Function at 0x10001310
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x1006a200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1a0], 0x9ff80995
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
sub eax, 0x82c911ab
je 0x10001940
jmp 0x10001354
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8448d7b1
je 0x1000284f
jmp 0x1000136a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x87b99664
je 0x100026ec
jmp 0x10001380
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8be965a4
je 0x1000298a
jmp 0x10001396
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8d48677a
je 0x1000202d
jmp 0x100013ac
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8eddb7c6
je 0x10001da1
jmp 0x100013c2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x90f56d19
je 0x10002211
jmp 0x100013d8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x994c8337
je 0x10001c28
jmp 0x100013ee
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9e801ea9
je 0x1000270b
jmp 0x10001404
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9ff80995
je 0x100018ef
jmp 0x1000141a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa15f1144
je 0x1000215a
jmp 0x10001430
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa6bd8557
je 0x10002933
jmp 0x10001446
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa6e2eb09
je 0x100025fb
jmp 0x1000145c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa8688757
je 0x10001a67
jmp 0x10001472
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa8ef6825
je 0x10001b88
jmp 0x10001488
mov eax, dword [ebp - 0x1a8]
sub eax, 0xaaf61b23
je 0x10001cfe
jmp 0x1000149e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xae75e1f6
je 0x10001ae6
jmp 0x100014b4
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb12c9c67
je 0x100020eb
jmp 0x100014ca
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb2abaa52
je 0x100025ec
jmp 0x100014e0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb2db7a04
je 0x10002a73
jmp 0x100014f6
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb575f790
je 0x1000276b
jmp 0x1000150c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbf3db4aa
je 0x10002535
jmp 0x10001522
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc0f69f39
je 0x10001a76
jmp 0x10001538
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc252d1ef
je 0x10001ec5
jmp 0x1000154e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc5a1e752
je 0x10001ea4
jmp 0x10001564
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcc013da2
je 0x10001a9d
jmp 0x1000157a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcc0555f9
je 0x100020fa
jmp 0x10001590
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd1ec9c42
je 0x1000213b
jmp 0x100015a6
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd9b0fc48
je 0x100019c8
jmp 0x100015bc
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe2f32996
je 0x1000260a
jmp 0x100015d2
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe38ddf1e
je 0x100028f0
jmp 0x100015e8
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe5af2757
je 0x100029a6
jmp 0x100015fe
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe5dcafe1
je 0x10001fa8
jmp 0x10001614
mov eax, dword [ebp - 0x1a8]
sub eax, 0xeb9e263f
je 0x100028e1
jmp 0x1000162a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf36b96c4
je 0x10001e17
jmp 0x10001640
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf56cd7ef
je 0x1000242c
jmp 0x10001656
mov eax, dword [ebp - 0x1a8]
sub eax, 0xfd0f260c
je 0x10001e89
jmp 0x1000166c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x469113
je 0x10002a5d
jmp 0x10001682
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4f63038
je 0x1000286f
jmp 0x10001698
mov eax, dword [ebp - 0x1a8]
sub eax, 0x762c9c2
je 0x10001b97
jmp 0x100016ae
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7988c9a
je 0x10002232
jmp 0x100016c4
mov eax, dword [ebp - 0x1a8]
sub eax, 0x818b5db
je 0x100022a7
jmp 0x100016da
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9e27d1a
je 0x1000285e
jmp 0x100016f0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa040afa
je 0x100019d7
jmp 0x10001706
mov eax, dword [ebp - 0x1a8]
sub eax, 0x106f6d31
je 0x100027e1
jmp 0x1000171c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x147a3770
je 0x10001c37
jmp 0x10001732
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1da0bd32
je 0x1000274a
jmp 0x10001748
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2454213f
je 0x10001e68
jmp 0x1000175e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x29c2140a
je 0x1000267a
jmp 0x10001774
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2cf7aa93
je 0x10001ed4
jmp 0x1000178a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x346de127
je 0x10001c88
jmp 0x100017a0
mov eax, dword [ebp - 0x1a8]
sub eax, 0x361de47b
je 0x1000287e
jmp 0x100017b6
mov eax, dword [ebp - 0x1a8]
sub eax, 0x381c9c7e
je 0x100026dd
jmp 0x100017cc
mov eax, dword [ebp - 0x1a8]
sub eax, 0x39ebe81f
je 0x10001f25
jmp 0x100017e2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3e254718
je 0x10002109
jmp 0x100017f8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x41dba667
je 0x10001fb7
jmp 0x1000180e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4233e5c2
je 0x10002341
jmp 0x10001824
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4581120d
je 0x10002629
jmp 0x1000183a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x46ea497f
je 0x100024e4
jmp 0x10001850
mov eax, dword [ebp - 0x1a8]
sub eax, 0x524ecdd7
je 0x100028c6
jmp 0x10001866
mov eax, dword [ebp - 0x1a8]
sub eax, 0x52c380fd
je 0x1000225c
jmp 0x1000187c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x62d8cced
je 0x100022f0
jmp 0x10001892
mov eax, dword [ebp - 0x1a8]
sub eax, 0x64362964
je 0x10002a0d
jmp 0x100018a8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x75d8243b
je 0x10001d92
jmp 0x100018be
mov eax, dword [ebp - 0x1a8]
sub eax, 0x765d6689
je 0x1000241d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0x1cca0686
sub edx, 1
sub edx, 0x1cca0686
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f63038
mov ecx, 0x82c911ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
add edx, 0xef5d65df
sub edx, 1
sub edx, 0xef5d65df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4f63038
mov ecx, 0xd9b0fc48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0xa040afa
jmp 0x10002a7d
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c170
add esp, 0xc
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x188], eax
mov eax, 0xa8688757
mov ecx, 0xc0f69f39
cmp dword [ebp - 0x188], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x9e27d1a
jmp 0x10002a7d
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1a0], 0xcc013da2
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x361de47b
mov ecx, 0xae75e1f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x15c], eax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0x2f29fa06
sub edx, 1
add edx, 0x2f29fa06
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x361de47b
mov ecx, 0xa8ef6825
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x762c9c2
jmp 0x10002a7d
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x190], eax
mov edx, 0xffffffff
mov eax, 0x147a3770
mov ecx, 0x994c8337
cmp dword [ebp - 0x190], edx
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x9e27d1a
jmp 0x10002a7d
mov eax, dword [ebp - 0x190]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1a0], 0x346de127
jmp 0x10002a7d
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
add edx, 0xb88d74cc
sub edx, 1
sub edx, 0xb88d74cc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x524ecdd7
mov ecx, 0xaaf61b23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
setne al
and al, 1
mov byte [ebp - 0x151], al
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
sub edx, 0xfc085bb
sub edx, 1
add edx, 0xfc085bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x524ecdd7
mov ecx, 0x75d8243b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x8eddb7c6
jmp 0x10002a7d
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
sub edx, 0x51ff9f08
sub edx, 1
add edx, 0x51ff9f08
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeb9e263f
mov ecx, 0xf36b96c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0x29340702
sub edx, 1
add edx, 0x29340702
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeb9e263f
mov ecx, 0x2454213f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dl, byte [ebp - 0x151]
mov eax, 0xfd0f260c
mov ecx, 0x2cf7aa93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1a0], 0xc5a1e752
jmp 0x10002a7d
mov eax, dword [ebp - 0x150]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xc252d1ef
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x9e27d1a
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0x5181691c
sub edx, 1
sub edx, 0x5181691c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe38ddf1e
mov ecx, 0x39ebe81f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x194]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14c], eax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe38ddf1e
mov ecx, 0xe5dcafe1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x41dba667
jmp 0x10002a7d
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
add edx, 0xf8a6347
sub edx, 1
sub edx, 0xf8a6347
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa6bd8557
mov ecx, 0x8d48677a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0x3c]
add ecx, 0x34fa7edc
add ecx, eax
sub ecx, 0x34fa7edc
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov word [eax], 0
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
add edx, 0xd8e2d260
sub edx, 1
sub edx, 0xd8e2d260
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa6bd8557
mov ecx, 0xb12c9c67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0xcc0555f9
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x3e254718
jmp 0x10002a7d
mov eax, dword [ebp - 0x178]
movzx eax, word [eax]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x1a0], 0xd1ec9c42
jmp 0x10002a7d
mov eax, dword [ebp - 0x144]
mov ax, word [eax]
mov word [ebp - 0x140], ax
mov dword [ebp - 0x1a0], 0xa15f1144
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8be965a4
mov ecx, 0x7e114809
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dl, byte [ebp - 0x13d]
mov eax, 0x9e801ea9
mov ecx, 0x7988c9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x2165bc21
add eax, 0x18
sub eax, 0x2165bc21
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1a0], 0x52c380fd
jmp 0x10002a7d
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
mov eax, dword [ebp - 0x13c]
sub eax, 0x6a94a787
add eax, ecx
add eax, 0x6a94a787
mov ecx, dword [ebp - 0x178]
movzx ecx, word [ecx]
imul ecx, ecx, 0x28
add eax, 0x4f62e0ae
add eax, ecx
sub eax, 0x4f62e0ae
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1a0], 0x818b5db
jmp 0x10002a7d
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e4e0
add esp, 8
mov edx, eax
mov eax, 0x62d8cced
mov ecx, 0xa6e2eb09
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0x86f302bc
sub edx, 1
add edx, 0x86f302bc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5af2757
mov ecx, 0x4233e5c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x3a007844
add edx, eax
sub edx, 0x3a007844
mov eax, dword [ebp - 0x170]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x131], al
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
sub edx, 0x6ac41432
sub edx, 1
add edx, 0x6ac41432
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe5af2757
mov ecx, 0x765d6689
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov eax, dword [ebp - 0x16c]
mov cl, byte [ebp - 0x131]
mov byte [eax], cl
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0xd18f1d8f
add ecx, eax
sub ecx, 0xd18f1d8f
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c2d0
add esp, 0xc
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1a0], 0x46ea497f
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0x45ed8754
sub edx, 1
sub edx, 0x45ed8754
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x64362964
mov ecx, 0xbf3db4aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov esi, dword [ebp - 0x128]
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x12c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
sub edx, 0x52afebaf
sub edx, 1
add edx, 0x52afebaf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x64362964
mov ecx, 0xb2abaa52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0xa6e2eb09
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0xe2f32996
jmp 0x10002a7d
mov eax, dword [ebp - 0x178]
mov ax, word [eax]
mov word [ebp - 0x124], ax
mov dword [ebp - 0x1a0], 0x4581120d
jmp 0x10002a7d
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0xbc7e1839
sub edx, 1
add edx, 0xbc7e1839
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x469113
mov ecx, 0x29c2140a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov ax, word [ebp - 0x124]
add ax, 0xd9d7
add ax, 1
sub ax, 0xd9d7
mov word [ebp - 0x122], ax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x469113
mov ecx, 0x381c9c7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x87b99664
jmp 0x10002a7d
mov eax, dword [ebp - 0x178]
mov cx, word [ebp - 0x122]
mov word [eax], cx
mov dword [ebp - 0x1a0], 0x3e254718
jmp 0x10002a7d
mov eax, dword [ebp - 0x190]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x194]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x1a0], 0x1da0bd32
jmp 0x10002a7d
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xb575f790
jmp 0x10002a7d
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
add edx, 0xcb0cc95b
sub edx, 1
sub edx, 0xcb0cc95b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb2db7a04
mov ecx, 0x106f6d31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2db7a04
mov ecx, 0x8448d7b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x9e27d1a
jmp 0x10002a7d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000b570
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1a0], 0x82c911ab
jmp 0x10002a7d
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x1a0], 0xae75e1f6
jmp 0x10002a7d
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x1a0], 0xaaf61b23
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0xf36b96c4
jmp 0x10002a7d
mov eax, dword [ebp - 0x194]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1a0], 0x39ebe81f
jmp 0x10002a7d
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x19c]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov word [eax], 0
mov dword [ebp - 0x1a0], 0x8d48677a
jmp 0x10002a7d
mov ax, word [ebp - 0x140]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x1a0], 0x7e114809
jmp 0x10002a7d
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x7cce1f4b
add edx, eax
sub edx, 0x7cce1f4b
mov eax, dword [ebp - 0x170]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1a0], 0x4233e5c2
jmp 0x10002a7d
mov esi, dword [ebp - 0x128]
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x12c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov dword [ebp - 0x1a0], 0xbf3db4aa
jmp 0x10002a7d
mov ax, word [ebp - 0x124]
mov dword [ebp - 0x1a0], 0x29c2140a
jmp 0x10002a7d
mov dword [ebp - 0x1a0], 0x106f6d31
jmp 0x10001338