Function at 0x10008ee0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x100b1880]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x98], 0x8aea1bd3
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x813d047c
je 0x10009b99
jmp 0x10008f24
mov eax, dword [ebp - 0xa0]
sub eax, 0x867c67f8
je 0x1000a19b
jmp 0x10008f3a
mov eax, dword [ebp - 0xa0]
sub eax, 0x8950b4d0
je 0x1000a35f
jmp 0x10008f50
mov eax, dword [ebp - 0xa0]
sub eax, 0x8aea1bd3
je 0x10009501
jmp 0x10008f66
mov eax, dword [ebp - 0xa0]
sub eax, 0x8dab5b99
je 0x10009d9e
jmp 0x10008f7c
mov eax, dword [ebp - 0xa0]
sub eax, 0x8dafeb0f
je 0x100097bc
jmp 0x10008f92
mov eax, dword [ebp - 0xa0]
sub eax, 0x8e4af903
je 0x10009c46
jmp 0x10008fa8
mov eax, dword [ebp - 0xa0]
sub eax, 0x91148ce6
je 0x1000a2a0
jmp 0x10008fbe
mov eax, dword [ebp - 0xa0]
sub eax, 0x97653039
je 0x1000a0a0
jmp 0x10008fd4
mov eax, dword [ebp - 0xa0]
sub eax, 0x9bca99c7
je 0x10009a2d
jmp 0x10008fea
mov eax, dword [ebp - 0xa0]
sub eax, 0xa0a8933d
je 0x100098f5
jmp 0x10009000
mov eax, dword [ebp - 0xa0]
sub eax, 0xa3b25951
je 0x1000a4f1
jmp 0x10009016
mov eax, dword [ebp - 0xa0]
sub eax, 0xa44aa394
je 0x1000a22a
jmp 0x1000902c
mov eax, dword [ebp - 0xa0]
sub eax, 0xaf7897ad
je 0x1000a4ca
jmp 0x10009042
mov eax, dword [ebp - 0xa0]
sub eax, 0xb023e1d4
je 0x1000975c
jmp 0x10009058
mov eax, dword [ebp - 0xa0]
sub eax, 0xb048620a
je 0x1000996b
jmp 0x1000906e
mov eax, dword [ebp - 0xa0]
sub eax, 0xb4616dde
je 0x10009844
jmp 0x10009084
mov eax, dword [ebp - 0xa0]
sub eax, 0xb60cc3f4
je 0x10009bf5
jmp 0x1000909a
mov eax, dword [ebp - 0xa0]
sub eax, 0xbbac8057
je 0x10009a44
jmp 0x100090b0
mov eax, dword [ebp - 0xa0]
sub eax, 0xbc31d8d4
je 0x1000a45b
jmp 0x100090c6
mov eax, dword [ebp - 0xa0]
sub eax, 0xc13ff869
je 0x1000a316
jmp 0x100090dc
mov eax, dword [ebp - 0xa0]
sub eax, 0xcaf3a55b
je 0x10009e60
jmp 0x100090f2
mov eax, dword [ebp - 0xa0]
sub eax, 0xcb23a4bd
je 0x10009de7
jmp 0x10009108
mov eax, dword [ebp - 0xa0]
sub eax, 0xcdf71a62
je 0x10009817
jmp 0x1000911e
mov eax, dword [ebp - 0xa0]
sub eax, 0xd250dd45
je 0x100099f8
jmp 0x10009134
mov eax, dword [ebp - 0xa0]
sub eax, 0xd3cca4e8
je 0x1000a116
jmp 0x1000914a
mov eax, dword [ebp - 0xa0]
sub eax, 0xdaee14bf
je 0x100096fb
jmp 0x10009160
mov eax, dword [ebp - 0xa0]
sub eax, 0xe4b2d725
je 0x1000a42f
jmp 0x10009176
mov eax, dword [ebp - 0xa0]
sub eax, 0xef942127
je 0x100095cf
jmp 0x1000918c
mov eax, dword [ebp - 0xa0]
sub eax, 0xf0fae4d5
je 0x10009ac7
jmp 0x100091a2
mov eax, dword [ebp - 0xa0]
sub eax, 0xf40a02ef
je 0x1000a531
jmp 0x100091b8
mov eax, dword [ebp - 0xa0]
sub eax, 0xfb8fabf5
je 0x10009e20
jmp 0x100091ce
mov eax, dword [ebp - 0xa0]
sub eax, 0xffc47dcf
je 0x1000a509
jmp 0x100091e4
mov eax, dword [ebp - 0xa0]
sub eax, 0x34471e5
je 0x10009835
jmp 0x100091fa
mov eax, dword [ebp - 0xa0]
sub eax, 0x796cf8e
je 0x10009a71
jmp 0x10009210
mov eax, dword [ebp - 0xa0]
sub eax, 0x120fc846
je 0x1000a14a
jmp 0x10009226
mov eax, dword [ebp - 0xa0]
sub eax, 0x14114e0c
je 0x10009dbc
jmp 0x1000923c
mov eax, dword [ebp - 0xa0]
sub eax, 0x152812bd
je 0x10009f03
jmp 0x10009252
mov eax, dword [ebp - 0xa0]
sub eax, 0x15a4f632
je 0x10009c9b
jmp 0x10009268
mov eax, dword [ebp - 0xa0]
sub eax, 0x1a59be18
je 0x1000a540
jmp 0x1000927e
mov eax, dword [ebp - 0xa0]
sub eax, 0x1b81d932
je 0x1000a449
jmp 0x10009294
mov eax, dword [ebp - 0xa0]
sub eax, 0x1cacacc7
je 0x1000a38c
jmp 0x100092aa
mov eax, dword [ebp - 0xa0]
sub eax, 0x212c52bb
je 0x1000968d
jmp 0x100092c0
mov eax, dword [ebp - 0xa0]
sub eax, 0x2440353a
je 0x1000a46d
jmp 0x100092d6
mov eax, dword [ebp - 0xa0]
sub eax, 0x2bb34e5f
je 0x1000a21b
jmp 0x100092ec
mov eax, dword [ebp - 0xa0]
sub eax, 0x3519bbf0
je 0x1000a032
jmp 0x10009302
mov eax, dword [ebp - 0xa0]
sub eax, 0x386785db
je 0x10009f8a
jmp 0x10009318
mov eax, dword [ebp - 0xa0]
sub eax, 0x38dfc251
je 0x1000a325
jmp 0x1000932e
mov eax, dword [ebp - 0xa0]
sub eax, 0x3a5a6864
je 0x1000a4dc
jmp 0x10009344
mov eax, dword [ebp - 0xa0]
sub eax, 0x42c0ce7f
je 0x1000a4b5
jmp 0x1000935a
mov eax, dword [ebp - 0xa0]
sub eax, 0x4b17b9e0
je 0x10009ea9
jmp 0x10009370
mov eax, dword [ebp - 0xa0]
sub eax, 0x4b99bdd7
je 0x1000a125
jmp 0x10009386
mov eax, dword [ebp - 0xa0]
sub eax, 0x4ded5f80
je 0x10009bdd
jmp 0x1000939c
mov eax, dword [ebp - 0xa0]
sub eax, 0x50522f84
je 0x10009caa
jmp 0x100093b2
mov eax, dword [ebp - 0xa0]
sub eax, 0x52a9334f
je 0x10009539
jmp 0x100093c8
mov eax, dword [ebp - 0xa0]
sub eax, 0x5360d890
je 0x10009895
jmp 0x100093de
mov eax, dword [ebp - 0xa0]
sub eax, 0x55a55a4d
je 0x10009a07
jmp 0x100093f4
mov eax, dword [ebp - 0xa0]
sub eax, 0x57648be5
je 0x100095de
jmp 0x1000940a
mov eax, dword [ebp - 0xa0]
sub eax, 0x5bde39e6
je 0x1000976b
jmp 0x10009420
mov eax, dword [ebp - 0xa0]
sub eax, 0x5c3fb484
je 0x10009d18
jmp 0x10009436
mov eax, dword [ebp - 0xa0]
sub eax, 0x5fb9c73a
je 0x10009b18
jmp 0x1000944c
mov eax, dword [ebp - 0xa0]
sub eax, 0x613de8ad
je 0x10009a62
jmp 0x10009462
mov eax, dword [ebp - 0xa0]
sub eax, 0x63e7ddda
je 0x10009f12
jmp 0x10009478
mov eax, dword [ebp - 0xa0]
sub eax, 0x72eebb27
je 0x10009ba8
jmp 0x1000948e
mov eax, dword [ebp - 0xa0]
sub eax, 0x753f83af
je 0x1000a3d5
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x98], 0x52a9334f
jmp 0x1000a54a
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10024b10
add esp, 0xc
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x94], eax
mov eax, 0xef942127
mov ecx, 0x57648be5
cmp dword [ebp - 0x94], 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x1cacacc7
jmp 0x1000a54a
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x94]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x98], 0x212c52bb
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe4b2d725
mov ecx, 0xdaee14bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
sub edx, 0x665c72a3
sub edx, 1
add edx, 0x665c72a3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe4b2d725
mov ecx, 0xb023e1d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x5bde39e6
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
sub edx, 0xef5d5391
sub edx, 1
add edx, 0xef5d5391
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b81d932
mov ecx, 0x8dafeb0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x58]
mov ecx, 0xffffffff
cmp eax, ecx
sete al
and al, 1
mov byte [ebp - 0x51], al
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b81d932
mov ecx, 0xcdf71a62
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dl, byte [ebp - 0x51]
mov eax, 0xb4616dde
mov ecx, 0x34471e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x1cacacc7
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
add edx, 0x6d83b3d
sub edx, 1
sub edx, 0x6d83b3d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc31d8d4
mov ecx, 0x5360d890
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc31d8d4
mov ecx, 0x7f0f62c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
sub edx, 0x57872b3b
sub edx, 1
add edx, 0x57872b3b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2440353a
mov ecx, 0xb048620a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
sub edx, 0x5116150f
sub edx, 1
add edx, 0x5116150f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2440353a
mov ecx, 0xd250dd45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x55a55a4d
jmp 0x1000a54a
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x7c]
mov eax, 0x9bca99c7
mov ecx, 0x796cf8e
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x98], 0xbbac8057
jmp 0x1000a54a
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x613de8ad
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x1cacacc7
jmp 0x1000a54a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0xf0fae4d5
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
sub edx, 0x30166b46
sub edx, 1
add edx, 0x30166b46
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42c0ce7f
mov ecx, 0x5fb9c73a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
sub edx, 0x5497f3
sub edx, 1
add edx, 0x5497f3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x42c0ce7f
mov ecx, 0x813d047c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x72eebb27
jmp 0x1000a54a
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0xe401d18a
add ecx, eax
sub ecx, 0xe401d18a
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov word [eax], 0
mov dword [ebp - 0x98], 0x4ded5f80
jmp 0x1000a54a
mov eax, dword [ebp - 0x6c]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x98], 0xb60cc3f4
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
add edx, 0x4a2747f3
sub edx, 1
sub edx, 0x4a2747f3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf7897ad
mov ecx, 0x8e4af903
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf7897ad
mov ecx, 0x15a4f632
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x50522f84
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a5a6864
mov ecx, 0x5c3fb484
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
sub edx, 0x9ac44715
sub edx, 1
add edx, 0x9ac44715
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3a5a6864
mov ecx, 0x8dab5b99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dl, byte [ebp - 0x35]
mov eax, 0x38dfc251
mov ecx, 0x14114e0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x2e], ax
mov dword [ebp - 0x98], 0xcb23a4bd
jmp 0x1000a54a
mov ax, word [ebp - 0x2e]
movzx edx, ax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x6c]
movzx ecx, word [ecx]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x98], 0xfb8fabf5
jmp 0x1000a54a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10032c75
call fcn.10028470
add esp, 8
mov edx, eax
mov eax, 0xcaf3a55b
mov ecx, 0x3519bbf0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3b25951
mov ecx, 0x4b17b9e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x64]
mov dword [eax], 0
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
add edx, 0x9bebb02a
sub edx, 1
sub edx, 0x9bebb02a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3b25951
mov ecx, 0x152812bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x63e7ddda
jmp 0x1000a54a
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x8758df15
add edx, eax
sub edx, 0x8758df15
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x98], 0x386785db
jmp 0x1000a54a
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add edx, 0x90ac17b6
add edx, eax
sub edx, 0x90ac17b6
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10024c70
add esp, 0xc
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x8db74a2f
add esi, eax
sub esi, 0x8db74a2f
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov dword [ebp - 0x98], 0x3519bbf0
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xffc47dcf
mov ecx, 0x97653039
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
add edx, 0x3af452c2
sub edx, 1
sub edx, 0x3af452c2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xffc47dcf
mov ecx, 0xd3cca4e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x4b99bdd7
jmp 0x1000a54a
mov eax, dword [ebp - 0x6c]
mov ax, word [eax]
add ax, 0x95ca
add ax, 1
sub ax, 0x95ca
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x98], 0x120fc846
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
mov edx, eax
sub edx, 0x9bcf54ee
sub edx, 1
add edx, 0x9bcf54ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7edd488d
mov ecx, 0x867c67f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x6c]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
sub edx, 0xb39b16c3
sub edx, 1
add edx, 0xb39b16c3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7edd488d
mov ecx, 0x2bb34e5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0xa44aa394
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
add edx, 0xc504dd2b
sub edx, 1
sub edx, 0xc504dd2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf40a02ef
mov ecx, 0x91148ce6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov ecx, dword [0x100b2d94]
mov eax, dword [0x100b2d90]
mov edx, ecx
sub edx, 0x34f22f04
sub edx, 1
add edx, 0x34f22f04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf40a02ef
mov ecx, 0xc13ff869
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x4ded5f80
jmp 0x1000a54a
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x98], 0x8950b4d0
jmp 0x1000a54a
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x7f91c52d
jmp 0x1000a54a
mov eax, dword [0x100b2d94]
mov ecx, dword [0x100b2d90]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a59be18
mov ecx, 0x753f83af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a54a
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x98], 0xdaee14bf
jmp 0x1000a54a
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x98], 0x8dafeb0f
jmp 0x1000a54a
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x98], 0x5360d890
jmp 0x1000a54a
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x98], 0xb048620a
jmp 0x1000a54a
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x98], 0x5fb9c73a
jmp 0x1000a54a
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x98], 0x8e4af903
jmp 0x1000a54a
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x98], 0x5c3fb484
jmp 0x1000a54a
mov eax, dword [ebp - 0x64]
mov dword [eax], 0
mov dword [ebp - 0x98], 0x4b17b9e0
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x97653039
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x91148ce6
jmp 0x1000a54a
mov dword [ebp - 0x98], 0x753f83af
jmp 0x10008f08