Function at 0x1000e930
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [0x1008a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x19c], 0xfffc6eb
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
sub eax, 0x8e3492c0
je 0x1000f31d
jmp 0x1000e975
mov eax, dword [ebp - 0x1a4]
sub eax, 0x97784fb4
je 0x1000f659
jmp 0x1000e98b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x984ba48e
je 0x1000ff1f
jmp 0x1000e9a1
mov eax, dword [ebp - 0x1a4]
sub eax, 0x99a1bd94
je 0x1000f3c3
jmp 0x1000e9b7
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9d3697fd
je 0x1000fd86
jmp 0x1000e9cd
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9fd22099
je 0x1000fde9
jmp 0x1000e9e3
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa50c8882
je 0x1000f088
jmp 0x1000e9f9
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa6c322db
je 0x1000fd09
jmp 0x1000ea0f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa8000811
je 0x1000fa8e
jmp 0x1000ea25
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa83120cd
je 0x1000f2ed
jmp 0x1000ea3b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xae6bf533
je 0x1000f8bc
jmp 0x1000ea51
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb0b39dfb
je 0x1000f45a
jmp 0x1000ea67
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb432d8f7
je 0x1000f5d2
jmp 0x1000ea7d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbd5deb07
je 0x1000f820
jmp 0x1000ea93
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc0059e38
je 0x10010044
jmp 0x1000eaa9
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc04c00eb
je 0x1000f389
jmp 0x1000eabf
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc1cc4e8f
je 0x1000faee
jmp 0x1000ead5
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc43faf5b
je 0x1000ff4f
jmp 0x1000eaeb
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc9ca301a
je 0x10010017
jmp 0x1000eb01
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcb6eb689
je 0x1000f30e
jmp 0x1000eb17
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd3d90dc5
je 0x1000fa2e
jmp 0x1000eb2d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd6387f5b
je 0x1000fe6f
jmp 0x1000eb43
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd9c409e8
je 0x1000f507
jmp 0x1000eb59
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdd12ca4b
je 0x1000fbff
jmp 0x1000eb6f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdf19d14d
je 0x1000f1d6
jmp 0x1000eb85
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe32dd64c
je 0x1000fadf
jmp 0x1000eb9b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe4652742
je 0x1000f058
jmp 0x1000ebb1
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe5bd483c
je 0x1000f92a
jmp 0x1000ebc7
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe9d14907
je 0x1000fb54
jmp 0x1000ebdd
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf828ca5d
je 0x1000ff10
jmp 0x1000ebf3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2556470
je 0x1000f8ad
jmp 0x1000ec09
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2cf3f86
je 0x1000f079
jmp 0x1000ec1f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc0a6a97
je 0x1000fbe1
jmp 0x1000ec35
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf39cd5d
je 0x1000f69d
jmp 0x1000ec4b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf8da6ca
je 0x1000f36e
jmp 0x1000ec61
mov eax, dword [ebp - 0x1a4]
sub eax, 0xfffc6eb
je 0x1000ef10
jmp 0x1000ec77
mov eax, dword [ebp - 0x1a4]
sub eax, 0x10eeb365
je 0x1000fbf0
jmp 0x1000ec8d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x12b84b4d
je 0x1000ff3a
jmp 0x1000eca3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1d508241
je 0x1000f682
jmp 0x1000ecb9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1ea3fddb
je 0x1000f72a
jmp 0x1000eccf
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1f9ba5d2
je 0x1000fc7d
jmp 0x1000ece5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x246ec6bb
je 0x1000fe0a
jmp 0x1000ecfb
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3cf7f00d
je 0x1000f709
jmp 0x1000ed11
mov eax, dword [ebp - 0x1a4]
sub eax, 0x411264a4
je 0x1000fa3d
jmp 0x1000ed27
mov eax, dword [ebp - 0x1a4]
sub eax, 0x44810a79
je 0x1000feb7
jmp 0x1000ed3d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x46136833
je 0x1000ef7a
jmp 0x1000ed53
mov eax, dword [ebp - 0x1a4]
sub eax, 0x48a1296a
je 0x1000f194
jmp 0x1000ed69
mov eax, dword [ebp - 0x1a4]
sub eax, 0x49d4932e
je 0x1000f4b2
jmp 0x1000ed7f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4b141a81
je 0x1000f7aa
jmp 0x1000ed95
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4b8cef4e
je 0x1000fdf8
jmp 0x1000edab
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4d4f835a
je 0x1000fd18
jmp 0x1000edc1
mov eax, dword [ebp - 0x1a4]
sub eax, 0x530b1d01
je 0x1000f575
jmp 0x1000edd7
mov eax, dword [ebp - 0x1a4]
sub eax, 0x57f12e97
je 0x1000f1a3
jmp 0x1000eded
mov eax, dword [ebp - 0x1a4]
sub eax, 0x63f3bb73
je 0x1000f0fe
jmp 0x1000ee03
mov eax, dword [ebp - 0x1a4]
sub eax, 0x64ed27d2
je 0x1000f4a3
jmp 0x1000ee19
mov eax, dword [ebp - 0x1a4]
sub eax, 0x65395f3c
je 0x1000fb0b
jmp 0x1000ee2f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x65b9302d
je 0x1000fc2c
jmp 0x1000ee45
mov eax, dword [ebp - 0x1a4]
sub eax, 0x680ab32b
je 0x1000f3e4
jmp 0x1000ee5b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x69bc6ab4
je 0x10010065
jmp 0x1000ee71
mov eax, dword [ebp - 0x1a4]
sub eax, 0x6c310f88
je 0x1000f3a8
jmp 0x1000ee87
mov eax, dword [ebp - 0x1a4]
sub eax, 0x72c3b306
je 0x1000ef31
jmp 0x1000ee9d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7513f3ad
je 0x10010008
jmp 0x1000eeb3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7716160e
je 0x1000f61c
jmp 0x1000eec9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7a05289a
je 0x1000f244
jmp 0x1000eedf
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7b46b54b
je 0x1000f638
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x19c], 0x72c3b306
jmp 0x10010081
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x246ec6bb
mov ecx, 0x46136833
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x170], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002b120
add esp, 0xc
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
setne al
and al, 1
mov byte [ebp - 0x161], al
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
mov edx, ecx
add edx, 0x210b8104
sub edx, 1
sub edx, 0x210b8104
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x246ec6bb
mov ecx, 0xe4652742
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dl, byte [ebp - 0x161]
mov eax, 0x2cf3f86
mov ecx, 0xa50c8882
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x4b8cef4e
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
mov edx, ecx
add edx, 0xd3fa886
sub edx, 1
sub edx, 0xd3fa886
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd6387f5b
mov ecx, 0x63f3bb73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x160], eax
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
sub edx, 0x28c718d
sub edx, 1
add edx, 0x28c718d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6387f5b
mov ecx, 0x48a1296a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x57f12e97
jmp 0x10010081
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x160]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x19c], 0xdf19d14d
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x44810a79
mov ecx, 0x7a05289a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x180], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x180], eax
sete al
and al, 1
mov byte [ebp - 0x159], al
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x44810a79
mov ecx, 0xa83120cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dl, byte [ebp - 0x159]
mov eax, 0x8e3492c0
mov ecx, 0xcb6eb689
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x4b8cef4e
jmp 0x10010081
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x19c], 0xf8da6ca
jmp 0x10010081
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x19c], 0xc04c00eb
jmp 0x10010081
mov eax, 0x6c310f88
mov ecx, 0x49d4932e
cmp dword [ebp - 0x184], 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x19c], 0x99a1bd94
jmp 0x10010081
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x680ab32b
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
mov edx, ecx
sub edx, 0xe6490372
sub edx, 1
add edx, 0xe6490372
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf828ca5d
mov ecx, 0xb0b39dfb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf828ca5d
mov ecx, 0x64ed27d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x4b8cef4e
jmp 0x10010081
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x19c], 0xd9c409e8
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x984ba48e
mov ecx, 0x530b1d01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x18c], eax
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
add edx, 0x568bae14
sub edx, 1
sub edx, 0x568bae14
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x984ba48e
mov ecx, 0xb432d8f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x7fe60380
jmp 0x10010081
movzx eax, word [ebp - 0x192]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x19c], 0x7b46b54b
jmp 0x10010081
mov eax, dword [ebp - 0x148]
movzx esi, word [eax]
mov edx, dword [ebp - 0x14c]
mov eax, 0xdd12ca4b
mov ecx, 0x1d508241
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x19c], 0xf39cd5d
jmp 0x10010081
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x190]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
movzx ecx, word [ebp - 0x192]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0x198]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100388f6
call fcn.1002ea80
add esp, 8
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x19c], 0x3cf7f00d
jmp 0x10010081
mov edx, dword [ebp - 0x140]
mov eax, 0x1ea3fddb
mov ecx, 0x411264a4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x198]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x19c], 0x4b141a81
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
mov edx, ecx
add edx, 0x93832b78
sub edx, 1
sub edx, 0x93832b78
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x12b84b4d
mov ecx, 0xbd5deb07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x198]
mov ecx, dword [ecx + 0xc]
add eax, 0x45236c1a
add eax, ecx
sub eax, 0x45236c1a
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x198]
add eax, 0xc
mov dword [ebp - 0x130], eax
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
sub edx, 0x30af6bd
sub edx, 1
add edx, 0x30af6bd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12b84b4d
mov ecx, 0x2556470
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0xae6bf533
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc43faf5b
mov ecx, 0xe5bd483c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
add ecx, 0x33d5b9f5
add ecx, eax
sub ecx, 0x33d5b9f5
mov eax, dword [ebp - 0x198]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x138]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002b280
add esp, 0xc
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x198]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x198]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc43faf5b
mov ecx, 0xd3d90dc5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x411264a4
jmp 0x10010081
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
add edx, 0x31d32185
sub edx, 1
sub edx, 0x31d32185
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7513f3ad
mov ecx, 0xa8000811
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
sub edx, 0x80cbb0
sub edx, 1
add edx, 0x80cbb0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7513f3ad
mov ecx, 0xe32dd64c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0xc1cc4e8f
jmp 0x10010081
mov ax, word [ebp - 0x192]
mov word [ebp - 0x12a], ax
mov dword [ebp - 0x19c], 0x65395f3c
jmp 0x10010081
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9ca301a
mov ecx, 0xe9d14907
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov ax, word [ebp - 0x12a]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x192], ax
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
mov edx, ecx
sub edx, 0x19b294e3
sub edx, 1
add edx, 0x19b294e3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc9ca301a
mov ecx, 0xc0a6a97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x10eeb365
jmp 0x10010081
mov dword [ebp - 0x19c], 0x7716160e
jmp 0x10010081
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x19c], 0x65b9302d
jmp 0x10010081
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
add edx, 0x5f0f3a1f
sub edx, 1
sub edx, 0x5f0f3a1f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc0059e38
mov ecx, 0x1f9ba5d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x128]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x124], eax
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc0059e38
mov ecx, 0xa6c322db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x4d4f835a
jmp 0x10010081
mov ecx, dword [0x1008b76c]
mov eax, dword [0x1008b768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x69bc6ab4
mov ecx, 0x9d3697fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1008b76c]
mov ecx, dword [0x1008b768]
mov edx, eax
add edx, 0xeea4233d
sub edx, 1
sub edx, 0xeea4233d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69bc6ab4
mov ecx, 0x9fd22099
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010081
mov dword [ebp - 0x19c], 0x4b8cef4e
jmp 0x10010081
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002a380
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x170], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002b120
add esp, 0xc
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x19c], 0x46136833
jmp 0x10010081
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x19c], 0x63f3bb73
jmp 0x10010081
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x19c], 0x7a05289a
jmp 0x10010081
mov dword [ebp - 0x19c], 0xb0b39dfb
jmp 0x10010081
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x19c], 0x530b1d01
jmp 0x10010081
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x19c], 0xbd5deb07
jmp 0x10010081
mov eax, dword [ebp - 0x130]
mov edx, dword [eax]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x198]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x138]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002b280
add esp, 0xc
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x198]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x198]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov dword [ebp - 0x19c], 0xe5bd483c
jmp 0x10010081
mov dword [ebp - 0x19c], 0xa8000811
jmp 0x10010081
mov ax, word [ebp - 0x12a]
mov ax, word [ebp - 0x12a]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x192], ax
mov dword [ebp - 0x19c], 0xe9d14907
jmp 0x10010081
mov eax, dword [ebp - 0x128]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x1f9ba5d2
jmp 0x10010081
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x9d3697fd
jmp 0x1000e959