Function at 0x100010a0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x194
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x10069600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0x100b1390
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
sub eax, 0x83178970
je 0x100027cd
jmp 0x100010e5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x86f466ac
je 0x10002095
jmp 0x100010fb
mov eax, dword [ebp - 0x1a0]
sub eax, 0x88993dac
je 0x10002aa4
jmp 0x10001111
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8c8d7669
je 0x10001c14
jmp 0x10001127
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9cb22e05
je 0x10002c8c
jmp 0x1000113d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa2e91f44
je 0x100021a4
jmp 0x10001153
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa40503ab
je 0x10002658
jmp 0x10001169
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa51ab992
je 0x10001d2e
jmp 0x1000117f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa5ab4fe5
je 0x10002e4b
jmp 0x10001195
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa8e491cf
je 0x10001e59
jmp 0x100011ab
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb3e2a629
je 0x10002d9d
jmp 0x100011c1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb5a340f0
je 0x100018ba
jmp 0x100011d7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb62b4649
je 0x10001cae
jmp 0x100011ed
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb78fd4e2
je 0x10002949
jmp 0x10001203
mov eax, dword [ebp - 0x1a0]
sub eax, 0xba848169
je 0x10002ad7
jmp 0x10001219
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbd0ab4a5
je 0x10001e1d
jmp 0x1000122f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbd493ccc
je 0x10002599
jmp 0x10001245
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcbb6f80c
je 0x10001928
jmp 0x1000125b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd59a9894
je 0x1000282d
jmp 0x10001271
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd632aa77
je 0x10002caa
jmp 0x10001287
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd6fd2493
je 0x100025e2
jmp 0x1000129d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd7ad6504
je 0x100023d6
jmp 0x100012b3
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd90e2918
je 0x10002395
jmp 0x100012c9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdb0516d5
je 0x10002c71
jmp 0x100012df
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdb49221d
je 0x10002e5a
jmp 0x100012f5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdbd03c74
je 0x1000231a
jmp 0x1000130b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe2171b2f
je 0x1000210b
jmp 0x10001321
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe2ea9a91
je 0x10002515
jmp 0x10001337
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe97fd459
je 0x10001ecf
jmp 0x1000134d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xeba746ea
je 0x10002e78
jmp 0x10001363
mov eax, dword [ebp - 0x1a0]
sub eax, 0xec3d63a2
je 0x10001d3d
jmp 0x10001379
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf177d865
je 0x10001b19
jmp 0x1000138f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf1987b9d
je 0x100028aa
jmp 0x100013a5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf5450903
je 0x1000200a
jmp 0x100013bb
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf78d4a22
je 0x10001b28
jmp 0x100013d1
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2f7d80
je 0x10002195
jmp 0x100013e7
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2b683a9
je 0x100029c6
jmp 0x100013fd
mov eax, dword [ebp - 0x1a0]
sub eax, 0x312cfef
je 0x10001c65
jmp 0x10001413
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6215a7c
je 0x1000288d
jmp 0x10001429
mov eax, dword [ebp - 0x1a0]
sub eax, 0x705fd81
je 0x10002d47
jmp 0x1000143f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xccefc99
je 0x1000207d
jmp 0x10001455
mov eax, dword [ebp - 0x1a0]
sub eax, 0xda53a6a
je 0x10002d82
jmp 0x1000146b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x100b1390
je 0x1000180c
jmp 0x10001481
mov eax, dword [ebp - 0x1a0]
sub eax, 0x11b706d9
je 0x10002d1c
jmp 0x10001497
mov eax, dword [ebp - 0x1a0]
sub eax, 0x135bf93e
je 0x10002386
jmp 0x100014ad
mov eax, dword [ebp - 0x1a0]
sub eax, 0x13a0050b
je 0x10002c9b
jmp 0x100014c3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x177a67f3
je 0x100021c4
jmp 0x100014d9
mov eax, dword [ebp - 0x1a0]
sub eax, 0x18c00c2b
je 0x10002bec
jmp 0x100014ef
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1fba1aea
je 0x10002cb9
jmp 0x10001505
mov eax, dword [ebp - 0x1a0]
sub eax, 0x23a20556
je 0x10001e38
jmp 0x1000151b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x24e52c5b
je 0x10002d38
jmp 0x10001531
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3030c0f2
je 0x10001c05
jmp 0x10001547
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3312319f
je 0x100019aa
jmp 0x1000155d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x33521d90
je 0x100028d3
jmp 0x10001573
mov eax, dword [ebp - 0x1a0]
sub eax, 0x353a82f2
je 0x10001dfc
jmp 0x10001589
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3d584516
je 0x10002e69
jmp 0x1000159f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3d762373
je 0x100018ab
jmp 0x100015b5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x42015b69
je 0x10001f9c
jmp 0x100015cb
mov eax, dword [ebp - 0x1a0]
sub eax, 0x43dca7de
je 0x10002283
jmp 0x100015e1
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4d009554
je 0x100027dc
jmp 0x100015f7
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4e8a45b4
je 0x10001f2f
jmp 0x1000160d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4ea3c780
je 0x10001b71
jmp 0x10001623
mov eax, dword [ebp - 0x1a0]
sub eax, 0x50d2140e
je 0x10002215
jmp 0x10001639
mov eax, dword [ebp - 0x1a0]
sub eax, 0x577ee656
je 0x1000287e
jmp 0x1000164f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5a39703f
je 0x10001d86
mov eax, dword [ebp - 0x19c]
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x198], 0x7097edc7
jmp 0x10002e82
mov dword [ebp - 0x198], 0xba848169
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x721d8c31
mov ecx, 0xcbb6f80c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
lea eax, [ebp - 0x120]
mov dword [ebp - 0x160], eax
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x721d8c31
mov ecx, 0x3312319f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0x73e4223e
jmp 0x10002e82
mov dword [ebp - 0x198], 0xf78d4a22
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb0516d5
mov ecx, 0x4ea3c780
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x180], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x180], eax
sete al
and al, 1
mov byte [ebp - 0x156], al
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
sub edx, 0x4bbba463
sub edx, 1
add edx, 0x4bbba463
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb0516d5
mov ecx, 0x72017862
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0xba848169
jmp 0x10002e82
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x198], 0x312cfef
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9cb22e05
mov ecx, 0xb62b4649
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
cmp dword [ebp - 0x184], 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9cb22e05
mov ecx, 0xa51ab992
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0xec3d63a2
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x13a0050b
mov ecx, 0x5a39703f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dl, byte [ebp - 0x155]
mov eax, 0xbd0ab4a5
mov ecx, 0x4e8a45b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x198], 0x23a20556
jmp 0x10002e82
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0xa8e491cf
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
mov edx, ecx
add edx, 0xe8895661
sub edx, 1
sub edx, 0xe8895661
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd632aa77
mov ecx, 0xe97fd459
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
add edx, 0xe2f7dd84
sub edx, 1
sub edx, 0xe2f7dd84
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd632aa77
mov ecx, 0x65358bfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x198], 0x42015b69
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1fba1aea
mov ecx, 0xf5450903
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x150]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x190], eax
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1fba1aea
mov ecx, 0x7ebae3d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov word [ebp - 0x192], 0
mov dword [ebp - 0x198], 0x86f466ac
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
mov edx, ecx
sub edx, 0x23984250
sub edx, 1
add edx, 0x23984250
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b565a26
mov ecx, 0xe2171b2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
movzx eax, word [ebp - 0x192]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x190]
add eax, 4
mov dword [ebp - 0x144], eax
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b565a26
mov ecx, 0x2f7d80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0xa2e91f44
jmp 0x10002e82
mov eax, dword [ebp - 0x144]
mov ax, word [eax + 2]
mov word [ebp - 0x140], ax
mov dword [ebp - 0x198], 0x177a67f3
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
sub edx, 0xe74aae00
sub edx, 1
add edx, 0xe74aae00
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11b706d9
mov ecx, 0x50d2140e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov ax, word [ebp - 0x140]
movzx ecx, ax
mov eax, dword [ebp - 0x148]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x13d], al
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
add edx, 0xfc4f6949
sub edx, 1
sub edx, 0xfc4f6949
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11b706d9
mov ecx, 0x43dca7de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dl, byte [ebp - 0x13d]
mov eax, 0x2b683a9
mov ecx, 0x72d4f3e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x190]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
add edx, 0x72e94925
sub edx, 1
sub edx, 0x72e94925
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24e52c5b
mov ecx, 0x135bf93e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0xd90e2918
jmp 0x10002e82
mov eax, dword [ebp - 0x190]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
movzx ecx, word [ebp - 0x192]
imul ecx, ecx, 0x28
sub eax, 0x9023ab12
add eax, ecx
add eax, 0x9023ab12
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x198], 0xd7ad6504
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x705fd81
mov ecx, 0x71339c73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x773ac00
add edx, eax
add edx, 0x773ac00
mov eax, dword [ebp - 0x168]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x198], 0xbd493ccc
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda53a6a
mov ecx, 0xd6fd2493
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x16c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x12c], eax
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
add edx, 0x987f9daf
sub edx, 1
sub edx, 0x987f9daf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda53a6a
mov ecx, 0xa40503ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0x72e4cea7
jmp 0x10002e82
mov dword [ebp - 0x198], 0x4d009554
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
sub edx, 0x5d50e6c7
sub edx, 1
add edx, 0x5d50e6c7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa5ab4fe5
mov ecx, 0xd59a9894
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [0x1006a940]
mov ecx, dword [0x1006a93c]
mov edx, eax
sub edx, 0xc1cd30b8
sub edx, 1
add edx, 0xc1cd30b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa5ab4fe5
mov ecx, 0x577ee656
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov dword [ebp - 0x198], 0x6215a7c
jmp 0x10002e82
mov ax, word [ebp - 0x192]
mov word [ebp - 0x126], ax
mov dword [ebp - 0x198], 0xf1987b9d
jmp 0x10002e82
mov ax, word [ebp - 0x126]
sub ax, 0xcaa3
add ax, 1
add ax, 0xcaa3
mov word [ebp - 0x192], ax
mov dword [ebp - 0x198], 0x33521d90
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
mov edx, ecx
sub edx, 0x895b1935
sub edx, 1
add edx, 0x895b1935
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb49221d
mov ecx, 0xb78fd4e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdb49221d
mov ecx, 0x747ae023
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0x793cf1f9
jmp 0x10002e82
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0xba848169
jmp 0x10002e82
mov ecx, dword [0x1006a940]
mov eax, dword [0x1006a93c]
mov edx, ecx
add edx, 0x69a2a402
sub edx, 1
sub edx, 0x69a2a402
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeba746ea
mov ecx, 0x725c503e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10002e82
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x178]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x198], 0x7dd4dbad
jmp 0x10002e82
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x198], 0x4ea3c780
jmp 0x10002e82
mov dword [ebp - 0x198], 0xb62b4649
jmp 0x10002e82
mov dword [ebp - 0x198], 0x5a39703f
jmp 0x10002e82
mov dword [ebp - 0x198], 0xe97fd459
jmp 0x10002e82
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
sub eax, 0x96df9976
add eax, ecx
add eax, 0x96df9976
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x198], 0xf5450903
jmp 0x10002e82
mov ax, word [ebp - 0x140]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x198], 0x50d2140e
jmp 0x10002e82
mov dword [ebp - 0x198], 0xdbd03c74
jmp 0x10002e82
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000f730
add esp, 8
mov dword [ebp - 0x198], 0x71339c73
jmp 0x10002e82
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x198], 0xd6fd2493
jmp 0x10002e82
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x8b50479b
add ecx, eax
sub ecx, 0x8b50479b
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x12c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d520
add esp, 0xc
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x168]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov dword [ebp - 0x198], 0x7d437eea
jmp 0x10002e82
mov dword [ebp - 0x198], 0xd59a9894
jmp 0x10002e82
mov dword [ebp - 0x198], 0xb78fd4e2
jmp 0x10002e82
mov dword [ebp - 0x198], 0x7229b077
jmp 0x10002e82
mov dword [ebp - 0x198], 0x725c503e
jmp 0x100010c9