Function at 0x100012d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1003a600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0xddbe5e40
sub edx, 1
sub edx, 0xddbe5e40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x94], 0x909a4fdd
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x80dcf481
je 0x100026bf
jmp 0x10001353
mov eax, dword [ebp - 0x9c]
sub eax, 0x8233991b
je 0x10002682
jmp 0x10001369
mov eax, dword [ebp - 0x9c]
sub eax, 0x8740193f
je 0x10002bd6
jmp 0x1000137f
mov eax, dword [ebp - 0x9c]
sub eax, 0x89ea21d3
je 0x10002099
jmp 0x10001395
mov eax, dword [ebp - 0x9c]
sub eax, 0x8a6c5d30
je 0x10002c39
jmp 0x100013ab
mov eax, dword [ebp - 0x9c]
sub eax, 0x909a4fdd
je 0x100019ca
jmp 0x100013c1
mov eax, dword [ebp - 0x9c]
sub eax, 0x91a82a7a
je 0x10002a3d
jmp 0x100013d7
mov eax, dword [ebp - 0x9c]
sub eax, 0x94c3b9c3
je 0x10002975
jmp 0x100013ed
mov eax, dword [ebp - 0x9c]
sub eax, 0x9652e797
je 0x10002a95
jmp 0x10001403
mov eax, dword [ebp - 0x9c]
sub eax, 0x9b738133
je 0x1000263e
jmp 0x10001419
mov eax, dword [ebp - 0x9c]
sub eax, 0xa0004c0d
je 0x10002528
jmp 0x1000142f
mov eax, dword [ebp - 0x9c]
sub eax, 0xa2ef7391
je 0x10002ab5
jmp 0x10001445
mov eax, dword [ebp - 0x9c]
sub eax, 0xa327de07
je 0x1000232a
jmp 0x1000145b
mov eax, dword [ebp - 0x9c]
sub eax, 0xa52ec756
je 0x100026f7
jmp 0x10001471
mov eax, dword [ebp - 0x9c]
sub eax, 0xaf4a830b
je 0x100020f2
jmp 0x10001487
mov eax, dword [ebp - 0x9c]
sub eax, 0xb1766474
je 0x10002ba9
jmp 0x1000149d
mov eax, dword [ebp - 0x9c]
sub eax, 0xb7264605
je 0x10002a4c
jmp 0x100014b3
mov eax, dword [ebp - 0x9c]
sub eax, 0xbe678442
je 0x10002b35
jmp 0x100014c9
mov eax, dword [ebp - 0x9c]
sub eax, 0xc59a8305
je 0x10002aa6
jmp 0x100014df
mov eax, dword [ebp - 0x9c]
sub eax, 0xc5cab812
je 0x10002ac4
jmp 0x100014f5
mov eax, dword [ebp - 0x9c]
sub eax, 0xc8e394a1
je 0x10002b97
jmp 0x1000150b
mov eax, dword [ebp - 0x9c]
sub eax, 0xc976a73a
je 0x10002b85
jmp 0x10001521
mov eax, dword [ebp - 0x9c]
sub eax, 0xce694a5a
je 0x10001df2
jmp 0x10001537
mov eax, dword [ebp - 0x9c]
sub eax, 0xd4beeaaa
je 0x10001e01
jmp 0x1000154d
mov eax, dword [ebp - 0x9c]
sub eax, 0xd6706f0d
je 0x10001b6d
jmp 0x10001563
mov eax, dword [ebp - 0x9c]
sub eax, 0xd990ed6e
je 0x1000295c
jmp 0x10001579
mov eax, dword [ebp - 0x9c]
sub eax, 0xdb6ae3a6
je 0x10001f64
jmp 0x1000158f
mov eax, dword [ebp - 0x9c]
sub eax, 0xdd8f4539
je 0x10002be8
jmp 0x100015a5
mov eax, dword [ebp - 0x9c]
sub eax, 0xdf6eaa7c
je 0x10002005
jmp 0x100015bb
mov eax, dword [ebp - 0x9c]
sub eax, 0xe060f185
je 0x10001f82
jmp 0x100015d1
mov eax, dword [ebp - 0x9c]
sub eax, 0xeb5b1f72
je 0x10002023
jmp 0x100015e7
mov eax, dword [ebp - 0x9c]
sub eax, 0xebcdf9e6
je 0x10002c4b
jmp 0x100015fd
mov eax, dword [ebp - 0x9c]
sub eax, 0xec808659
je 0x10002920
jmp 0x10001613
mov eax, dword [ebp - 0x9c]
sub eax, 0xf3c8937c
je 0x1000265e
jmp 0x10001629
mov eax, dword [ebp - 0x9c]
sub eax, 0xf52638a2
je 0x1000220b
jmp 0x1000163f
mov eax, dword [ebp - 0x9c]
sub eax, 0xfc6132d9
je 0x100024b2
jmp 0x10001655
mov eax, dword [ebp - 0x9c]
sub eax, 0xff07ad02
je 0x10002c5a
jmp 0x1000166b
mov eax, dword [ebp - 0x9c]
sub eax, 0x224bb8
je 0x100019f9
jmp 0x10001681
mov eax, dword [ebp - 0x9c]
sub eax, 0x1ff9b77
je 0x10002177
jmp 0x10001697
mov eax, dword [ebp - 0x9c]
sub eax, 0x207ff57
je 0x10002101
jmp 0x100016ad
mov eax, dword [ebp - 0x9c]
sub eax, 0x22f0292
je 0x10002911
jmp 0x100016c3
mov eax, dword [ebp - 0x9c]
sub eax, 0x7af7352
je 0x10001d00
jmp 0x100016d9
mov eax, dword [ebp - 0x9c]
sub eax, 0xeda80e9
je 0x10001a84
jmp 0x100016ef
mov eax, dword [ebp - 0x9c]
sub eax, 0x11743da4
je 0x10001ce2
jmp 0x10001705
mov eax, dword [ebp - 0x9c]
sub eax, 0x1309d3ed
je 0x100029be
jmp 0x1000171b
mov eax, dword [ebp - 0x9c]
sub eax, 0x1341b3f3
je 0x100022ca
jmp 0x10001731
mov eax, dword [ebp - 0x9c]
sub eax, 0x1370c18d
je 0x10001fa8
jmp 0x10001747
mov eax, dword [ebp - 0x9c]
sub eax, 0x14518ea8
je 0x10001b5e
jmp 0x1000175d
mov eax, dword [ebp - 0x9c]
sub eax, 0x18beb1f8
je 0x1000289b
jmp 0x10001773
mov eax, dword [ebp - 0x9c]
sub eax, 0x1f36d37a
je 0x1000280e
jmp 0x10001789
mov eax, dword [ebp - 0x9c]
sub eax, 0x225022c3
je 0x10002a77
jmp 0x1000179f
mov eax, dword [ebp - 0x9c]
sub eax, 0x23eca96d
je 0x10002392
jmp 0x100017b5
mov eax, dword [ebp - 0x9c]
sub eax, 0x25b72876
je 0x10002825
jmp 0x100017cb
mov eax, dword [ebp - 0x9c]
sub eax, 0x263474e5
je 0x10001e76
jmp 0x100017e1
mov eax, dword [ebp - 0x9c]
sub eax, 0x2c696b9b
je 0x10001be3
jmp 0x100017f7
mov eax, dword [ebp - 0x9c]
sub eax, 0x307f62ea
je 0x10001a93
jmp 0x1000180d
mov eax, dword [ebp - 0x9c]
sub eax, 0x323d4c29
je 0x1000242a
jmp 0x10001823
mov eax, dword [ebp - 0x9c]
sub eax, 0x342ba7b8
je 0x100021fc
jmp 0x10001839
mov eax, dword [ebp - 0x9c]
sub eax, 0x358d5657
je 0x1000225c
jmp 0x1000184f
mov eax, dword [ebp - 0x9c]
sub eax, 0x36a1b937
je 0x10002383
jmp 0x10001865
mov eax, dword [ebp - 0x9c]
sub eax, 0x4381a2dc
je 0x10002939
jmp 0x1000187b
mov eax, dword [ebp - 0x9c]
sub eax, 0x47aac9ad
je 0x10001f91
jmp 0x10001891
mov eax, dword [ebp - 0x9c]
sub eax, 0x48e5ef5b
je 0x100025da
jmp 0x100018a7
mov eax, dword [ebp - 0x9c]
sub eax, 0x53166839
je 0x10001adc
jmp 0x100018bd
mov eax, dword [ebp - 0x9c]
sub eax, 0x56cff35d
je 0x100023e1
mov al, byte [ebp - 0x8e]
mov cl, byte [ebp - 0x8d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc59a8305
mov ecx, 0x224bb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
mov edx, eax
sub edx, 0xaff624d8
sub edx, 1
add edx, 0xaff624d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc59a8305
mov ecx, 0xeda80e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0x307f62ea
jmp 0x10002c75
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2ef7391
mov ecx, 0x53166839
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0x1a8068b6
sub edx, 1
sub edx, 0x1a8068b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa2ef7391
mov ecx, 0x14518ea8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0xd6706f0d
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0x9babb74e
sub edx, 1
sub edx, 0x9babb74e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc5cab812
mov ecx, 0x2c696b9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov ecx, dword [ebp - 0x98]
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c640
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc5cab812
mov ecx, 0x11743da4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dl, byte [ebp - 0x4d]
mov eax, 0x7af7352
mov ecx, 0x68cadf79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0x9652e797
jmp 0x10002c75
mov dword [ebp - 0x94], 0xd4beeaaa
jmp 0x10002c75
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x263474e5
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc976a73a
mov ecx, 0x595e2cf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dl, byte [ebp - 0x41]
mov eax, 0x47aac9ad
mov ecx, 0xe060f185
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0x9652e797
jmp 0x10002c75
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x94], 0x1370c18d
jmp 0x10002c75
mov eax, dword [ebp - 0x40]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov dword [ebp - 0x94], 0xdf6eaa7c
jmp 0x10002c75
mov dl, byte [ebp - 0x39]
mov eax, 0xeb5b1f72
mov ecx, 0x78e8958b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0xe8669e4e
sub edx, 1
sub edx, 0xe8669e4e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc8e394a1
mov ecx, 0x89ea21d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
mov edx, eax
sub edx, 0xf251366b
sub edx, 1
add edx, 0xf251366b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8e394a1
mov ecx, 0xaf4a830b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0x207ff57
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0xd968c4c1
sub edx, 1
sub edx, 0xd968c4c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb1766474
mov ecx, 0x1ff9b77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x38]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0xf9bb5633
sub edx, 1
sub edx, 0xf9bb5633
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb1766474
mov ecx, 0x342ba7b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0xf52638a2
jmp 0x10002c75
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
mov edx, eax
sub edx, 0x86294967
sub edx, 1
add edx, 0x86294967
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7672eae4
mov ecx, 0x358d5657
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7672eae4
mov ecx, 0x1341b3f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0x9652e797
jmp 0x10002c75
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
mov edx, eax
add edx, 0x206558df
sub edx, 1
sub edx, 0x206558df
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8740193f
mov ecx, 0x36a1b937
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0x23eca96d
jmp 0x10002c75
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x94], 0x56cff35d
jmp 0x10002c75
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd8f4539
mov ecx, 0x75383d76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0x2bac5e35
sub edx, 1
sub edx, 0x2bac5e35
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x704f9b66
mov ecx, 0xa0004c0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x704f9b66
mov ecx, 0x70a17d9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x28], eax
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a6c5d30
mov ecx, 0x7083a165
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov eax, 0x94c3b9c3
mov ecx, 0xf3c8937c
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, 0x57de856b
add eax, 0x18
sub eax, 0x57de856b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x94], 0x8233991b
jmp 0x10002c75
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0xba5d3f0b
add ecx, eax
sub ecx, 0xba5d3f0b
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x80dcf481
jmp 0x10002c75
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e9b0
add esp, 8
mov edx, eax
mov eax, 0xa52ec756
mov ecx, 0x25b72876
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c7a0
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x94], 0x56e513e0
jmp 0x10002c75
mov eax, dword [ebp - 0x54]
mov cl, byte [ebp - 0x15]
mov byte [eax], cl
mov dword [ebp - 0x94], 0x25b72876
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0x99c7b3ff
sub edx, 1
sub edx, 0x99c7b3ff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xebcdf9e6
mov ecx, 0x18beb1f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
mov edx, ecx
add edx, 0x5a48df3a
sub edx, 1
sub edx, 0x5a48df3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xebcdf9e6
mov ecx, 0x22f0292
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0xec808659
jmp 0x10002c75
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x94], 0x4381a2dc
jmp 0x10002c75
mov ax, word [ebp - 0x14]
sub ax, 0x7551
add ax, 1
add ax, 0x7551
mov word [ebp - 0x12], ax
mov dword [ebp - 0x94], 0xd990ed6e
jmp 0x10002c75
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x94], 0xfc6132d9
jmp 0x10002c75
mov eax, dword [0x1003b938]
mov ecx, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff07ad02
mov ecx, 0x1309d3ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1003b938]
mov eax, dword [0x1003b934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff07ad02
mov ecx, 0x91a82a7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002c75
mov dword [ebp - 0x94], 0xb7264605
jmp 0x10002c75
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x94], 0x225022c3
jmp 0x10002c75
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x9652e797
jmp 0x10002c75
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000ba40
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x94], 0x224bb8
jmp 0x10002c75
mov dword [ebp - 0x94], 0x53166839
jmp 0x10002c75
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c640
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x94], 0x2c696b9b
jmp 0x10002c75
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x94], 0x73d965f8
jmp 0x10002c75
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x595e2cf6
jmp 0x10002c75
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x89ea21d3
jmp 0x10002c75
mov eax, dword [ebp - 0x38]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x1ff9b77
jmp 0x10002c75
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], 0xa327de07
jmp 0x10002c75
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0xd0710bee
add ecx, eax
sub ecx, 0xd0710bee
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x94], 0x323d4c29
jmp 0x10002c75
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x94], 0x48e5ef5b
jmp 0x10002c75
mov dword [ebp - 0x94], 0x18beb1f8
jmp 0x10002c75
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x1309d3ed
jmp 0x10001337