xac]
sub eax, 0xb2383b3e
je 0x4145e6
jmp 0x4129d9
mov eax, dword [ebp - 0xac]
sub eax, 0xb4fb7e40
je 0x413091
jmp 0x4129ef
mov eax, dword [ebp - 0xac]
sub eax, 0xb7479c23
je 0x4144be
jmp 0x412a05
mov eax, dword [ebp - 0xac]
sub eax, 0xb7dac798
je 0x4139e9
jmp 0x412a1b
mov eax, dword [ebp - 0xac]
sub eax, 0xc3772df7
je 0x413332
jmp 0x412a31
mov eax, dword [ebp - 0xac]
sub eax, 0xcbe49c18
je 0x414034
jmp 0x412a47
mov eax, dword [ebp - 0xac]
sub eax, 0xcc44af7f
je 0x4135ba
jmp 0x412a5d
mov eax, dword [ebp - 0xac]
sub eax, 0xd437d5d7
je 0x414438
jmp 0x412a73
mov eax, dword [ebp - 0xac]
sub eax, 0xdabd3b3b
je 0x413785
jmp 0x412a89
mov eax, dword [ebp - 0xac]
sub eax, 0xdb47fa7c
je 0x414334
jmp 0x412a9f
mov eax, dword [ebp - 0xac]
sub eax, 0xdcf0f110
je 0x4134e1
jmp 0x412ab5
mov eax, dword [ebp - 0xac]
sub eax, 0xdd66b2cf
je 0x4143b9
jmp 0x412acb
mov eax, dword [ebp - 0xac]
sub eax, 0xdd7b0030
je 0x413f2a
jmp 0x412ae1
mov eax, dword [ebp - 0xac]
sub eax, 0xe3184823
je 0x414447
jmp 0x412af7
mov eax, dword [ebp - 0xac]
sub eax, 0xe371c424
je 0x4140bb
jmp 0x412b0d
mov eax, dword [ebp - 0xac]
sub eax, 0xe462ce98
je 0x413b37
jmp 0x412b23
mov eax, dword [ebp - 0xac]
sub eax, 0xe4b8ee05
je 0x412fb9
jmp 0x412b39
mov eax, dword [ebp - 0xac]
sub eax, 0xea065a11
je 0x41355e
jmp 0x412b4f
mov eax, dword [ebp - 0xac]
sub eax, 0xf29950bf
je 0x414222
jmp 0x412b65
mov eax, dword [ebp - 0xac]
sub eax, 0xf578ba69
je 0x41410c
jmp 0x412b7b
mov eax, dword [ebp - 0xac]
sub eax, 0xf6b357cf
je 0x413e7a
jmp 0x412b91
mov eax, dword [ebp - 0xac]
sub eax, 0xf936cca9
je 0x41419d
jmp 0x412ba7
mov eax, dword [ebp - 0xac]
sub eax, 0xfb003c46
je 0x414714
jmp 0x412bbd
mov eax, dword [ebp - 0xac]
sub eax, 0xc23b29f
je 0x413943
jmp 0x412bd3
mov eax, dword [ebp - 0xac]
sub eax, 0xd9cb2a4
je 0x4130a0
jmp 0x412be9
mov eax, dword [ebp - 0xac]
sub eax, 0xef07370
je 0x4141ac
jmp 0x412bff
mov eax, dword [ebp - 0xac]
sub eax, 0x105cbff1
je 0x414638
jmp 0x412c15
mov eax, dword [ebp - 0xac]
sub eax, 0x114c82bc
je 0x414623
jmp 0x412c2b
mov eax, dword [ebp - 0xac]
sub eax, 0x12bfa1f4
je 0x413baf
jmp 0x412c41
mov eax, dword [ebp - 0xac]
sub eax, 0x1900aa5c
je 0x4145f8
jmp 0x412c57
mov eax, dword [ebp - 0xac]
sub eax, 0x1a5d68a8
je 0x4142e3
jmp 0x412c6d
mov eax, dword [ebp - 0xac]
sub eax, 0x1b5e50b3
je 0x4139da
jmp 0x412c83
mov eax, dword [ebp - 0xac]
sub eax, 0x1c64b68e
je 0x413c25
jmp 0x412c99
mov eax, dword [ebp - 0xac]
sub eax, 0x1d8308e9
je 0x413214
jmp 0x412caf
mov eax, dword [ebp - 0xac]
sub eax, 0x1f34a718
je 0x4130f1
jmp 0x412cc5
mov eax, dword [ebp - 0xac]
sub eax, 0x208b2116
je 0x414555
jmp 0x412cdb
mov eax, dword [ebp - 0xac]
sub eax, 0x20a67c75
je 0x414025
jmp 0x412cf1
mov eax, dword [ebp - 0xac]
sub eax, 0x25320a7b
je 0x413a3a
jmp 0x412d07
mov eax, dword [ebp - 0xac]
sub eax, 0x2544d987
je 0x414723
jmp 0x412d1d
mov eax, dword [ebp - 0xac]
sub eax, 0x258acb1e
je 0x413704
jmp 0x412d33
mov eax, dword [ebp - 0xac]
sub eax, 0x2b3eb6f6
je 0x4131e7
jmp 0x412d49
mov eax, dword [ebp - 0xac]
sub eax, 0x31cba311
je 0x413dae
jmp 0x412d5f
mov eax, dword [ebp - 0xac]
sub eax, 0x3cd4dec4
je 0x4136a4
jmp 0x412d75
mov eax, dword [ebp - 0xac]
sub eax, 0x4aab85b4
je 0x413862
mov al, byte [ebp - 0x9e]
mov cl, byte [ebp - 0x9d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd437d5d7
mov ecx, 0xe4b8ee05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd437d5d7
mov ecx, 0xb4fb7e40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0xd9cb2a4
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
sub edx, 0x5b8e061
sub edx, 1
add edx, 0x5b8e061
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe3184823
mov ecx, 0x1f34a718
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [ebp - 0xa8]
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0042f570
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe3184823
mov ecx, 0x58621ee4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov edx, dword [ebp - 0x60]
mov eax, 0x9782ec8a
mov ecx, 0x1d8308e9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0x76373c69
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb7479c23
mov ecx, 0xa5646bb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
add edx, 0x5e068b1
sub edx, 1
sub edx, 0x5e068b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb7479c23
mov ecx, 0xc3772df7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0x77718fe5
jmp 0x41472d
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
sub edx, 0x98a24706
sub edx, 1
add edx, 0x98a24706
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x611d41a1
mov ecx, 0x74128a1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov edx, dword [ebp - 0x84]
mov esi, 0xffffffff
mov eax, 0xea065a11
mov ecx, 0x84f5626d
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bd47d4e
mov ecx, 0xdcf0f110
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5bd47d4e
mov ecx, 0x648cb4f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xa4], 0xcc44af7f
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x208b2116
mov ecx, 0xb0dbf08d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x58]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x208b2116
mov ecx, 0x3cd4dec4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0x809337a3
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
sub edx, 0xb192c4b4
sub edx, 1
add edx, 0xb192c4b4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83b08e06
mov ecx, 0x258acb1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83b08e06
mov ecx, 0xa935508b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dl, byte [ebp - 0x51]
mov eax, 0x7c25d9e7
mov ecx, 0x646d39ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
sub edx, 0x62fc065
sub edx, 1
add edx, 0x62fc065
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x519d39d4
mov ecx, 0x74efc80b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xa4], 0x8f15b17d
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
add edx, 0x84f8a785
sub edx, 1
sub edx, 0x84f8a785
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6cd26d9a
mov ecx, 0xc23b29f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
sub ecx, 0x43763541
add ecx, eax
add ecx, 0x43763541
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
add edx, 0x995eceeb
sub edx, 1
sub edx, 0x995eceeb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6cd26d9a
mov ecx, 0x1b5e50b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0xb7dac798
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
sub edx, 0x12848640
sub edx, 1
add edx, 0x12848640
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2383b3e
mov ecx, 0x25320a7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x3e], ax
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
add edx, 0x7f54304b
sub edx, 1
sub edx, 0x7f54304b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb2383b3e
mov ecx, 0x5d9dabe9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ax, word [ebp - 0x3e]
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x38], eax
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
add edx, 0x364e765c
sub edx, 1
sub edx, 0x364e765c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1900aa5c
mov ecx, 0x6f1bb820
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
sub edx, 0x186f96e8
sub edx, 1
add edx, 0x186f96e8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x766925fe
mov ecx, 0x1c64b68e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x766925fe
mov ecx, 0x9d42d16a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dl, byte [ebp - 0x31]
mov eax, 0x6d966213
mov ecx, 0xaea262f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
add edx, 0xedfdfe04
sub edx, 1
sub edx, 0xedfdfe04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x114c82bc
mov ecx, 0x795f69ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0xa70864ce
jmp 0x41472d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
sub ecx, 0x7c30fc2c
add ecx, eax
add ecx, 0x7c30fc2c
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xa4], 0x8b1126b5
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
sub edx, 0x26b8112
sub edx, 1
add edx, 0x26b8112
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x105cbff1
mov ecx, 0xf6b357cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x43f1fb
call fcn.00432e70
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x22], al
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x105cbff1
mov ecx, 0x566f645f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
add edx, 0x5f45bfde
sub edx, 1
sub edx, 0x5f45bfde
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9121cf8a
mov ecx, 0x905544bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xd414a3d8
add edx, eax
add edx, 0xd414a3d8
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
sub edx, 0xa16f5562
sub edx, 1
add edx, 0xa16f5562
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9121cf8a
mov ecx, 0x20a67c75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0xcbe49c18
jmp 0x41472d
mov cl, byte [ebp - 0x21]
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x49645415
add edx, eax
add edx, 0x49645415
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0042f6d0
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa4], 0xe371c424
jmp 0x41472d
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
add edx, 0xef136538
sub edx, 1
sub edx, 0xef136538
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4cb231fe
mov ecx, 0xf578ba69
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [0x44755c]
mov ecx, dword [0x447558]
mov edx, eax
add edx, 0x7dc43ab2
sub edx, 1
sub edx, 0x7dc43ab2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4cb231fe
mov ecx, 0xf936cca9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0xef07370
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
add edx, 0x72bd530b
sub edx, 1
sub edx, 0x72bd530b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb003c46
mov ecx, 0xf29950bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
mov edx, ecx
add edx, 0x260822ce
sub edx, 1
sub edx, 0x260822ce
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb003c46
mov ecx, 0xa557922c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov dword [ebp - 0xa4], 0x8a804d00
jmp 0x41472d
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0xa4], 0x604c350f
jmp 0x41472d
mov eax, dword [ebp - 0x70]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0xa4], 0xb7dac798
jmp 0x41472d
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0x76373c69
jmp 0x41472d
mov ecx, dword [0x44755c]
mov eax, dword [0x447558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2544d987
mov ecx, 0x8d212a13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x41472d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042e880
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa4], 0xe4b8ee05
jmp 0x41472d
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0042f570
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa4], 0x1f34a718
jmp 0x41472d
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa4], 0xa5646bb0
jmp 0x41472d
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xa4], 0xb0dbf08d
jmp 0x41472d
mov dword [ebp - 0xa4], 0x258acb1e
jmp 0x41472d
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa4], 0x25320a7b
jmp 0x41472d
mov ax, word [ebp - 0x3e]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa4], 0xe462ce98
jmp 0x41472d
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa4], 0x795f69ca
jmp 0x41472d
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x43f1fb
call fcn.00432e70
add esp, 8
mov dword [ebp - 0xa4], 0xf6b357cf
jmp 0x41472d
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x99c66c99
add edx, eax
sub edx, 0x99c66c99
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xa4], 0x905544bf
jmp 0x41472d
mov dword [ebp - 0xa4], 0xf29950bf
jmp 0x41472d
mov dword [ebp - 0xa4], 0xdd66b2cf
jmp 0x4127ef