Function at 0x100011e0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x10069800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a0], 0x3e4dab57
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
sub eax, 0x813d25df
je 0x10002763
jmp 0x10001225
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8c1665ed
je 0x1000293e
jmp 0x1000123b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x93a13fb6
je 0x1000228a
jmp 0x10001251
mov eax, dword [ebp - 0x1a8]
sub eax, 0x96babef4
je 0x10002b63
jmp 0x10001267
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9b03c4e5
je 0x10001eaf
jmp 0x1000127d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9dbd8a64
je 0x100027b4
jmp 0x10001293
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9e488b96
je 0x100028f5
jmp 0x100012a9
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa07957ad
je 0x10001e09
jmp 0x100012bf
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa14957e6
je 0x100025a9
jmp 0x100012d5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa2a6f949
je 0x10002923
jmp 0x100012eb
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa2fa37d3
je 0x10002c08
jmp 0x10001301
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa3644ce9
je 0x10001d33
jmp 0x10001317
mov eax, dword [ebp - 0x1a8]
sub eax, 0xab6ff7ce
je 0x1000221e
jmp 0x1000132d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb140f24e
je 0x10002c7a
jmp 0x10001343
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb48625b0
je 0x10002c8f
jmp 0x10001359
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb7ff3166
je 0x10002a8f
jmp 0x1000136f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbb3f34f3
je 0x10002841
jmp 0x10001385
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc21d5c1c
je 0x100024e7
jmp 0x1000139b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc44f413c
je 0x10001fbe
jmp 0x100013b1
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc6512d6d
je 0x100025ca
jmp 0x100013c7
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcf2918a7
je 0x10001cc9
jmp 0x100013dd
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd1f8b35c
je 0x10001ea0
jmp 0x100013f3
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd4ccc74e
je 0x10002904
jmp 0x10001409
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd738c14a
je 0x10002bc9
jmp 0x1000141f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdfac74fa
je 0x100018cb
jmp 0x10001435
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe169365a
je 0x10002754
jmp 0x1000144b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe9260409
je 0x10002510
jmp 0x10001461
mov eax, dword [ebp - 0x1a8]
sub eax, 0xeded6628
je 0x10002546
jmp 0x10001477
mov eax, dword [ebp - 0x1a8]
sub eax, 0xeed0b97d
je 0x100021a8
jmp 0x1000148d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf5396279
je 0x10002cdd
jmp 0x100014a3
mov eax, dword [ebp - 0x1a8]
sub eax, 0xff309686
je 0x10001d93
jmp 0x100014b9
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa45b4d
je 0x10001ba9
jmp 0x100014cf
mov eax, dword [ebp - 0x1a8]
sub eax, 0x296bb2d
je 0x10002832
jmp 0x100014e5
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2b7b4d0
je 0x10002055
jmp 0x100014fb
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5fb8e07
je 0x10002a5f
jmp 0x10001511
mov eax, dword [ebp - 0x1a8]
sub eax, 0xde28e2f
je 0x10002c65
jmp 0x10001527
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe961aae
je 0x10001940
jmp 0x1000153d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x10a86692
je 0x10002199
jmp 0x10001553
mov eax, dword [ebp - 0x1a8]
sub eax, 0x16991398
je 0x10001f25
jmp 0x10001569
mov eax, dword [ebp - 0x1a8]
sub eax, 0x183e8ed3
je 0x10001a8c
jmp 0x1000157f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x19fbc7fd
je 0x1000212f
jmp 0x10001595
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1a993735
je 0x1000241f
jmp 0x100015ab
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1e7a3a65
je 0x10002619
jmp 0x100015c1
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2057080f
je 0x100026a9
jmp 0x100015d7
mov eax, dword [ebp - 0x1a8]
sub eax, 0x28417727
je 0x10002a50
jmp 0x100015ed
mov eax, dword [ebp - 0x1a8]
sub eax, 0x290dc9b6
je 0x1000218a
jmp 0x10001603
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2bc09da1
je 0x10001a07
jmp 0x10001619
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2c364f8f
je 0x10002bf9
jmp 0x1000162f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2f2637d0
je 0x1000288a
jmp 0x10001645
mov eax, dword [ebp - 0x1a8]
sub eax, 0x334723d4
je 0x10001cba
jmp 0x1000165b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x341444fb
je 0x10002b54
jmp 0x10001671
mov eax, dword [ebp - 0x1a8]
sub eax, 0x37dfcbf5
je 0x10001c2e
jmp 0x10001687
mov eax, dword [ebp - 0x1a8]
sub eax, 0x382fa519
je 0x100019b6
jmp 0x1000169d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3be370a5
je 0x1000227b
jmp 0x100016b3
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3ce9e7af
je 0x100023a6
jmp 0x100016c9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3e4dab57
je 0x10001886
jmp 0x100016df
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3f9fde16
je 0x100024b4
jmp 0x100016f5
mov eax, dword [ebp - 0x1a8]
sub eax, 0x40b0e9f7
je 0x10002a6e
jmp 0x1000170b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x444be2c1
je 0x100022db
jmp 0x10001721
mov eax, dword [ebp - 0x1a8]
sub eax, 0x464244da
je 0x100020e6
jmp 0x10001737
mov eax, dword [ebp - 0x1a8]
sub eax, 0x479ff85a
je 0x10001cea
jmp 0x1000174d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x48309eb5
je 0x10001d84
jmp 0x10001763
mov eax, dword [ebp - 0x1a8]
sub eax, 0x487f3bff
je 0x10001fdf
jmp 0x10001779
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4a3a3aa3
je 0x10002bd8
jmp 0x1000178f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4b71a8cf
je 0x10001a16
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x1a0], 0xdfac74fa
jmp 0x10002d1d
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x184], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x188], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c7e0
add esp, 0xc
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18c], eax
mov eax, 0xe961aae
mov ecx, 0x4b71a8cf
cmp dword [ebp - 0x18c], 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0xd3647f84
sub edx, 1
add edx, 0xd3647f84
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x622ee410
mov ecx, 0x382fa519
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0xb49fd228
sub edx, 1
add edx, 0xb49fd228
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x622ee410
mov ecx, 0x2bc09da1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x40b0e9f7
jmp 0x10002d1d
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x188]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x18c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x194], eax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0xebac57e9
sub edx, 1
add edx, 0xebac57e9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb7ff3166
mov ecx, 0xa45b4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x64a196e8
jmp 0x10002d1d
mov eax, 0xffffffff
cmp dword [ebp - 0x194], eax
sete al
and al, 1
mov byte [ebp - 0x165], al
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x814c5c6e
sub edx, 1
add edx, 0x814c5c6e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5b3d3626
mov ecx, 0x334723d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0xcf2918a7
jmp 0x10002d1d
mov dl, byte [ebp - 0x165]
mov eax, 0xff309686
mov ecx, 0x479ff85a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x341444fb
mov ecx, 0xa3644ce9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0x86958ab7
sub edx, 1
add edx, 0x86958ab7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x341444fb
mov ecx, 0x48309eb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x40b0e9f7
jmp 0x10002d1d
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x3cce1ae8
sub edx, 1
add edx, 0x3cce1ae8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x96babef4
mov ecx, 0xa07957ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x194]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x164], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96babef4
mov ecx, 0xd1f8b35c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x9b03c4e5
jmp 0x10002d1d
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0x373b8524
sub edx, 1
sub edx, 0x373b8524
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e459388
mov ecx, 0x16991398
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x164]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x15d], al
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0x61a56591
sub edx, 1
sub edx, 0x61a56591
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e459388
mov ecx, 0x623017bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dl, byte [ebp - 0x15d]
mov eax, 0x487f3bff
mov ecx, 0xeed0b97d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0xdedccb13
sub edx, 1
add edx, 0xdedccb13
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd738c14a
mov ecx, 0x2b7b4d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x15c], eax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x17d3be93
sub edx, 1
add edx, 0x17d3be93
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd738c14a
mov ecx, 0x5e744f41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a3a3aa3
mov ecx, 0x19fbc7fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x15c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a3a3aa3
mov ecx, 0x290dc9b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x10a86692
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x40b0e9f7
jmp 0x10002d1d
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x4020c1d5
sub edx, 1
add edx, 0x4020c1d5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2c364f8f
mov ecx, 0xab6ff7ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x158], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0x5e9e909c
sub edx, 1
add edx, 0x5e9e909c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c364f8f
mov ecx, 0x3be370a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x93a13fb6
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0xa4bceeb4
sub edx, 1
add edx, 0xa4bceeb4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2fa37d3
mov ecx, 0x444be2c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x158]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x180]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
add eax, 0x640b479
add eax, ecx
sub eax, 0x640b479
mov dword [ebp - 0x154], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
add edx, 0x3d4ea1c5
sub edx, 1
sub edx, 0x3d4ea1c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2fa37d3
mov ecx, 0x4eeedad8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov word [eax], 0
mov dword [ebp - 0x1a0], 0x771f1f72
jmp 0x10002d1d
mov eax, dword [ebp - 0x178]
mov ax, word [eax]
mov word [ebp - 0x14e], ax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x9ce22d32
sub edx, 1
add edx, 0x9ce22d32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xde28e2f
mov ecx, 0x67f74c82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov ax, word [ebp - 0x14e]
movzx eax, ax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1a0], 0xc21d5c1c
jmp 0x10002d1d
mov eax, dword [ebp - 0x148]
movzx esi, word [eax]
mov edx, dword [ebp - 0x14c]
mov eax, 0xa2a6f949
mov ecx, 0xe9260409
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x1a0], 0xeded6628
jmp 0x10002d1d
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x178]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0xce33781d
add ecx, eax
sub ecx, 0xce33781d
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000eb50
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x13d], al
mov dword [ebp - 0x1a0], 0xa14957e6
jmp 0x10002d1d
mov dl, byte [ebp - 0x13d]
mov eax, 0xc6512d6d
mov ecx, 0xe169365a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x8ba1f10c
add eax, ecx
sub eax, 0x8ba1f10c
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1a0], 0x1e7a3a65
jmp 0x10002d1d
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x13c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1a0], 0x2057080f
jmp 0x10002d1d
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
add ecx, 0xd4f0eabd
add ecx, eax
sub ecx, 0xd4f0eabd
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x134]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c940
add esp, 0xc
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x190]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x170]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x16c]
mov byte [eax], cl
mov dword [ebp - 0x1a0], 0xe169365a
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x813d25df
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0x67fde084
sub edx, 1
add edx, 0x67fde084
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb140f24e
mov ecx, 0x9dbd8a64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov eax, dword [ebp - 0x178]
mov ax, word [eax]
mov word [ebp - 0x128], ax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb140f24e
mov ecx, 0x296bb2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0xbb3f34f3
jmp 0x10002d1d
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb48625b0
mov ecx, 0x2f2637d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov ax, word [ebp - 0x128]
sub ax, 0x2501
add ax, 1
add ax, 0x2501
mov word [ebp - 0x126], ax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0xd81295f2
sub edx, 1
add edx, 0xd81295f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb48625b0
mov ecx, 0x9e488b96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0xd4ccc74e
jmp 0x10002d1d
mov eax, dword [ebp - 0x178]
mov cx, word [ebp - 0x126]
mov word [eax], cx
mov dword [ebp - 0x1a0], 0x771f1f72
jmp 0x10002d1d
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x1a0], 0x8c1665ed
jmp 0x10002d1d
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf5396279
mov ecx, 0x61c4ae8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x5fb8e07
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x40b0e9f7
jmp 0x10002d1d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bbe0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x188]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x18c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x1a0], 0x183e8ed3
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0xa3644ce9
jmp 0x10002d1d
mov eax, dword [ebp - 0x194]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1a0], 0xa07957ad
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0x2b7b4d0
jmp 0x10002d1d
mov eax, dword [ebp - 0x15c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x19fbc7fd
jmp 0x10002d1d
mov dword [ebp - 0x1a0], 0xab6ff7ce
jmp 0x10002d1d
mov eax, dword [ebp - 0x158]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1a0], 0x444be2c1
jmp 0x10002d1d
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1a0], 0x1a993735
jmp 0x10002d1d
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1a0], 0x9dbd8a64
jmp 0x10002d1d
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov ax, word [ebp - 0x128]
mov dword [ebp - 0x1a0], 0x2f2637d0
jmp 0x10002d1d
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x198]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x188]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x61c4ae8b
jmp 0x10001209