Function at 0x1000eaf0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c0
mov eax, dword [ebp + 8]
mov eax, dword [0x100b9a80]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x1ac], 0xe655e693
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
sub eax, 0x806650eb
je 0x1000f7ae
jmp 0x1000eb3b
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8bbd5646
je 0x1000f758
jmp 0x1000eb51
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8e0f738d
je 0x1000f421
jmp 0x1000eb67
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9993f1ae
je 0x1000f217
jmp 0x1000eb7d
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9aed1861
je 0x1000fde5
jmp 0x1000eb93
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9b0823fd
je 0x1000f4b4
jmp 0x1000eba9
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9c97bc39
je 0x1000feb5
jmp 0x1000ebbf
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa4472999
je 0x1000f8d3
jmp 0x1000ebd5
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb0ca3093
je 0x1000f7ef
jmp 0x1000ebeb
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb19cd6a2
je 0x1000fb97
jmp 0x1000ec01
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb4bb4339
je 0x1000fe4d
jmp 0x1000ec17
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb59cbf62
je 0x1000f7d4
jmp 0x1000ec2d
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb9012989
je 0x1000fbd3
jmp 0x1000ec43
mov eax, dword [ebp - 0x1b0]
sub eax, 0xc04b6752
je 0x1000f590
jmp 0x1000ec59
mov eax, dword [ebp - 0x1b0]
sub eax, 0xc26b63fd
je 0x1000f767
jmp 0x1000ec6f
mov eax, dword [ebp - 0x1b0]
sub eax, 0xc69365ad
je 0x1000f2a8
jmp 0x1000ec85
mov eax, dword [ebp - 0x1b0]
sub eax, 0xcdc63018
je 0x1000f118
jmp 0x1000ec9b
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd296243b
je 0x1000f4ff
jmp 0x1000ecb1
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd5833a39
je 0x1000f086
jmp 0x1000ecc7
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd75e4c8a
je 0x1000f34f
jmp 0x1000ecdd
mov eax, dword [ebp - 0x1b0]
sub eax, 0xdaef1a43
je 0x1000fc21
jmp 0x1000ecf3
mov eax, dword [ebp - 0x1b0]
sub eax, 0xe655e693
je 0x1000f010
jmp 0x1000ed09
mov eax, dword [ebp - 0x1b0]
sub eax, 0xe81953c4
je 0x1000fd22
jmp 0x1000ed1f
mov eax, dword [ebp - 0x1b0]
sub eax, 0xeba2531c
je 0x1000f152
jmp 0x1000ed35
mov eax, dword [ebp - 0x1b0]
sub eax, 0xebf3daf3
je 0x1000f32e
jmp 0x1000ed4b
mov eax, dword [ebp - 0x1b0]
sub eax, 0xeda16e10
je 0x1000f9fe
jmp 0x1000ed61
mov eax, dword [ebp - 0x1b0]
sub eax, 0xf41f2bb1
je 0x1000f35e
jmp 0x1000ed77
mov eax, dword [ebp - 0x1b0]
sub eax, 0xf7354b82
je 0x1000f4f0
jmp 0x1000ed8d
mov eax, dword [ebp - 0x1b0]
sub eax, 0xf754a5ee
je 0x1000f66e
jmp 0x1000eda3
mov eax, dword [ebp - 0x1b0]
sub eax, 0xfa3526bb
je 0x1000f493
jmp 0x1000edb9
mov eax, dword [ebp - 0x1b0]
sub eax, 0x4803a68
je 0x1000f65f
jmp 0x1000edcf
mov eax, dword [ebp - 0x1b0]
sub eax, 0x90602c8
je 0x1000f51a
jmp 0x1000ede5
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa78dcf9
je 0x1000f161
jmp 0x1000edfb
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd41d80a
je 0x1000fb88
jmp 0x1000ee11
mov eax, dword [ebp - 0x1b0]
sub eax, 0xe08c9fd
je 0x1000f232
jmp 0x1000ee27
mov eax, dword [ebp - 0x1b0]
sub eax, 0x26d9376e
je 0x1000fba6
jmp 0x1000ee3d
mov eax, dword [ebp - 0x1b0]
sub eax, 0x2a5dc75b
je 0x1000f825
jmp 0x1000ee53
mov eax, dword [ebp - 0x1b0]
sub eax, 0x35b14da9
je 0x1000fc00
jmp 0x1000ee69
mov eax, dword [ebp - 0x1b0]
sub eax, 0x3e9ccaa9
je 0x1000fb31
jmp 0x1000ee7f
mov eax, dword [ebp - 0x1b0]
sub eax, 0x4170e8c5
je 0x1000fab0
jmp 0x1000ee95
mov eax, dword [ebp - 0x1b0]
sub eax, 0x4ea92d34
je 0x1000faa1
jmp 0x1000eeab
mov eax, dword [ebp - 0x1b0]
sub eax, 0x4f413b1a
je 0x1000fd6c
jmp 0x1000eec1
mov eax, dword [ebp - 0x1b0]
sub eax, 0x55bd0f36
je 0x1000f4cf
jmp 0x1000eed7
mov eax, dword [ebp - 0x1b0]
sub eax, 0x5ada2e95
je 0x1000fd0d
jmp 0x1000eeed
mov eax, dword [ebp - 0x1b0]
sub eax, 0x5d5e76a0
je 0x1000f6b7
jmp 0x1000ef03
mov eax, dword [ebp - 0x1b0]
sub eax, 0x5e18b4d5
je 0x1000f3a7
jmp 0x1000ef19
mov eax, dword [ebp - 0x1b0]
sub eax, 0x6022378d
je 0x1000fae0
jmp 0x1000ef2f
mov eax, dword [ebp - 0x1b0]
sub eax, 0x67391974
je 0x1000fd81
jmp 0x1000ef45
mov eax, dword [ebp - 0x1b0]
sub eax, 0x6956b7e8
je 0x1000f78f
jmp 0x1000ef5b
mov eax, dword [ebp - 0x1b0]
sub eax, 0x699740f2
je 0x1000fc97
jmp 0x1000ef71
mov eax, dword [ebp - 0x1b0]
sub eax, 0x6d3e8e64
je 0x1000f127
jmp 0x1000ef87
mov eax, dword [ebp - 0x1b0]
sub eax, 0x73394b13
je 0x1000f9ef
jmp 0x1000ef9d
mov eax, dword [ebp - 0x1b0]
sub eax, 0x733d5f63
je 0x1000f890
jmp 0x1000efb3
mov eax, dword [ebp - 0x1b0]
sub eax, 0x7430ef6a
je 0x1000fd90
jmp 0x1000efc9
mov eax, dword [ebp - 0x1b0]
sub eax, 0x7bb16e35
je 0x1000fe98
jmp 0x1000efdf
mov eax, dword [ebp - 0x1b0]
sub eax, 0x7d9c6817
je 0x1000f430
jmp 0x1000eff5
mov eax, dword [ebp - 0x1b0]
sub eax, 0x7f5d3f0a
je 0x1000f941
jmp 0x1000f00b
jmp 0x1000febf
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
mov edx, ecx
sub edx, 0x47407856
sub edx, 1
add edx, 0x47407856
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe81953c4
mov ecx, 0xd5833a39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d9d0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x178], eax
mov eax, dword [0x100bb0c4]
mov ecx, dword [0x100bb0c0]
mov edx, eax
sub edx, 0xc054f675
sub edx, 1
add edx, 0xc054f675
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe81953c4
mov ecx, 0xcdc63018
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0x6d3e8e64
jmp 0x1000febf
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x184], eax
mov eax, 0xeba2531c
mov ecx, 0xa78dcf9
cmp dword [ebp - 0x184], 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xdaef1a43
jmp 0x1000febf
mov ecx, dword [ebp - 0x184]
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x188], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x184]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x114]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x1ac], 0x9993f1ae
jmp 0x1000febf
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x1ac], 0xe08c9fd
jmp 0x1000febf
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
mov edx, ecx
add edx, 0x91b0313a
sub edx, 1
sub edx, 0x91b0313a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4f413b1a
mov ecx, 0xc69365ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x174]
mov ecx, 0xffffffff
cmp eax, ecx
sete al
and al, 1
mov byte [ebp - 0x16d], al
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4f413b1a
mov ecx, 0xebf3daf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dl, byte [ebp - 0x16d]
mov eax, 0xf41f2bb1
mov ecx, 0xd75e4c8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xdaef1a43
jmp 0x1000febf
mov eax, dword [0x100bb0c4]
mov ecx, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67391974
mov ecx, 0x5e18b4d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x16c], eax
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x67391974
mov ecx, 0x8e0f738d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0x7d9c6817
jmp 0x1000febf
mov eax, dword [ebp - 0x16c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
setne al
and al, 1
mov byte [ebp - 0x165], al
mov dword [ebp - 0x1ac], 0xfa3526bb
jmp 0x1000febf
mov dl, byte [ebp - 0x165]
mov eax, 0x9b0823fd
mov ecx, 0xd296243b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1ac], 0x55bd0f36
jmp 0x1000febf
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1ac], 0xf7354b82
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xdaef1a43
jmp 0x1000febf
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x1ac], 0x90602c8
jmp 0x1000febf
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
mov edx, ecx
add edx, 0x964278df
sub edx, 1
sub edx, 0x964278df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7430ef6a
mov ecx, 0xc04b6752
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x160]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x198]
add eax, 0x3c
mov dword [ebp - 0x158], eax
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7430ef6a
mov ecx, 0x4803a68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xf754a5ee
jmp 0x1000febf
mov eax, dword [0x100bb0c4]
mov ecx, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9aed1861
mov ecx, 0x5d5e76a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x19c], eax
mov word [ebp - 0x19e], 0
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
mov edx, ecx
add edx, 0x5bbe8133
sub edx, 1
sub edx, 0x5bbe8133
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9aed1861
mov ecx, 0x8bbd5646
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xc26b63fd
jmp 0x1000febf
movzx eax, word [ebp - 0x19e]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1ac], 0x6956b7e8
jmp 0x1000febf
mov eax, dword [ebp - 0x150]
movzx eax, word [eax + 6]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x1ac], 0x806650eb
jmp 0x1000febf
mov edx, dword [ebp - 0x154]
mov esi, dword [ebp - 0x14c]
mov eax, 0x26d9376e
mov ecx, 0xb59cbf62
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1ac], 0xb0ca3093
jmp 0x1000febf
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1ac], 0x2a5dc75b
jmp 0x1000febf
mov eax, dword [ebp - 0x140]
movzx ecx, word [eax + 0x14]
mov eax, dword [ebp - 0x144]
add eax, 0x543549ae
add eax, ecx
sub eax, 0x543549ae
movzx ecx, word [ebp - 0x19e]
imul ecx, ecx, 0x28
sub eax, 0x9c0d6544
add eax, ecx
add eax, 0x9c0d6544
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003bef5
call fcn.10031340
mov edx, eax
mov eax, 0x733d5f63
mov ecx, 0x4ea92d34
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x1a4]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1ac], 0xa4472999
jmp 0x1000febf
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb4bb4339
mov ecx, 0x7f5d3f0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x1a5], al
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x1a4]
mov ecx, dword [ecx + 0xc]
add eax, 0x2b28bb4d
add eax, ecx
sub eax, 0x2b28bb4d
mov dword [ebp - 0x134], eax
mov eax, dword [0x100bb0c4]
mov ecx, dword [0x100bb0c0]
mov edx, eax
add edx, 0x52a6ee3
sub edx, 1
sub edx, 0x52a6ee3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4bb4339
mov ecx, 0x73394b13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xeda16e10
jmp 0x1000febf
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 0xc]
add ecx, 0xc3f939ca
add ecx, eax
sub ecx, 0xc3f939ca
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x134]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002db30
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x1a4]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x188]
mov eax, dword [ebp - 0x1a4]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
lea eax, [ebp - 0x124]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x1a5], al
mov dword [ebp - 0x1ac], 0x4ea92d34
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0x4170e8c5
jmp 0x1000febf
mov ax, word [ebp - 0x19e]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x12e], ax
mov dword [ebp - 0x1ac], 0x6022378d
jmp 0x1000febf
mov eax, dword [0x100bb0c4]
mov ecx, dword [0x100bb0c0]
mov edx, eax
add edx, 0xf0393a41
sub edx, 1
sub edx, 0xf0393a41
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7bb16e35
mov ecx, 0x3e9ccaa9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov ax, word [ebp - 0x12e]
mov word [ebp - 0x19e], ax
mov eax, dword [0x100bb0c4]
mov ecx, dword [0x100bb0c0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7bb16e35
mov ecx, 0xd41d80a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xb19cd6a2
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0xc26b63fd
jmp 0x1000febf
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1ac], 0xb9012989
jmp 0x1000febf
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1ac], 0x35b14da9
jmp 0x1000febf
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1ac], 0xdaef1a43
jmp 0x1000febf
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
mov edx, ecx
sub edx, 0x4102aab9
sub edx, 1
add edx, 0x4102aab9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9c97bc39
mov ecx, 0x699740f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov ecx, dword [0x100bb0c4]
mov eax, dword [0x100bb0c0]
mov edx, ecx
sub edx, 0xb27f327c
sub edx, 1
add edx, 0xb27f327c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9c97bc39
mov ecx, 0x5ada2e95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x1000febf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cbc0
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d9d0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x1ac], 0xd5833a39
jmp 0x1000febf
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1ac], 0xc69365ad
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0x5e18b4d5
jmp 0x1000febf
mov eax, dword [ebp - 0x160]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1ac], 0xc04b6752
jmp 0x1000febf
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
sub eax, 0xbeb096eb
add eax, ecx
add eax, 0xbeb096eb
mov dword [ebp - 0x19c], eax
mov word [ebp - 0x19e], 0
mov dword [ebp - 0x1ac], 0x5d5e76a0
jmp 0x1000febf
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x1a5], al
mov dword [ebp - 0x1ac], 0x7f5d3f0a
jmp 0x1000febf
mov ax, word [ebp - 0x12e]
mov word [ebp - 0x19e], ax
mov dword [ebp - 0x1ac], 0x3e9ccaa9
jmp 0x1000febf
mov dword [ebp - 0x1ac], 0x699740f2
jmp 0x1000eb1f