Function at 0x100011d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x1006a000]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1a0], 0x412b0dfe
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
sub eax, 0x83e26f97
je 0x10001bf3
jmp 0x10001214
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8551278f
je 0x10002631
jmp 0x1000122a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x85792b7f
je 0x100017eb
jmp 0x10001240
mov eax, dword [ebp - 0x1a8]
sub eax, 0x94543519
je 0x100028f8
jmp 0x10001256
mov eax, dword [ebp - 0x1a8]
sub eax, 0x945ec295
je 0x100027e2
jmp 0x1000126c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x97a242fc
je 0x100026d7
jmp 0x10001282
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa8558f0d
je 0x10001e8a
jmp 0x10001298
mov eax, dword [ebp - 0x1a8]
sub eax, 0xac0fa2c5
je 0x10001a6c
jmp 0x100012ae
mov eax, dword [ebp - 0x1a8]
sub eax, 0xae14ca99
je 0x100026fa
jmp 0x100012c4
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb031fda6
je 0x10002a8b
jmp 0x100012da
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb18231ea
je 0x10002ac7
jmp 0x100012f0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb4d99114
je 0x10001afd
jmp 0x10001306
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb7c0ca7e
je 0x10001a5d
jmp 0x1000131c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb969114a
je 0x100020fa
jmp 0x10001332
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbf1e7508
je 0x100026a7
jmp 0x10001348
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc115dd14
je 0x10001d73
jmp 0x1000135e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc55f3c36
je 0x10001bb5
jmp 0x10001374
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc9395a1b
je 0x10001f3e
jmp 0x1000138a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xced61e23
je 0x10001fde
jmp 0x100013a0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd57407fe
je 0x10001eb2
jmp 0x100013b6
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdae19ad2
je 0x10001e63
jmp 0x100013cc
mov eax, dword [ebp - 0x1a8]
sub eax, 0xddab04f1
je 0x10002513
jmp 0x100013e2
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe127a193
je 0x100024a3
jmp 0x100013f8
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe643ac6a
je 0x1000187b
jmp 0x1000140e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe769d4b3
je 0x100024c2
jmp 0x10001424
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe7c0b186
je 0x100019bd
jmp 0x1000143a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe9baf143
je 0x10002886
jmp 0x10001450
mov eax, dword [ebp - 0x1a8]
sub eax, 0xec48f096
je 0x10001ed0
jmp 0x10001466
mov eax, dword [ebp - 0x1a8]
sub eax, 0xed900a4b
je 0x100027f3
jmp 0x1000147c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xeef7a985
je 0x10002340
jmp 0x10001492
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf557c6a9
je 0x100026b6
jmp 0x100014a8
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf56e3104
je 0x10001a87
jmp 0x100014be
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf5848708
je 0x100021a3
jmp 0x100014d4
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf5e1eaea
je 0x10001fbd
jmp 0x100014ea
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4d39f9
je 0x100023bd
jmp 0x10001500
mov eax, dword [ebp - 0x1a8]
sub eax, 0x226c7bd
je 0x1000188a
jmp 0x10001516
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2c911fd
je 0x10002913
jmp 0x1000152c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x45f1ca0
je 0x10002494
jmp 0x10001542
mov eax, dword [ebp - 0x1a8]
sub eax, 0xab8ee97
je 0x10002a22
jmp 0x10001558
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb0e7a2e
je 0x10001902
jmp 0x1000156e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc68a02c
je 0x100020eb
jmp 0x10001584
mov eax, dword [ebp - 0x1a8]
sub eax, 0x127b7bb1
je 0x10001d05
jmp 0x1000159a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x13ab97e6
je 0x10001fae
jmp 0x100015b0
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1711eb35
je 0x1000215d
jmp 0x100015c6
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1bba00c3
je 0x10002020
jmp 0x100015dc
mov eax, dword [ebp - 0x1a8]
sub eax, 0x236425ca
je 0x100025bb
jmp 0x100015f2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2b0fc8d3
je 0x10002928
jmp 0x10001608
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3274840c
je 0x10002096
jmp 0x1000161e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3560a4f2
je 0x10002219
jmp 0x10001634
mov eax, dword [ebp - 0x1a8]
sub eax, 0x37562e5d
je 0x1000283b
jmp 0x1000164a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x37563c11
je 0x10002895
jmp 0x10001660
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3851723b
je 0x1000271b
jmp 0x10001676
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3a2d0546
je 0x100025ac
jmp 0x1000168c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3f1e85be
je 0x100018b1
jmp 0x100016a2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x412b0dfe
je 0x100017af
jmp 0x100016b8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x42f2926d
je 0x10001bc4
jmp 0x100016ce
mov eax, dword [ebp - 0x1a8]
sub eax, 0x49bcec03
je 0x1000234f
jmp 0x100016e4
mov eax, dword [ebp - 0x1a8]
sub eax, 0x501b1f55
je 0x10001e54
jmp 0x100016fa
mov eax, dword [ebp - 0x1a8]
sub eax, 0x58bf8461
je 0x10001cd5
jmp 0x10001710
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5dbe480e
je 0x100019cc
jmp 0x10001726
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5ef64bee
je 0x10001cc6
jmp 0x1000173c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x658966ea
je 0x10002485
jmp 0x10001752
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6acdb7f1
je 0x10001c44
jmp 0x10001768
mov eax, dword [ebp - 0x1a8]
sub eax, 0x76eaad79
je 0x10001cf6
jmp 0x1000177e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x78c8ac98
je 0x10002ab8
push eax
mov eax, esp
mov dword [ebp - 0x188], eax
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x1a0], 0x85792b7f
jmp 0x10002ad1
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x18c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c600
add esp, 0xc
mov eax, dword [ebp - 0x18c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x194], eax
mov eax, 0xe643ac6a
mov ecx, 0x226c7bd
cmp dword [ebp - 0x194], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x3851723b
jmp 0x10002ad1
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1a0], 0x3f1e85be
jmp 0x10002ad1
mov eax, dword [0x1006b340]
mov ecx, dword [0x1006b33c]
mov edx, eax
add edx, 0x74018719
sub edx, 1
sub edx, 0x74018719
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed900a4b
mov ecx, 0xb0e7a2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x160], eax
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
add edx, 0xf8361392
sub edx, 1
sub edx, 0xf8361392
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xed900a4b
mov ecx, 0xe7c0b186
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x5dbe480e
jmp 0x10002ad1
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x160]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x19c], eax
mov edx, 0xffffffff
mov eax, 0xac0fa2c5
mov ecx, 0xb7c0ca7e
cmp dword [ebp - 0x19c], edx
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x3851723b
jmp 0x10002ad1
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x1a0], 0xf56e3104
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
add edx, 0x1a34f699
sub edx, 1
sub edx, 0x1a34f699
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37562e5d
mov ecx, 0xb4d99114
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x158], eax
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
sub edx, 0xa2a50f31
sub edx, 1
add edx, 0xa2a50f31
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37562e5d
mov ecx, 0xc55f3c36
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x42f2926d
jmp 0x10002ad1
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x158]
mov dword [eax], ecx
mov edx, dword [ebp - 0x188]
mov eax, 0x83e26f97
mov ecx, 0x127b7bb1
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [0x1006b340]
mov ecx, dword [0x1006b33c]
mov edx, eax
sub edx, 0xf94185a5
sub edx, 1
add edx, 0xf94185a5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9baf143
mov ecx, 0x6acdb7f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x154], eax
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
sub edx, 0x48c7e727
sub edx, 1
add edx, 0x48c7e727
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9baf143
mov ecx, 0x5ef64bee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x58bf8461
jmp 0x10002ad1
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x76eaad79
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x3851723b
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37563c11
mov ecx, 0xc115dd14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14c], eax
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
sub edx, 0x47702280
sub edx, 1
add edx, 0x47702280
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37563c11
mov ecx, 0x501b1f55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0xdae19ad2
jmp 0x10002ad1
mov eax, dword [ebp - 0x150]
mov edx, dword [ebp - 0x14c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1a0], 0xa8558f0d
jmp 0x10002ad1
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov word [eax], 0
mov dword [ebp - 0x1a0], 0xd57407fe
jmp 0x10002ad1
mov eax, dword [ebp - 0x178]
movzx eax, word [eax]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x1a0], 0xec48f096
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x94543519
mov ecx, 0xc9395a1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x144]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x13d], al
mov eax, dword [0x1006b340]
mov ecx, dword [0x1006b33c]
mov edx, eax
sub edx, 0x49bfb8e3
sub edx, 1
add edx, 0x49bfb8e3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94543519
mov ecx, 0x13ab97e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0xf5e1eaea
jmp 0x10002ad1
mov dl, byte [ebp - 0x13d]
mov eax, 0xf557c6a9
mov ecx, 0xced61e23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
sub eax, 0x9681c0a1
add eax, 0x18
add eax, 0x9681c0a1
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, 0xde0e83d
add eax, ecx
sub eax, 0xde0e83d
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1a0], 0x1bba00c3
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
add edx, 0x27243b31
sub edx, 1
sub edx, 0x27243b31
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2c911fd
mov ecx, 0x3274840c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x138], eax
mov eax, dword [0x1006b340]
mov ecx, dword [0x1006b33c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c911fd
mov ecx, 0xc68a02c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0xb969114a
jmp 0x10002ad1
mov eax, dword [ebp - 0x178]
movzx eax, word [eax]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x138]
sub ecx, 0x217a657c
add ecx, eax
add ecx, 0x217a657c
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e970
add esp, 8
mov edx, eax
mov eax, 0x1711eb35
mov ecx, 0x45f1ca0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1a0], 0xf5848708
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
sub edx, 0x60ffd837
sub edx, 1
add edx, 0x60ffd837
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2b0fc8d3
mov ecx, 0x3560a4f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x130]
sub edx, 0xbc0b4da3
add edx, eax
add edx, 0xbc0b4da3
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x134]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x244e30a8
add edx, eax
add edx, 0x244e30a8
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0xbc667b93
add ecx, eax
sub ecx, 0xbc667b93
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c760
add esp, 0xc
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x124], eax
mov eax, dword [0x1006b340]
mov ecx, dword [0x1006b33c]
mov edx, eax
sub edx, 0x96a1f9ed
sub edx, 1
add edx, 0x96a1f9ed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b0fc8d3
mov ecx, 0xeef7a985
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x49bcec03
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xab8ee97
mov ecx, 0x4d39f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov esi, dword [ebp - 0x198]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
add edx, 0x1e1e2b1
sub edx, 1
sub edx, 0x1e1e2b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xab8ee97
mov ecx, 0x658966ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x45f1ca0
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0xe127a193
jmp 0x10002ad1
mov eax, dword [ebp - 0x178]
mov ax, word [eax]
mov word [ebp - 0x11e], ax
mov dword [ebp - 0x1a0], 0xe769d4b3
jmp 0x10002ad1
mov eax, dword [0x1006b340]
mov ecx, dword [0x1006b33c]
mov edx, eax
add edx, 0xfb96e2fc
sub edx, 1
sub edx, 0xfb96e2fc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb031fda6
mov ecx, 0xddab04f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov cx, word [ebp - 0x11e]
xor eax, eax
sub ax, cx
xor ecx, ecx
sub cx, 1
add ax, cx
xor ecx, ecx
sub cx, ax
mov eax, dword [ebp - 0x178]
mov word [eax], cx
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
sub edx, 0x93e7509e
sub edx, 1
add edx, 0x93e7509e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb031fda6
mov ecx, 0x3a2d0546
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x236425ca
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
sub edx, 0x91d08081
sub edx, 1
add edx, 0x91d08081
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78c8ac98
mov ecx, 0x8551278f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
add edx, 0xc08e7b3a
sub edx, 1
sub edx, 0xc08e7b3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x78c8ac98
mov ecx, 0xbf1e7508
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0xd57407fe
jmp 0x10002ad1
mov eax, dword [ebp - 0x19c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x97a242fc
jmp 0x10002ad1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xae14ca99
jmp 0x10002ad1
mov eax, dword [ebp - 0x190]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x3851723b
jmp 0x10002ad1
mov ecx, dword [0x1006b340]
mov eax, dword [0x1006b33c]
mov edx, ecx
add edx, 0x34629374
sub edx, 1
sub edx, 0x34629374
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb18231ea
mov ecx, 0x7b08b608
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ad1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000ba00
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1a0], 0xb0e7a2e
jmp 0x10002ad1
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x1a0], 0xb4d99114
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x6acdb7f1
jmp 0x10002ad1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1a0], 0xc115dd14
jmp 0x10002ad1
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1a0], 0xc9395a1b
jmp 0x10002ad1
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1a0], 0x3274840c
jmp 0x10002ad1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x130]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x134]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x5efae456
add edx, eax
add edx, 0x5efae456
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x128dc392
add ecx, eax
sub ecx, 0x128dc392
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c760
add esp, 0xc
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1a0], 0x3560a4f2
jmp 0x10002ad1
mov esi, dword [ebp - 0x198]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xeef55d71
add esi, eax
add esi, 0xeef55d71
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov dword [ebp - 0x1a0], 0x4d39f9
jmp 0x10002ad1
mov cx, word [ebp - 0x11e]
add cx, 0xdb6b
add cx, 1
sub cx, 0xdb6b
mov eax, dword [ebp - 0x178]
mov word [eax], cx
mov dword [ebp - 0x1a0], 0xddab04f1
jmp 0x10002ad1
mov dword [ebp - 0x1a0], 0x7b08b608
jmp 0x100011f8