Function at 0x10001310
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1b0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b4], eax
mov eax, dword [0x10073800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1b0], 0x74c06018
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b8], eax
sub eax, 0x879acb36
je 0x10002c33
jmp 0x10001354
mov eax, dword [ebp - 0x1b8]
sub eax, 0x909a4f9a
je 0x100024c1
jmp 0x1000136a
mov eax, dword [ebp - 0x1b8]
sub eax, 0x91898766
je 0x10002a98
jmp 0x10001380
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9737412c
je 0x100022ef
jmp 0x10001396
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa2beba97
je 0x1000253a
jmp 0x100013ac
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa39e3e22
je 0x10001fff
jmp 0x100013c2
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa948e944
je 0x10001c00
jmp 0x100013d8
mov eax, dword [ebp - 0x1b8]
sub eax, 0xaaa20aee
je 0x10002ae1
jmp 0x100013ee
mov eax, dword [ebp - 0x1b8]
sub eax, 0xab552433
je 0x10002352
jmp 0x10001404
mov eax, dword [ebp - 0x1b8]
sub eax, 0xae855353
je 0x100021c3
jmp 0x1000141a
mov eax, dword [ebp - 0x1b8]
sub eax, 0xaf96b1d7
je 0x100023d3
jmp 0x10001430
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb104213d
je 0x10002ca2
jmp 0x10001446
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb37d9eee
je 0x1000200e
jmp 0x1000145c
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbe8d815b
je 0x1000268c
jmp 0x10001472
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbeb3bb42
je 0x10002b72
jmp 0x10001488
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc0464c4a
je 0x100029ca
jmp 0x1000149e
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc27bb7a1
je 0x10002e8e
jmp 0x100014b4
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc42b339b
je 0x10002245
jmp 0x100014ca
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc67ca318
je 0x10002e54
jmp 0x100014e0
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc68bc72b
je 0x10002d84
jmp 0x100014f6
mov eax, dword [ebp - 0x1b8]
sub eax, 0xca016605
je 0x10002cb3
jmp 0x1000150c
mov eax, dword [ebp - 0x1b8]
sub eax, 0xcae17667
je 0x1000277b
jmp 0x10001522
mov eax, dword [ebp - 0x1b8]
sub eax, 0xcd8304e8
je 0x10002727
jmp 0x10001538
mov eax, dword [ebp - 0x1b8]
sub eax, 0xcdde203b
je 0x10001f40
jmp 0x1000154e
mov eax, dword [ebp - 0x1b8]
sub eax, 0xd9b59a1b
je 0x10001de1
jmp 0x10001564
mov eax, dword [ebp - 0x1b8]
sub eax, 0xda5950da
je 0x10002370
jmp 0x1000157a
mov eax, dword [ebp - 0x1b8]
sub eax, 0xdd7c9121
je 0x10002266
jmp 0x10001590
mov eax, dword [ebp - 0x1b8]
sub eax, 0xe53e4a37
je 0x10002e39
jmp 0x100015a6
mov eax, dword [ebp - 0x1b8]
sub eax, 0xe690f998
je 0x100025b0
jmp 0x100015bc
mov eax, dword [ebp - 0x1b8]
sub eax, 0xe6b94ce7
je 0x10002d3c
jmp 0x100015d2
mov eax, dword [ebp - 0x1b8]
sub eax, 0xe91dd135
je 0x10002a89
jmp 0x100015e8
mov eax, dword [ebp - 0x1b8]
sub eax, 0xea5a045b
je 0x10001cde
jmp 0x100015fe
mov eax, dword [ebp - 0x1b8]
sub eax, 0xee712787
je 0x10002424
jmp 0x10001614
mov eax, dword [ebp - 0x1b8]
sub eax, 0xf5a3b543
je 0x10002e7f
jmp 0x1000162a
mov eax, dword [ebp - 0x1b8]
sub eax, 0xfa0fd115
je 0x10001ea0
jmp 0x10001640
mov eax, dword [ebp - 0x1b8]
sub eax, 0xfeb26169
je 0x10002361
jmp 0x10001656
mov eax, dword [ebp - 0x1b8]
sub eax, 0xff7e4789
je 0x10001c7e
jmp 0x1000166c
mov eax, dword [ebp - 0x1b8]
sub eax, 0x26739d0
je 0x100020f0
jmp 0x10001682
mov eax, dword [ebp - 0x1b8]
sub eax, 0x64cdc82
je 0x1000297a
jmp 0x10001698
mov eax, dword [ebp - 0x1b8]
sub eax, 0x89e1fd9
je 0x10002da2
jmp 0x100016ae
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9ea70b9
je 0x10002ea3
jmp 0x100016c4
mov eax, dword [ebp - 0x1b8]
sub eax, 0xfd59335
je 0x100027cc
jmp 0x100016da
mov eax, dword [ebp - 0x1b8]
sub eax, 0x103c507b
je 0x1000263b
jmp 0x100016f0
mov eax, dword [ebp - 0x1b8]
sub eax, 0x11c433f4
je 0x10002d93
jmp 0x10001706
mov eax, dword [ebp - 0x1b8]
sub eax, 0x14d5ac04
je 0x10002c4e
jmp 0x1000171c
mov eax, dword [ebp - 0x1b8]
sub eax, 0x174458b3
je 0x10001c8d
jmp 0x10001732
mov eax, dword [ebp - 0x1b8]
sub eax, 0x188af9ae
je 0x10002c81
jmp 0x10001748
mov eax, dword [ebp - 0x1b8]
sub eax, 0x18f5cd5c
je 0x100024d0
jmp 0x1000175e
mov eax, dword [ebp - 0x1b8]
sub eax, 0x1a596c67
je 0x10002bc3
jmp 0x10001774
mov eax, dword [ebp - 0x1b8]
sub eax, 0x1d0c0ea9
je 0x10001eaf
jmp 0x1000178a
mov eax, dword [ebp - 0x1b8]
sub eax, 0x2035a637
je 0x10002281
jmp 0x100017a0
mov eax, dword [ebp - 0x1b8]
sub eax, 0x2157e715
je 0x10002a1b
jmp 0x100017b6
mov eax, dword [ebp - 0x1b8]
sub eax, 0x27c21661
je 0x10002868
jmp 0x100017cc
mov eax, dword [ebp - 0x1b8]
sub eax, 0x29bf2d24
je 0x10001b7b
jmp 0x100017e2
mov eax, dword [ebp - 0x1b8]
sub eax, 0x2ad72ea7
je 0x10002c24
jmp 0x100017f8
mov eax, dword [ebp - 0x1b8]
sub eax, 0x2d68fb0d
je 0x100020e1
jmp 0x1000180e
mov eax, dword [ebp - 0x1b8]
sub eax, 0x2efcca8b
je 0x10001a6d
jmp 0x10001824
mov eax, dword [ebp - 0x1b8]
sub eax, 0x323baa6c
je 0x10002883
jmp 0x1000183a
mov eax, dword [ebp - 0x1b8]
sub eax, 0x3a5cb2be
je 0x10001b8a
jmp 0x10001850
mov eax, dword [ebp - 0x1b8]
sub eax, 0x3e4bcb3c
je 0x10002e1e
jmp 0x10001866
mov eax, dword [ebp - 0x1b8]
sub eax, 0x3f4599a5
je 0x1000214d
jmp 0x1000187c
mov eax, dword [ebp - 0x1b8]
sub eax, 0x46e51a0a
je 0x1000261a
jmp 0x10001892
mov eax, dword [ebp - 0x1b8]
sub eax, 0x48e25da5
je 0x10002db7
jmp 0x100018a8
mov eax, dword [ebp - 0x1b8]
sub eax, 0x48f7d25f
je 0x10002b3a
jmp 0x100018be
mov eax, dword [ebp - 0x1b8]
sub eax, 0x49e1b547
je 0x10002736
mov eax, dword [ebp - 0x1b4]
push eax
mov ecx, esp
mov dword [ebp - 0x190], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x18c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x188], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x184], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x180], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x194], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cd60
add esp, 0xc
mov eax, dword [ebp - 0x194]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x178], eax
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
mov edx, ecx
sub edx, 0x5d85280d
sub edx, 1
add edx, 0x5d85280d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xca016605
mov ecx, 0x29bf2d24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x3a5cb2be
jmp 0x10002ebd
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
mov edx, ecx
sub edx, 0xdbcdee0a
sub edx, 1
add edx, 0xdbcdee0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58c9c5a0
mov ecx, 0xa948e944
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x178]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x171], al
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58c9c5a0
mov ecx, 0x5f22616d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0xb104213d
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
sub edx, 0x6d6dec1c
sub edx, 1
add edx, 0x6d6dec1c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4d7521e1
mov ecx, 0xea5a045b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x16c], eax
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4d7521e1
mov ecx, 0x5badd976
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov ecx, dword [ebp - 0x170]
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x164], eax
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe6b94ce7
mov ecx, 0xfa0fd115
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x1d0c0ea9
jmp 0x10002ebd
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x164]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1a4], eax
mov edx, 0xffffffff
mov eax, 0xb37d9eee
mov ecx, 0xcdde203b
cmp dword [ebp - 0x1a4], edx
cmove eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
mov edx, ecx
sub edx, 0x9d083713
sub edx, 1
add edx, 0x9d083713
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc68bc72b
mov ecx, 0x78768dc9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0xb104213d
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
add edx, 0x1987f34c
sub edx, 1
sub edx, 0x1987f34c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11c433f4
mov ecx, 0x4b8ea5ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x26739d0
jmp 0x10002ebd
mov eax, dword [ebp - 0x160]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x1b0], 0x3f4599a5
jmp 0x10002ebd
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
mov edx, ecx
add edx, 0xf0f7fda7
sub edx, 1
sub edx, 0xf0f7fda7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x89e1fd9
mov ecx, 0xae855353
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x15c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x89e1fd9
mov ecx, 0xc42b339b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dl, byte [ebp - 0x155]
mov eax, 0xdd7c9121
mov ecx, 0xda5950da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x1b0], 0x2035a637
jmp 0x10002ebd
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x48e25da5
mov ecx, 0x9737412c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
sub edx, 0xd65b707e
sub edx, 1
add edx, 0xd65b707e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48e25da5
mov ecx, 0xab552433
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0xfeb26169
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0xb104213d
jmp 0x10002ebd
mov eax, dword [ebp - 0x1a8]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x190]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1b0], 0xaf96b1d7
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
sub edx, 0x317c61cf
sub edx, 1
add edx, 0x317c61cf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x722b884b
mov ecx, 0xee712787
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x150]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x18c]
mov dword [eax], ecx
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
mov edx, ecx
sub edx, 0x16d13ea4
sub edx, 1
add edx, 0x16d13ea4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x722b884b
mov ecx, 0x909a4f9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x18f5cd5c
jmp 0x10002ebd
mov eax, dword [ebp - 0x188]
mov word [eax], 0
mov dword [ebp - 0x1b0], 0x79326c0b
jmp 0x10002ebd
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
mov edx, ecx
add edx, 0xc606a004
sub edx, 1
sub edx, 0xc606a004
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e4bcb3c
mov ecx, 0xe690f998
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x144]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x13d], al
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
add edx, 0xab14b46c
sub edx, 1
sub edx, 0xab14b46c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e4bcb3c
mov ecx, 0x46e51a0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dl, byte [ebp - 0x13d]
mov eax, 0x879acb36
mov ecx, 0x103c507b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
add edx, 0xc1e569de
sub edx, 1
sub edx, 0xc1e569de
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe53e4a37
mov ecx, 0xbe8d815b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
sub eax, 0x22e18bc4
add eax, ecx
add eax, 0x22e18bc4
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe53e4a37
mov ecx, 0xcd8304e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x49e1b547
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
sub edx, 0x825c55c8
sub edx, 1
add edx, 0x825c55c8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc67ca318
mov ecx, 0xfd59335
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov ecx, dword [ebp - 0x138]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000f0d0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x131], al
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
add edx, 0x33a6c241
sub edx, 1
sub edx, 0x33a6c241
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc67ca318
mov ecx, 0x69858cdd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x180]
mov dword [eax], 0
mov dword [ebp - 0x1b0], 0x323baa6c
jmp 0x10002ebd
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x180]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x17c]
mov byte [eax], cl
mov edx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x4d9d4161
add edx, eax
sub edx, 0x4d9d4161
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cec0
add esp, 0xc
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x184]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1b0], 0x64cdc82
jmp 0x10002ebd
mov esi, dword [ebp - 0x128]
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x12c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x17c]
mov byte [eax], cl
mov dword [ebp - 0x1b0], 0xc0464c4a
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
sub edx, 0x3234a30a
sub edx, 1
add edx, 0x3234a30a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5a3b543
mov ecx, 0x2157e715
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov ecx, dword [0x10074b40]
mov eax, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf5a3b543
mov ecx, 0xe91dd135
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x91898766
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc27bb7a1
mov ecx, 0xaaa20aee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x188]
mov ax, word [eax]
mov word [ebp - 0x124], ax
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc27bb7a1
mov ecx, 0x48f7d25f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x6d2cf980
jmp 0x10002ebd
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
add edx, 0x69d2d527
sub edx, 1
sub edx, 0x69d2d527
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ea70b9
mov ecx, 0x1a596c67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov eax, dword [ebp - 0x188]
mov cx, word [ebp - 0x122]
mov word [eax], cx
mov eax, dword [0x10074b40]
mov ecx, dword [0x10074b3c]
mov edx, eax
add edx, 0xeba2aa4e
sub edx, 1
sub edx, 0xeba2aa4e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ea70b9
mov ecx, 0x2ad72ea7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x79326c0b
jmp 0x10002ebd
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x1b0], 0x14d5ac04
jmp 0x10002ebd
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1a8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b0], 0x188af9ae
jmp 0x10002ebd
mov eax, dword [ebp - 0x198]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b0], 0xb104213d
jmp 0x10002ebd
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000c160
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x194], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cd60
add esp, 0xc
mov eax, dword [ebp - 0x194]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1b0], 0x2efcca8b
jmp 0x10002ebd
mov ecx, dword [ebp - 0x170]
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1b0], 0xd9b59a1b
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x78768dc9
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x4b8ea5ea
jmp 0x10002ebd
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1b0], 0xae855353
jmp 0x10002ebd
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b0], 0x9737412c
jmp 0x10002ebd
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1b0], 0xe690f998
jmp 0x10002ebd
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1b0], 0xbe8d815b
jmp 0x10002ebd
mov ecx, dword [ebp - 0x138]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000f0d0
add esp, 8
mov dword [ebp - 0x1b0], 0xfd59335
jmp 0x10002ebd
mov dword [ebp - 0x1b0], 0x2157e715
jmp 0x10002ebd
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1b0], 0xaaa20aee
jmp 0x10002ebd
mov eax, dword [ebp - 0x188]
mov cx, word [ebp - 0x122]
mov word [eax], cx
mov dword [ebp - 0x1b0], 0x1a596c67
jmp 0x10001338