Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x194
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
mov eax, dword [0x1006aa00]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x194], 0x13a0c33c
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x19c], eax
sub eax, 0x878670f8
je 0x100015ab
jmp 0x100010f4
mov eax, dword [ebp - 0x19c]
sub eax, 0x8b161c32
je 0x10002253
jmp 0x1000110a
mov eax, dword [ebp - 0x19c]
sub eax, 0x90cdfc92
je 0x10001700
jmp 0x10001120
mov eax, dword [ebp - 0x19c]
sub eax, 0x956d3add
je 0x10001a8a
jmp 0x10001136
mov eax, dword [ebp - 0x19c]
sub eax, 0x957aec35
je 0x10001725
jmp 0x1000114c
mov eax, dword [ebp - 0x19c]
sub eax, 0x9ccc4ba8
je 0x10001927
jmp 0x10001162
mov eax, dword [ebp - 0x19c]
sub eax, 0x9d4f5fa8
je 0x10001b1e
jmp 0x10001178
mov eax, dword [ebp - 0x19c]
sub eax, 0xa43d1bd7
je 0x1000179b
jmp 0x1000118e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa513f5a0
je 0x1000215a
jmp 0x100011a4
mov eax, dword [ebp - 0x19c]
sub eax, 0xa890b2ec
je 0x10001bcb
jmp 0x100011ba
mov eax, dword [ebp - 0x19c]
sub eax, 0xab07b238
je 0x10001997
jmp 0x100011d0
mov eax, dword [ebp - 0x19c]
sub eax, 0xad8ce648
je 0x10001dd3
jmp 0x100011e6
mov eax, dword [ebp - 0x19c]
sub eax, 0xafa3db1f
je 0x10001a7b
jmp 0x100011fc
mov eax, dword [ebp - 0x19c]
sub eax, 0xb16020d8
je 0x1000212d
jmp 0x10001212
mov eax, dword [ebp - 0x19c]
sub eax, 0xb7f29285
je 0x100021f2
jmp 0x10001228
mov eax, dword [ebp - 0x19c]
sub eax, 0xbceaad50
je 0x10001ecd
jmp 0x1000123e
mov eax, dword [ebp - 0x19c]
sub eax, 0xd57265a7
je 0x10001f97
jmp 0x10001254
mov eax, dword [ebp - 0x19c]
sub eax, 0xdcbdcc3b
je 0x10001e60
jmp 0x1000126a
mov eax, dword [ebp - 0x19c]
sub eax, 0xe2351d28
je 0x10001cbd
jmp 0x10001280
mov eax, dword [ebp - 0x19c]
sub eax, 0xe4b84b0e
je 0x10001614
jmp 0x10001296
mov eax, dword [ebp - 0x19c]
sub eax, 0xeea839d7
je 0x10001bb0
jmp 0x100012ac
mov eax, dword [ebp - 0x19c]
sub eax, 0xf07c38a1
je 0x10001db2
jmp 0x100012c2
mov eax, dword [ebp - 0x19c]
sub eax, 0xf5520f31
je 0x10001811
jmp 0x100012d8
mov eax, dword [ebp - 0x19c]
sub eax, 0xf7e8f7a2
je 0x10002262
jmp 0x100012ee
mov eax, dword [ebp - 0x19c]
sub eax, 0xfa9a0a12
je 0x10001918
jmp 0x10001304
mov eax, dword [ebp - 0x19c]
sub eax, 0xfdf2b8c5
je 0x10001b42
jmp 0x1000131a
mov eax, dword [ebp - 0x19c]
sub eax, 0xff056ca6
je 0x100019b2
jmp 0x10001330
mov eax, dword [ebp - 0x19c]
sub eax, 0xff9f9756
je 0x1000219e
jmp 0x10001346
mov eax, dword [ebp - 0x19c]
sub eax, 0x8f82bd6
je 0x10001f46
jmp 0x1000135c
mov eax, dword [ebp - 0x19c]
sub eax, 0xbbf8d70
je 0x100021ad
jmp 0x10001372
mov eax, dword [ebp - 0x19c]
sub eax, 0xcfc5680
je 0x10001896
jmp 0x10001388
mov eax, dword [ebp - 0x19c]
sub eax, 0xe3899e7
je 0x10001b8f
jmp 0x1000139e
mov eax, dword [ebp - 0x19c]
sub eax, 0x13a0c33c
je 0x10001587
jmp 0x100013b4
mov eax, dword [ebp - 0x19c]
sub eax, 0x16a35a92
je 0x1000204b
jmp 0x100013ca
mov eax, dword [ebp - 0x19c]
sub eax, 0x1f187525
je 0x10001623
jmp 0x100013e0
mov eax, dword [ebp - 0x19c]
sub eax, 0x253bc68e
je 0x1000209c
jmp 0x100013f6
mov eax, dword [ebp - 0x19c]
sub eax, 0x28917fca
je 0x1000202e
jmp 0x1000140c
mov eax, dword [ebp - 0x19c]
sub eax, 0x2c14fb04
je 0x100021bc
jmp 0x10001422
mov eax, dword [ebp - 0x19c]
sub eax, 0x2dbced66
je 0x10001c41
jmp 0x10001438
mov eax, dword [ebp - 0x19c]
sub eax, 0x3735a78e
je 0x100021dd
jmp 0x1000144e
mov eax, dword [ebp - 0x19c]
sub eax, 0x392e100a
je 0x1000218d
jmp 0x10001464
mov eax, dword [ebp - 0x19c]
sub eax, 0x3f828ce9
je 0x10001d1d
jmp 0x1000147a
mov eax, dword [ebp - 0x19c]
sub eax, 0x41e3897d
je 0x10001a99
jmp 0x10001490
mov eax, dword [ebp - 0x19c]
sub eax, 0x43cb0131
je 0x10001ae2
jmp 0x100014a6
mov eax, dword [ebp - 0x19c]
sub eax, 0x4c0c71f0
je 0x10001ff6
jmp 0x100014bc
mov eax, dword [ebp - 0x19c]
sub eax, 0x50b30431
je 0x10001b5f
jmp 0x100014d2
mov eax, dword [ebp - 0x19c]
sub eax, 0x5ce6d52b
je 0x10002005
jmp 0x100014e8
mov eax, dword [ebp - 0x19c]
sub eax, 0x618e33e3
je 0x10001ccc
jmp 0x100014fe
mov eax, dword [ebp - 0x19c]
sub eax, 0x63d18ac3
je 0x100019fb
jmp 0x10001514
mov eax, dword [ebp - 0x19c]
sub eax, 0x661ecf8d
je 0x10001f37
jmp 0x1000152a
mov eax, dword [ebp - 0x19c]
sub eax, 0x6c10e7a3
je 0x1000211e
jmp 0x10001540
mov eax, dword [ebp - 0x19c]
sub eax, 0x6fe92640
je 0x1000166b
jmp 0x10001556
mov eax, dword [ebp - 0x19c]
sub eax, 0x735fb43b
je 0x10001820
jmp 0x1000156c
mov eax, dword [ebp - 0x19c]
sub eax, 0x7380389f
je 0x10001978
jmp 0x10001582
jmp 0x1000226c
mov eax, dword [ebp - 0x198]
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x194], 0x878670f8
jmp 0x1000226c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000b8f0
add esp, 0xc
mov eax, dword [ebp - 0x168]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x170], eax
mov eax, 0xe4b84b0e
mov ecx, 0x1f187525
cmp dword [ebp - 0x170], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0x392e100a
jmp 0x1000226c
mov ecx, dword [ebp - 0x170]
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x194], 0x6fe92640
jmp 0x1000226c
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x170]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x194], 0x90cdfc92
jmp 0x1000226c
mov edx, dword [ebp - 0x15c]
mov esi, 0xffffffff
mov eax, 0x735fb43b
mov ecx, 0x957aec35
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
mov edx, ecx
add edx, 0x6a8d38c0
sub edx, 1
sub edx, 0x6a8d38c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff9f9756
mov ecx, 0xa43d1bd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
mov edx, ecx
sub edx, 0xa382d730
sub edx, 1
add edx, 0xa382d730
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff9f9756
mov ecx, 0xf5520f31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0x392e100a
jmp 0x1000226c
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
mov edx, ecx
add edx, 0x19e1ab41
sub edx, 1
sub edx, 0x19e1ab41
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbbf8d70
mov ecx, 0xcfc5680
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x158], eax
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
mov edx, ecx
sub edx, 0x33efa484
sub edx, 1
add edx, 0x33efa484
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbbf8d70
mov ecx, 0xfa9a0a12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0x9ccc4ba8
jmp 0x1000226c
mov eax, dword [ebp - 0x158]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x194], 0x7380389f
jmp 0x1000226c
mov eax, 0xab07b238
mov ecx, 0x41e3897d
cmp dword [ebp - 0x17c], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x194], 0xff056ca6
jmp 0x1000226c
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c14fb04
mov ecx, 0x63d18ac3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2c14fb04
mov ecx, 0xafa3db1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0x956d3add
jmp 0x1000226c
mov dword [ebp - 0x194], 0x392e100a
jmp 0x1000226c
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x194], 0x43cb0131
jmp 0x1000226c
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x184]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x174f4061
add eax, ecx
add eax, 0x174f4061
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x194], 0x9d4f5fa8
jmp 0x1000226c
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x188], eax
mov word [ebp - 0x18a], 0
mov dword [ebp - 0x194], 0xfdf2b8c5
jmp 0x1000226c
mov ax, word [ebp - 0x18a]
mov word [ebp - 0x14c], ax
mov dword [ebp - 0x194], 0x50b30431
jmp 0x1000226c
mov ax, word [ebp - 0x14c]
movzx eax, ax
mov ecx, dword [ebp - 0x188]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x194], 0xe3899e7
jmp 0x1000226c
mov dl, byte [ebp - 0x149]
mov eax, 0x16a35a92
mov ecx, 0xeea839d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x194], 0xa890b2ec
jmp 0x1000226c
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
mov edx, ecx
add edx, 0xd6548d5e
sub edx, 1
sub edx, 0xd6548d5e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3735a78e
mov ecx, 0x2dbced66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x188]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x144], eax
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
mov edx, eax
add edx, 0x20681d1
sub edx, 1
sub edx, 0x20681d1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3735a78e
mov ecx, 0xe2351d28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0x618e33e3
jmp 0x1000226c
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
mov edx, eax
sub edx, 0x71e09069
sub edx, 1
add edx, 0x71e09069
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7f29285
mov ecx, 0x3f828ce9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
movzx eax, word [ebp - 0x18a]
imul ecx, eax, 0x28
mov eax, dword [ebp - 0x144]
add eax, 0x6f51cdfe
add eax, ecx
sub eax, 0x6f51cdfe
mov dword [ebp - 0x190], eax
mov ecx, dword [ebp - 0x190]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000dc60
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x13d], al
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7f29285
mov ecx, 0xf07c38a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dl, byte [ebp - 0x13d]
mov eax, 0xad8ce648
mov ecx, 0x661ecf8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0xc]
add edx, 0x684fc414
add edx, eax
sub edx, 0x684fc414
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x194], 0xdcbdcc3b
jmp 0x1000226c
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
xor eax, eax
sub eax, ecx
sub edx, eax
mov ecx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x190]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000ba50
add esp, 0xc
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x194], 0xbceaad50
jmp 0x1000226c
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x174]
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0xc]
sub esi, 0x79eccd53
add esi, eax
add esi, 0x79eccd53
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov dword [ebp - 0x194], 0x661ecf8d
jmp 0x1000226c
mov dword [ebp - 0x194], 0x8f82bd6
jmp 0x1000226c
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
mov edx, eax
add edx, 0xcc62cc73
sub edx, 1
sub edx, 0xcc62cc73
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b161c32
mov ecx, 0xd57265a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov ax, word [ebp - 0x18a]
mov word [ebp - 0x12c], ax
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
mov edx, eax
sub edx, 0xb0e4a7b2
sub edx, 1
add edx, 0xb0e4a7b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b161c32
mov ecx, 0x4c0c71f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0x5ce6d52b
jmp 0x1000226c
mov ax, word [ebp - 0x12c]
sub ax, 0x890d
add ax, 1
add ax, 0x890d
mov word [ebp - 0x12a], ax
mov dword [ebp - 0x194], 0x28917fca
jmp 0x1000226c
mov ax, word [ebp - 0x12a]
mov word [ebp - 0x18a], ax
mov dword [ebp - 0x194], 0xfdf2b8c5
jmp 0x1000226c
mov eax, dword [0x1006bd40]
mov ecx, dword [0x1006bd3c]
mov edx, eax
sub edx, 0x2a3720b6
sub edx, 1
add edx, 0x2a3720b6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf7e8f7a2
mov ecx, 0x253bc68e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x128], eax
mov ecx, dword [0x1006bd40]
mov eax, dword [0x1006bd3c]
mov edx, ecx
sub edx, 0xe9a7695
sub edx, 1
add edx, 0xe9a7695
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf7e8f7a2
mov ecx, 0x6c10e7a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000226c
mov dword [ebp - 0x194], 0xb16020d8
jmp 0x1000226c
mov eax, dword [ebp - 0x128]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x194], 0xa513f5a0
jmp 0x1000226c
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x16c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x392e100a
jmp 0x1000226c
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000acf0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x194], 0xa43d1bd7
jmp 0x1000226c
mov dword [ebp - 0x194], 0xcfc5680
jmp 0x1000226c
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x63d18ac3
jmp 0x1000226c
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0x2dbced66
jmp 0x1000226c
movzx eax, word [ebp - 0x18a]
imul edx, eax, 0x28
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x190], eax
mov ecx, dword [ebp - 0x190]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000dc60
add esp, 8
mov dword [ebp - 0x194], 0x3f828ce9
jmp 0x1000226c
mov dword [ebp - 0x194], 0xd57265a7
jmp 0x1000226c
mov dword [ebp - 0x194], 0x253bc68e
jmp 0x100010d8