Function at 0x100010a0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x10037600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
sub edx, 0x32af0adf
sub edx, 1
add edx, 0x32af0adf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0xa8], 0x817ba9f1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x817ba9f1
je 0x10001759
jmp 0x10001124
mov eax, dword [ebp - 0xb0]
sub eax, 0x84f90ceb
je 0x100021ac
jmp 0x1000113a
mov eax, dword [ebp - 0xb0]
sub eax, 0x89b6a16e
je 0x10002690
jmp 0x10001150
mov eax, dword [ebp - 0xb0]
sub eax, 0x905c74e2
je 0x1000269f
jmp 0x10001166
mov eax, dword [ebp - 0xb0]
sub eax, 0x95445fca
je 0x10002053
jmp 0x1000117c
mov eax, dword [ebp - 0xb0]
sub eax, 0x9589db1c
je 0x100020fe
jmp 0x10001192
mov eax, dword [ebp - 0xb0]
sub eax, 0x95df1540
je 0x100021fd
jmp 0x100011a8
mov eax, dword [ebp - 0xb0]
sub eax, 0x98fea686
je 0x100027c0
jmp 0x100011be
mov eax, dword [ebp - 0xb0]
sub eax, 0x9ef75702
je 0x10001ab0
jmp 0x100011d4
mov eax, dword [ebp - 0xb0]
sub eax, 0xa3e7d560
je 0x1000288e
jmp 0x100011ea
mov eax, dword [ebp - 0xb0]
sub eax, 0xa484a4d6
je 0x10002677
jmp 0x10001200
mov eax, dword [ebp - 0xb0]
sub eax, 0xaf9abd17
je 0x10001cbd
jmp 0x10001216
mov eax, dword [ebp - 0xb0]
sub eax, 0xb2ed2e1b
je 0x10001ec1
jmp 0x1000122c
mov eax, dword [ebp - 0xb0]
sub eax, 0xb7474cf3
je 0x10001da4
jmp 0x10001242
mov eax, dword [ebp - 0xb0]
sub eax, 0xb9cc0a37
je 0x1000231b
jmp 0x10001258
mov eax, dword [ebp - 0xb0]
sub eax, 0xc0236e2c
je 0x10001ed0
jmp 0x1000126e
mov eax, dword [ebp - 0xb0]
sub eax, 0xc5fc71bb
je 0x10001b9b
jmp 0x10001284
mov eax, dword [ebp - 0xb0]
sub eax, 0xc82cb036
je 0x10001992
jmp 0x1000129a
mov eax, dword [ebp - 0xb0]
sub eax, 0xca7c1161
je 0x10001dfa
jmp 0x100012b0
mov eax, dword [ebp - 0xb0]
sub eax, 0xcca822b2
je 0x100026b9
jmp 0x100012c6
mov eax, dword [ebp - 0xb0]
sub eax, 0xd25edbff
je 0x10002900
jmp 0x100012dc
mov eax, dword [ebp - 0xb0]
sub eax, 0xd9480086
je 0x10002912
jmp 0x100012f2
mov eax, dword [ebp - 0xb0]
sub eax, 0xe1028e26
je 0x10002364
jmp 0x10001308
mov eax, dword [ebp - 0xb0]
sub eax, 0xe569837c
je 0x10001dc2
jmp 0x1000131e
mov eax, dword [ebp - 0xb0]
sub eax, 0xeaae24dd
je 0x100027cf
jmp 0x10001334
mov eax, dword [ebp - 0xb0]
sub eax, 0xebef3289
je 0x100028a3
jmp 0x1000134a
mov eax, dword [ebp - 0xb0]
sub eax, 0xf0607a65
je 0x10002765
jmp 0x10001360
mov eax, dword [ebp - 0xb0]
sub eax, 0xf4c85e49
je 0x10002714
jmp 0x10001376
mov eax, dword [ebp - 0xb0]
sub eax, 0xf7808778
je 0x1000191c
jmp 0x1000138c
mov eax, dword [ebp - 0xb0]
sub eax, 0xf7d0421c
je 0x100028d2
jmp 0x100013a2
mov eax, dword [ebp - 0xb0]
sub eax, 0xfcd49e6e
je 0x10001beb
jmp 0x100013b8
mov eax, dword [ebp - 0xb0]
sub eax, 0xf6566a
je 0x10001b6e
jmp 0x100013ce
mov eax, dword [ebp - 0xb0]
sub eax, 0x1426df8
je 0x100028bd
jmp 0x100013e4
mov eax, dword [ebp - 0xb0]
sub eax, 0x143e9d3
je 0x10001b10
jmp 0x100013fa
mov eax, dword [ebp - 0xb0]
sub eax, 0x4ebdb48
je 0x10002516
jmp 0x10001410
mov eax, dword [ebp - 0xb0]
sub eax, 0xcb460fe
je 0x10001b8c
jmp 0x10001426
mov eax, dword [ebp - 0xb0]
sub eax, 0x1026453b
je 0x1000217d
jmp 0x1000143c
mov eax, dword [ebp - 0xb0]
sub eax, 0x11f20298
je 0x1000245d
jmp 0x10001452
mov eax, dword [ebp - 0xb0]
sub eax, 0x12a6b054
je 0x10001849
jmp 0x10001468
mov eax, dword [ebp - 0xb0]
sub eax, 0x12a9a173
je 0x10001fd5
jmp 0x1000147e
mov eax, dword [ebp - 0xb0]
sub eax, 0x1acb1fad
je 0x10001788
jmp 0x10001494
mov eax, dword [ebp - 0xb0]
sub eax, 0x1d2768ef
je 0x10001ccc
jmp 0x100014aa
mov eax, dword [ebp - 0xb0]
sub eax, 0x1eb423c4
je 0x100028e1
jmp 0x100014c0
mov eax, dword [ebp - 0xb0]
sub eax, 0x2223ab09
je 0x10001ddc
jmp 0x100014d6
mov eax, dword [ebp - 0xb0]
sub eax, 0x25b97462
je 0x10002288
jmp 0x100014ec
mov eax, dword [ebp - 0xb0]
sub eax, 0x281a83fc
je 0x1000183a
jmp 0x10001502
mov eax, dword [ebp - 0xb0]
sub eax, 0x285df0b9
je 0x1000299c
jmp 0x10001518
mov eax, dword [ebp - 0xb0]
sub eax, 0x29ec16fb
je 0x10002927
jmp 0x1000152e
mov eax, dword [ebp - 0xb0]
sub eax, 0x2a5be989
je 0x10002088
jmp 0x10001544
mov eax, dword [ebp - 0xb0]
sub eax, 0x2f5bcf09
je 0x100018f3
jmp 0x1000155a
mov eax, dword [ebp - 0xb0]
sub eax, 0x3357bb8e
je 0x10001abf
jmp 0x10001570
mov eax, dword [ebp - 0xb0]
sub eax, 0x367d8e33
je 0x1000256e
jmp 0x10001586
mov eax, dword [ebp - 0xb0]
sub eax, 0x3766d231
je 0x10001c3c
jmp 0x1000159c
mov eax, dword [ebp - 0xb0]
sub eax, 0x38b355f2
je 0x100027ae
jmp 0x100015b2
mov eax, dword [ebp - 0xb0]
sub eax, 0x3c9ca989
je 0x10002646
jmp 0x100015c8
mov eax, dword [ebp - 0xb0]
sub eax, 0x3cf97908
je 0x100022c7
jmp 0x100015de
mov eax, dword [ebp - 0xb0]
sub eax, 0x3d778dc1
je 0x10001e70
jmp 0x100015f4
mov eax, dword [ebp - 0xb0]
sub eax, 0x43613115
je 0x10001f5f
jmp 0x1000160a
mov eax, dword [ebp - 0xb0]
sub eax, 0x447f2da9
je 0x100026e2
jmp 0x10001620
mov eax, dword [ebp - 0xb0]
sub eax, 0x45000307
je 0x1000187e
jmp 0x10001636
mov eax, dword [ebp - 0xb0]
sub eax, 0x47d49562
je 0x10002062
jmp 0x1000164c
mov eax, dword [ebp - 0xb0]
sub eax, 0x4b0592ee
je 0x1000294b
jmp 0x10001662
mov eax, dword [ebp - 0xb0]
sub eax, 0x4bfcad47
je 0x100023ef
jmp 0x10001678
mov eax, dword [ebp - 0xb0]
sub eax, 0x4d182686
je 0x10002655
jmp 0x1000168e
mov eax, dword [ebp - 0xb0]
sub eax, 0x51174d7c
je 0x10002a23
mov al, byte [ebp - 0xa2]
mov cl, byte [ebp - 0xa1]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98fea686
mov ecx, 0x1acb1fad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
add edx, 0x24723545
sub edx, 1
sub edx, 0x24723545
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98fea686
mov ecx, 0x281a83fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x12a6b054
jmp 0x10002a2d
mov ecx, dword [ebp - 0xac]
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x45000307
jmp 0x10002a2d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10009e70
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov edx, dword [ebp - 0x94]
mov eax, 0x2f5bcf09
mov ecx, 0x6c1ed171
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0xf4c85e49
jmp 0x10002a2d
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
sub edx, 0xb3fc7216
sub edx, 1
add edx, 0xb3fc7216
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeaae24dd
mov ecx, 0xc82cb036
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeaae24dd
mov ecx, 0x9ef75702
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x3357bb8e
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
add edx, 0x8606526f
sub edx, 1
sub edx, 0x8606526f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3e7d560
mov ecx, 0x143e9d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x88]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x5d], al
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3e7d560
mov ecx, 0xf6566a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dl, byte [ebp - 0x5d]
mov eax, 0xc5fc71bb
mov ecx, 0xcb460fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0xf4c85e49
jmp 0x10002a2d
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xa8], 0xfcd49e6e
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
add edx, 0x6760dbb7
sub edx, 1
sub edx, 0x6760dbb7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xebef3289
mov ecx, 0x3766d231
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
sub edx, 0x5573b7cc
sub edx, 1
add edx, 0x5573b7cc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xebef3289
mov ecx, 0xaf9abd17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x1d2768ef
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
sub edx, 0x5ebccbe0
sub edx, 1
add edx, 0x5ebccbe0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1426df8
mov ecx, 0x732289d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dl, byte [ebp - 0x55]
mov eax, 0xe569837c
mov ecx, 0xc0236e2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa8], 0x2223ab09
jmp 0x10002a2d
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0xca7c1161
jmp 0x10002a2d
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
add edx, 0xd05109c1
sub edx, 1
sub edx, 0xd05109c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf7d0421c
mov ecx, 0x3d778dc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
add edx, 0x70ca28b7
sub edx, 1
sub edx, 0x70ca28b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf7d0421c
mov ecx, 0xb2ed2e1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0xf4c85e49
jmp 0x10002a2d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa8], 0x6b4cae75
jmp 0x10002a2d
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
add edx, 0x3db30079
sub edx, 1
sub edx, 0x3db30079
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1eb423c4
mov ecx, 0x12a9a173
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1eb423c4
mov ecx, 0x95445fca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x47d49562
jmp 0x10002a2d
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xa8], 0x2a5be989
jmp 0x10002a2d
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
sub edx, 0xff0575da
sub edx, 1
add edx, 0xff0575da
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd25edbff
mov ecx, 0x9589db1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x44]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
mov edx, ecx
sub edx, 0xfbcb4a9
sub edx, 1
add edx, 0xfbcb4a9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd25edbff
mov ecx, 0x1026453b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x5aa2cc4f
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
sub edx, 0x79973b99
sub edx, 1
add edx, 0x79973b99
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9480086
mov ecx, 0x95df1540
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x38], eax
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd9480086
mov ecx, 0x25b97462
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x759acafb
jmp 0x10002a2d
mov eax, dword [ebp - 0x30]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x34]
add ecx, 0xe31c07f9
add ecx, eax
sub ecx, 0xe31c07f9
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100151a0
call fcn.1000c160
add esp, 8
mov edx, eax
mov eax, 0xb9cc0a37
mov ecx, 0x3c9ca989
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29ec16fb
mov ecx, 0xe1028e26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0xe5671f55
add eax, ecx
sub eax, 0xe5671f55
mov dword [ebp - 0x28], eax
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29ec16fb
mov ecx, 0x62e2c082
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov ecx, dword [0x1003899c]
mov eax, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4b0592ee
mov ecx, 0x11f20298
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x9842d416
add eax, ecx
add eax, 0x9842d416
mov dword [ebp - 0x20], eax
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
add edx, 0x8f841dd7
sub edx, 1
sub edx, 0x8f841dd7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b0592ee
mov ecx, 0x4ebdb48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x6b4a8f18
jmp 0x10002a2d
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10009fd0
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
add edx, 0x3940c10b
sub edx, 1
sub edx, 0x3940c10b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x285df0b9
mov ecx, 0x6d655dd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x4d182686
jmp 0x10002a2d
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x1a], ax
mov dword [ebp - 0xa8], 0xa484a4d6
jmp 0x10002a2d
mov eax, dword [ebp - 0x74]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov dword [ebp - 0xa8], 0x89b6a16e
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x47d49562
jmp 0x10002a2d
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa8], 0xcca822b2
jmp 0x10002a2d
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa8], 0x447f2da9
jmp 0x10002a2d
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0xf4c85e49
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
mov edx, eax
sub edx, 0x1794f61e
sub edx, 1
add edx, 0x1794f61e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x51174d7c
mov ecx, 0xf0607a65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov eax, dword [0x1003899c]
mov ecx, dword [0x10038998]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x51174d7c
mov ecx, 0x38b355f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10002a2d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100090f0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa8], 0x1acb1fad
jmp 0x10002a2d
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0xc82cb036
jmp 0x10002a2d
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xa8], 0x143e9d3
jmp 0x10002a2d
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x3766d231
jmp 0x10002a2d
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa8], 0x732289d3
jmp 0x10002a2d
mov dword [ebp - 0xa8], 0x3d778dc1
jmp 0x10002a2d
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov dword [ebp - 0xa8], 0x12a9a173
jmp 0x10002a2d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa8], 0x9589db1c
jmp 0x10002a2d
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xa8], 0x95df1540
jmp 0x10002a2d
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa8], 0xe1028e26
jmp 0x10002a2d
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa8], 0x11f20298
jmp 0x10002a2d
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10009fd0
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov dword [ebp - 0xa8], 0x367d8e33
jmp 0x10002a2d
jmp 0x10001108