Function at 0x100011c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x78
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x1003a600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xf7621dcb
sub edx, 1
add edx, 0xf7621dcb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x72], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], 0x57826bb6
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x80], eax
sub eax, 0x81f6f14b
je 0x10001bb1
jmp 0x1000122e
mov eax, dword [ebp - 0x80]
sub eax, 0x858d85b4
je 0x10001f9c
jmp 0x10001241
mov eax, dword [ebp - 0x80]
sub eax, 0x8dbeee56
je 0x10002864
jmp 0x10001254
mov eax, dword [ebp - 0x80]
sub eax, 0x8e16e591
je 0x10002211
jmp 0x10001267
mov eax, dword [ebp - 0x80]
sub eax, 0x8ebe9bb4
je 0x10001963
jmp 0x1000127a
mov eax, dword [ebp - 0x80]
sub eax, 0x9563083d
je 0x10002017
jmp 0x1000128d
mov eax, dword [ebp - 0x80]
sub eax, 0x96b96968
je 0x1000208d
jmp 0x100012a0
mov eax, dword [ebp - 0x80]
sub eax, 0x98b5f6ed
je 0x100020f4
jmp 0x100012b3
mov eax, dword [ebp - 0x80]
sub eax, 0x9b534bb8
je 0x10001957
jmp 0x100012c6
mov eax, dword [ebp - 0x80]
sub eax, 0x9eee701e
je 0x10001ce5
jmp 0x100012d9
mov eax, dword [ebp - 0x80]
sub eax, 0xa10fd9c6
je 0x10002610
jmp 0x100012ec
mov eax, dword [ebp - 0x80]
sub eax, 0xa5386eff
je 0x10001ad8
jmp 0x100012ff
mov eax, dword [ebp - 0x80]
sub eax, 0xa7f71778
je 0x100025e7
jmp 0x10001312
mov eax, dword [ebp - 0x80]
sub eax, 0xa95a614f
je 0x10001e54
jmp 0x10001325
mov eax, dword [ebp - 0x80]
sub eax, 0xb4f004bd
je 0x10002836
jmp 0x10001338
mov eax, dword [ebp - 0x80]
sub eax, 0xc12ca5dd
je 0x1000270f
jmp 0x1000134b
mov eax, dword [ebp - 0x80]
sub eax, 0xc86c2f36
je 0x1000202f
jmp 0x1000135e
mov eax, dword [ebp - 0x80]
sub eax, 0xc8927867
je 0x10002079
jmp 0x10001371
mov eax, dword [ebp - 0x80]
sub eax, 0xc9d765ce
je 0x1000267b
jmp 0x10001384
mov eax, dword [ebp - 0x80]
sub eax, 0xc9d87acf
je 0x10001bbd
jmp 0x10001397
mov eax, dword [ebp - 0x80]
sub eax, 0xd01ea89a
je 0x10002327
jmp 0x100013aa
mov eax, dword [ebp - 0x80]
sub eax, 0xd3f536b5
je 0x100017b1
jmp 0x100013bd
mov eax, dword [ebp - 0x80]
sub eax, 0xd424bc4c
je 0x10001de9
jmp 0x100013d0
mov eax, dword [ebp - 0x80]
sub eax, 0xd4dfb5de
je 0x10001acc
jmp 0x100013e3
mov eax, dword [ebp - 0x80]
sub eax, 0xd9a293c4
je 0x10002379
jmp 0x100013f6
mov eax, dword [ebp - 0x80]
sub eax, 0xd9e6bac8
je 0x100019e6
jmp 0x10001409
mov eax, dword [ebp - 0x80]
sub eax, 0xeab124cf
je 0x10001f29
jmp 0x1000141c
mov eax, dword [ebp - 0x80]
sub eax, 0xf47dff55
je 0x10001ea9
jmp 0x1000142f
mov eax, dword [ebp - 0x80]
sub eax, 0xfdced6ec
je 0x10002727
jmp 0x10001442
mov eax, dword [ebp - 0x80]
sub eax, 0x232f1d7
je 0x10002058
jmp 0x10001455
mov eax, dword [ebp - 0x80]
sub eax, 0x9d26a94
je 0x1000271b
jmp 0x10001468
mov eax, dword [ebp - 0x80]
sub eax, 0xddf520a
je 0x100026e6
jmp 0x1000147b
mov eax, dword [ebp - 0x80]
sub eax, 0x164ff010
je 0x1000250c
jmp 0x1000148e
mov eax, dword [ebp - 0x80]
sub eax, 0x18fcf31f
je 0x10001822
jmp 0x100014a1
mov eax, dword [ebp - 0x80]
sub eax, 0x1acd4d67
je 0x1000236d
jmp 0x100014b4
mov eax, dword [ebp - 0x80]
sub eax, 0x1bcbc697
je 0x10001ec1
jmp 0x100014c7
mov eax, dword [ebp - 0x80]
sub eax, 0x21aae8fe
je 0x100023e4
jmp 0x100014da
mov eax, dword [ebp - 0x80]
sub eax, 0x23f29a72
je 0x1000280e
jmp 0x100014ed
mov eax, dword [ebp - 0x80]
sub eax, 0x25cc8ca0
je 0x10001c28
jmp 0x10001500
mov eax, dword [ebp - 0x80]
sub eax, 0x27fa9234
je 0x1000248e
jmp 0x10001513
mov eax, dword [ebp - 0x80]
sub eax, 0x287b0110
je 0x1000277d
jmp 0x10001526
mov eax, dword [ebp - 0x80]
sub eax, 0x2b0c4392
je 0x1000210f
jmp 0x10001539
mov eax, dword [ebp - 0x80]
sub eax, 0x2d9300b8
je 0x100027ff
jmp 0x1000154c
mov eax, dword [ebp - 0x80]
sub eax, 0x2dd7366f
je 0x10002577
jmp 0x1000155f
mov eax, dword [ebp - 0x80]
sub eax, 0x34b22b39
je 0x10002023
jmp 0x10001572
mov eax, dword [ebp - 0x80]
sub eax, 0x376bd0d5
je 0x10001d87
jmp 0x10001585
mov eax, dword [ebp - 0x80]
sub eax, 0x385306fc
je 0x10002500
jmp 0x10001598
mov eax, dword [ebp - 0x80]
sub eax, 0x3cfba39a
je 0x10002798
jmp 0x100015ab
mov eax, dword [ebp - 0x80]
sub eax, 0x3f195b2f
je 0x10001ddd
jmp 0x100015be
mov eax, dword [ebp - 0x80]
sub eax, 0x4280cd7e
je 0x100024f4
jmp 0x100015d1
mov eax, dword [ebp - 0x80]
sub eax, 0x46d124e7
je 0x1000221d
jmp 0x100015e4
mov eax, dword [ebp - 0x80]
sub eax, 0x46f16fe8
je 0x10002185
jmp 0x100015f7
mov eax, dword [ebp - 0x80]
sub eax, 0x48cb4354
je 0x10001a59
jmp 0x1000160a
mov eax, dword [ebp - 0x80]
sub eax, 0x4bc34025
je 0x10002448
jmp 0x1000161d
mov eax, dword [ebp - 0x80]
sub eax, 0x4bc8ec2f
je 0x10001b92
jmp 0x10001630
mov eax, dword [ebp - 0x80]
sub eax, 0x4d56cf0c
je 0x100026f2
jmp 0x10001643
mov eax, dword [ebp - 0x80]
sub eax, 0x4f872509
je 0x10001eb5
jmp 0x10001656
mov eax, dword [ebp - 0x80]
sub eax, 0x57826bb6
je 0x1000178b
jmp 0x10001669
mov eax, dword [ebp - 0x80]
sub eax, 0x59c2a0dd
je 0x10002044
jmp 0x1000167c
mov eax, dword [ebp - 0x80]
sub eax, 0x5b586021
je 0x10001d14
jmp 0x1000168f
mov eax, dword [ebp - 0x80]
sub eax, 0x5d20e0c0
je 0x100027ac
jmp 0x100016a2
mov eax, dword [ebp - 0x80]
sub eax, 0x635bdd4a
je 0x100018a1
jmp 0x100016b5
mov eax, dword [ebp - 0x80]
sub eax, 0x67114315
je 0x10001cf9
jmp 0x100016c8
mov eax, dword [ebp - 0x80]
sub eax, 0x67d202eb
je 0x10002703
jmp 0x100016db
mov eax, dword [ebp - 0x80]
sub eax, 0x6c5e8625
je 0x1000276e
mov al, byte [ebp - 0x72]
mov cl, byte [ebp - 0x71]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67d202eb
mov ecx, 0xd3f536b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x67d202eb
mov ecx, 0x18fcf31f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x7a0f63a9
jmp 0x1000286b
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x6a953271
sub edx, 1
sub edx, 0x6a953271
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc12ca5dd
mov ecx, 0x9b534bb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x8ebe9bb4
jmp 0x1000286b
mov ecx, dword [ebp - 0x7c]
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov eax, esp
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c7e0
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov edx, dword [ebp - 0x64]
mov eax, 0xd9e6bac8
mov ecx, 0xa5386eff
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xea1d9ee6
sub edx, 1
add edx, 0xea1d9ee6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9d26a94
mov ecx, 0x48cb4354
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0xc3c38060
sub edx, 1
sub edx, 0xc3c38060
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9d26a94
mov ecx, 0xd4dfb5de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x4d56cf0c
jmp 0x1000286b
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x78], 0x6d75c634
jmp 0x1000286b
mov edx, dword [ebp - 0x34]
mov esi, 0xffffffff
mov eax, 0xc9d87acf
mov ecx, 0x81f6f14b
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x4d56cf0c
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfdced6ec
mov ecx, 0x25cc8ca0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0x28092ab1
sub edx, 1
sub edx, 0x28092ab1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfdced6ec
mov ecx, 0x6e9b846f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov dword [ebp - 0x78], 0x67114315
jmp 0x1000286b
mov edx, dword [ebp - 0x54]
mov eax, 0x5b586021
mov ecx, 0x1bcbc697
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0x9880c9c4
sub edx, 1
add edx, 0x9880c9c4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6c5e8625
mov ecx, 0x376bd0d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
sub edx, 0xa5c37f5a
sub edx, 1
add edx, 0xa5c37f5a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6c5e8625
mov ecx, 0x3f195b2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0xd424bc4c
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x287b0110
mov ecx, 0xa95a614f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x287b0110
mov ecx, 0xf47dff55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x4f872509
jmp 0x1000286b
mov dword [ebp - 0x78], 0x4d56cf0c
jmp 0x1000286b
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [ebp - 0x78], 0xeab124cf
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
add edx, 0xb6b23b25
sub edx, 1
sub edx, 0xb6b23b25
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3cfba39a
mov ecx, 0x858d85b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x44]
mov word [eax], 0
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
mov edx, ecx
sub edx, 0xcc8ceccb
sub edx, 1
add edx, 0xcc8ceccb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3cfba39a
mov ecx, 0x9563083d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x34b22b39
jmp 0x1000286b
mov dword [ebp - 0x78], 0xc86c2f36
jmp 0x1000286b
mov eax, dword [ebp - 0x44]
movzx eax, word [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x78], 0x59c2a0dd
jmp 0x1000286b
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x78], 0x232f1d7
jmp 0x1000286b
mov eax, dword [ebp - 0x24]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0x28]
mov eax, 0x164ff010
mov ecx, 0xc8927867
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x78], 0x96b96968
jmp 0x1000286b
mov ecx, dword [ebp - 0x20]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x44]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000eb50
add esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x78], 0x98b5f6ed
jmp 0x1000286b
mov edx, dword [ebp - 0x1c]
mov eax, 0x2b0c4392
mov ecx, 0x6ff9e55c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x78], 0x7a98fd2b
jmp 0x1000286b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xf], al
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0x54361f77
sub edx, 1
sub edx, 0x54361f77
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d20e0c0
mov ecx, 0x8e16e591
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x46d124e7
jmp 0x1000286b
mov cl, byte [ebp - 0xf]
and cl, 1
mov eax, dword [ebp - 0x38]
mov byte [eax], cl
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xc5c5be4d
add edx, eax
add edx, 0xc5c5be4d
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c940
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x60]
mov esi, dword [eax]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xd749c24d
add esi, eax
add esi, 0xd749c24d
mov eax, dword [ebp - 0x3c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x38]
mov byte [eax], cl
mov dword [ebp - 0x78], 0x6ff9e55c
jmp 0x1000286b
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f1f4db9
mov ecx, 0x1acd4d67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0xd9a293c4
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2d9300b8
mov ecx, 0x21aae8fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x44]
mov ax, word [eax]
mov word [ebp - 0xe], ax
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0x782b73c
sub edx, 1
sub edx, 0x782b73c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2d9300b8
mov ecx, 0x7d18dd10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23f29a72
mov ecx, 0x27fa9234
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov cx, word [ebp - 0xe]
add cx, 0x7c69
add cx, 1
sub cx, 0x7c69
mov eax, dword [ebp - 0x44]
mov word [eax], cx
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0x8f5e2053
sub edx, 1
sub edx, 0x8f5e2053
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23f29a72
mov ecx, 0x4280cd7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x385306fc
jmp 0x1000286b
mov dword [ebp - 0x78], 0xc86c2f36
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb4f004bd
mov ecx, 0x2dd7366f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1003b940]
mov ecx, dword [0x1003b93c]
mov edx, eax
add edx, 0x8841fb09
sub edx, 1
sub edx, 0x8841fb09
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4f004bd
mov ecx, 0xa7f71778
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x7b9defab
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8dbeee56
mov ecx, 0xc9d765ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov ecx, dword [0x1003b940]
mov eax, dword [0x1003b93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8dbeee56
mov ecx, 0xddf520a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x1000286b
mov dword [ebp - 0x78], 0x4d56cf0c
jmp 0x1000286b
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bbe0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x78], 0xd3f536b5
jmp 0x1000286b
mov dword [ebp - 0x78], 0x635bdd4a
jmp 0x1000286b
mov dword [ebp - 0x78], 0x48cb4354
jmp 0x1000286b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x78], 0x25cc8ca0
jmp 0x1000286b
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], 0xa95a614f
jmp 0x1000286b
mov eax, dword [ebp - 0x44]
mov word [eax], 0
mov dword [ebp - 0x78], 0x858d85b4
jmp 0x1000286b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xc76ea4d6
add edx, eax
add edx, 0xc76ea4d6
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x78], 0x46f16fe8
jmp 0x1000286b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x78], 0x21aae8fe
jmp 0x1000286b
mov ax, word [ebp - 0xe]
mov cx, word [ebp - 0xe]
sub cx, 0x3665
add cx, 1
add cx, 0x3665
mov eax, dword [ebp - 0x44]
mov word [eax], cx
mov dword [ebp - 0x78], 0x27fa9234
jmp 0x1000286b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], 0x2dd7366f
jmp 0x1000286b
mov dword [ebp - 0x78], 0xc9d765ce
jmp 0x10001218