Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x10071a00]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1a0], 0xda1cf403
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
sub eax, 0x83212af7
je 0x100021c7
jmp 0x100010f4
mov eax, dword [ebp - 0x1a8]
sub eax, 0x83391981
je 0x100029c6
jmp 0x1000110a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8398448e
je 0x10001996
jmp 0x10001120
mov eax, dword [ebp - 0x1a8]
sub eax, 0x89a7ede0
je 0x100027ab
jmp 0x10001136
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8b4ced0d
je 0x100018a1
jmp 0x1000114c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8cacfe64
je 0x1000202a
jmp 0x10001162
mov eax, dword [ebp - 0x1a8]
sub eax, 0x92472693
je 0x10001bbf
jmp 0x10001178
mov eax, dword [ebp - 0x1a8]
sub eax, 0x93fa0bc8
je 0x100027d8
jmp 0x1000118e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x98231913
je 0x10001b51
jmp 0x100011a4
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9de7fc99
je 0x10002862
jmp 0x100011ba
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa3abdfc6
je 0x100023c0
jmp 0x100011d0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa4da74d7
je 0x10002873
jmp 0x100011e6
mov eax, dword [ebp - 0x1a8]
sub eax, 0xad669d85
je 0x10001d8e
jmp 0x100011fc
mov eax, dword [ebp - 0x1a8]
sub eax, 0xae1b7bb6
je 0x1000230c
jmp 0x10001212
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb07da63e
je 0x10001d9d
jmp 0x10001228
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb0ff1fa3
je 0x10001ab1
jmp 0x1000123e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb3f88d55
je 0x10001cc0
jmp 0x10001254
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb4dd9642
je 0x10001aa2
jmp 0x1000126a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb6344fd3
je 0x10002575
jmp 0x10001280
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb6891858
je 0x10001dee
jmp 0x10001296
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb6a9af02
je 0x100028e1
jmp 0x100012ac
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb7f120ad
je 0x10002a7e
jmp 0x100012c2
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbee632ec
je 0x100022bb
jmp 0x100012d8
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc27ebc38
je 0x10002983
jmp 0x100012ee
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc7b6c757
je 0x10001f13
jmp 0x10001304
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcf1c57aa
je 0x10001867
jmp 0x1000131a
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd6429255
je 0x100022ac
jmp 0x10001330
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd6857753
je 0x10001b42
jmp 0x10001346
mov eax, dword [ebp - 0x1a8]
sub eax, 0xda1cf403
je 0x10001713
jmp 0x1000135c
mov eax, dword [ebp - 0x1a8]
sub eax, 0xda356ad5
je 0x10001c86
jmp 0x10001372
mov eax, dword [ebp - 0x1a8]
sub eax, 0xda805ebd
je 0x1000273b
jmp 0x10001388
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdf78ecdb
je 0x10002539
jmp 0x1000139e
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe7f729c6
je 0x10001fb4
jmp 0x100013b4
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe89bf652
je 0x10001ea5
jmp 0x100013ca
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf1361fc2
je 0x10001e96
jmp 0x100013e0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf7511723
je 0x100018b0
jmp 0x100013f6
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf99985bc
je 0x10001d09
jmp 0x1000140c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7b2bca
je 0x10002a47
jmp 0x10001422
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1189dae
je 0x100024ae
jmp 0x10001438
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2e8d386
je 0x100029f1
jmp 0x1000144e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5ea8516
je 0x10002218
jmp 0x10001464
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6f32c74
je 0x1000279c
jmp 0x1000147a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x875cd1e
je 0x10001876
jmp 0x10001490
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd4f8eb8
je 0x1000175c
jmp 0x100014a6
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1010d6ca
je 0x1000282f
jmp 0x100014bc
mov eax, dword [ebp - 0x1a8]
sub eax, 0x11330d98
je 0x100020bc
jmp 0x100014d2
mov eax, dword [ebp - 0x1a8]
sub eax, 0x12189402
je 0x10002ab9
jmp 0x100014e8
mov eax, dword [ebp - 0x1a8]
sub eax, 0x15cb46b4
je 0x10001d6d
jmp 0x100014fe
mov eax, dword [ebp - 0x1a8]
sub eax, 0x194be946
je 0x100028d2
jmp 0x10001514
mov eax, dword [ebp - 0x1a8]
sub eax, 0x24aec9d4
je 0x100019e7
jmp 0x1000152a
mov eax, dword [ebp - 0x1a8]
sub eax, 0x29f18f63
je 0x100027e7
jmp 0x10001540
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2fd7726d
je 0x10002802
jmp 0x10001556
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3e0b6a98
je 0x10001d5e
jmp 0x1000156c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3ecc86ae
je 0x100026c5
jmp 0x10001582
mov eax, dword [ebp - 0x1a8]
sub eax, 0x463ebbd3
je 0x100026b6
jmp 0x10001598
mov eax, dword [ebp - 0x1a8]
sub eax, 0x48ad77b5
je 0x10002438
jmp 0x100015ae
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4af7d6ba
je 0x100018f9
jmp 0x100015c4
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4b56205a
je 0x10002a32
jmp 0x100015da
mov eax, dword [ebp - 0x1a8]
sub eax, 0x50134639
je 0x10001ca1
jmp 0x100015f0
mov eax, dword [ebp - 0x1a8]
sub eax, 0x503bc315
je 0x10002929
jmp 0x10001606
mov eax, dword [ebp - 0x1a8]
sub eax, 0x563e394f
je 0x10002592
jmp 0x1000161c
mov eax, dword [ebp - 0x1a8]
sub eax, 0x591745f0
je 0x10001c77
jmp 0x10001632
mov eax, dword [ebp - 0x1a8]
sub eax, 0x61d1fa1d
je 0x10002132
jmp 0x10001648
mov eax, dword [ebp - 0x1a8]
sub eax, 0x627b7364
je 0x10002974
jmp 0x1000165e
mov eax, dword [ebp - 0x1a8]
sub eax, 0x650555e4
je 0x100023f5
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4da74d7
mov ecx, 0xd4f8eb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, esp
mov dword [ebp - 0x184], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x180], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x17c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x178], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c870
add esp, 0xc
mov eax, dword [ebp - 0x188]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x168], eax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0x10c3f8ca
sub edx, 1
sub edx, 0x10c3f8ca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4da74d7
mov ecx, 0xcf1c57aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x875cd1e
jmp 0x10002ac9
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x190], eax
mov eax, 0x8b4ced0d
mov ecx, 0xf7511723
cmp dword [ebp - 0x190], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x9de7fc99
jmp 0x10002ac9
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x194be946
mov ecx, 0x4af7d6ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x160], eax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0xe20f79d2
sub edx, 1
sub edx, 0xe20f79d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x194be946
mov ecx, 0x69c68e63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
sub edx, 0xcaff9ccf
sub edx, 1
add edx, 0xcaff9ccf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6a9af02
mov ecx, 0x24aec9d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x15c], eax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0xcac8737a
sub edx, 1
sub edx, 0xcac8737a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb6a9af02
mov ecx, 0xb4dd9642
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0xb0ff1fa3
jmp 0x10002ac9
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x15c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x198], eax
mov edx, 0xffffffff
mov eax, 0x98231913
mov ecx, 0xd6857753
cmp dword [ebp - 0x198], edx
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x9de7fc99
jmp 0x10002ac9
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x503bc315
mov ecx, 0x92472693
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x198]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x158], eax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
sub edx, 0x90052ab3
sub edx, 1
add edx, 0x90052ab3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x503bc315
mov ecx, 0x591745f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0xda356ad5
jmp 0x10002ac9
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1a0], 0x50134639
jmp 0x10002ac9
mov eax, 0xb3f88d55
mov ecx, 0xb07da63e
cmp dword [ebp - 0x19c], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x627b7364
mov ecx, 0xf99985bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x154], eax
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x627b7364
mov ecx, 0x3e0b6a98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x15cb46b4
jmp 0x10002ac9
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0xad669d85
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x9de7fc99
jmp 0x10002ac9
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
sub edx, 0xf1df8cf8
sub edx, 1
add edx, 0xf1df8cf8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc27ebc38
mov ecx, 0xb6891858
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc27ebc38
mov ecx, 0xf1361fc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0xe89bf652
jmp 0x10002ac9
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x83391981
mov ecx, 0xc7b6c757
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0xaf95f43a
sub edx, 1
sub edx, 0xaf95f43a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x83391981
mov ecx, 0x6b393544
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
sub edx, 0x341ff4b9
sub edx, 1
add edx, 0x341ff4b9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2e8d386
mov ecx, 0x8cacfe64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov word [eax], 0
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
sub edx, 0xa5d89c2e
sub edx, 1
add edx, 0xa5d89c2e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e8d386
mov ecx, 0x7fac56d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
sub edx, 0xfe854b01
sub edx, 1
add edx, 0xfe854b01
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4b56205a
mov ecx, 0x61d1fa1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x178]
mov ax, word [eax]
mov word [ebp - 0x14a], ax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0xb402c2df
sub edx, 1
sub edx, 0xb402c2df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4b56205a
mov ecx, 0x6c3e3785
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
sub edx, 0x9cada670
sub edx, 1
add edx, 0x9cada670
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b2bca
mov ecx, 0x5ea8516
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov ax, word [ebp - 0x14a]
movzx eax, ax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
sub edx, 0x2fe6c3dd
sub edx, 1
add edx, 0x2fe6c3dd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b2bca
mov ecx, 0xd6429255
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0xbee632ec
jmp 0x10002ac9
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
add edx, 0xc5e46e9e
sub edx, 1
sub edx, 0xc5e46e9e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x734a42e1
mov ecx, 0xae1b7bb6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x144]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x148]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x13d], al
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0xea265b85
sub edx, 1
sub edx, 0xea265b85
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x734a42e1
mov ecx, 0x765bccd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1a0], 0x650555e4
jmp 0x10002ac9
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0x73a42002
sub edx, 1
sub edx, 0x73a42002
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb7f120ad
mov ecx, 0x1189dae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ebe0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x12d], al
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
sub edx, 0xf034e667
sub edx, 1
add edx, 0xf034e667
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7f120ad
mov ecx, 0xdf78ecdb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dl, byte [ebp - 0x12d]
mov eax, 0x7a6fb80c
mov ecx, 0x463ebbd3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1a0], 0x563e394f
jmp 0x10002ac9
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xb6f8dc66
add edx, eax
add edx, 0xb6f8dc66
mov eax, dword [ebp - 0x170]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov edx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xbe92a1d5
add edx, eax
sub edx, 0xbe92a1d5
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c9d0
add esp, 0xc
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x194]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x5a1082a5
add esi, eax
add esi, 0x5a1082a5
mov eax, dword [ebp - 0x170]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov dword [ebp - 0x1a0], 0x463ebbd3
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x3ecc86ae
jmp 0x10002ac9
mov ecx, dword [0x10072d40]
mov eax, dword [0x10072d3c]
mov edx, ecx
add edx, 0xeefbebc1
sub edx, 1
sub edx, 0xeefbebc1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x12189402
mov ecx, 0xda805ebd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov eax, dword [ebp - 0x178]
mov ax, word [eax]
mov word [ebp - 0x126], ax
mov eax, dword [0x10072d40]
mov ecx, dword [0x10072d3c]
mov edx, eax
sub edx, 0x75c3eff
sub edx, 1
add edx, 0x75c3eff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12189402
mov ecx, 0x6f32c74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x89a7ede0
jmp 0x10002ac9
mov cx, word [ebp - 0x126]
sub cx, 0xa141
add cx, 1
add cx, 0xa141
mov eax, dword [ebp - 0x178]
mov word [eax], cx
mov dword [ebp - 0x1a0], 0x93fa0bc8
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x11330d98
jmp 0x10002ac9
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x1a0], 0x2fd7726d
jmp 0x10002ac9
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x1a0], 0x1010d6ca
jmp 0x10002ac9
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x9de7fc99
jmp 0x10002ac9
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bc70
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c870
add esp, 0xc
mov eax, dword [ebp - 0x188]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1a0], 0xd4f8eb8
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0x4af7d6ba
jmp 0x10002ac9
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x1a0], 0x24aec9d4
jmp 0x10002ac9
mov eax, dword [ebp - 0x198]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x1a0], 0x92472693
jmp 0x10002ac9
mov dword [ebp - 0x1a0], 0xf99985bc
jmp 0x10002ac9
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1a0], 0xb6891858
jmp 0x10002ac9
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0xc7b6c757
jmp 0x10002ac9
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x832c180b
add ecx, eax
sub ecx, 0x832c180b
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov word [eax], 0
mov dword [ebp - 0x1a0], 0x8cacfe64
jmp 0x10002ac9
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1a0], 0x61d1fa1d
jmp 0x10002ac9
mov ax, word [ebp - 0x14a]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1a0], 0x5ea8516
jmp 0x10002ac9
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ebe0
add esp, 8
mov dword [ebp - 0x1a0], 0x1189dae
jmp 0x10002ac9
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1a0], 0xda805ebd
jmp 0x100010d8