Function at 0x100011c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1006c800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
add edx, 0xeca5d118
sub edx, 1
sub edx, 0xeca5d118
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x94], 0xa02576db
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x81997be0
je 0x10002806
jmp 0x10001243
mov eax, dword [ebp - 0x9c]
sub eax, 0x82e6aab8
je 0x10001911
jmp 0x10001259
mov eax, dword [ebp - 0x9c]
sub eax, 0x8638910c
je 0x10001d61
jmp 0x1000126f
mov eax, dword [ebp - 0x9c]
sub eax, 0x87d3a805
je 0x100028b0
jmp 0x10001285
mov eax, dword [ebp - 0x9c]
sub eax, 0x880b4880
je 0x100026ce
jmp 0x1000129b
mov eax, dword [ebp - 0x9c]
sub eax, 0x88c0a6c8
je 0x10001c93
jmp 0x100012b1
mov eax, dword [ebp - 0x9c]
sub eax, 0x8935ee3b
je 0x10001f35
jmp 0x100012c7
mov eax, dword [ebp - 0x9c]
sub eax, 0x8a06b8d8
je 0x10001ab7
jmp 0x100012dd
mov eax, dword [ebp - 0x9c]
sub eax, 0x9c7e78d2
je 0x10002159
jmp 0x100012f3
mov eax, dword [ebp - 0x9c]
sub eax, 0x9e6e7354
je 0x1000207f
jmp 0x10001309
mov eax, dword [ebp - 0x9c]
sub eax, 0xa02576db
je 0x10001836
jmp 0x1000131f
mov eax, dword [ebp - 0x9c]
sub eax, 0xa1e387b2
je 0x1000248b
jmp 0x10001335
mov eax, dword [ebp - 0x9c]
sub eax, 0xb0bfe865
je 0x10001e40
jmp 0x1000134b
mov eax, dword [ebp - 0x9c]
sub eax, 0xb0e9ec0a
je 0x10001902
jmp 0x10001361
mov eax, dword [ebp - 0x9c]
sub eax, 0xb991a3e7
je 0x10001f5b
jmp 0x10001377
mov eax, dword [ebp - 0x9c]
sub eax, 0xc9879a66
je 0x10001eb0
jmp 0x1000138d
mov eax, dword [ebp - 0x9c]
sub eax, 0xcbc5c6be
je 0x10002369
jmp 0x100013a3
mov eax, dword [ebp - 0x9c]
sub eax, 0xce772bc1
je 0x10001d10
jmp 0x100013b9
mov eax, dword [ebp - 0x9c]
sub eax, 0xd57dce3b
je 0x10002501
jmp 0x100013cf
mov eax, dword [ebp - 0x9c]
sub eax, 0xd6112d0b
je 0x1000269c
jmp 0x100013e5
mov eax, dword [ebp - 0x9c]
sub eax, 0xd80067df
je 0x10001ac6
jmp 0x100013fb
mov eax, dword [ebp - 0x9c]
sub eax, 0xda3cd561
je 0x10001f26
jmp 0x10001411
mov eax, dword [ebp - 0x9c]
sub eax, 0xdb101114
je 0x10001955
jmp 0x10001427
mov eax, dword [ebp - 0x9c]
sub eax, 0xdd78ab6b
je 0x1000286e
jmp 0x1000143d
mov eax, dword [ebp - 0x9c]
sub eax, 0xde526f2d
je 0x10002297
jmp 0x10001453
mov eax, dword [ebp - 0x9c]
sub eax, 0xded5fc8e
je 0x10002050
jmp 0x10001469
mov eax, dword [ebp - 0x9c]
sub eax, 0xe10fac59
je 0x1000288f
jmp 0x1000147f
mov eax, dword [ebp - 0x9c]
sub eax, 0xe1c09242
je 0x1000293a
jmp 0x10001495
mov eax, dword [ebp - 0x9c]
sub eax, 0xedd4de6b
je 0x10001bff
jmp 0x100014ab
mov eax, dword [ebp - 0x9c]
sub eax, 0xedf72938
je 0x1000279c
jmp 0x100014c1
mov eax, dword [ebp - 0x9c]
sub eax, 0xf0c05c97
je 0x1000265b
jmp 0x100014d7
mov eax, dword [ebp - 0x9c]
sub eax, 0xf7dade5f
je 0x10001d01
jmp 0x100014ed
mov eax, dword [ebp - 0x9c]
sub eax, 0xf8629ee8
je 0x1000287d
jmp 0x10001503
mov eax, dword [ebp - 0x9c]
sub eax, 0xfa4b8747
je 0x10001b96
jmp 0x10001519
mov eax, dword [ebp - 0x9c]
sub eax, 0xfc8dc59a
je 0x10001ba5
jmp 0x1000152f
mov eax, dword [ebp - 0x9c]
sub eax, 0xfe593550
je 0x10002631
jmp 0x10001545
mov eax, dword [ebp - 0x9c]
sub eax, 0x21f2c3b
je 0x100019bf
jmp 0x1000155b
mov eax, dword [ebp - 0x9c]
sub eax, 0x33a5197
je 0x1000230d
jmp 0x10001571
mov eax, dword [ebp - 0x9c]
sub eax, 0x54d80eb
je 0x1000278d
jmp 0x10001587
mov eax, dword [ebp - 0x9c]
sub eax, 0xa98a246
je 0x100025a2
jmp 0x1000159d
mov eax, dword [ebp - 0x9c]
sub eax, 0xdc8f9ee
je 0x10002378
jmp 0x100015b3
mov eax, dword [ebp - 0x9c]
sub eax, 0x1195aeb0
je 0x10001e31
jmp 0x100015c9
mov eax, dword [ebp - 0x9c]
sub eax, 0x1a548ed1
je 0x10001865
jmp 0x100015df
mov eax, dword [ebp - 0x9c]
sub eax, 0x1e102699
je 0x10001e5f
jmp 0x100015f5
mov eax, dword [ebp - 0x9c]
sub eax, 0x1ef7bb77
je 0x100020d5
jmp 0x1000160b
mov eax, dword [ebp - 0x9c]
sub eax, 0x2076b7dd
je 0x1000247c
jmp 0x10001621
mov eax, dword [ebp - 0x9c]
sub eax, 0x254e60be
je 0x1000254a
jmp 0x10001637
mov eax, dword [ebp - 0x9c]
sub eax, 0x27b718ff
je 0x10002928
jmp 0x1000164d
mov eax, dword [ebp - 0x9c]
sub eax, 0x2a522336
je 0x10002744
jmp 0x10001663
mov eax, dword [ebp - 0x9c]
sub eax, 0x337fae78
je 0x100021aa
jmp 0x10001679
mov eax, dword [ebp - 0x9c]
sub eax, 0x35a13707
je 0x10001bca
jmp 0x1000168f
mov eax, dword [ebp - 0x9c]
sub eax, 0x378e3637
je 0x10001c1d
jmp 0x100016a5
mov eax, dword [ebp - 0x9c]
sub eax, 0x38d547fe
je 0x100021c8
jmp 0x100016bb
mov eax, dword [ebp - 0x9c]
sub eax, 0x3cfdf24f
je 0x10002559
jmp 0x100016d1
mov eax, dword [ebp - 0x9c]
sub eax, 0x3ea93eb3
je 0x10002815
jmp 0x100016e7
mov eax, dword [ebp - 0x9c]
sub eax, 0x44f996c6
je 0x10001a2d
jmp 0x100016fd
mov eax, dword [ebp - 0x9c]
sub eax, 0x4540669a
je 0x10001be8
jmp 0x10001713
mov eax, dword [ebp - 0x9c]
sub eax, 0x46071bcf
je 0x10001fd1
jmp 0x10001729
mov eax, dword [ebp - 0x9c]
sub eax, 0x52d2257f
je 0x100019ce
jmp 0x1000173f
mov eax, dword [ebp - 0x9c]
sub eax, 0x57e2e3a7
je 0x10002674
jmp 0x10001755
mov eax, dword [ebp - 0x9c]
sub eax, 0x59f04b7d
je 0x100027ad
jmp 0x1000176b
mov eax, dword [ebp - 0x9c]
sub eax, 0x659ffe60
je 0x10001b0f
jmp 0x10001781
mov eax, dword [ebp - 0x9c]
sub eax, 0x67d84de9
je 0x10002108
jmp 0x10001797
mov eax, dword [ebp - 0x9c]
sub eax, 0x6c744d2f
je 0x1000205f
jmp 0x100017ad
mov eax, dword [ebp - 0x9c]
sub eax, 0x6d0798c7
je 0x10001a18
mov al, byte [ebp - 0x8e]
mov cl, byte [ebp - 0x8d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59f04b7d
mov ecx, 0x1a548ed1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
add edx, 0xa72901e5
sub edx, 1
sub edx, 0xa72901e5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59f04b7d
mov ecx, 0xb0e9ec0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0x82e6aab8
jmp 0x10002944
mov ecx, dword [ebp - 0x98]
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x94], 0xdb101114
jmp 0x10002944
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10010830
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov edx, dword [ebp - 0x80]
mov eax, 0x21f2c3b
mov ecx, 0x52d2257f
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xedf72938
jmp 0x10002944
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x6d0798c7
jmp 0x10002944
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov edx, dword [ebp - 0x74]
mov esi, 0xffffffff
mov eax, 0xd80067df
mov ecx, 0x8a06b8d8
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xedf72938
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75f7c69b
mov ecx, 0x659ffe60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75f7c69b
mov ecx, 0xfa4b8747
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xfc8dc59a
jmp 0x10002944
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 0x94], 0x35a13707
jmp 0x10002944
mov dl, byte [ebp - 0x41]
mov eax, 0x4540669a
mov ecx, 0xce772bc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x94], 0xedd4de6b
jmp 0x10002944
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x378e3637
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
add edx, 0x246c1735
sub edx, 1
sub edx, 0x246c1735
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x81997be0
mov ecx, 0x88c0a6c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x81997be0
mov ecx, 0xf7dade5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xedf72938
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
add edx, 0x546ed8ef
sub edx, 1
sub edx, 0x546ed8ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ea93eb3
mov ecx, 0x8638910c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ea93eb3
mov ecx, 0x1195aeb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xb0bfe865
jmp 0x10002944
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x94], 0x1e102699
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
add edx, 0x8e1e0d41
sub edx, 1
sub edx, 0x8e1e0d41
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd78ab6b
mov ecx, 0xc9879a66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
sub edx, 0x96fdf714
sub edx, 1
add edx, 0x96fdf714
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdd78ab6b
mov ecx, 0xda3cd561
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0x8935ee3b
jmp 0x10002944
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x94], 0xb991a3e7
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
sub edx, 0xbd46bda
sub edx, 1
add edx, 0xbd46bda
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf8629ee8
mov ecx, 0x46071bcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x34]
movzx eax, word [eax]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
sub edx, 0xe1b84a37
sub edx, 1
add edx, 0xe1b84a37
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf8629ee8
mov ecx, 0xded5fc8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0x6c744d2f
jmp 0x10002944
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov eax, 0x57e2e3a7
mov ecx, 0x9e6e7354
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x1366e1aa
add ecx, eax
sub ecx, 0x1366e1aa
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x94], 0x1ef7bb77
jmp 0x10002944
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001c3b0
call fcn.10012ba0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov dword [ebp - 0x94], 0x67d84de9
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
sub edx, 0x5166fa82
sub edx, 1
add edx, 0x5166fa82
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe10fac59
mov ecx, 0x9c7e78d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
add edx, 0xda730694
sub edx, 1
sub edx, 0xda730694
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe10fac59
mov ecx, 0x337fae78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dl, byte [ebp - 0x25]
mov eax, 0x38d547fe
mov ecx, 0xa1e387b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xda3f59a9
add edx, eax
add edx, 0xda3f59a9
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x11529dea
add ecx, eax
sub ecx, 0x11529dea
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10010990
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x94], 0xde526f2d
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
sub edx, 0xbc40f692
sub edx, 1
add edx, 0xbc40f692
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f8e3472
mov ecx, 0x33a5197
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
sub edx, 0x1184f469
sub edx, 1
add edx, 0x1184f469
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f8e3472
mov ecx, 0xcbc5c6be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xdc8f9ee
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
mov edx, eax
sub edx, 0x8231cdea
sub edx, 1
add edx, 0x8231cdea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87d3a805
mov ecx, 0x7e743b7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xa1e387b2
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
sub edx, 0x75c365f9
sub edx, 1
add edx, 0x75c365f9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x74070362
mov ecx, 0xd57dce3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x74070362
mov ecx, 0x254e60be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0x3cfdf24f
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27b718ff
mov ecx, 0xa98a246
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
add edx, 0x8c745ee4
sub edx, 1
sub edx, 0x8c745ee4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x27b718ff
mov ecx, 0x74832369
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov ax, word [ebp - 0x14]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x12], ax
mov dword [ebp - 0x94], 0xf0c05c97
jmp 0x10002944
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x94], 0x8935ee3b
jmp 0x10002944
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x94], 0xd6112d0b
jmp 0x10002944
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x880b4880
jmp 0x10002944
mov ecx, dword [0x1006db48]
mov eax, dword [0x1006db44]
mov edx, ecx
sub edx, 0x2a368cde
sub edx, 1
add edx, 0x2a368cde
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe1c09242
mov ecx, 0x2a522336
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov eax, dword [0x1006db48]
mov ecx, dword [0x1006db44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1c09242
mov ecx, 0x54d80eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002944
mov dword [ebp - 0x94], 0xedf72938
jmp 0x10002944
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000fc30
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x94], 0x1a548ed1
jmp 0x10002944
mov dword [ebp - 0x94], 0x88c0a6c8
jmp 0x10002944
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x94], 0x8638910c
jmp 0x10002944
mov dword [ebp - 0x94], 0xc9879a66
jmp 0x10002944
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x94], 0x46071bcf
jmp 0x10002944
mov dword [ebp - 0x94], 0x9c7e78d2
jmp 0x10002944
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
sub esi, 0x8700eb29
add esi, eax
add esi, 0x8700eb29
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov dword [ebp - 0x94], 0x7e743b7e
jmp 0x10002944
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x94], 0xa98a246
jmp 0x10002944
mov dword [ebp - 0x94], 0x2a522336
jmp 0x10001227