Function at 0x10001320
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x10063600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa6], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0xac], 0xe9c08ddf
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x876ec076
je 0x10001c1f
jmp 0x1000139c
mov eax, dword [ebp - 0xb4]
sub eax, 0x8c688180
je 0x10001b9c
jmp 0x100013b2
mov eax, dword [ebp - 0xb4]
sub eax, 0x8f99e41a
je 0x100021c0
jmp 0x100013c8
mov eax, dword [ebp - 0xb4]
sub eax, 0x91e476f8
je 0x100022d2
jmp 0x100013de
mov eax, dword [ebp - 0xb4]
sub eax, 0x94097bf8
je 0x10001f3c
jmp 0x100013f4
mov eax, dword [ebp - 0xb4]
sub eax, 0x9535f88b
je 0x10001dda
jmp 0x1000140a
mov eax, dword [ebp - 0xb4]
sub eax, 0x95e2aa2b
je 0x10001fb2
jmp 0x10001420
mov eax, dword [ebp - 0xb4]
sub eax, 0x95e574dc
je 0x1000297b
jmp 0x10001436
mov eax, dword [ebp - 0xb4]
sub eax, 0x97cbf2c1
je 0x10002330
jmp 0x1000144c
mov eax, dword [ebp - 0xb4]
sub eax, 0x9dd4dce0
je 0x1000262e
jmp 0x10001462
mov eax, dword [ebp - 0xb4]
sub eax, 0xa14b7977
je 0x10001ecd
jmp 0x10001478
mov eax, dword [ebp - 0xb4]
sub eax, 0xac3ef850
je 0x10002379
jmp 0x1000148e
mov eax, dword [ebp - 0xb4]
sub eax, 0xad15553d
je 0x10001e57
jmp 0x100014a4
mov eax, dword [ebp - 0xb4]
sub eax, 0xad944d1d
je 0x10002574
jmp 0x100014ba
mov eax, dword [ebp - 0xb4]
sub eax, 0xae20f307
je 0x10002792
jmp 0x100014d0
mov eax, dword [ebp - 0xb4]
sub eax, 0xb3a9ac9f
je 0x100029db
jmp 0x100014e6
mov eax, dword [ebp - 0xb4]
sub eax, 0xb52d0408
je 0x10002783
jmp 0x100014fc
mov eax, dword [ebp - 0xb4]
sub eax, 0xb7440082
je 0x10001d13
jmp 0x10001512
mov eax, dword [ebp - 0xb4]
sub eax, 0xba0dcdd7
je 0x10002432
jmp 0x10001528
mov eax, dword [ebp - 0xb4]
sub eax, 0xbc7e7092
je 0x10002169
jmp 0x1000153e
mov eax, dword [ebp - 0xb4]
sub eax, 0xbcabebdc
je 0x1000284b
jmp 0x10001554
mov eax, dword [ebp - 0xb4]
sub eax, 0xbe11ceff
je 0x10002725
jmp 0x1000156a
mov eax, dword [ebp - 0xb4]
sub eax, 0xbf54c404
je 0x10001c10
jmp 0x10001580
mov eax, dword [ebp - 0xb4]
sub eax, 0xc0d81e97
je 0x1000201d
jmp 0x10001596
mov eax, dword [ebp - 0xb4]
sub eax, 0xc1a386dd
je 0x10001c44
jmp 0x100015ac
mov eax, dword [ebp - 0xb4]
sub eax, 0xd20a8375
je 0x10001dcb
jmp 0x100015c2
mov eax, dword [ebp - 0xb4]
sub eax, 0xd61cb5b3
je 0x10002178
jmp 0x100015d8
mov eax, dword [ebp - 0xb4]
sub eax, 0xdb5280bf
je 0x10002a4f
jmp 0x100015ee
mov eax, dword [ebp - 0xb4]
sub eax, 0xe371f9ab
je 0x10002743
jmp 0x10001604
mov eax, dword [ebp - 0xb4]
sub eax, 0xe65e0943
je 0x10002911
jmp 0x1000161a
mov eax, dword [ebp - 0xb4]
sub eax, 0xe9c08ddf
je 0x1000198f
jmp 0x10001630
mov eax, dword [ebp - 0xb4]
sub eax, 0xe9fe95d6
je 0x1000295a
jmp 0x10001646
mov eax, dword [ebp - 0xb4]
sub eax, 0xeb6bc17d
je 0x10001bab
jmp 0x1000165c
mov eax, dword [ebp - 0xb4]
sub eax, 0xebf9e9a4
je 0x1000289b
jmp 0x10001672
mov eax, dword [ebp - 0xb4]
sub eax, 0xf6ed0054
je 0x1000224e
jmp 0x10001688
mov eax, dword [ebp - 0xb4]
sub eax, 0xf8d6df96
je 0x100021d8
jmp 0x1000169e
mov eax, dword [ebp - 0xb4]
sub eax, 0x41153ab
je 0x10002198
jmp 0x100016b4
mov eax, dword [ebp - 0xb4]
sub eax, 0xbe1d4d1
je 0x10001f1e
jmp 0x100016ca
mov eax, dword [ebp - 0xb4]
sub eax, 0xf4fd5f8
je 0x100029b7
jmp 0x100016e0
mov eax, dword [ebp - 0xb4]
sub eax, 0x1586cfa4
je 0x10002878
jmp 0x100016f6
mov eax, dword [ebp - 0xb4]
sub eax, 0x1bc54fb1
je 0x10001a90
jmp 0x1000170c
mov eax, dword [ebp - 0xb4]
sub eax, 0x1bdeebf9
je 0x10002423
jmp 0x10001722
mov eax, dword [ebp - 0xb4]
sub eax, 0x1cd52f54
je 0x1000209b
jmp 0x10001738
mov eax, dword [ebp - 0xb4]
sub eax, 0x1e7d923e
je 0x10001b15
jmp 0x1000174e
mov eax, dword [ebp - 0xb4]
sub eax, 0x24147c4d
je 0x1000275c
jmp 0x10001764
mov eax, dword [ebp - 0xb4]
sub eax, 0x269fc6a0
je 0x100022e1
jmp 0x1000177a
mov eax, dword [ebp - 0xb4]
sub eax, 0x2947af7f
je 0x10002ba2
jmp 0x10001790
mov eax, dword [ebp - 0xb4]
sub eax, 0x29bc75df
je 0x1000204a
jmp 0x100017a6
mov eax, dword [ebp - 0xb4]
sub eax, 0x33993e52
je 0x100029a8
jmp 0x100017bc
mov eax, dword [ebp - 0xb4]
sub eax, 0x391d707b
je 0x100025dd
jmp 0x100017d2
mov eax, dword [ebp - 0xb4]
sub eax, 0x3c99a4c1
je 0x10002304
jmp 0x100017e8
mov eax, dword [ebp - 0xb4]
sub eax, 0x3efaf239
je 0x10002ac1
jmp 0x100017fe
mov eax, dword [ebp - 0xb4]
sub eax, 0x4871a9a0
je 0x1000253b
jmp 0x10001814
mov eax, dword [ebp - 0xb4]
sub eax, 0x4ad802ce
je 0x10001d82
jmp 0x1000182a
mov eax, dword [ebp - 0xb4]
sub eax, 0x4e57b5fc
je 0x10002a3d
jmp 0x10001840
mov eax, dword [ebp - 0xb4]
sub eax, 0x52f3c534
je 0x100027db
jmp 0x10001856
mov eax, dword [ebp - 0xb4]
sub eax, 0x533a1f72
je 0x1000296c
jmp 0x1000186c
mov eax, dword [ebp - 0xb4]
sub eax, 0x55621210
je 0x10001df4
jmp 0x10001882
mov eax, dword [ebp - 0xb4]
sub eax, 0x59135f18
je 0x10001a9f
jmp 0x10001898
mov eax, dword [ebp - 0xb4]
sub eax, 0x5c2ca380
je 0x100019be
jmp 0x100018ae
mov eax, dword [ebp - 0xb4]
sub eax, 0x61114856
je 0x10002483
jmp 0x100018c4
mov eax, dword [ebp - 0xb4]
sub eax, 0x632c68bc
je 0x10002734
jmp 0x100018da
mov eax, dword [ebp - 0xb4]
sub eax, 0x63acfcb1
je 0x1000285a
jmp 0x100018f0
mov eax, dword [ebp - 0xb4]
sub eax, 0x653e8251
je 0x1000251d
jmp 0x10001906
mov eax, dword [ebp - 0xb4]
sub eax, 0x693ce6d0
je 0x1000200e
mov al, byte [ebp - 0xa6]
mov cl, byte [ebp - 0xa5]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x533a1f72
mov ecx, 0x5c2ca380
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x533a1f72
mov ecx, 0x1bc54fb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0x59135f18
jmp 0x10002bac
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
sub edx, 0x41e2cda
sub edx, 1
add edx, 0x41e2cda
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x95e574dc
mov ecx, 0x1e7d923e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov ecx, dword [ebp - 0xb0]
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
add edx, 0x93114b0b
sub edx, 1
sub edx, 0x93114b0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x95e574dc
mov ecx, 0x8c688180
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0xeb6bc17d
jmp 0x10002bac
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100089e0
add esp, 0xc
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov edx, dword [ebp - 0x98]
mov eax, 0xbf54c404
mov ecx, 0x876ec076
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0xebf9e9a4
jmp 0x10002bac
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xac], 0xc1a386dd
jmp 0x10002bac
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0xac], 0xb7440082
jmp 0x10002bac
mov dl, byte [ebp - 0x5d]
mov eax, 0x9535f88b
mov ecx, 0x73c16163
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33993e52
mov ecx, 0xd20a8375
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0xebf9e9a4
jmp 0x10002bac
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xac], 0x55621210
jmp 0x10002bac
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov dword [ebp - 0xac], 0xad15553d
jmp 0x10002bac
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
sub edx, 0xe6919154
sub edx, 1
add edx, 0xe6919154
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf4fd5f8
mov ecx, 0xa14b7977
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
add edx, 0xe592f4e7
sub edx, 1
sub edx, 0xe592f4e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf4fd5f8
mov ecx, 0xbe1d4d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dl, byte [ebp - 0x55]
mov eax, 0x94097bf8
mov ecx, 0x29bc75df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
sub edx, 0xf26807a
sub edx, 1
add edx, 0xf26807a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75c4fd86
mov ecx, 0x95e2aa2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
sub edx, 0x6d569c44
sub edx, 1
add edx, 0x6d569c44
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75c4fd86
mov ecx, 0x693ce6d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x770b819a
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
sub edx, 0x94b35177
sub edx, 1
add edx, 0x94b35177
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb3a9ac9f
mov ecx, 0x1cd52f54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
sub edx, 0x3b07f445
sub edx, 1
add edx, 0x3b07f445
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb3a9ac9f
mov ecx, 0xbc7e7092
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0xd61cb5b3
jmp 0x10002bac
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xac], 0x41153ab
jmp 0x10002bac
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov word [eax], 0
mov dword [ebp - 0xac], 0x8f99e41a
jmp 0x10002bac
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xac], 0xf8d6df96
jmp 0x10002bac
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
add edx, 0x38eaca59
sub edx, 1
sub edx, 0x38eaca59
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e57b5fc
mov ecx, 0xf6ed0054
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x40], eax
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
add edx, 0x83860ead
sub edx, 1
sub edx, 0x83860ead
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e57b5fc
mov ecx, 0x91e476f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0x269fc6a0
jmp 0x10002bac
mov eax, dword [ebp - 0x40]
movzx esi, word [eax]
mov edx, dword [ebp - 0x44]
mov eax, 0xae20f307
mov ecx, 0x3c99a4c1
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub eax, 0xf44ef060
add eax, 0x18
add eax, 0xf44ef060
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xac], 0x97cbf2c1
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb5280bf
mov ecx, 0xac3ef850
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x8944c40b
add ecx, eax
add ecx, 0x8944c40b
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x7b760d26
add ecx, eax
add ecx, 0x7b760d26
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb5280bf
mov ecx, 0x1bdeebf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0xba0dcdd7
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
sub edx, 0x32260c29
sub edx, 1
add edx, 0x32260c29
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ff33052
mov ecx, 0x61114856
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov ecx, dword [ebp - 0x34]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100141a0
call fcn.1000ad50
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x2d], al
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
add edx, 0xf711ad59
sub edx, 1
sub edx, 0xf711ad59
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6ff33052
mov ecx, 0x653e8251
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dl, byte [ebp - 0x2d]
mov eax, 0x4871a9a0
mov ecx, 0x632c68bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xac], 0xad944d1d
jmp 0x10002bac
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x2c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xac], 0x391d707b
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
add edx, 0x7a3617d1
sub edx, 1
sub edx, 0x7a3617d1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3efaf239
mov ecx, 0x9dd4dce0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
sub edx, 0x27b2640f
add edx, eax
add edx, 0x27b2640f
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x79ee4c22
add ecx, eax
add ecx, 0x79ee4c22
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10008b40
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov esi, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
sub edx, 0xdd2359a6
sub edx, 1
add edx, 0xdd2359a6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3efaf239
mov ecx, 0xbe11ceff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0x632c68bc
jmp 0x10002bac
mov dword [ebp - 0xac], 0xe371f9ab
jmp 0x10002bac
mov eax, dword [ebp - 0x78]
mov ax, word [eax]
mov word [ebp - 0x16], ax
mov dword [ebp - 0xac], 0x24147c4d
jmp 0x10002bac
mov cx, word [ebp - 0x16]
sub cx, 0x5798
add cx, 1
add cx, 0x5798
mov eax, dword [ebp - 0x78]
mov word [eax], cx
mov dword [ebp - 0xac], 0xb52d0408
jmp 0x10002bac
mov dword [ebp - 0xac], 0x8f99e41a
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x74849a38
mov ecx, 0x52f3c534
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
mov edx, eax
add edx, 0xb59fe010
sub edx, 1
sub edx, 0xb59fe010
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x74849a38
mov ecx, 0xbcabebdc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov dword [ebp - 0xac], 0x63acfcb1
jmp 0x10002bac
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x1586cfa4
jmp 0x10002bac
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0xebf9e9a4
jmp 0x10002bac
mov ecx, dword [0x10064958]
mov eax, dword [0x10064954]
mov edx, ecx
add edx, 0xc46ba8d8
sub edx, 1
sub edx, 0xc46ba8d8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2947af7f
mov ecx, 0xe65e0943
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov eax, dword [0x10064958]
mov ecx, dword [0x10064954]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2947af7f
mov ecx, 0xe9fe95d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x10002bac
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007dc0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xac], 0x5c2ca380
jmp 0x10002bac
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0x1e7d923e
jmp 0x10002bac
mov dword [ebp - 0xac], 0x4ad802ce
jmp 0x10002bac
mov dword [ebp - 0xac], 0xa14b7977
jmp 0x10002bac
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xac], 0x1cd52f54
jmp 0x10002bac
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0xf6ed0054
jmp 0x10002bac
mov eax, dword [ebp - 0x38]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0xff190cee
add ecx, eax
add ecx, 0xff190cee
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xac], 0xac3ef850
jmp 0x10002bac
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
add edx, 0xcd747892
add edx, eax
sub edx, 0xcd747892
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x33607df4
add ecx, eax
sub ecx, 0x33607df4
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10008b40
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov esi, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov dword [ebp - 0xac], 0x9dd4dce0
jmp 0x10002bac
mov dword [ebp - 0xac], 0xe65e0943
jmp 0x10001380