Function at 0x100010c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1009b200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x94], 0x553269a4
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x8012ad73
je 0x1000298e
jmp 0x1000113b
mov eax, dword [ebp - 0x9c]
sub eax, 0x89edb80e
je 0x10001dfd
jmp 0x10001151
mov eax, dword [ebp - 0x9c]
sub eax, 0xa5709272
je 0x10001a29
jmp 0x10001167
mov eax, dword [ebp - 0x9c]
sub eax, 0xa9ab50ca
je 0x1000274d
jmp 0x1000117d
mov eax, dword [ebp - 0x9c]
sub eax, 0xadf1f74e
je 0x100022e2
jmp 0x10001193
mov eax, dword [ebp - 0x9c]
sub eax, 0xafaeb6a6
je 0x1000275c
jmp 0x100011a9
mov eax, dword [ebp - 0x9c]
sub eax, 0xb3b97734
je 0x1000249d
jmp 0x100011bf
mov eax, dword [ebp - 0x9c]
sub eax, 0xb725f575
je 0x1000229b
jmp 0x100011d5
mov eax, dword [ebp - 0x9c]
sub eax, 0xbb2ba619
je 0x10002a5e
jmp 0x100011eb
mov eax, dword [ebp - 0x9c]
sub eax, 0xbb8c4c57
je 0x100025db
jmp 0x10001201
mov eax, dword [ebp - 0x9c]
sub eax, 0xbc23ef11
je 0x10002bae
jmp 0x10001217
mov eax, dword [ebp - 0x9c]
sub eax, 0xbc4440aa
je 0x10001d8b
jmp 0x1000122d
mov eax, dword [ebp - 0x9c]
sub eax, 0xbcea4ac9
je 0x100018d1
jmp 0x10001243
mov eax, dword [ebp - 0x9c]
sub eax, 0xbe4b5229
je 0x100022ca
jmp 0x10001259
mov eax, dword [ebp - 0x9c]
sub eax, 0xc2e57634
je 0x10001d7c
jmp 0x1000126f
mov eax, dword [ebp - 0x9c]
sub eax, 0xc3de80e3
je 0x100027e8
jmp 0x10001285
mov eax, dword [ebp - 0x9c]
sub eax, 0xc484c02a
je 0x100029bd
jmp 0x1000129b
mov eax, dword [ebp - 0x9c]
sub eax, 0xc49d2e80
je 0x1000273e
jmp 0x100012b1
mov eax, dword [ebp - 0x9c]
sub eax, 0xc852b578
je 0x100024bb
jmp 0x100012c7
mov eax, dword [ebp - 0x9c]
sub eax, 0xcb9717f9
je 0x10002839
jmp 0x100012dd
mov eax, dword [ebp - 0x9c]
sub eax, 0xd74dcc04
je 0x10002a4f
jmp 0x100012f3
mov eax, dword [ebp - 0x9c]
sub eax, 0xda077867
je 0x10002909
jmp 0x10001309
mov eax, dword [ebp - 0x9c]
sub eax, 0xdc03b7ba
je 0x10001af8
jmp 0x1000131f
mov eax, dword [ebp - 0x9c]
sub eax, 0xdf8cda50
je 0x10001fb1
jmp 0x10001335
mov eax, dword [ebp - 0x9c]
sub eax, 0xdfcb683d
je 0x10001e4e
jmp 0x1000134b
mov eax, dword [ebp - 0x9c]
sub eax, 0xe02df6fc
je 0x10002797
jmp 0x10001361
mov eax, dword [ebp - 0x9c]
sub eax, 0xe5407e8f
je 0x10001b41
jmp 0x10001377
mov eax, dword [ebp - 0x9c]
sub eax, 0xe763aa38
je 0x1000214e
jmp 0x1000138d
mov eax, dword [ebp - 0x9c]
sub eax, 0xe847cb31
je 0x10002aaf
jmp 0x100013a3
mov eax, dword [ebp - 0x9c]
sub eax, 0xe8beda94
je 0x10002879
jmp 0x100013b9
mov eax, dword [ebp - 0x9c]
sub eax, 0xed094daa
je 0x100029ae
jmp 0x100013cf
mov eax, dword [ebp - 0x9c]
sub eax, 0xeee13f0b
je 0x10001c98
jmp 0x100013e5
mov eax, dword [ebp - 0x9c]
sub eax, 0xf18d6486
je 0x100022aa
jmp 0x100013fb
mov eax, dword [ebp - 0x9c]
sub eax, 0xf445564c
je 0x10002a6d
jmp 0x10001411
mov eax, dword [ebp - 0x9c]
sub eax, 0xf879091c
je 0x10001fc0
jmp 0x10001427
mov eax, dword [ebp - 0x9c]
sub eax, 0xfae45dba
je 0x10001bb7
jmp 0x1000143d
mov eax, dword [ebp - 0x9c]
sub eax, 0xfbed121f
je 0x100023e1
jmp 0x10001453
mov eax, dword [ebp - 0x9c]
sub eax, 0xfea38722
je 0x1000299d
jmp 0x10001469
mov eax, dword [ebp - 0x9c]
sub eax, 0x177c64a
je 0x10001dd8
jmp 0x1000147f
mov eax, dword [ebp - 0x9c]
sub eax, 0x3f4e69e
je 0x100018c2
jmp 0x10001495
mov eax, dword [ebp - 0x9c]
sub eax, 0x432f74a
je 0x10001ec4
jmp 0x100014ab
mov eax, dword [ebp - 0x9c]
sub eax, 0x43b0a84
je 0x1000236b
jmp 0x100014c1
mov eax, dword [ebp - 0x9c]
sub eax, 0xbbf6964
je 0x10001848
jmp 0x100014d7
mov eax, dword [ebp - 0x9c]
sub eax, 0x1ce15f03
je 0x1000215d
jmp 0x100014ed
mov eax, dword [ebp - 0x9c]
sub eax, 0x1fd6a560
je 0x10001f33
jmp 0x10001503
mov eax, dword [ebp - 0x9c]
sub eax, 0x204f0a92
je 0x10001d06
jmp 0x10001519
mov eax, dword [ebp - 0x9c]
sub eax, 0x23cfb854
je 0x10002078
jmp 0x1000152f
mov eax, dword [ebp - 0x9c]
sub eax, 0x2b66daf1
je 0x10002b9f
jmp 0x10001545
mov eax, dword [ebp - 0x9c]
sub eax, 0x2bdca5d5
je 0x10002087
jmp 0x1000155b
mov eax, dword [ebp - 0x9c]
sub eax, 0x2bf4a20a
je 0x10001c01
jmp 0x10001571
mov eax, dword [ebp - 0x9c]
sub eax, 0x2c99acad
je 0x10001ee2
jmp 0x10001587
mov eax, dword [ebp - 0x9c]
sub eax, 0x32055930
je 0x10002a9d
jmp 0x1000159d
mov eax, dword [ebp - 0x9c]
sub eax, 0x3252ae4b
je 0x10001ae9
jmp 0x100015b3
mov eax, dword [ebp - 0x9c]
sub eax, 0x32f8b1b7
je 0x10002069
jmp 0x100015c9
mov eax, dword [ebp - 0x9c]
sub eax, 0x36f200a1
je 0x10001949
jmp 0x100015df
mov eax, dword [ebp - 0x9c]
sub eax, 0x3719a31c
je 0x10002677
jmp 0x100015f5
mov eax, dword [ebp - 0x9c]
sub eax, 0x38ac5a99
je 0x100021ff
jmp 0x1000160b
mov eax, dword [ebp - 0x9c]
sub eax, 0x3d76d208
je 0x10002306
jmp 0x10001621
mov eax, dword [ebp - 0x9c]
sub eax, 0x3e1542fb
je 0x10002ae4
jmp 0x10001637
mov eax, dword [ebp - 0x9c]
sub eax, 0x4173e5cd
je 0x10001bc6
jmp 0x1000164d
mov eax, dword [ebp - 0x9c]
sub eax, 0x417a571d
je 0x10002b31
jmp 0x10001663
mov eax, dword [ebp - 0x9c]
sub eax, 0x4a3a7793
je 0x10002a3d
jmp 0x10001679
mov eax, dword [ebp - 0x9c]
sub eax, 0x4b5a49e7
je 0x10002775
jmp 0x1000168f
mov eax, dword [ebp - 0x9c]
sub eax, 0x4cfa4ada
je 0x10002bbd
jmp 0x100016a5
mov eax, dword [ebp - 0x9c]
sub eax, 0x553269a4
je 0x100017f4
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
sub edx, 0x5729c5fe
sub edx, 1
add edx, 0x5729c5fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed094daa
mov ecx, 0x3f4e69e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xbcea4ac9
jmp 0x10002bd6
push eax
sub esp, 0x100
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x94], 0x62bcb887
jmp 0x10002bd6
mov ecx, dword [ebp - 0x98]
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10011840
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc484c02a
mov ecx, 0xa5709272
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dl, byte [ebp - 0x4d]
mov eax, 0x63e3877d
mov ecx, 0xdc03b7ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xfea38722
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a3a7793
mov ecx, 0xe5407e8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a3a7793
mov ecx, 0xfae45dba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0x4173e5cd
jmp 0x10002bd6
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x94], 0x2bf4a20a
jmp 0x10002bd6
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov edx, dword [ebp - 0x74]
mov esi, 0xffffffff
mov eax, 0xbc4440aa
mov ecx, 0xeee13f0b
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd74dcc04
mov ecx, 0x204f0a92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
add edx, 0xee0eae6c
sub edx, 1
sub edx, 0xee0eae6c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd74dcc04
mov ecx, 0xc2e57634
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xfea38722
jmp 0x10002bd6
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x94], 0x177c64a
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 0x94], 0x89edb80e
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
add edx, 0xcbd6b526
sub edx, 1
sub edx, 0xcbd6b526
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb2ba619
mov ecx, 0xdfcb683d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
add edx, 0xec20d04d
sub edx, 1
sub edx, 0xec20d04d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb2ba619
mov ecx, 0x432f74a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dl, byte [ebp - 0x41]
mov eax, 0x2c99acad
mov ecx, 0x2bdca5d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
sub edx, 0xf06c15c3
sub edx, 1
add edx, 0xf06c15c3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf445564c
mov ecx, 0x1fd6a560
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
add edx, 0x2666ceea
sub edx, 1
sub edx, 0x2666ceea
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf445564c
mov ecx, 0xdf8cda50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xf879091c
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
sub edx, 0x7cf1ef83
sub edx, 1
add edx, 0x7cf1ef83
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d2571e1
mov ecx, 0x602a1178
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0x23cfb854
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xfea38722
jmp 0x10002bd6
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
sub edx, 0x85f09e5a
sub edx, 1
add edx, 0x85f09e5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x32055930
mov ecx, 0x555d0bbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0x1ce15f03
jmp 0x10002bd6
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x94], 0x6580bfc5
jmp 0x10002bd6
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
sub edx, 0x67644417
sub edx, 1
add edx, 0x67644417
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe847cb31
mov ecx, 0xb725f575
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xf18d6486
jmp 0x10002bd6
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x94], 0xbe4b5229
jmp 0x10002bd6
mov eax, dword [ebp - 0x30]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x94], 0xadf1f74e
jmp 0x10002bd6
mov eax, dword [ebp - 0x2c]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x34]
mov eax, 0x78e7debe
mov ecx, 0x3d76d208
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, 0xe4090baf
add eax, 0x18
sub eax, 0xe4090baf
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x94], 0x7e370003
jmp 0x10002bd6
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
add edx, 0xda24ca60
sub edx, 1
sub edx, 0xda24ca60
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e1542fb
mov ecx, 0xfbed121f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov ax, word [ebp - 0x1c]
movzx eax, ax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x54ff3e9c
add ecx, eax
add ecx, 0x54ff3e9c
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001d3b0
call fcn.10013bb0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x19], al
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
sub edx, 0x494a1caf
sub edx, 1
add edx, 0x494a1caf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e1542fb
mov ecx, 0xb3b97734
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dl, byte [ebp - 0x19]
mov eax, 0xc852b578
mov ecx, 0xa9ab50ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
add edx, 0xef3d722d
sub edx, 1
sub edx, 0xef3d722d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x417a571d
mov ecx, 0x5b6b683e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x43eb72ec
add ecx, eax
add ecx, 0x43eb72ec
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x18]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.100119a0
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x13a6eee
add esi, eax
sub esi, 0x13a6eee
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov dword [ebp - 0x94], 0x3719a31c
jmp 0x10002bd6
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
sub edx, 0x5a9a170
sub edx, 1
add edx, 0x5a9a170
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b66daf1
mov ecx, 0x6a8e1a95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xa9ab50ca
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xafaeb6a6
jmp 0x10002bd6
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x94], 0x4b5a49e7
jmp 0x10002bd6
mov cx, word [ebp - 0x12]
xor eax, eax
sub ax, 1
sub cx, ax
mov eax, dword [ebp - 0x60]
mov word [eax], cx
mov dword [ebp - 0x94], 0xe02df6fc
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
sub edx, 0x6ca4375d
sub edx, 1
add edx, 0x6ca4375d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc23ef11
mov ecx, 0xc3de80e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov eax, dword [0x1009c540]
mov ecx, dword [0x1009c53c]
mov edx, eax
add edx, 0x50cb981b
sub edx, 1
sub edx, 0x50cb981b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc23ef11
mov ecx, 0xcb9717f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xf18d6486
jmp 0x10002bd6
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x94], 0x6095fed4
jmp 0x10002bd6
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1009c540]
mov eax, dword [0x1009c53c]
mov edx, ecx
sub edx, 0x4db5b50a
sub edx, 1
add edx, 0x4db5b50a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4cfa4ada
mov ecx, 0x8012ad73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xfea38722
jmp 0x10002bd6
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10010c40
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x94], 0xbbf6964
jmp 0x10002bd6
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10011840
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x94], 0x36f200a1
jmp 0x10002bd6
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x94], 0xe5407e8f
jmp 0x10002bd6
mov dword [ebp - 0x94], 0x204f0a92
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xdfcb683d
jmp 0x10002bd6
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x1fd6a560
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], 0x555d0bbb
jmp 0x10002bd6
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x65d87f94
add ecx, eax
add ecx, 0x65d87f94
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x94], 0x38ac5a99
jmp 0x10002bd6
mov ax, word [ebp - 0x1c]
movzx eax, ax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sub ecx, 0x327ae501
add ecx, eax
add ecx, 0x327ae501
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001d3b0
call fcn.10013bb0
add esp, 8
mov dword [ebp - 0x94], 0xfbed121f
jmp 0x10002bd6
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xb37a1486
add edx, eax
sub edx, 0xb37a1486
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x94], 0x5b6b683e
jmp 0x10002bd6
mov dword [ebp - 0x94], 0x6a8e1a95
jmp 0x10002bd6
mov dword [ebp - 0x94], 0xc3de80e3
jmp 0x10002bd6
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xda077867
jmp 0x1000111f