Function at 0x100010d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x198
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x10065e00]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x198], 0x9a632552
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
sub eax, 0x8181268b
je 0x10002564
jmp 0x10001114
mov eax, dword [ebp - 0x1a0]
sub eax, 0x83dbeb42
je 0x10002461
jmp 0x1000112a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8742ca2f
je 0x10001cf5
jmp 0x10001140
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8840c5c1
je 0x10002134
jmp 0x10001156
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8c189a77
je 0x10001971
jmp 0x1000116c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x95b9043d
je 0x100017c7
jmp 0x10001182
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9a632552
je 0x1000162b
jmp 0x10001198
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa457956b
je 0x10002376
jmp 0x100011ae
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaa3e4c18
je 0x100023c7
jmp 0x100011c4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xac4207c6
je 0x100025a6
jmp 0x100011da
mov eax, dword [ebp - 0x1a0]
sub eax, 0xba671298
je 0x10001f48
jmp 0x100011f0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xba7bded4
je 0x10002355
jmp 0x10001206
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbc623a0c
je 0x100024e7
jmp 0x1000121c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbcb9674a
je 0x10002286
jmp 0x10001232
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbf096883
je 0x10002210
jmp 0x10001248
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc38ff95a
je 0x1000172a
jmp 0x1000125e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc73c4bb9
je 0x10001dcb
jmp 0x10001274
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc842fd4f
je 0x10001eab
jmp 0x1000128a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcac0da0f
je 0x10001a9b
jmp 0x100012a0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xccc07459
je 0x10002597
jmp 0x100012b6
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcdc2be45
je 0x1000249f
jmp 0x100012cc
mov eax, dword [ebp - 0x1a0]
sub eax, 0xce58b075
je 0x100018ec
jmp 0x100012e2
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd73e2f21
je 0x10001f57
jmp 0x100012f8
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdded9eea
je 0x10001b85
jmp 0x1000130e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe054df59
je 0x10001e13
jmp 0x10001324
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe127f5ea
je 0x100016d9
jmp 0x1000133a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe2ec1a48
je 0x10001d46
jmp 0x10001350
mov eax, dword [ebp - 0x1a0]
sub eax, 0xecd5f972
je 0x10001f84
jmp 0x10001366
mov eax, dword [ebp - 0x1a0]
sub eax, 0xef6b9a3a
je 0x1000247f
jmp 0x1000137c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xefcb49c5
je 0x10002303
jmp 0x10001392
mov eax, dword [ebp - 0x1a0]
sub eax, 0xfeca84e8
je 0x10002346
jmp 0x100013a8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x10b8cc5
je 0x10002008
jmp 0x100013be
mov eax, dword [ebp - 0x1a0]
sub eax, 0x47ec2a3
je 0x100022f4
jmp 0x100013d4
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8252c23
je 0x100025b5
jmp 0x100013ea
mov eax, dword [ebp - 0x1a0]
sub eax, 0x10275730
je 0x100018fb
jmp 0x10001400
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1131b370
je 0x10002470
jmp 0x10001416
mov eax, dword [ebp - 0x1a0]
sub eax, 0x15160aa4
je 0x10002647
jmp 0x1000142c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x18eabb27
je 0x1000183d
jmp 0x10001442
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1ab52718
je 0x10001ab6
jmp 0x10001458
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1bf88970
je 0x10002059
jmp 0x1000146e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x200d7ac4
je 0x10002656
jmp 0x10001484
mov eax, dword [ebp - 0x1a0]
sub eax, 0x21789e61
je 0x100016ca
jmp 0x1000149a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x258ebeec
je 0x10001c54
jmp 0x100014b0
mov eax, dword [ebp - 0x1a0]
sub eax, 0x295c548c
je 0x10002490
jmp 0x100014c6
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2fe549fc
je 0x10001dbc
jmp 0x100014dc
mov eax, dword [ebp - 0x1a0]
sub eax, 0x36c6af2b
je 0x10001b76
jmp 0x100014f2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x47bcc288
je 0x10001e3d
jmp 0x10001508
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4823ac65
je 0x10001fbf
jmp 0x1000151e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4d2c82aa
je 0x10002143
jmp 0x10001534
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5366a1e2
je 0x10001be6
jmp 0x1000154a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x545a0637
je 0x10001b19
jmp 0x10001560
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5a3aa831
je 0x10001b55
jmp 0x10001576
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5a9ccfc2
je 0x10001a6b
jmp 0x1000158c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6402bf23
je 0x10001ce6
jmp 0x100015a2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x647aaa2a
je 0x10001b3a
jmp 0x100015b8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6c2227ab
je 0x10002320
jmp 0x100015ce
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6ea14230
je 0x10001de8
jmp 0x100015e4
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7608f834
je 0x100017b8
jmp 0x100015fa
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7cdb982c
je 0x10001a8c
jmp 0x10001610
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7f76eeed
je 0x10001643
jmp 0x10001626
jmp 0x10002684
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x198], 0x7f76eeed
jmp 0x10002684
mov eax, dword [ebp - 0x19c]
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x170], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100079b0
add esp, 0xc
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x178], eax
mov eax, 0x21789e61
mov ecx, 0xe127f5ea
cmp dword [ebp - 0x178], 0
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0xef6b9a3a
jmp 0x10002684
mov eax, dword [0x10067158]
mov ecx, dword [0x10067154]
mov edx, eax
sub edx, 0xf8381878
sub edx, 1
add edx, 0xf8381878
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x295c548c
mov ecx, 0xc38ff95a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x15c], eax
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
add edx, 0x16ad124d
sub edx, 1
sub edx, 0x16ad124d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x295c548c
mov ecx, 0x7608f834
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0x95b9043d
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
add edx, 0x6cd7ba2d
sub edx, 1
sub edx, 0x6cd7ba2d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcdc2be45
mov ecx, 0x18eabb27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x17c], eax
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
sub edx, 0x9702cde9
sub edx, 1
add edx, 0x9702cde9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcdc2be45
mov ecx, 0xce58b075
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0x10275730
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
sub edx, 0x1eb0df85
sub edx, 1
add edx, 0x1eb0df85
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbc623a0c
mov ecx, 0x8c189a77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x178]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x180], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x180], eax
sete al
and al, 1
mov byte [ebp - 0x155], al
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
sub edx, 0xd51fe2c0
sub edx, 1
add edx, 0xd51fe2c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbc623a0c
mov ecx, 0x5a9ccfc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dl, byte [ebp - 0x155]
mov eax, 0xcac0da0f
mov ecx, 0x7cdb982c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0xef6b9a3a
jmp 0x10002684
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x198], 0x1ab52718
jmp 0x10002684
mov eax, dword [ebp - 0x154]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
setne al
and al, 1
mov byte [ebp - 0x14d], al
mov dword [ebp - 0x198], 0x545a0637
jmp 0x10002684
mov dl, byte [ebp - 0x14d]
mov eax, 0x647aaa2a
mov ecx, 0xdded9eea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x198], 0x5a3aa831
jmp 0x10002684
mov eax, dword [ebp - 0x14c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0x36c6af2b
jmp 0x10002684
mov dword [ebp - 0x198], 0xef6b9a3a
jmp 0x10002684
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x198], 0x5366a1e2
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8181268b
mov ecx, 0x258ebeec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x190], eax
mov word [ebp - 0x192], 0
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8181268b
mov ecx, 0x6402bf23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0x8742ca2f
jmp 0x10002684
mov eax, dword [0x10067158]
mov ecx, dword [0x10067154]
mov edx, eax
sub edx, 0x259e909f
sub edx, 1
add edx, 0x259e909f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xccc07459
mov ecx, 0xe2ec1a48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
sub edx, 0xac2e1706
sub edx, 1
add edx, 0xac2e1706
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xccc07459
mov ecx, 0x2fe549fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0xc73c4bb9
jmp 0x10002684
mov ax, word [ebp - 0x192]
mov word [ebp - 0x142], ax
mov dword [ebp - 0x198], 0x6ea14230
jmp 0x10002684
mov ax, word [ebp - 0x142]
movzx eax, ax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x198], 0xe054df59
jmp 0x10002684
mov eax, dword [ebp - 0x13c]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0x140]
mov eax, 0xba7bded4
mov ecx, 0x47bcc288
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac4207c6
mov ecx, 0xc842fd4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov eax, dword [ebp - 0x190]
sub eax, 0xca6c447e
add eax, 0x18
add eax, 0xca6c447e
mov ecx, dword [ebp - 0x190]
movzx ecx, word [ecx + 0x14]
add eax, 0x3e08a992
add eax, ecx
sub eax, 0x3e08a992
mov dword [ebp - 0x138], eax
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xac4207c6
mov ecx, 0xba671298
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0xd73e2f21
jmp 0x10002684
movzx eax, word [ebp - 0x192]
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x138]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xecd5f972
jmp 0x10002684
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100131a0
call fcn.10009d20
add esp, 8
mov edx, eax
mov eax, 0x4823ac65
mov ecx, 0xbf096883
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x198], 0x10b8cc5
jmp 0x10002684
mov eax, dword [0x10067158]
mov ecx, dword [0x10067154]
mov edx, eax
sub edx, 0xac50a13f
sub edx, 1
add edx, 0xac50a13f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8252c23
mov ecx, 0x1bf88970
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov edx, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x12c]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x134]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
sub edx, 0xd03e1095
sub edx, 1
add edx, 0xd03e1095
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8252c23
mov ecx, 0x8840c5c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0x4d2c82aa
jmp 0x10002684
mov eax, dword [ebp - 0x124]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x128]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x915cf9cd
add ecx, eax
sub ecx, 0x915cf9cd
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10007b10
add esp, 0xc
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x713e2b5c
add esi, eax
sub esi, 0x713e2b5c
mov eax, dword [ebp - 0x168]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov dword [ebp - 0x198], 0xbf096883
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
sub edx, 0x66334843
sub edx, 1
add edx, 0x66334843
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x15160aa4
mov ecx, 0xbcb9674a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15160aa4
mov ecx, 0x47ec2a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0xefcb49c5
jmp 0x10002684
mov ax, word [ebp - 0x192]
mov word [ebp - 0x11e], ax
mov dword [ebp - 0x198], 0x6c2227ab
jmp 0x10002684
mov ax, word [ebp - 0x11e]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x192], ax
mov dword [ebp - 0x198], 0xfeca84e8
jmp 0x10002684
mov dword [ebp - 0x198], 0xc73c4bb9
jmp 0x10002684
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0xa457956b
jmp 0x10002684
mov eax, dword [0x10067158]
mov ecx, dword [0x10067154]
mov edx, eax
sub edx, 0x14cad421
sub edx, 1
add edx, 0x14cad421
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x200d7ac4
mov ecx, 0xaa3e4c18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10067158]
mov eax, dword [0x10067154]
mov edx, ecx
add edx, 0xf3f6bf8a
sub edx, 1
sub edx, 0xf3f6bf8a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x200d7ac4
mov ecx, 0x83dbeb42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002684
mov dword [ebp - 0x198], 0x1131b370
jmp 0x10002684
mov dword [ebp - 0x198], 0xef6b9a3a
jmp 0x10002684
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10006d90
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x198], 0xc38ff95a
jmp 0x10002684
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x198], 0x18eabb27
jmp 0x10002684
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x178]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x198], 0x8c189a77
jmp 0x10002684
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x190], eax
mov word [ebp - 0x192], 0
mov dword [ebp - 0x198], 0x258ebeec
jmp 0x10002684
mov dword [ebp - 0x198], 0xe2ec1a48
jmp 0x10002684
mov dword [ebp - 0x198], 0xc842fd4f
jmp 0x10002684
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x12c]
add edx, 0x2211ac7e
add edx, eax
sub edx, 0x2211ac7e
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x134]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x198], 0x1bf88970
jmp 0x10002684
mov dword [ebp - 0x198], 0xbcb9674a
jmp 0x10002684
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0xaa3e4c18
jmp 0x100010f8