Function at 0x1000ea00
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x10096080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
sub edx, 0x631b9e10
sub edx, 1
add edx, 0x631b9e10
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x94], 0x8c8f105d
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x809e6505
je 0x10010172
jmp 0x1000ea84
mov eax, dword [ebp - 0x9c]
sub eax, 0x80a7c8b2
je 0x1000f6ff
jmp 0x1000ea9a
mov eax, dword [ebp - 0x9c]
sub eax, 0x82efb169
je 0x1000ff58
jmp 0x1000eab0
mov eax, dword [ebp - 0x9c]
sub eax, 0x86ae8897
je 0x1000f230
jmp 0x1000eac6
mov eax, dword [ebp - 0x9c]
sub eax, 0x895db6b0
je 0x1000f5d0
jmp 0x1000eadc
mov eax, dword [ebp - 0x9c]
sub eax, 0x897382e7
je 0x1000f775
jmp 0x1000eaf2
mov eax, dword [ebp - 0x9c]
sub eax, 0x8c8f105d
je 0x1000f077
jmp 0x1000eb08
mov eax, dword [ebp - 0x9c]
sub eax, 0x9c795c56
je 0x1000f913
jmp 0x1000eb1e
mov eax, dword [ebp - 0x9c]
sub eax, 0xa051997d
je 0x1000ff09
jmp 0x1000eb34
mov eax, dword [ebp - 0x9c]
sub eax, 0xa384dae7
je 0x1000f4b5
jmp 0x1000eb4a
mov eax, dword [ebp - 0x9c]
sub eax, 0xa3ea1872
je 0x100100b6
jmp 0x1000eb60
mov eax, dword [ebp - 0x9c]
sub eax, 0xa4a5fd64
je 0x1000f364
jmp 0x1000eb76
mov eax, dword [ebp - 0x9c]
sub eax, 0xa739a7a7
je 0x1000fa36
jmp 0x1000eb8c
mov eax, dword [ebp - 0x9c]
sub eax, 0xa85fe9dd
je 0x10010095
jmp 0x1000eba2
mov eax, dword [ebp - 0x9c]
sub eax, 0xab496097
je 0x100100d7
jmp 0x1000ebb8
mov eax, dword [ebp - 0x9c]
sub eax, 0xac03e75a
je 0x1000fce0
jmp 0x1000ebce
mov eax, dword [ebp - 0x9c]
sub eax, 0xadfaeaeb
je 0x1000f7f3
jmp 0x1000ebe4
mov eax, dword [ebp - 0x9c]
sub eax, 0xaff02c57
je 0x1000ff18
jmp 0x1000ebfa
mov eax, dword [ebp - 0x9c]
sub eax, 0xb07dfaeb
je 0x1000f15c
jmp 0x1000ec10
mov eax, dword [ebp - 0x9c]
sub eax, 0xbb221327
je 0x1000f355
jmp 0x1000ec26
mov eax, dword [ebp - 0x9c]
sub eax, 0xbe887c68
je 0x1000f0cb
jmp 0x1000ec3c
mov eax, dword [ebp - 0x9c]
sub eax, 0xc1a4c527
je 0x100100c8
jmp 0x1000ec52
mov eax, dword [ebp - 0x9c]
sub eax, 0xc5ac7ace
je 0x1000f3e3
jmp 0x1000ec68
mov eax, dword [ebp - 0x9c]
sub eax, 0xc5f79dc0
je 0x1000f221
jmp 0x1000ec7e
mov eax, dword [ebp - 0x9c]
sub eax, 0xc97b668b
je 0x1000f16b
jmp 0x1000ec94
mov eax, dword [ebp - 0x9c]
sub eax, 0xd014f2c7
je 0x1000fb94
jmp 0x1000ecaa
mov eax, dword [ebp - 0x9c]
sub eax, 0xd5a6094d
je 0x1000ffcc
jmp 0x1000ecc0
mov eax, dword [ebp - 0x9c]
sub eax, 0xd5ea7d52
je 0x1000f802
jmp 0x1000ecd6
mov eax, dword [ebp - 0x9c]
sub eax, 0xd69fdf87
je 0x1000f9cb
jmp 0x1000ecec
mov eax, dword [ebp - 0x9c]
sub eax, 0xdfd27772
je 0x1000f99b
jmp 0x1000ed02
mov eax, dword [ebp - 0x9c]
sub eax, 0xe49db439
je 0x1000f186
jmp 0x1000ed18
mov eax, dword [ebp - 0x9c]
sub eax, 0xe95e3c17
je 0x1000f6e1
jmp 0x1000ed2e
mov eax, dword [ebp - 0x9c]
sub eax, 0xf6407b60
je 0x1000f65d
jmp 0x1000ed44
mov eax, dword [ebp - 0x9c]
sub eax, 0xf768a366
je 0x10010036
jmp 0x1000ed5a
mov eax, dword [ebp - 0x9c]
sub eax, 0xf78e2f1d
je 0x1000fa7f
jmp 0x1000ed70
mov eax, dword [ebp - 0x9c]
sub eax, 0xf93f0800
je 0x1000fa10
jmp 0x1000ed86
mov eax, dword [ebp - 0x9c]
sub eax, 0xf99d4434
je 0x1000fc2b
jmp 0x1000ed9c
mov eax, dword [ebp - 0x9c]
sub eax, 0x128f89
je 0x1000ff7b
jmp 0x1000edb2
mov eax, dword [ebp - 0x9c]
sub eax, 0xb1130c
je 0x10010027
jmp 0x1000edc8
mov eax, dword [ebp - 0x9c]
sub eax, 0x55b6af7
je 0x1000fe52
jmp 0x1000edde
mov eax, dword [ebp - 0x9c]
sub eax, 0x6aeb6e7
je 0x100100a4
jmp 0x1000edf4
mov eax, dword [ebp - 0x9c]
sub eax, 0xbd3e717
je 0x1000fe0d
jmp 0x1000ee0a
mov eax, dword [ebp - 0x9c]
sub eax, 0x119200a2
je 0x1000f9f0
jmp 0x1000ee20
mov eax, dword [ebp - 0x9c]
sub eax, 0x127e2ccd
je 0x1000fe39
jmp 0x1000ee36
mov eax, dword [ebp - 0x9c]
sub eax, 0x17abf6eb
je 0x1000f434
jmp 0x1000ee4c
mov eax, dword [ebp - 0x9c]
sub eax, 0x1887c8c8
je 0x1000fc6a
jmp 0x1000ee62
mov eax, dword [ebp - 0x9c]
sub eax, 0x1e3e2fa1
je 0x1001021d
jmp 0x1000ee78
mov eax, dword [ebp - 0x9c]
sub eax, 0x1fd33f08
je 0x1000fafe
jmp 0x1000ee8e
mov eax, dword [ebp - 0x9c]
sub eax, 0x21cb92c5
je 0x1000fc3a
jmp 0x1000eea4
mov eax, dword [ebp - 0x9c]
sub eax, 0x243d1c78
je 0x1000f96e
jmp 0x1000eeba
mov eax, dword [ebp - 0x9c]
sub eax, 0x25a88ecc
je 0x1000ff38
jmp 0x1000eed0
mov eax, dword [ebp - 0x9c]
sub eax, 0x319cad4b
je 0x1000f820
jmp 0x1000eee6
mov eax, dword [ebp - 0x9c]
sub eax, 0x3e562cbb
je 0x1000fb0d
jmp 0x1000eefc
mov eax, dword [ebp - 0x9c]
sub eax, 0x4614151b
je 0x1000fb43
jmp 0x1000ef12
mov eax, dword [ebp - 0x9c]
sub eax, 0x4967fbf6
je 0x1000f896
jmp 0x1000ef28
mov eax, dword [ebp - 0x9c]
sub eax, 0x49997532
je 0x1000f5e7
jmp 0x1000ef3e
mov eax, dword [ebp - 0x9c]
sub eax, 0x52bc9ab9
je 0x10010083
jmp 0x1000ef54
mov eax, dword [ebp - 0x9c]
sub eax, 0x606078fd
je 0x1000f904
jmp 0x1000ef6a
mov eax, dword [ebp - 0x9c]
sub eax, 0x63d96ad8
je 0x1001022c
jmp 0x1000ef80
mov eax, dword [ebp - 0x9c]
sub eax, 0x6651f69b
je 0x1000f497
jmp 0x1000ef96
mov eax, dword [ebp - 0x9c]
sub eax, 0x6bf2b7ee
je 0x1000fdfe
jmp 0x1000efac
mov eax, dword [ebp - 0x9c]
sub eax, 0x73141277
je 0x10010118
jmp 0x1000efc2
mov eax, dword [ebp - 0x9c]
sub eax, 0x74cda677
je 0x1000f574
jmp 0x1000efd8
mov eax, dword [ebp - 0x9c]
sub eax, 0x7651646a
je 0x10010015
jmp 0x1000efee
mov eax, dword [ebp - 0x9c]
sub eax, 0x77190740
je 0x1000f523
mov bl, byte [ebp - 0x8e]
mov dh, byte [ebp - 0x8d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb1130c
mov ecx, 0xbe887c68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
mov edx, eax
sub edx, 0x3a7b6530
sub edx, 1
add edx, 0x3a7b6530
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb1130c
mov ecx, 0xb07dfaeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0xc97b668b
jmp 0x10010236
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x94], 0xe49db439
jmp 0x10010236
mov ecx, dword [ebp - 0x98]
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002e710
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov edx, dword [ebp - 0x80]
mov eax, 0xc5f79dc0
mov ecx, 0x86ae8897
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0x128f89
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
sub edx, 0xf074ee67
sub edx, 1
add edx, 0xf074ee67
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf768a366
mov ecx, 0x7c9f66fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0xa4a5fd64
jmp 0x10010236
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x94], 0xc5ac7ace
jmp 0x10010236
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
mov edx, eax
sub edx, 0x8379a49b
sub edx, 1
add edx, 0x8379a49b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52bc9ab9
mov ecx, 0x17abf6eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x4c]
mov ecx, 0xffffffff
cmp eax, ecx
sete al
and al, 1
mov byte [ebp - 0x45], al
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
mov edx, eax
sub edx, 0xa4bbc106
sub edx, 1
add edx, 0xa4bbc106
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52bc9ab9
mov ecx, 0x6651f69b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dl, byte [ebp - 0x45]
mov eax, 0x7b7824b7
mov ecx, 0xa384dae7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa85fe9dd
mov ecx, 0x77190740
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0x128f89
jmp 0x10010236
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x49997532
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
sub edx, 0x9d0a6bf3
sub edx, 1
add edx, 0x9d0a6bf3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6aeb6e7
mov ecx, 0xf6407b60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
sub edx, 0xdf593724
sub edx, 1
add edx, 0xdf593724
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6aeb6e7
mov ecx, 0xe95e3c17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dl, byte [ebp - 0x3d]
mov eax, 0x80a7c8b2
mov ecx, 0x9c795c56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
add edx, 0x35832080
sub edx, 1
sub edx, 0x35832080
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa3ea1872
mov ecx, 0x897382e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
add edx, 0xde7d4e49
sub edx, 1
sub edx, 0xde7d4e49
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa3ea1872
mov ecx, 0xadfaeaeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0xd5ea7d52
jmp 0x10010236
mov eax, dword [ebp - 0x3c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x319cad4b
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
add edx, 0x623cf669
sub edx, 1
sub edx, 0x623cf669
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc1a4c527
mov ecx, 0x4967fbf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc1a4c527
mov ecx, 0x606078fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0x128f89
jmp 0x10010236
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x94], 0x243d1c78
jmp 0x10010236
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x38]
add ecx, 0x4bac66e1
add ecx, eax
sub ecx, 0x4bac66e1
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0xdfd27772
jmp 0x10010236
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x94], 0x7833b839
jmp 0x10010236
mov ax, word [ebp - 0x32]
movzx eax, ax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x94], 0x119200a2
jmp 0x10010236
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov eax, 0xaff02c57
mov ecx, 0xf93f0800
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x94], 0xa739a7a7
jmp 0x10010236
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab496097
mov ecx, 0xf78e2f1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
mov edx, eax
add edx, 0x319e64d1
sub edx, 1
sub edx, 0x319e64d1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab496097
mov ecx, 0x1fd33f08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0x3e562cbb
jmp 0x10010236
mov ecx, dword [ebp - 0x24]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003cedd
call fcn.10032080
add esp, 8
mov edx, eax
mov eax, 0x4614151b
mov ecx, 0x6bf2b7ee
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
mov edx, eax
add edx, 0x2f8a872a
sub edx, 1
sub edx, 0x2f8a872a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73141277
mov ecx, 0xd014f2c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xc15a86e
add edx, eax
sub edx, 0xc15a86e
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x20], eax
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73141277
mov ecx, 0xf99d4434
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0x21cb92c5
jmp 0x10010236
mov eax, dword [ebp - 0x20]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x94], 0x1887c8c8
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
sub edx, 0x210573b5
sub edx, 1
add edx, 0x210573b5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x809e6505
mov ecx, 0xac03e75a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002e870
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
mov edx, ecx
add edx, 0xb822eadf
sub edx, 1
sub edx, 0xb822eadf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x809e6505
mov ecx, 0x7bf8efd2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0xbd3e717
jmp 0x10010236
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x12], ax
mov dword [ebp - 0x94], 0x127e2ccd
jmp 0x10010236
mov eax, dword [ebp - 0x60]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x94], 0x55b6af7
jmp 0x10010236
mov ecx, dword [0x100976d4]
mov eax, dword [0x100976d0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1e3e2fa1
mov ecx, 0x788b411c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov dword [ebp - 0x94], 0x7833b839
jmp 0x10010236
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x25a88ecc
jmp 0x10010236
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x82efb169
jmp 0x10010236
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x128f89
jmp 0x10010236
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
mov edx, eax
sub edx, 0xfb7bf597
sub edx, 1
add edx, 0xfb7bf597
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63d96ad8
mov ecx, 0xd5a6094d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov eax, dword [0x100976d4]
mov ecx, dword [0x100976d0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63d96ad8
mov ecx, 0x7651646a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010236
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d900
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x94], 0xbe887c68
jmp 0x10010236
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x94], 0x7c9f66fb
jmp 0x10010236
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x94], 0x17abf6eb
jmp 0x10010236
mov dword [ebp - 0x94], 0x77190740
jmp 0x10010236
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], 0xf6407b60
jmp 0x10010236
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x897382e7
jmp 0x10010236
mov dword [ebp - 0x94], 0x4967fbf6
jmp 0x10010236
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x94], 0xf78e2f1d
jmp 0x10010236
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x2bf4a168
add edx, eax
sub edx, 0x2bf4a168
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x94], 0xd014f2c7
jmp 0x10010236
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002e870
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xea934505
add esi, eax
sub esi, 0xea934505
mov eax, dword [ebp - 0x58]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x54]
mov byte [eax], cl
mov dword [ebp - 0x94], 0xac03e75a
jmp 0x10010236
mov dword [ebp - 0x94], 0x788b411c
jmp 0x10010236
mov dword [ebp - 0x94], 0xd5a6094d
jmp 0x1000ea68