Function at 0x10007330
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1ac
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b4], eax
mov eax, dword [0x10090080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1b0], 0xd0c8156c
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b8], eax
sub eax, 0x81f809c4
je 0x1000849f
jmp 0x10007375
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8465218b
je 0x10007e62
jmp 0x1000738b
mov eax, dword [ebp - 0x1b8]
sub eax, 0x859ea13b
je 0x1000868c
jmp 0x100073a1
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8b5ee88f
je 0x100082e8
jmp 0x100073b7
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8ba131c9
je 0x10007b9f
jmp 0x100073cd
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8dda5054
je 0x10007b7e
jmp 0x100073e3
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9a1a53e0
je 0x10008b08
jmp 0x100073f9
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9e6a9a63
je 0x10008598
jmp 0x1000740f
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9ea857af
je 0x10008867
jmp 0x10007425
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9f1e1906
je 0x1000884a
jmp 0x1000743b
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9f386fd6
je 0x10007a8d
jmp 0x10007451
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa2879548
je 0x100081cf
jmp 0x10007467
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa37419b1
je 0x100089f6
jmp 0x1000747d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa6205e2d
je 0x1000888d
jmp 0x10007493
mov eax, dword [ebp - 0x1b8]
sub eax, 0xafa8038b
je 0x10008547
jmp 0x100074a9
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb144d3fa
je 0x10007e0d
jmp 0x100074bf
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb1870666
je 0x10007d88
jmp 0x100074d5
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb348af37
je 0x100088e9
jmp 0x100074eb
mov eax, dword [ebp - 0x1b8]
sub eax, 0xba3b3ea7
je 0x100088aa
jmp 0x10007501
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbc8be448
je 0x10007f7e
jmp 0x10007517
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbe51936a
je 0x10007ffe
jmp 0x1000752d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc3e9d829
je 0x10007d63
jmp 0x10007543
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc4a2ae69
je 0x10007e71
jmp 0x10007559
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc4dd1241
je 0x10007f08
jmp 0x1000756f
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc9b69bbf
je 0x10008254
jmp 0x10007585
mov eax, dword [ebp - 0x1b8]
sub eax, 0xcdaf595b
je 0x100083f3
jmp 0x1000759b
mov eax, dword [ebp - 0x1b8]
sub eax, 0xce493b16
je 0x10008653
jmp 0x100075b1
mov eax, dword [ebp - 0x1b8]
sub eax, 0xd0446ec9
je 0x10007d54
jmp 0x100075c7
mov eax, dword [ebp - 0x1b8]
sub eax, 0xd0c8156c
je 0x10007952
jmp 0x100075dd
mov eax, dword [ebp - 0x1b8]
sub eax, 0xd60057a4
je 0x10008a17
jmp 0x100075f3
mov eax, dword [ebp - 0x1b8]
sub eax, 0xd63353c9
je 0x100082d9
jmp 0x10007609
mov eax, dword [ebp - 0x1b8]
sub eax, 0xde7df291
je 0x100086ad
jmp 0x1000761f
mov eax, dword [ebp - 0x1b8]
sub eax, 0xe75dea0b
je 0x10008526
jmp 0x10007635
mov eax, dword [ebp - 0x1b8]
sub eax, 0xe94018fa
je 0x10008b9c
jmp 0x1000764b
mov eax, dword [ebp - 0x1b8]
sub eax, 0xeb08a229
je 0x10008644
jmp 0x10007661
mov eax, dword [ebp - 0x1b8]
sub eax, 0xec71cf02
je 0x10008c0e
jmp 0x10007677
mov eax, dword [ebp - 0x1b8]
sub eax, 0xef3cf9a3
je 0x10007d97
jmp 0x1000768d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xf0846aad
je 0x100080d4
jmp 0x100076a3
mov eax, dword [ebp - 0x1b8]
sub eax, 0xf30da752
je 0x10008c68
jmp 0x100076b9
mov eax, dword [ebp - 0x1b8]
sub eax, 0xf3366764
je 0x10008134
jmp 0x100076cf
mov eax, dword [ebp - 0x1b8]
sub eax, 0xf762c74b
je 0x1000844e
jmp 0x100076e5
mov eax, dword [ebp - 0x1b8]
sub eax, 0xfafdd86d
je 0x10007eed
jmp 0x100076fb
mov eax, dword [ebp - 0x1b8]
sub eax, 0xfb4d6d3a
je 0x10008a64
jmp 0x10007711
mov eax, dword [ebp - 0x1b8]
sub eax, 0xfe8925df
je 0x10008792
jmp 0x10007727
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8ec3b96
je 0x10007a7e
jmp 0x1000773d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xeb5fa51
je 0x10008b38
jmp 0x10007753
mov eax, dword [ebp - 0x1b8]
sub eax, 0x1b8012ed
je 0x100081de
jmp 0x10007769
mov eax, dword [ebp - 0x1b8]
sub eax, 0x1f1d7cb1
je 0x10008b17
jmp 0x1000777f
mov eax, dword [ebp - 0x1b8]
sub eax, 0x204b2247
je 0x10007c64
jmp 0x10007795
mov eax, dword [ebp - 0x1b8]
sub eax, 0x27851fea
je 0x10007ec2
jmp 0x100077ab
mov eax, dword [ebp - 0x1b8]
sub eax, 0x339cb627
je 0x10007bf6
jmp 0x100077c1
mov eax, dword [ebp - 0x1b8]
sub eax, 0x349f25d2
je 0x100080e3
jmp 0x100077d7
mov eax, dword [ebp - 0x1b8]
sub eax, 0x3791d52e
je 0x10008b47
jmp 0x100077ed
mov eax, dword [ebp - 0x1b8]
sub eax, 0x4438ebc3
je 0x10008402
jmp 0x10007803
mov eax, dword [ebp - 0x1b8]
sub eax, 0x489a9407
je 0x100089e7
jmp 0x10007819
mov eax, dword [ebp - 0x1b8]
sub eax, 0x4f80ee34
je 0x1000895f
jmp 0x1000782f
mov eax, dword [ebp - 0x1b8]
sub eax, 0x53fcfeff
je 0x1000841f
jmp 0x10007845
mov eax, dword [ebp - 0x1b8]
sub eax, 0x54fc8bcc
je 0x10008083
jmp 0x1000785b
mov eax, dword [ebp - 0x1b8]
sub eax, 0x58191452
je 0x1000800d
jmp 0x10007871
mov eax, dword [ebp - 0x1b8]
sub eax, 0x5959b995
je 0x10008a8b
jmp 0x10007887
mov eax, dword [ebp - 0x1b8]
sub eax, 0x66956640
je 0x10008bab
jmp 0x1000789d
mov eax, dword [ebp - 0x1b8]
sub eax, 0x69bed3b2
je 0x10007bae
jmp 0x100078b3
mov eax, dword [ebp - 0x1b8]
sub eax, 0x6ce817d0
je 0x10007ade
jmp 0x100078c9
mov eax, dword [ebp - 0x1b8]
sub eax, 0x709912e9
je 0x10008a05
jmp 0x100078df
mov eax, dword [ebp - 0x1b8]
sub eax, 0x7289f4ef
je 0x100086f3
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
sub edx, 0xd4dd205d
sub edx, 1
add edx, 0xd4dd205d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd60057a4
mov ecx, 0x7bff3e2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x9f386fd6
jmp 0x10008c84
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
sub edx, 0x916ede52
sub edx, 1
add edx, 0x916ede52
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfb4d6d3a
mov ecx, 0x6ce817d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x178]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
setne al
and al, 1
mov byte [ebp - 0x171], al
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
sub edx, 0x3d6c25c2
sub edx, 1
add edx, 0x3d6c25c2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfb4d6d3a
mov ecx, 0x8dda5054
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dl, byte [ebp - 0x171]
mov eax, 0x8ba131c9
mov ecx, 0x69bed3b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x709912e9
jmp 0x10008c84
mov ecx, dword [ebp - 0x190]
mov edx, dword [ebp - 0x18c]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x1b0], 0x339cb627
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5959b995
mov ecx, 0x204b2247
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x190]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x170], eax
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
sub edx, 0x77e99601
sub edx, 1
add edx, 0x77e99601
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5959b995
mov ecx, 0xd0446ec9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0xc3e9d829
jmp 0x10008c84
mov edx, dword [ebp - 0x170]
mov esi, 0xffffffff
mov eax, 0xef3cf9a3
mov ecx, 0xb1870666
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x709912e9
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
add edx, 0x9c6d65cf
sub edx, 1
sub edx, 0x9c6d65cf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9a1a53e0
mov ecx, 0xb144d3fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x16c], eax
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a1a53e0
mov ecx, 0x8465218b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0xc4a2ae69
jmp 0x10008c84
mov eax, dword [ebp - 0x16c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x1b0], 0x27851fea
jmp 0x10008c84
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x19c], eax
mov eax, 0xfafdd86d
mov ecx, 0x349f25d2
cmp dword [ebp - 0x19c], 0
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1b0], 0xc4dd1241
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
sub edx, 0xda102996
sub edx, 1
add edx, 0xda102996
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1f1d7cb1
mov ecx, 0xbc8be448
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x164]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1f1d7cb1
mov ecx, 0xbe51936a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x58191452
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
add edx, 0xdfec3dd0
sub edx, 1
sub edx, 0xdfec3dd0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeb5fa51
mov ecx, 0x54fc8bcc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
sub edx, 0x3352f62d
sub edx, 1
add edx, 0x3352f62d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeb5fa51
mov ecx, 0xf0846aad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x709912e9
jmp 0x10008c84
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
sub edx, 0x371b2978
sub edx, 1
add edx, 0x371b2978
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3791d52e
mov ecx, 0xf3366764
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x160], eax
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3791d52e
mov ecx, 0xa2879548
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x1b8012ed
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
sub edx, 0x65d923df
sub edx, 1
add edx, 0x65d923df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe94018fa
mov ecx, 0xc9b69bbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x15c], eax
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
add edx, 0x71182f66
sub edx, 1
sub edx, 0x71182f66
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe94018fa
mov ecx, 0xd63353c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x8b5ee88f
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x66956640
mov ecx, 0x7923ddc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x4438ebc3
jmp 0x10008c84
mov ax, word [ebp - 0x1aa]
mov word [ebp - 0x156], ax
mov dword [ebp - 0x1b0], 0x53fcfeff
jmp 0x10008c84
mov ax, word [ebp - 0x156]
movzx eax, ax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x1a8]
movzx eax, word [eax + 6]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1b0], 0xf762c74b
jmp 0x10008c84
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
sub edx, 0xc13cc40e
sub edx, 1
add edx, 0xc13cc40e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a59fbc8
mov ecx, 0x81f809c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x150]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x149], al
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7a59fbc8
mov ecx, 0xe75dea0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dl, byte [ebp - 0x149]
mov eax, 0xba3b3ea7
mov ecx, 0xafa8038b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
add edx, 0x51658598
sub edx, 1
sub edx, 0x51658598
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec71cf02
mov ecx, 0x9e6a9a63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov ecx, dword [ebp - 0x1a8]
add ecx, 0x47d62c9
add ecx, 0x18
sub ecx, 0x47d62c9
mov eax, dword [ebp - 0x1a8]
movzx eax, word [eax + 0x14]
sub ecx, 0x4360400c
add ecx, eax
add ecx, 0x4360400c
movzx eax, word [ebp - 0x1aa]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x148], eax
mov eax, dword [0x10091584]
mov ecx, dword [0x10091580]
mov edx, eax
sub edx, 0xbb3d9d29
sub edx, 1
add edx, 0xbb3d9d29
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec71cf02
mov ecx, 0xeb08a229
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0xce493b16
jmp 0x10008c84
mov ecx, dword [ebp - 0x148]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100307da
call fcn.10026fd0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x141], al
mov dword [ebp - 0x1b0], 0x859ea13b
jmp 0x10008c84
mov dl, byte [ebp - 0x141]
mov eax, 0xde7df291
mov ecx, 0x7553b5c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x180]
mov dword [eax], 0
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1b0], 0x7289f4ef
jmp 0x10008c84
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x12c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x134]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.100237d0
add esp, 0xc
mov eax, dword [ebp - 0x180]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x194]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x180]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x17c]
mov byte [eax], cl
mov dword [ebp - 0x1b0], 0x7553b5c9
jmp 0x10008c84
mov ax, word [ebp - 0x1aa]
mov word [ebp - 0x128], ax
mov dword [ebp - 0x1b0], 0x9ea857af
jmp 0x10008c84
mov ax, word [ebp - 0x128]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x126], ax
mov dword [ebp - 0x1b0], 0xa6205e2d
jmp 0x10008c84
mov ax, word [ebp - 0x126]
mov word [ebp - 0x1aa], ax
mov dword [ebp - 0x1b0], 0x4438ebc3
jmp 0x10008c84
mov eax, dword [ebp - 0x198]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x19c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x1b0], 0xb348af37
jmp 0x10008c84
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
add edx, 0x3b71f81
sub edx, 1
sub edx, 0x3b71f81
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf30da752
mov ecx, 0x4f80ee34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10091584]
mov eax, dword [0x10091580]
mov edx, ecx
add edx, 0xed5622b0
sub edx, 1
sub edx, 0xed5622b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf30da752
mov ecx, 0x489a9407
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0xa37419b1
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x709912e9
jmp 0x10008c84
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100228d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10023670
add esp, 0xc
mov dword [ebp - 0x1b0], 0x7bff3e2f
jmp 0x10008c84
mov eax, dword [ebp - 0x178]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1b0], 0x6ce817d0
jmp 0x10008c84
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x190]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1b0], 0x204b2247
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0xb144d3fa
jmp 0x10008c84
mov eax, dword [ebp - 0x164]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b0], 0xbc8be448
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0x54fc8bcc
jmp 0x10008c84
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1b0], 0xf3366764
jmp 0x10008c84
mov dword [ebp - 0x1b0], 0xc9b69bbf
jmp 0x10008c84
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
add eax, 0x22423be4
add eax, ecx
sub eax, 0x22423be4
mov dword [ebp - 0x1a8], eax
mov word [ebp - 0x1aa], 0
mov dword [ebp - 0x1b0], 0x7923ddc7
jmp 0x10008c84
mov ecx, dword [ebp - 0x1a8]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x1a8]
movzx eax, word [eax + 0x14]
add ecx, 0x61fdd8e9
add ecx, eax
sub ecx, 0x61fdd8e9
movzx eax, word [ebp - 0x1aa]
imul eax, eax, 0x28
sub ecx, 0xf78bb81d
add ecx, eax
add ecx, 0xf78bb81d
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1b0], 0x9e6a9a63
jmp 0x10008c84
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b0], 0x4f80ee34
jmp 0x10007359