Function at 0x10001310
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
add edx, 0xc578b974
sub edx, 1
sub edx, 0xc578b974
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0xa8], 0x87ddacad
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x8031a4e8
je 0x10001e69
jmp 0x10001393
mov eax, dword [ebp - 0xb0]
sub eax, 0x83c5cf15
je 0x10001db5
jmp 0x100013a9
mov eax, dword [ebp - 0xb0]
sub eax, 0x83ec5637
je 0x10002472
jmp 0x100013bf
mov eax, dword [ebp - 0xb0]
sub eax, 0x87ddacad
je 0x1000187e
jmp 0x100013d5
mov eax, dword [ebp - 0xb0]
sub eax, 0x8a43c1ef
je 0x100026f9
jmp 0x100013eb
mov eax, dword [ebp - 0xb0]
sub eax, 0x9621ff9f
je 0x10001c11
jmp 0x10001401
mov eax, dword [ebp - 0xb0]
sub eax, 0x962ad555
je 0x100020a4
jmp 0x10001417
mov eax, dword [ebp - 0xb0]
sub eax, 0x969af478
je 0x10002635
jmp 0x1000142d
mov eax, dword [ebp - 0xb0]
sub eax, 0x9a48dc18
je 0x10001c62
jmp 0x10001443
mov eax, dword [ebp - 0xb0]
sub eax, 0x9a6d1d65
je 0x100018ad
jmp 0x10001459
mov eax, dword [ebp - 0xb0]
sub eax, 0x9b2f6f52
je 0x10001b3b
jmp 0x1000146f
mov eax, dword [ebp - 0xb0]
sub eax, 0xa4399acf
je 0x10002126
jmp 0x10001485
mov eax, dword [ebp - 0xb0]
sub eax, 0xa4d3cb54
je 0x10001d36
jmp 0x1000149b
mov eax, dword [ebp - 0xb0]
sub eax, 0xa54c86ea
je 0x10001bdd
jmp 0x100014b1
mov eax, dword [ebp - 0xb0]
sub eax, 0xb1a5d959
je 0x1000202e
jmp 0x100014c7
mov eax, dword [ebp - 0xb0]
sub eax, 0xb2666bfb
je 0x100024e8
jmp 0x100014dd
mov eax, dword [ebp - 0xb0]
sub eax, 0xb31ed24d
je 0x100019ba
jmp 0x100014f3
mov eax, dword [ebp - 0xb0]
sub eax, 0xb737227f
je 0x10001e96
jmp 0x10001509
mov eax, dword [ebp - 0xb0]
sub eax, 0xb89f60cc
je 0x100026a7
jmp 0x1000151f
mov eax, dword [ebp - 0xb0]
sub eax, 0xba8ce09f
je 0x100025d3
jmp 0x10001535
mov eax, dword [ebp - 0xb0]
sub eax, 0xc42bd569
je 0x10002606
jmp 0x1000154b
mov eax, dword [ebp - 0xb0]
sub eax, 0xcb51fe1e
je 0x10001bec
jmp 0x10001561
mov eax, dword [ebp - 0xb0]
sub eax, 0xdd33c479
je 0x10002182
jmp 0x10001577
mov eax, dword [ebp - 0xb0]
sub eax, 0xe02b2934
je 0x1000270f
jmp 0x1000158d
mov eax, dword [ebp - 0xb0]
sub eax, 0xe32f43cf
je 0x10001a15
jmp 0x100015a3
mov eax, dword [ebp - 0xb0]
sub eax, 0xe579b844
je 0x100024f7
jmp 0x100015b9
mov eax, dword [ebp - 0xb0]
sub eax, 0xe9367e2b
je 0x10001dc4
jmp 0x100015cf
mov eax, dword [ebp - 0xb0]
sub eax, 0xee0b828c
je 0x10001b1d
jmp 0x100015e5
mov eax, dword [ebp - 0xb0]
sub eax, 0xf0750103
je 0x10001e87
jmp 0x100015fb
mov eax, dword [ebp - 0xb0]
sub eax, 0xf4397bb1
je 0x10001f0c
jmp 0x10001611
mov eax, dword [ebp - 0xb0]
sub eax, 0xf81ba536
je 0x10002510
jmp 0x10001627
mov eax, dword [ebp - 0xb0]
sub eax, 0xfb69add8
je 0x10001d45
jmp 0x1000163d
mov eax, dword [ebp - 0xb0]
sub eax, 0xfe932a4b
je 0x10002626
jmp 0x10001653
mov eax, dword [ebp - 0xb0]
sub eax, 0x3f50cb0
je 0x10001e4f
jmp 0x10001669
mov eax, dword [ebp - 0xb0]
sub eax, 0x14ce6b00
je 0x10002761
jmp 0x1000167f
mov eax, dword [ebp - 0xb0]
sub eax, 0x1a8f0a4b
je 0x1000256d
jmp 0x10001695
mov eax, dword [ebp - 0xb0]
sub eax, 0x1b1c5d41
je 0x10002135
jmp 0x100016ab
mov eax, dword [ebp - 0xb0]
sub eax, 0x1d8ec89d
je 0x10001e14
jmp 0x100016c1
mov eax, dword [ebp - 0xb0]
sub eax, 0x1fc97620
je 0x100025c2
jmp 0x100016d7
mov eax, dword [ebp - 0xb0]
sub eax, 0x20f08856
je 0x100025b3
jmp 0x100016ed
mov eax, dword [ebp - 0xb0]
sub eax, 0x250891a4
je 0x100021fb
jmp 0x10001703
mov eax, dword [ebp - 0xb0]
sub eax, 0x25665486
je 0x100021c5
jmp 0x10001719
mov eax, dword [ebp - 0xb0]
sub eax, 0x2605ec1e
je 0x10002153
jmp 0x1000172f
mov eax, dword [ebp - 0xb0]
sub eax, 0x2fb83338
je 0x10002053
jmp 0x10001745
mov eax, dword [ebp - 0xb0]
sub eax, 0x3390db1e
je 0x10002404
jmp 0x1000175b
mov eax, dword [ebp - 0xb0]
sub eax, 0x39b1ec33
je 0x100019c9
jmp 0x10001771
mov eax, dword [ebp - 0xb0]
sub eax, 0x3a7b0682
je 0x10002003
jmp 0x10001787
mov eax, dword [ebp - 0xb0]
sub eax, 0x3c647694
je 0x10002553
jmp 0x1000179d
mov eax, dword [ebp - 0xb0]
sub eax, 0x45bbdae3
je 0x10001b8c
jmp 0x100017b3
mov eax, dword [ebp - 0xb0]
sub eax, 0x4820a130
je 0x10002285
jmp 0x100017c9
mov eax, dword [ebp - 0xb0]
sub eax, 0x4965996e
je 0x100023b0
jmp 0x100017df
mov eax, dword [ebp - 0xb0]
sub eax, 0x50ece459
je 0x10001fca
jmp 0x100017f5
mov eax, dword [ebp - 0xb0]
sub eax, 0x5612800e
je 0x100022ce
jmp 0x1000180b
mov eax, dword [ebp - 0xb0]
sub eax, 0x57414e01
je 0x10001fd9
jmp 0x10001821
mov eax, dword [ebp - 0xb0]
sub eax, 0x5e990825
je 0x1000253a
jmp 0x10001837
mov eax, dword [ebp - 0xb0]
sub eax, 0x644888e7
je 0x10001e2e
jmp 0x1000184d
mov eax, dword [ebp - 0xb0]
sub eax, 0x652e5ddb
je 0x10001a8b
jmp 0x10001863
mov eax, dword [ebp - 0xb0]
sub eax, 0x6bfab319
je 0x100023a1
jmp 0x10001879
jmp 0x1000276b
mov al, byte [ebp - 0xa2]
mov cl, byte [ebp - 0xa1]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xba8ce09f
mov ecx, 0x9a6d1d65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov ecx, dword [ebp - 0xac]
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
add edx, 0x3d889ad3
sub edx, 1
sub edx, 0x3d889ad3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba8ce09f
mov ecx, 0xb31ed24d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x39b1ec33
jmp 0x1000276b
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000d860
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xa8], 0xe32f43cf
jmp 0x1000276b
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
sub edx, 0x63e79e
sub edx, 1
add edx, 0x63e79e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc42bd569
mov ecx, 0x652e5ddb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x5d], al
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
add edx, 0x867d132b
sub edx, 1
sub edx, 0x867d132b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc42bd569
mov ecx, 0xee0b828c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dl, byte [ebp - 0x5d]
mov eax, 0x9b2f6f52
mov ecx, 0xcb51fe1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [0x1006bb40]
mov ecx, dword [0x1006bb3c]
mov edx, eax
add edx, 0x67d86a9c
sub edx, 1
sub edx, 0x67d86a9c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe932a4b
mov ecx, 0x45bbdae3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [0x1006bb40]
mov ecx, dword [0x1006bb3c]
mov edx, eax
sub edx, 0x771309c8
sub edx, 1
add edx, 0x771309c8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe932a4b
mov ecx, 0xa54c86ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x1fc97620
jmp 0x1000276b
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xa8], 0x9621ff9f
jmp 0x1000276b
mov eax, dword [0x1006bb40]
mov ecx, dword [0x1006bb3c]
mov edx, eax
add edx, 0x88cc25da
sub edx, 1
sub edx, 0x88cc25da
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x969af478
mov ecx, 0x9a48dc18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x969af478
mov ecx, 0xa4d3cb54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0xfb69add8
jmp 0x1000276b
mov eax, dword [ebp - 0x54]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov edx, dword [ebp - 0x88]
mov esi, 0xffffffff
mov eax, 0xe9367e2b
mov ecx, 0x83c5cf15
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x1fc97620
jmp 0x1000276b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa8], 0x1d8ec89d
jmp 0x1000276b
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x644888e7
jmp 0x1000276b
mov edx, dword [ebp - 0x84]
mov eax, 0x3f50cb0
mov ecx, 0xb737227f
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xa8], 0x8031a4e8
jmp 0x1000276b
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0xf0750103
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x1fc97620
jmp 0x1000276b
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
add edx, 0x29e6ab9f
sub edx, 1
sub edx, 0x29e6ab9f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb89f60cc
mov ecx, 0xf4397bb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
add edx, 0xf5917f1
sub edx, 1
sub edx, 0xf5917f1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb89f60cc
mov ecx, 0x50ece459
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x57414e01
jmp 0x1000276b
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xa8], 0x3a7b0682
jmp 0x1000276b
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov dword [ebp - 0xa8], 0xb1a5d959
jmp 0x1000276b
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x38], ax
mov dword [ebp - 0xa8], 0x2fb83338
jmp 0x1000276b
mov eax, dword [0x1006bb40]
mov ecx, dword [0x1006bb3c]
mov edx, eax
add edx, 0x588422de
sub edx, 1
sub edx, 0x588422de
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a43c1ef
mov ecx, 0x962ad555
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov ax, word [ebp - 0x38]
movzx ecx, ax
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8a43c1ef
mov ecx, 0xa4399acf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x1b1c5d41
jmp 0x1000276b
mov dl, byte [ebp - 0x35]
mov eax, 0x3c647694
mov ecx, 0x2605ec1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub eax, 0xeb50996b
add eax, 0x18
add eax, 0xeb50996b
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa8], 0xdd33c479
jmp 0x1000276b
mov eax, dword [ebp - 0x30]
movzx eax, word [eax + 0x10]
mov ecx, dword [ebp - 0x34]
add ecx, 0xa379c3fa
add ecx, eax
sub ecx, 0xa379c3fa
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa8], 0x25665486
jmp 0x1000276b
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000fbd0
add esp, 8
mov edx, eax
mov eax, 0x250891a4
mov ecx, 0x3390db1e
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xff9ee6b5
add edx, eax
add edx, 0xff9ee6b5
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x66a5492b
add eax, ecx
sub eax, 0x66a5492b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xa8], 0x4820a130
jmp 0x1000276b
mov eax, dword [0x1006bb40]
mov ecx, dword [0x1006bb3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe02b2934
mov ecx, 0x5612800e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x855f4b5f
add ecx, eax
sub ecx, 0x855f4b5f
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d9c0
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe02b2934
mov ecx, 0x6bfab319
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x4965996e
jmp 0x1000276b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov esi, dword [ebp - 0x1c]
add esi, 0x9c83f00a
add esi, eax
sub esi, 0x9c83f00a
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov dword [ebp - 0xa8], 0x3390db1e
jmp 0x1000276b
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x14ce6b00
mov ecx, 0x83ec5637
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov ecx, dword [0x1006bb40]
mov eax, dword [0x1006bb3c]
mov edx, ecx
sub edx, 0xfea1b1e1
sub edx, 1
add edx, 0xfea1b1e1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x14ce6b00
mov ecx, 0xb2666bfb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000276b
mov dword [ebp - 0xa8], 0xe579b844
jmp 0x1000276b
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0xa8], 0xf81ba536
jmp 0x1000276b
mov ax, word [ebp - 0x14]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x12], ax
mov dword [ebp - 0xa8], 0x5e990825
jmp 0x1000276b
mov eax, dword [ebp - 0x74]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0xa8], 0xb1a5d959
jmp 0x1000276b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa8], 0x1a8f0a4b
jmp 0x1000276b
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0x20f08856
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x1fc97620
jmp 0x1000276b
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000cc60
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0xac]
push eax
mov eax, esp
push eax
mov edx, esp
mov dword [ebp - 0xb4], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x9a6d1d65
jmp 0x1000276b
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa8], 0x652e5ddb
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x45bbdae3
jmp 0x1000276b
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa8], 0x9a48dc18
jmp 0x1000276b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], 0xf4397bb1
jmp 0x1000276b
mov ax, word [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa8], 0x962ad555
jmp 0x1000276b
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d9c0
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa8], 0x5612800e
jmp 0x1000276b
mov dword [ebp - 0xa8], 0x83ec5637
jmp 0x10001377