Function at 0x1000da40
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10095080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x99], al
mov dword [ebp - 0xa0], 0x3ee23cd3
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], eax
sub eax, 0x80db24a5
je 0x1000e31b
jmp 0x1000dabb
mov eax, dword [ebp - 0xa8]
sub eax, 0x843e03fd
je 0x1000e8f3
jmp 0x1000dad1
mov eax, dword [ebp - 0xa8]
sub eax, 0x8dcb934d
je 0x1000e5ec
jmp 0x1000dae7
mov eax, dword [ebp - 0xa8]
sub eax, 0x8e5aecfa
je 0x1000eaad
jmp 0x1000dafd
mov eax, dword [ebp - 0xa8]
sub eax, 0x8f13a54d
je 0x1000f5b7
jmp 0x1000db13
mov eax, dword [ebp - 0xa8]
sub eax, 0x92c0776d
je 0x1000ef7b
jmp 0x1000db29
mov eax, dword [ebp - 0xa8]
sub eax, 0xa9d222a3
je 0x1000f113
jmp 0x1000db3f
mov eax, dword [ebp - 0xa8]
sub eax, 0xb1748f1c
je 0x1000e6e0
jmp 0x1000db55
mov eax, dword [ebp - 0xa8]
sub eax, 0xb9f148fb
je 0x1000f466
jmp 0x1000db6b
mov eax, dword [ebp - 0xa8]
sub eax, 0xbdb1d61a
je 0x1000ea26
jmp 0x1000db81
mov eax, dword [ebp - 0xa8]
sub eax, 0xc1ec061b
je 0x1000f50a
jmp 0x1000db97
mov eax, dword [ebp - 0xa8]
sub eax, 0xc24cdf6c
je 0x1000eabc
jmp 0x1000dbad
mov eax, dword [ebp - 0xa8]
sub eax, 0xc5ebec44
je 0x1000e7cc
jmp 0x1000dbc3
mov eax, dword [ebp - 0xa8]
sub eax, 0xc755772d
je 0x1000f12c
jmp 0x1000dbd9
mov eax, dword [ebp - 0xa8]
sub eax, 0xce13c053
je 0x1000e9aa
jmp 0x1000dbef
mov eax, dword [ebp - 0xa8]
sub eax, 0xcf8c4192
je 0x1000e68a
jmp 0x1000dc05
mov eax, dword [ebp - 0xa8]
sub eax, 0xcf9eddc6
je 0x1000f104
jmp 0x1000dc1b
mov eax, dword [ebp - 0xa8]
sub eax, 0xde62f004
je 0x1000f590
jmp 0x1000dc31
mov eax, dword [ebp - 0xa8]
sub eax, 0xded7fde2
je 0x1000f5fe
jmp 0x1000dc47
mov eax, dword [ebp - 0xa8]
sub eax, 0xe06680dc
je 0x1000f5a2
jmp 0x1000dc5d
mov eax, dword [ebp - 0xa8]
sub eax, 0xe44f3f94
je 0x1000e433
jmp 0x1000dc73
mov eax, dword [ebp - 0xa8]
sub eax, 0xe5355389
je 0x1000ef38
jmp 0x1000dc89
mov eax, dword [ebp - 0xa8]
sub eax, 0xe5f508c6
je 0x1000e451
jmp 0x1000dc9f
mov eax, dword [ebp - 0xa8]
sub eax, 0xe91f7824
je 0x1000f4fb
jmp 0x1000dcb5
mov eax, dword [ebp - 0xa8]
sub eax, 0xe93e6a61
je 0x1000e460
jmp 0x1000dccb
mov eax, dword [ebp - 0xa8]
sub eax, 0xed066415
je 0x1000f679
jmp 0x1000dce1
mov eax, dword [ebp - 0xa8]
sub eax, 0xf13c3591
je 0x1000eb0d
jmp 0x1000dcf7
mov eax, dword [ebp - 0xa8]
sub eax, 0xf7822e5f
je 0x1000eda5
jmp 0x1000dd0d
mov eax, dword [ebp - 0xa8]
sub eax, 0xfa4a196c
je 0x1000ee5a
jmp 0x1000dd23
mov eax, dword [ebp - 0xa8]
sub eax, 0xfb92fc9a
je 0x1000f3c4
jmp 0x1000dd39
mov eax, dword [ebp - 0xa8]
sub eax, 0xfc40df61
je 0x1000f08e
jmp 0x1000dd4f
mov eax, dword [ebp - 0xa8]
sub eax, 0xfe87413b
je 0x1000f65b
jmp 0x1000dd65
mov eax, dword [ebp - 0xa8]
sub eax, 0x3b473d
je 0x1000e7db
jmp 0x1000dd7b
mov eax, dword [ebp - 0xa8]
sub eax, 0x2a8d1e7
je 0x1000f018
jmp 0x1000dd91
mov eax, dword [ebp - 0xa8]
sub eax, 0xc58d757
je 0x1000edb4
jmp 0x1000dda7
mov eax, dword [ebp - 0xa8]
sub eax, 0x106e4aaa
je 0x1000f3b5
jmp 0x1000ddbd
mov eax, dword [ebp - 0xa8]
sub eax, 0x10bec30c
je 0x1000ec68
jmp 0x1000ddd3
mov eax, dword [ebp - 0xa8]
sub eax, 0x11712d3f
je 0x1000f21c
jmp 0x1000dde9
mov eax, dword [ebp - 0xa8]
sub eax, 0x12cc6d2c
je 0x1000e619
jmp 0x1000ddff
mov eax, dword [ebp - 0xa8]
sub eax, 0x146aec99
je 0x1000f364
jmp 0x1000de15
mov eax, dword [ebp - 0xa8]
sub eax, 0x15c602d6
je 0x1000e6a8
jmp 0x1000de2b
mov eax, dword [ebp - 0xa8]
sub eax, 0x16108b63
je 0x1000e485
jmp 0x1000de41
mov eax, dword [ebp - 0xa8]
sub eax, 0x1c20b2f8
je 0x1000f68e
jmp 0x1000de57
mov eax, dword [ebp - 0xa8]
sub eax, 0x1e0030b6
je 0x1000e60a
jmp 0x1000de6d
mov eax, dword [ebp - 0xa8]
sub eax, 0x1e13c15c
je 0x1000ef29
jmp 0x1000de83
mov eax, dword [ebp - 0xa8]
sub eax, 0x1e977356
je 0x1000f57b
jmp 0x1000de99
mov eax, dword [ebp - 0xa8]
sub eax, 0x20110f4a
je 0x1000e1c8
jmp 0x1000deaf
mov eax, dword [ebp - 0xa8]
sub eax, 0x251dc827
je 0x1000e66d
jmp 0x1000dec5
mov eax, dword [ebp - 0xa8]
sub eax, 0x25590e68
je 0x1000e4d4
jmp 0x1000dedb
mov eax, dword [ebp - 0xa8]
sub eax, 0x2ea54cf6
je 0x1000ecfb
jmp 0x1000def1
mov eax, dword [ebp - 0xa8]
sub eax, 0x3045612f
je 0x1000e93c
jmp 0x1000df07
mov eax, dword [ebp - 0xa8]
sub eax, 0x30b3f96b
je 0x1000e756
jmp 0x1000df1d
mov eax, dword [ebp - 0xa8]
sub eax, 0x3da27652
je 0x1000f66a
jmp 0x1000df33
mov eax, dword [ebp - 0xa8]
sub eax, 0x3ee23cd3
je 0x1000e174
jmp 0x1000df49
mov eax, dword [ebp - 0xa8]
sub eax, 0x4166237d
je 0x1000f475
jmp 0x1000df5f
mov eax, dword [ebp - 0xa8]
sub eax, 0x4441f1fd
je 0x1000f14e
jmp 0x1000df75
mov eax, dword [ebp - 0xa8]
sub eax, 0x466c561e
je 0x1000edec
jmp 0x1000df8b
mov eax, dword [ebp - 0xa8]
sub eax, 0x473633bb
je 0x1000f2d8
jmp 0x1000dfa1
mov eax, dword [ebp - 0xa8]
sub eax, 0x475a6802
je 0x1000e347
jmp 0x1000dfb7
mov eax, dword [ebp - 0xa8]
sub eax, 0x4c9b306a
je 0x1000e32a
jmp 0x1000dfcd
mov eax, dword [ebp - 0xa8]
sub eax, 0x4e710c06
je 0x1000ec0c
jmp 0x1000dfe3
mov eax, dword [ebp - 0xa8]
sub eax, 0x4f063f1b
je 0x1000f3d5
jmp 0x1000dff9
mov eax, dword [ebp - 0xa8]
sub eax, 0x50f69d59
je 0x1000ecb2
jmp 0x1000e00f
mov eax, dword [ebp - 0xa8]
sub eax, 0x52bb0f01
je 0x1000f31b
jmp 0x1000e025
mov eax, dword [ebp - 0xa8]
sub eax, 0x5b427796
je 0x1000f19f
mov bl, byte [ebp - 0x9a]
mov dh, byte [ebp - 0x99]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4f063f1b
mov ecx, 0x20110f4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov ecx, dword [ebp - 0xa4]
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov edx, esp
mov dword [ebp - 0x98], edx
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0x94], edx
push eax
mov edx, esp
mov dword [ebp - 0x90], edx
push eax
mov edx, esp
mov dword [ebp - 0x8c], edx
sub esp, 0x104
mov edx, esp
mov dword [ebp - 0x88], edx
push eax
mov edx, esp
mov dword [ebp - 0x84], edx
push eax
mov edx, esp
mov dword [ebp - 0x80], edx
push eax
mov edx, esp
mov dword [ebp - 0x7c], edx
push eax
mov edx, esp
mov dword [ebp - 0x78], edx
push eax
mov edx, esp
mov dword [ebp - 0x74], edx
push eax
mov edx, esp
mov dword [ebp - 0x70], edx
push eax
mov edx, esp
mov dword [ebp - 0x6c], edx
push eax
mov edx, esp
mov dword [ebp - 0x68], edx
push eax
mov edx, esp
mov dword [ebp - 0x64], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d8d0
mov eax, dword [ebp - 0xac]
add esp, 0xc
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
sub edx, 0x353969c3
sub edx, 1
add edx, 0x353969c3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4f063f1b
mov ecx, 0x80db24a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0x4c9b306a
jmp 0x1000f698
mov eax, dword [ebp - 0x60]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x59], al
mov dword [ebp - 0xa0], 0x475a6802
jmp 0x1000f698
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0x70da5c0
sub edx, 1
sub edx, 0x70da5c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb9f148fb
mov ecx, 0x6c979b5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dl, byte [ebp - 0x59]
mov eax, 0xe5f508c6
mov ecx, 0xe93e6a61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xfb92fc9a
jmp 0x1000f698
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa0], 0x16108b63
jmp 0x1000f698
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa0], 0x25590e68
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4166237d
mov ecx, 0x7a2a9ecf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dl, byte [ebp - 0x4a]
mov eax, 0x12cc6d2c
mov ecx, 0x1e0030b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xfb92fc9a
jmp 0x1000f698
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0xa0], 0x251dc827
jmp 0x1000f698
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov dword [ebp - 0xa0], 0xcf8c4192
jmp 0x1000f698
mov dl, byte [ebp - 0x49]
mov eax, 0x15c602d6
mov ecx, 0x3b473d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xa0], 0x6e278b3a
jmp 0x1000f698
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0xfda49f0c
sub edx, 1
sub edx, 0xfda49f0c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe91f7824
mov ecx, 0x30b3f96b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
sub edx, 0xcdc28b44
sub edx, 1
add edx, 0xcdc28b44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe91f7824
mov ecx, 0xc5ebec44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xfb92fc9a
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc1ec061b
mov ecx, 0x7a024850
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d1880bf
mov ecx, 0x3045612f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
mov edx, eax
sub edx, 0x6c364d4
sub edx, 1
add edx, 0x6c364d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d1880bf
mov ecx, 0x7fb841d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x40]
add ecx, 0xc3ee1899
add ecx, eax
sub ecx, 0xc3ee1899
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov dword [ebp - 0xa0], 0x719c69c1
jmp 0x1000f698
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0xf2357b08
sub edx, 1
sub edx, 0xf2357b08
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1e977356
mov ecx, 0x8e5aecfa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xc24cdf6c
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
mov edx, eax
sub edx, 0x5ef95627
sub edx, 1
add edx, 0x5ef95627
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde62f004
mov ecx, 0xf13c3591
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x34]
add eax, 4
add eax, 2
mov dword [ebp - 0x30], eax
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xde62f004
mov ecx, 0x7c54c5f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x29], al
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe06680dc
mov ecx, 0x10bec30c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dl, byte [ebp - 0x29]
mov eax, 0x11712d3f
mov ecx, 0x5f8fb3b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8f13a54d
mov ecx, 0x2ea54cf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x24]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0xc2ba162d
add ecx, eax
sub ecx, 0xc2ba162d
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0x29e7b293
sub edx, 1
sub edx, 0x29e7b293
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8f13a54d
mov ecx, 0xf7822e5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xc58d757
jmp 0x1000f698
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003beed
call fcn.10031240
add esp, 8
mov edx, eax
mov eax, 0x466c561e
mov ecx, 0x2a8d1e7
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xded7fde2
mov ecx, 0xfa4a196c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x1d], al
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0xfead80ac
sub edx, 1
sub edx, 0xfead80ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xded7fde2
mov ecx, 0x1e13c15c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xe5355389
jmp 0x1000f698
mov cl, byte [ebp - 0x1d]
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa0], 0x92c0776d
jmp 0x1000f698
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002da30
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x369f3eb5
add esi, eax
sub esi, 0x369f3eb5
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov dword [ebp - 0xa0], 0x2a8d1e7
jmp 0x1000f698
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0x1d544767
sub edx, 1
sub edx, 0x1d544767
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe87413b
mov ecx, 0xfc40df61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov ecx, dword [0x100966fc]
mov eax, dword [0x100966f8]
mov edx, ecx
add edx, 0x1cf95f74
sub edx, 1
sub edx, 0x1cf95f74
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe87413b
mov ecx, 0xcf9eddc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xa9d222a3
jmp 0x1000f698
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov dword [ebp - 0xa0], 0xc755772d
jmp 0x1000f698
mov cx, word [ebp - 0x12]
xor eax, eax
sub ax, 1
sub cx, ax
mov eax, dword [ebp - 0x70]
mov word [eax], cx
mov dword [ebp - 0xa0], 0x4441f1fd
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
mov edx, eax
sub edx, 0xe0aa4be0
sub edx, 1
add edx, 0xe0aa4be0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3da27652
mov ecx, 0x5b427796
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
mov edx, eax
sub edx, 0x4595a62d
sub edx, 1
add edx, 0x4595a62d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed066415
mov ecx, 0x5c817df2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0], 0x52bb0f01
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c20b2f8
mov ecx, 0x146aec99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov eax, dword [0x100966fc]
mov ecx, dword [0x100966f8]
mov edx, eax
add edx, 0x540e5d5a
sub edx, 1
sub edx, 0x540e5d5a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c20b2f8
mov ecx, 0x106e4aaa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xfb92fc9a
jmp 0x1000f698
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002cac0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0xa4]
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov edx, esp
mov dword [ebp - 0xbc], edx
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0xb8], edx
push eax
mov edx, esp
mov dword [ebp - 0xb0], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0xbc]
mov edx, eax
mov eax, dword [ebp - 0xb8]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d8d0
mov eax, dword [ebp - 0xb4]
add esp, 0xc
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0xa0], 0x20110f4a
jmp 0x1000f698
mov dword [ebp - 0xa0], 0x6c979b5d
jmp 0x1000f698
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa0], 0x7a2a9ecf
jmp 0x1000f698
mov dword [ebp - 0xa0], 0x30b3f96b
jmp 0x1000f698
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], 0x7a024850
jmp 0x1000f698
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa0], 0xbdb1d61a
jmp 0x1000f698
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa0], 0xf13c3591
jmp 0x1000f698
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa0], 0x4e710c06
jmp 0x1000f698
mov eax, dword [ebp - 0x24]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x91b1c52f
add ecx, eax
sub ecx, 0x91b1c52f
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0xa0], 0x2ea54cf6
jmp 0x1000f698
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xc13ecde
add edx, eax
sub edx, 0xc13ecde
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xa0], 0xfa4a196c
jmp 0x1000f698
mov dword [ebp - 0xa0], 0xfc40df61
jmp 0x1000f698
mov dword [ebp - 0xa0], 0x5b427796
jmp 0x1000f698
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa0], 0x5c817df2
jmp 0x1000f698
mov dword [ebp - 0xa0], 0x146aec99
jmp 0x1000da9f