Function at 0x100011d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x94], eax
mov eax, dword [0x1006a200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x90], 0xd9ddae7a
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x98], eax
sub eax, 0x8300f6ac
je 0x10002428
jmp 0x10001214
mov eax, dword [ebp - 0x98]
sub eax, 0x8603f173
je 0x10001d0c
jmp 0x1000122a
mov eax, dword [ebp - 0x98]
sub eax, 0x899aae74
je 0x10002656
jmp 0x10001240
mov eax, dword [ebp - 0x98]
sub eax, 0x89c05964
je 0x10001f0a
jmp 0x10001256
mov eax, dword [ebp - 0x98]
sub eax, 0x8b4ba5cc
je 0x10001ea2
jmp 0x1000126c
mov eax, dword [ebp - 0x98]
sub eax, 0x8ea1fa8c
je 0x100019be
jmp 0x10001282
mov eax, dword [ebp - 0x98]
sub eax, 0x8f4d0e53
je 0x10001fba
jmp 0x10001298
mov eax, dword [ebp - 0x98]
sub eax, 0x90c048e2
je 0x10001c59
jmp 0x100012ae
mov eax, dword [ebp - 0x98]
sub eax, 0x935ba3a4
je 0x10001a5e
jmp 0x100012c4
mov eax, dword [ebp - 0x98]
sub eax, 0x9804f221
je 0x100025fa
jmp 0x100012da
mov eax, dword [ebp - 0x98]
sub eax, 0x9e807d91
je 0x10002633
jmp 0x100012f0
mov eax, dword [ebp - 0x98]
sub eax, 0xa091f76c
je 0x10001cfd
jmp 0x10001306
mov eax, dword [ebp - 0x98]
sub eax, 0xa159a1af
je 0x10001e09
jmp 0x1000131c
mov eax, dword [ebp - 0x98]
sub eax, 0xa2f2823b
je 0x100020d6
jmp 0x10001332
mov eax, dword [ebp - 0x98]
sub eax, 0xa7a827b4
je 0x10001f30
jmp 0x10001348
mov eax, dword [ebp - 0x98]
sub eax, 0xaa3e2db5
je 0x10002091
jmp 0x1000135e
mov eax, dword [ebp - 0x98]
sub eax, 0xb074617f
je 0x100019e8
jmp 0x10001374
mov eax, dword [ebp - 0x98]
sub eax, 0xb49998c5
je 0x100018b2
jmp 0x1000138a
mov eax, dword [ebp - 0x98]
sub eax, 0xb6cf474a
je 0x10001beb
jmp 0x100013a0
mov eax, dword [ebp - 0x98]
sub eax, 0xb980011b
je 0x1000193c
jmp 0x100013b6
mov eax, dword [ebp - 0x98]
sub eax, 0xbe5dbd10
je 0x10002541
jmp 0x100013cc
mov eax, dword [ebp - 0x98]
sub eax, 0xc81e1db3
je 0x100022e1
jmp 0x100013e2
mov eax, dword [ebp - 0x98]
sub eax, 0xc8893afe
je 0x10001852
jmp 0x100013f8
mov eax, dword [ebp - 0x98]
sub eax, 0xd8122795
je 0x1000194b
jmp 0x1000140e
mov eax, dword [ebp - 0x98]
sub eax, 0xd9ddae7a
je 0x1000176d
jmp 0x10001424
mov eax, dword [ebp - 0x98]
sub eax, 0xdc170be0
je 0x10001dfa
jmp 0x1000143a
mov eax, dword [ebp - 0x98]
sub eax, 0xe52e0b48
je 0x100020a0
jmp 0x10001450
mov eax, dword [ebp - 0x98]
sub eax, 0xe6564964
je 0x10001cc8
jmp 0x10001466
mov eax, dword [ebp - 0x98]
sub eax, 0xe879b8d8
je 0x10002309
jmp 0x1000147c
mov eax, dword [ebp - 0x98]
sub eax, 0xea0da1cf
je 0x10002437
jmp 0x10001492
mov eax, dword [ebp - 0x98]
sub eax, 0xf1ecc5c7
je 0x10001861
jmp 0x100014a8
mov eax, dword [ebp - 0x98]
sub eax, 0xf60aaf72
je 0x10002284
jmp 0x100014be
mov eax, dword [ebp - 0x98]
sub eax, 0xf755f1d2
je 0x10001f68
jmp 0x100014d4
mov eax, dword [ebp - 0x98]
sub eax, 0xff71f274
je 0x10001834
jmp 0x100014ea
mov eax, dword [ebp - 0x98]
sub eax, 0xff869b79
je 0x10001efb
jmp 0x10001500
mov eax, dword [ebp - 0x98]
sub eax, 0x7310375
je 0x10002532
jmp 0x10001516
mov eax, dword [ebp - 0x98]
sub eax, 0x111f08ef
je 0x10001caa
jmp 0x1000152c
mov eax, dword [ebp - 0x98]
sub eax, 0x15600cf8
je 0x10002488
jmp 0x10001542
mov eax, dword [ebp - 0x98]
sub eax, 0x16289319
je 0x10001d5d
jmp 0x10001558
mov eax, dword [ebp - 0x98]
sub eax, 0x17696b05
je 0x10002619
jmp 0x1000156e
mov eax, dword [ebp - 0x98]
sub eax, 0x1a7f0bd0
je 0x10001cdf
jmp 0x10001584
mov eax, dword [ebp - 0x98]
sub eax, 0x1bfa0a87
je 0x10002686
jmp 0x1000159a
mov eax, dword [ebp - 0x98]
sub eax, 0x1ccafe37
je 0x100023b6
jmp 0x100015b0
mov eax, dword [ebp - 0x98]
sub eax, 0x25d003da
je 0x10002030
jmp 0x100015c6
mov eax, dword [ebp - 0x98]
sub eax, 0x271b0e63
je 0x100025a4
jmp 0x100015dc
mov eax, dword [ebp - 0x98]
sub eax, 0x2779f162
je 0x1000220b
jmp 0x100015f2
mov eax, dword [ebp - 0x98]
sub eax, 0x27de92a1
je 0x10002595
jmp 0x10001608
mov eax, dword [ebp - 0x98]
sub eax, 0x28f72320
je 0x10002233
jmp 0x1000161e
mov eax, dword [ebp - 0x98]
sub eax, 0x29949d4f
je 0x10001f48
jmp 0x10001634
mov eax, dword [ebp - 0x98]
sub eax, 0x35db55a5
je 0x10001adb
jmp 0x1000164a
mov eax, dword [ebp - 0x98]
sub eax, 0x38f2c728
je 0x100024d9
jmp 0x10001660
mov eax, dword [ebp - 0x98]
sub eax, 0x3bf8757b
je 0x10002163
jmp 0x10001676
mov eax, dword [ebp - 0x98]
sub eax, 0x3ed91203
je 0x10002329
jmp 0x1000168c
mov eax, dword [ebp - 0x98]
sub eax, 0x407cdac4
je 0x10001bbf
jmp 0x100016a2
mov eax, dword [ebp - 0x98]
sub eax, 0x408074e5
je 0x100022f0
jmp 0x100016b8
mov eax, dword [ebp - 0x98]
sub eax, 0x41e8f9e2
je 0x100024ea
jmp 0x100016ce
mov eax, dword [ebp - 0x98]
sub eax, 0x57967a9b
je 0x10002146
jmp 0x100016e4
mov eax, dword [ebp - 0x98]
sub eax, 0x5f9d49be
je 0x10001acc
jmp 0x100016fa
mov eax, dword [ebp - 0x98]
sub eax, 0x6085e1ca
je 0x1000221a
jmp 0x10001710
mov eax, dword [ebp - 0x98]
sub eax, 0x60ddcbdb
je 0x10001bce
jmp 0x10001726
mov eax, dword [ebp - 0x98]
sub eax, 0x7672b319
je 0x10002340
jmp 0x1000173c
mov eax, dword [ebp - 0x98]
sub eax, 0x7a247f43
je 0x10001e34
jmp 0x10001752
mov eax, dword [ebp - 0x98]
sub eax, 0x7b1ea8d8
je 0x10001b24
jmp 0x10001768
jmp 0x10002690
mov eax, dword [ebp - 0x94]
push eax
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
sub esp, 0x104
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x58], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c980
add esp, 0xc
mov eax, dword [ebp - 0x88]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x90], 0xff71f274
jmp 0x10002690
mov edx, dword [ebp - 0x50]
mov eax, 0xc8893afe
mov ecx, 0xf1ecc5c7
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0xea0da1cf
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0xd73812d4
sub edx, 1
add edx, 0xd73812d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41e8f9e2
mov ecx, 0xb49998c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0x6aa53515
sub edx, 1
sub edx, 0x6aa53515
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41e8f9e2
mov ecx, 0xb980011b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0xd8122795
jmp 0x10002690
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x90], 0x8ea1fa8c
jmp 0x10002690
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x74]
mov esi, 0xffffffff
mov eax, 0x35db55a5
mov ecx, 0xb074617f
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
sub edx, 0x47d51f90
sub edx, 1
add edx, 0x47d51f90
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7310375
mov ecx, 0x935ba3a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7310375
mov ecx, 0x5f9d49be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0xea0da1cf
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe5dbd10
mov ecx, 0x7b1ea8d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0x98252fb4
sub edx, 1
add edx, 0x98252fb4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe5dbd10
mov ecx, 0x407cdac4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0x60ddcbdb
jmp 0x10002690
mov eax, dword [ebp - 0x48]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 0x90], 0xb6cf474a
jmp 0x10002690
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x27de92a1
mov ecx, 0x90c048e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0xab22990e
sub edx, 1
sub edx, 0xab22990e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27de92a1
mov ecx, 0x111f08ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dl, byte [ebp - 0x41]
mov eax, 0xe6564964
mov ecx, 0x8603f173
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x90], 0x1a7f0bd0
jmp 0x10002690
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0xa091f76c
jmp 0x10002690
mov dword [ebp - 0x90], 0xea0da1cf
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0x1aa177f8
sub edx, 1
sub edx, 0x1aa177f8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x271b0e63
mov ecx, 0x16289319
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0xaa481197
sub edx, 1
sub edx, 0xaa481197
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x271b0e63
mov ecx, 0xdc170be0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0xa159a1af
jmp 0x10002690
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x90], 0x7a247f43
jmp 0x10002690
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9804f221
mov ecx, 0x8b4ba5cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9804f221
mov ecx, 0xff869b79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0x89c05964
jmp 0x10002690
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x90], 0xa7a827b4
jmp 0x10002690
mov eax, dword [ebp - 0x30]
movzx eax, word [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x90], 0x29949d4f
jmp 0x10002690
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
mov eax, 0xe879b8d8
mov ecx, 0xf755f1d2
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, 0xb581843f
add eax, 0x18
sub eax, 0xb581843f
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x60]
movzx ecx, word [ecx]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x90], 0x8f4d0e53
jmp 0x10002690
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
add edx, 0x8e80791e
sub edx, 1
sub edx, 0x8e80791e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x17696b05
mov ecx, 0x25d003da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0xe5abaecd
sub edx, 1
add edx, 0xe5abaecd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17696b05
mov ecx, 0xaa3e2db5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0xe52e0b48
jmp 0x10002690
mov ecx, dword [ebp - 0x24]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ecf0
add esp, 8
mov edx, eax
mov eax, 0xa2f2823b
mov ecx, 0x2779f162
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x90], 0x57967a9b
jmp 0x10002690
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x90], 0x3bf8757b
jmp 0x10002690
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xf14108c6
add ecx, eax
add ecx, 0xf14108c6
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cae0
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x204b4e2f
add esi, eax
sub esi, 0x204b4e2f
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov dword [ebp - 0x90], 0x2779f162
jmp 0x10002690
mov dword [ebp - 0x90], 0x6085e1ca
jmp 0x10002690
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x90], 0x28f72320
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0xa936f973
sub edx, 1
sub edx, 0xa936f973
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e807d91
mov ecx, 0xf60aaf72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov ax, word [ebp - 0x14]
add ax, 0xb411
add ax, 1
sub ax, 0xb411
mov word [ebp - 0x12], ax
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e807d91
mov ecx, 0xc81e1db3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0x408074e5
jmp 0x10002690
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x90], 0x89c05964
jmp 0x10002690
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0x3ed91203
jmp 0x10002690
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x90], 0x7672b319
jmp 0x10002690
mov ecx, dword [0x1006b538]
mov eax, dword [0x1006b534]
mov edx, ecx
sub edx, 0x8882fbf7
sub edx, 1
add edx, 0x8882fbf7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x899aae74
mov ecx, 0x1ccafe37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
add edx, 0x2b1aea69
sub edx, 1
sub edx, 0x2b1aea69
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x899aae74
mov ecx, 0x8300f6ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov dword [ebp - 0x90], 0xea0da1cf
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0x749ebc0c
sub edx, 1
add edx, 0x749ebc0c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bfa0a87
mov ecx, 0x15600cf8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov eax, dword [0x1006b538]
mov ecx, dword [0x1006b534]
mov edx, eax
sub edx, 0x5368532c
sub edx, 1
add edx, 0x5368532c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bfa0a87
mov ecx, 0x38f2c728
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x90], eax
jmp 0x10002690
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bd80
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0x90], 0xb49998c5
jmp 0x10002690
mov dword [ebp - 0x90], 0x935ba3a4
jmp 0x10002690
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x90], 0x7b1ea8d8
jmp 0x10002690
mov dword [ebp - 0x90], 0x90c048e2
jmp 0x10002690
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x90], 0x16289319
jmp 0x10002690
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x90], 0x8b4ba5cc
jmp 0x10002690
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x90], 0x25d003da
jmp 0x10002690
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov ax, word [ebp - 0x14]
mov dword [ebp - 0x90], 0xf60aaf72
jmp 0x10002690
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], 0x1ccafe37
jmp 0x10002690
mov dword [ebp - 0x90], 0x15600cf8
jmp 0x100011f8