Function at 0x1000c4a0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x1008d080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
add edx, 0xffb50435
sub edx, 1
sub edx, 0xffb50435
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x92], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x91], al
mov dword [ebp - 0x98], 0x768e033d
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x82015f4c
je 0x1000d9e7
jmp 0x1000c523
mov eax, dword [ebp - 0xa0]
sub eax, 0x886f23ac
je 0x1000da05
jmp 0x1000c539
mov eax, dword [ebp - 0xa0]
sub eax, 0x8a660bbd
je 0x1000cb03
jmp 0x1000c54f
mov eax, dword [ebp - 0xa0]
sub eax, 0x8d6e953a
je 0x1000d9d8
jmp 0x1000c565
mov eax, dword [ebp - 0xa0]
sub eax, 0x8e141539
je 0x1000d787
jmp 0x1000c57b
mov eax, dword [ebp - 0xa0]
sub eax, 0x8f31d413
je 0x1000d0f2
jmp 0x1000c591
mov eax, dword [ebp - 0xa0]
sub eax, 0x9e19f6f7
je 0x1000cd93
jmp 0x1000c5a7
mov eax, dword [ebp - 0xa0]
sub eax, 0x9e3acb4a
je 0x1000cf7e
jmp 0x1000c5bd
mov eax, dword [ebp - 0xa0]
sub eax, 0x9fee14e6
je 0x1000cf07
jmp 0x1000c5d3
mov eax, dword [ebp - 0xa0]
sub eax, 0xa1dbd57f
je 0x1000d088
jmp 0x1000c5e9
mov eax, dword [ebp - 0xa0]
sub eax, 0xa91caa7e
je 0x1000d079
jmp 0x1000c5ff
mov eax, dword [ebp - 0xa0]
sub eax, 0xaaba3928
je 0x1000d88b
jmp 0x1000c615
mov eax, dword [ebp - 0xa0]
sub eax, 0xb8420f1c
je 0x1000ce16
jmp 0x1000c62b
mov eax, dword [ebp - 0xa0]
sub eax, 0xb873253e
je 0x1000d9f6
jmp 0x1000c641
mov eax, dword [ebp - 0xa0]
sub eax, 0xc04b8630
je 0x1000d804
jmp 0x1000c657
mov eax, dword [ebp - 0xa0]
sub eax, 0xc3fcd035
je 0x1000d9b8
jmp 0x1000c66d
mov eax, dword [ebp - 0xa0]
sub eax, 0xc45b0086
je 0x1000cf2d
jmp 0x1000c683
mov eax, dword [ebp - 0xa0]
sub eax, 0xc45ef8d4
je 0x1000cb64
jmp 0x1000c699
mov eax, dword [ebp - 0xa0]
sub eax, 0xcf11592b
je 0x1000d026
jmp 0x1000c6af
mov eax, dword [ebp - 0xa0]
sub eax, 0xd4bca648
je 0x1000d2be
jmp 0x1000c6c5
mov eax, dword [ebp - 0xa0]
sub eax, 0xd5059cfa
je 0x1000d671
jmp 0x1000c6db
mov eax, dword [ebp - 0xa0]
sub eax, 0xda14cb47
je 0x1000d691
jmp 0x1000c6f1
mov eax, dword [ebp - 0xa0]
sub eax, 0xde8e05a5
je 0x1000d658
jmp 0x1000c707
mov eax, dword [ebp - 0xa0]
sub eax, 0xdfb8a703
je 0x1000cd44
jmp 0x1000c71d
mov eax, dword [ebp - 0xa0]
sub eax, 0xe3c30dd8
je 0x1000d2eb
jmp 0x1000c733
mov eax, dword [ebp - 0xa0]
sub eax, 0xea355ee7
je 0x1000d178
jmp 0x1000c749
mov eax, dword [ebp - 0xa0]
sub eax, 0xec874c12
je 0x1000cf16
jmp 0x1000c75f
mov eax, dword [ebp - 0xa0]
sub eax, 0xed604bd5
je 0x1000d541
jmp 0x1000c775
mov eax, dword [ebp - 0xa0]
sub eax, 0xed7025d0
je 0x1000d044
jmp 0x1000c78b
mov eax, dword [ebp - 0xa0]
sub eax, 0xef7a249d
je 0x1000d93b
jmp 0x1000c7a1
mov eax, dword [ebp - 0xa0]
sub eax, 0xf13eff78
je 0x1000d017
jmp 0x1000c7b7
mov eax, dword [ebp - 0xa0]
sub eax, 0xf8400212
je 0x1000d51d
jmp 0x1000c7cd
mov eax, dword [ebp - 0xa0]
sub eax, 0xf9ac3c6c
je 0x1000d89a
jmp 0x1000c7e3
mov eax, dword [ebp - 0xa0]
sub eax, 0xfa05b4d6
je 0x1000d127
jmp 0x1000c7f9
mov eax, dword [ebp - 0xa0]
sub eax, 0xfbcd9dd9
je 0x1000cd53
jmp 0x1000c80f
mov eax, dword [ebp - 0xa0]
sub eax, 0x560163b
je 0x1000db0a
jmp 0x1000c825
mov eax, dword [ebp - 0xa0]
sub eax, 0x8bc76cc
je 0x1000d649
jmp 0x1000c83b
mov eax, dword [ebp - 0xa0]
sub eax, 0x9392d07
je 0x1000cc26
jmp 0x1000c851
mov eax, dword [ebp - 0xa0]
sub eax, 0xec8abcb
je 0x1000daf1
jmp 0x1000c867
mov eax, dword [ebp - 0xa0]
sub eax, 0x10b6f0b3
je 0x1000d42d
jmp 0x1000c87d
mov eax, dword [ebp - 0xa0]
sub eax, 0x150bc01c
je 0x1000d0db
jmp 0x1000c893
mov eax, dword [ebp - 0xa0]
sub eax, 0x166a70f7
je 0x1000da57
jmp 0x1000c8a9
mov eax, dword [ebp - 0xa0]
sub eax, 0x172d56d3
je 0x1000d9c7
jmp 0x1000c8bf
mov eax, dword [ebp - 0xa0]
sub eax, 0x173546aa
je 0x1000cc60
jmp 0x1000c8d5
mov eax, dword [ebp - 0xa0]
sub eax, 0x185f48fb
je 0x1000d1d2
jmp 0x1000c8eb
mov eax, dword [ebp - 0xa0]
sub eax, 0x1cb20653
je 0x1000db2a
jmp 0x1000c901
mov eax, dword [ebp - 0xa0]
sub eax, 0x1d2a7156
je 0x1000d348
jmp 0x1000c917
mov eax, dword [ebp - 0xa0]
sub eax, 0x25383ad6
je 0x1000d324
jmp 0x1000c92d
mov eax, dword [ebp - 0xa0]
sub eax, 0x25571bf5
je 0x1000da7e
jmp 0x1000c943
mov eax, dword [ebp - 0xa0]
sub eax, 0x2c731704
je 0x1000ccce
jmp 0x1000c959
mov eax, dword [ebp - 0xa0]
sub eax, 0x33ab1bc3
je 0x1000d8c5
jmp 0x1000c96f
mov eax, dword [ebp - 0xa0]
sub eax, 0x387eda5e
je 0x1000d391
jmp 0x1000c985
mov eax, dword [ebp - 0xa0]
sub eax, 0x3a4777a7
je 0x1000d05b
jmp 0x1000c99b
mov eax, dword [ebp - 0xa0]
sub eax, 0x41bf34d7
je 0x1000d796
jmp 0x1000c9b1
mov eax, dword [ebp - 0xa0]
sub eax, 0x4aad3e44
je 0x1000d1e1
jmp 0x1000c9c7
mov eax, dword [ebp - 0xa0]
sub eax, 0x4e50e585
je 0x1000dab0
jmp 0x1000c9dd
mov eax, dword [ebp - 0xa0]
sub eax, 0x5724548a
je 0x1000d5b7
jmp 0x1000c9f3
mov eax, dword [ebp - 0xa0]
sub eax, 0x61e7ae16
je 0x1000d2cd
jmp 0x1000ca09
mov eax, dword [ebp - 0xa0]
sub eax, 0x62c2b9dc
je 0x1000ce91
jmp 0x1000ca1f
mov eax, dword [ebp - 0xa0]
sub eax, 0x639307dc
je 0x1000ce40
jmp 0x1000ca35
mov eax, dword [ebp - 0xa0]
sub eax, 0x65f1da40
je 0x1000d63a
jmp 0x1000ca4b
mov eax, dword [ebp - 0xa0]
sub eax, 0x6933a4b7
je 0x1000da69
jmp 0x1000ca61
mov eax, dword [ebp - 0xa0]
sub eax, 0x6c670bdf
je 0x1000cb55
jmp 0x1000ca77
mov eax, dword [ebp - 0xa0]
sub eax, 0x709405ff
je 0x1000d257
jmp 0x1000ca8d
mov eax, dword [ebp - 0xa0]
sub eax, 0x72389773
je 0x1000d44b
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d6e953a
mov ecx, 0x6c670bdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0xc45ef8d4
jmp 0x1000db43
mov ecx, dword [ebp - 0x9c]
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100216c0
add esp, 0xc
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x98], 0x9392d07
jmp 0x1000db43
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov edx, dword [ebp - 0x84]
mov eax, 0x173546aa
mov ecx, 0xfbcd9dd9
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x82015f4c
mov ecx, 0x2c731704
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
add edx, 0xce525d07
sub edx, 1
sub edx, 0xce525d07
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x82015f4c
mov ecx, 0xdfb8a703
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0x172d56d3
jmp 0x1000db43
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x98], 0x9e19f6f7
jmp 0x1000db43
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x98], 0xb8420f1c
jmp 0x1000db43
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x78]
mov esi, 0xffffffff
mov eax, 0xec874c12
mov ecx, 0x639307dc
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
add edx, 0x54295e10
sub edx, 1
sub edx, 0x54295e10
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb873253e
mov ecx, 0x62c2b9dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
add edx, 0xb227ebf9
sub edx, 1
sub edx, 0xb227ebf9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb873253e
mov ecx, 0x9fee14e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0x172d56d3
jmp 0x1000db43
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x98], 0xc45b0086
jmp 0x1000db43
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
add edx, 0x418c65
sub edx, 1
sub edx, 0x418c65
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x886f23ac
mov ecx, 0x9e3acb4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
add edx, 0xbedb5aed
sub edx, 1
sub edx, 0xbedb5aed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x886f23ac
mov ecx, 0xf13eff78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0xcf11592b
jmp 0x1000db43
mov edx, dword [ebp - 0x48]
mov eax, 0xed7025d0
mov ecx, 0xa1dbd57f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x98], 0x3a4777a7
jmp 0x1000db43
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xa91caa7e
jmp 0x1000db43
mov dword [ebp - 0x98], 0x172d56d3
jmp 0x1000db43
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0x150bc01c
jmp 0x1000db43
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x98], 0x8f31d413
jmp 0x1000db43
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x8bec6456
add ecx, eax
sub ecx, 0x8bec6456
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov dword [ebp - 0x98], 0xfa05b4d6
jmp 0x1000db43
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
add edx, 0xefeb4466
sub edx, 1
sub edx, 0xefeb4466
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x166a70f7
mov ecx, 0xea355ee7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
sub edx, 0x931994bd
sub edx, 1
add edx, 0x931994bd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x166a70f7
mov ecx, 0x185f48fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0x4aad3e44
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
add edx, 0xaf723fd0
sub edx, 1
sub edx, 0xaf723fd0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6933a4b7
mov ecx, 0x709405ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
sub edx, 0xaec69d17
sub edx, 1
add edx, 0xaec69d17
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6933a4b7
mov ecx, 0xd4bca648
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0x61e7ae16
jmp 0x1000db43
mov dl, byte [ebp - 0x35]
mov eax, 0x41bf34d7
mov ecx, 0xe3c30dd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub eax, 0x2258ea05
add eax, 0x18
add eax, 0x2258ea05
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
sub eax, 0xf0a0103e
add eax, ecx
add eax, 0xf0a0103e
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x98], 0x25383ad6
jmp 0x1000db43
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x64]
movzx ecx, word [ecx]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x98], 0x1d2a7156
jmp 0x1000db43
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x25571bf5
mov ecx, 0x387eda5e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1002e866
call fcn.10025020
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x25571bf5
mov ecx, 0x10b6f0b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dl, byte [ebp - 0x29]
mov eax, 0x72389773
mov ecx, 0x8bc76cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0x8b397466
add eax, ecx
sub eax, 0x8b397466
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x98], 0xed604bd5
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
sub edx, 0x192de6a3
sub edx, 1
add edx, 0x192de6a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4e50e585
mov ecx, 0x5724548a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [0x1008e574]
mov ecx, dword [0x1008e570]
mov edx, eax
add edx, 0xd0e08f5c
sub edx, 1
sub edx, 0xd0e08f5c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e50e585
mov ecx, 0x65f1da40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0x8bc76cc
jmp 0x1000db43
mov dword [ebp - 0x98], 0xde8e05a5
jmp 0x1000db43
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x98], 0xd5059cfa
jmp 0x1000db43
mov ax, word [ebp - 0x14]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x12], ax
mov dword [ebp - 0x98], 0xda14cb47
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
sub edx, 0x3a205ae7
sub edx, 1
add edx, 0x3a205ae7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xec8abcb
mov ecx, 0x75776c3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0xfa05b4d6
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x560163b
mov ecx, 0xc04b8630
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
add edx, 0x6c86c030
sub edx, 1
sub edx, 0x6c86c030
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x560163b
mov ecx, 0xaaba3928
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0xf9ac3c6c
jmp 0x1000db43
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x98], 0x33ab1bc3
jmp 0x1000db43
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
mov edx, ecx
sub edx, 0x4ff3f8d4
sub edx, 1
add edx, 0x4ff3f8d4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1cb20653
mov ecx, 0xef7a249d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1008e574]
mov eax, dword [0x1008e570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1cb20653
mov ecx, 0xc3fcd035
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000db43
mov dword [ebp - 0x98], 0x172d56d3
jmp 0x1000db43
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10020920
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x98], 0x8a660bbd
jmp 0x1000db43
mov dword [ebp - 0x98], 0x2c731704
jmp 0x1000db43
mov dword [ebp - 0x98], 0x62c2b9dc
jmp 0x1000db43
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x98], 0x9e3acb4a
jmp 0x1000db43
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x98], 0xea355ee7
jmp 0x1000db43
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x98], 0x709405ff
jmp 0x1000db43
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1002e866
call fcn.10025020
add esp, 8
mov dword [ebp - 0x98], 0x387eda5e
jmp 0x1000db43
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov dword [ebp - 0x98], 0x5724548a
jmp 0x1000db43
mov eax, dword [ebp - 0x64]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x98], 0x75776c3f
jmp 0x1000db43
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xc04b8630
jmp 0x1000db43
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xef7a249d
jmp 0x1000c507