Function at 0x10001170
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x188
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18c], eax
mov eax, dword [0x10071c00]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x188], 0x14b544b
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
sub eax, 0x826e3a43
je 0x1000180b
jmp 0x100011b4
mov eax, dword [ebp - 0x190]
sub eax, 0x82c9b39d
je 0x10002258
jmp 0x100011ca
mov eax, dword [ebp - 0x190]
sub eax, 0x83abf402
je 0x10002522
jmp 0x100011e0
mov eax, dword [ebp - 0x190]
sub eax, 0x87c4fbc4
je 0x10001b11
jmp 0x100011f6
mov eax, dword [ebp - 0x190]
sub eax, 0x89e10aa7
je 0x10002207
jmp 0x1000120c
mov eax, dword [ebp - 0x190]
sub eax, 0x8cf26ec6
je 0x10001d10
jmp 0x10001222
mov eax, dword [ebp - 0x190]
sub eax, 0x8deffc2f
je 0x1000230f
jmp 0x10001238
mov eax, dword [ebp - 0x190]
sub eax, 0x8e5622c6
je 0x10001ae1
jmp 0x1000124e
mov eax, dword [ebp - 0x190]
sub eax, 0x9d9f7951
je 0x100019bf
jmp 0x10001264
mov eax, dword [ebp - 0x190]
sub eax, 0x9e7e94ec
je 0x10002605
jmp 0x1000127a
mov eax, dword [ebp - 0x190]
sub eax, 0x9f7d5df8
je 0x10001c0e
jmp 0x10001290
mov eax, dword [ebp - 0x190]
sub eax, 0xab0b30fd
je 0x10001ba0
jmp 0x100012a6
mov eax, dword [ebp - 0x190]
sub eax, 0xaf738e1d
je 0x10002106
jmp 0x100012bc
mov eax, dword [ebp - 0x190]
sub eax, 0xb0a34240
je 0x100021f8
jmp 0x100012d2
mov eax, dword [ebp - 0x190]
sub eax, 0xb4f56948
je 0x10001dcc
jmp 0x100012e8
mov eax, dword [ebp - 0x190]
sub eax, 0xb57a75eb
je 0x10001ac4
jmp 0x100012fe
mov eax, dword [ebp - 0x190]
sub eax, 0xbb22aa23
je 0x10001ca5
jmp 0x10001314
mov eax, dword [ebp - 0x190]
sub eax, 0xbcc62ed3
je 0x10001851
jmp 0x1000132a
mov eax, dword [ebp - 0x190]
sub eax, 0xc2179103
je 0x100025d0
jmp 0x10001340
mov eax, dword [ebp - 0x190]
sub eax, 0xd1245624
je 0x10001c87
jmp 0x10001356
mov eax, dword [ebp - 0x190]
sub eax, 0xd4279e99
je 0x10002385
jmp 0x1000136c
mov eax, dword [ebp - 0x190]
sub eax, 0xd67936f0
je 0x100019eb
jmp 0x10001382
mov eax, dword [ebp - 0x190]
sub eax, 0xdd270d7f
je 0x10002405
jmp 0x10001398
mov eax, dword [ebp - 0x190]
sub eax, 0xdfae27bc
je 0x100020f7
jmp 0x100013ae
mov eax, dword [ebp - 0x190]
sub eax, 0xe8cee509
je 0x10001d97
jmp 0x100013c4
mov eax, dword [ebp - 0x190]
sub eax, 0xf17af44f
je 0x10002097
jmp 0x100013da
mov eax, dword [ebp - 0x190]
sub eax, 0xf2c84ae9
je 0x10001cc7
jmp 0x100013f0
mov eax, dword [ebp - 0x190]
sub eax, 0xf70df530
je 0x100020d8
jmp 0x10001406
mov eax, dword [ebp - 0x190]
sub eax, 0xf7feaa62
je 0x100016ff
jmp 0x1000141c
mov eax, dword [ebp - 0x190]
sub eax, 0xfb8dcbf7
je 0x10002414
jmp 0x10001432
mov eax, dword [ebp - 0x190]
sub eax, 0x14b544b
je 0x10001689
jmp 0x10001448
mov eax, dword [ebp - 0x190]
sub eax, 0x35db60e
je 0x10002300
jmp 0x1000145e
mov eax, dword [ebp - 0x190]
sub eax, 0x7c9ce7b
je 0x10001c78
jmp 0x10001474
mov eax, dword [ebp - 0x190]
sub eax, 0x9107d88
je 0x10001d76
jmp 0x1000148a
mov eax, dword [ebp - 0x190]
sub eax, 0x9c74275
je 0x10001842
jmp 0x100014a0
mov eax, dword [ebp - 0x190]
sub eax, 0xb162776
je 0x100019ce
jmp 0x100014b6
mov eax, dword [ebp - 0x190]
sub eax, 0xc472875
je 0x10002088
jmp 0x100014cc
mov eax, dword [ebp - 0x190]
sub eax, 0xf1a2d61
je 0x10001a72
jmp 0x100014e2
mov eax, dword [ebp - 0x190]
sub eax, 0x111a4532
je 0x10001f18
jmp 0x100014f8
mov eax, dword [ebp - 0x190]
sub eax, 0x12496eb7
je 0x10001fa6
jmp 0x1000150e
mov eax, dword [ebp - 0x190]
sub eax, 0x22819784
je 0x10001b6e
jmp 0x10001524
mov eax, dword [ebp - 0x190]
sub eax, 0x250f3e5d
je 0x1000254a
jmp 0x1000153a
mov eax, dword [ebp - 0x190]
sub eax, 0x33297f0b
je 0x10002425
jmp 0x10001550
mov eax, dword [ebp - 0x190]
sub eax, 0x561db652
je 0x10001f39
jmp 0x10001566
mov eax, dword [ebp - 0x190]
sub eax, 0x56ac5a5e
je 0x10001a1f
jmp 0x1000157c
mov eax, dword [ebp - 0x190]
sub eax, 0x60603eeb
je 0x100025bb
jmp 0x10001592
mov eax, dword [ebp - 0x190]
sub eax, 0x622432e9
je 0x10002472
jmp 0x100015a8
mov eax, dword [ebp - 0x190]
sub eax, 0x62954ef4
je 0x100020a6
jmp 0x100015be
mov eax, dword [ebp - 0x190]
sub eax, 0x690738fa
je 0x100018a2
jmp 0x100015d4
mov eax, dword [ebp - 0x190]
sub eax, 0x69e48049
je 0x100017fc
jmp 0x100015ea
mov eax, dword [ebp - 0x190]
sub eax, 0x6b377e2b
je 0x10001aa3
jmp 0x10001600
mov eax, dword [ebp - 0x190]
sub eax, 0x6d086202
je 0x10002566
jmp 0x10001616
mov eax, dword [ebp - 0x190]
sub eax, 0x740034a5
je 0x10002174
jmp 0x1000162c
mov eax, dword [ebp - 0x190]
sub eax, 0x76dddabe
je 0x10001a10
jmp 0x10001642
mov eax, dword [ebp - 0x190]
sub eax, 0x79592b72
je 0x10001b02
jmp 0x10001658
mov eax, dword [ebp - 0x190]
sub eax, 0x7ba065d7
je 0x10001dfd
jmp 0x1000166e
mov eax, dword [ebp - 0x190]
sub eax, 0x7f904630
je 0x10001e4e
jmp 0x10001684
jmp 0x10002621
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
mov edx, ecx
add edx, 0x9e92bb40
sub edx, 1
sub edx, 0x9e92bb40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x33297f0b
mov ecx, 0xf7feaa62
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x160], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x15c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x158], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x178], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000ba30
add esp, 0xc
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x33297f0b
mov ecx, 0x69e48049
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0x826e3a43
jmp 0x10002621
mov eax, dword [ebp - 0x178]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x180], eax
mov eax, 0x9c74275
mov ecx, 0xbcc62ed3
cmp dword [ebp - 0x180], 0
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0xfb8dcbf7
jmp 0x10002621
mov eax, dword [0x10072f40]
mov ecx, dword [0x10072f3c]
mov edx, eax
sub edx, 0x7dfdfc8f
sub edx, 1
add edx, 0x7dfdfc8f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x622432e9
mov ecx, 0x690738fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x180]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
mov edx, ecx
sub edx, 0x61d5fa37
sub edx, 1
add edx, 0x61d5fa37
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x622432e9
mov ecx, 0x9d9f7951
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0xb162776
jmp 0x10002621
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0xd67936f0
jmp 0x10002621
mov edx, dword [ebp - 0x174]
mov esi, 0xffffffff
mov eax, 0x56ac5a5e
mov ecx, 0x76dddabe
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0xfb8dcbf7
jmp 0x10002621
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x188], 0xf1a2d61
jmp 0x10002621
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x145], al
mov dword [ebp - 0x188], 0x6b377e2b
jmp 0x10002621
mov dl, byte [ebp - 0x145]
mov eax, 0xb57a75eb
mov ecx, 0x87c4fbc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x188], 0x8e5622c6
jmp 0x10002621
mov eax, dword [ebp - 0x144]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x188], 0x79592b72
jmp 0x10002621
mov dword [ebp - 0x188], 0xfb8dcbf7
jmp 0x10002621
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x22819784
jmp 0x10002621
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x168]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
add eax, 0xbc73219e
add eax, ecx
sub eax, 0xbc73219e
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x188], 0xab0b30fd
jmp 0x10002621
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x83abf402
mov ecx, 0x9f7d5df8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov ecx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov word [eax], 0
mov eax, dword [0x10072f40]
mov ecx, dword [0x10072f3c]
mov edx, eax
sub edx, 0x509c0204
sub edx, 1
add edx, 0x509c0204
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83abf402
mov ecx, 0x7c9ce7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0xd1245624
jmp 0x10002621
mov eax, dword [ebp - 0x160]
movzx eax, word [eax]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x188], 0xbb22aa23
jmp 0x10002621
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x138], ax
mov dword [ebp - 0x188], 0xf2c84ae9
jmp 0x10002621
mov eax, dword [0x10072f40]
mov ecx, dword [0x10072f3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x250f3e5d
mov ecx, 0x8cf26ec6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov ax, word [ebp - 0x138]
movzx ecx, ax
mov eax, dword [ebp - 0x13c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x135], al
mov eax, dword [0x10072f40]
mov ecx, dword [0x10072f3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x250f3e5d
mov ecx, 0x9107d88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dl, byte [ebp - 0x135]
mov eax, 0xaf738e1d
mov ecx, 0xe8cee509
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x188], 0xb4f56948
jmp 0x10002621
mov eax, dword [ebp - 0x130]
movzx ecx, word [eax + 0x10]
mov eax, dword [ebp - 0x134]
sub eax, 0x6e53fb8
add eax, ecx
add eax, 0x6e53fb8
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x188], 0x7ba065d7
jmp 0x10002621
mov eax, dword [0x10072f40]
mov ecx, dword [0x10072f3c]
mov edx, eax
sub edx, 0x1350e143
sub edx, 1
add edx, 0x1350e143
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d086202
mov ecx, 0x7f904630
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x160]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x3c8d4b45
add ecx, eax
add ecx, 0x3c8d4b45
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000dda0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x128], al
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
mov edx, ecx
add edx, 0x293a0368
sub edx, 1
sub edx, 0x293a0368
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6d086202
mov ecx, 0x111a4532
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dl, byte [ebp - 0x128]
mov eax, 0x561db652
mov ecx, 0xf17af44f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x158]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x127], al
mov dword [ebp - 0x188], 0x12496eb7
jmp 0x10002621
mov cl, byte [ebp - 0x127]
and cl, 1
mov eax, dword [ebp - 0x154]
mov byte [eax], cl
mov edx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x21d03cab
add edx, eax
add edx, 0x21d03cab
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x9ffc3072
add ecx, eax
add ecx, 0x9ffc3072
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000bb90
add esp, 0xc
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x184]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x5fa535bf
add esi, eax
add esi, 0x5fa535bf
mov eax, dword [ebp - 0x158]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x154]
mov byte [eax], cl
mov dword [ebp - 0x188], 0xc472875
jmp 0x10002621
mov dword [ebp - 0x188], 0xf17af44f
jmp 0x10002621
mov dword [ebp - 0x188], 0x62954ef4
jmp 0x10002621
mov eax, dword [ebp - 0x160]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x126], ax
mov dword [ebp - 0x188], 0xf70df530
jmp 0x10002621
mov eax, dword [ebp - 0x160]
mov cx, word [ebp - 0x126]
mov word [eax], cx
mov dword [ebp - 0x188], 0xdfae27bc
jmp 0x10002621
mov dword [ebp - 0x188], 0xd1245624
jmp 0x10002621
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x60603eeb
mov ecx, 0x740034a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
mov edx, ecx
add edx, 0x898610d6
sub edx, 1
sub edx, 0x898610d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x60603eeb
mov ecx, 0xb0a34240
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0x89e10aa7
jmp 0x10002621
mov eax, dword [0x10072f40]
mov ecx, dword [0x10072f3c]
mov edx, eax
sub edx, 0xeca438ef
sub edx, 1
add edx, 0xeca438ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2179103
mov ecx, 0x82c9b39d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
mov edx, ecx
sub edx, 0x9239505d
sub edx, 1
add edx, 0x9239505d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc2179103
mov ecx, 0x35db60e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0x8deffc2f
jmp 0x10002621
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
mov edx, ecx
sub edx, 0xdc06ad68
sub edx, 1
add edx, 0xdc06ad68
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e7e94ec
mov ecx, 0xd4279e99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10072f40]
mov eax, dword [0x10072f3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e7e94ec
mov ecx, 0xdd270d7f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10002621
mov dword [ebp - 0x188], 0xfb8dcbf7
jmp 0x10002621
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000ae30
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x178], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000ba30
add esp, 0xc
mov dword [ebp - 0x188], 0xf7feaa62
jmp 0x10002621
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x180]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x188], 0x690738fa
jmp 0x10002621
mov ecx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov word [eax], 0
mov dword [ebp - 0x188], 0x9f7d5df8
jmp 0x10002621
mov ax, word [ebp - 0x138]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x188], 0x8cf26ec6
jmp 0x10002621
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x160]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000dda0
add esp, 8
mov dword [ebp - 0x188], 0x7f904630
jmp 0x10002621
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x188], 0x740034a5
jmp 0x10002621
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x188], 0x82c9b39d
jmp 0x10002621
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x188], 0xd4279e99
jmp 0x10001198