Function at 0x10001400
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x1006a204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xac], 0x549d8b28
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x801e2f52
je 0x10003a42
jmp 0x10001445
mov eax, dword [ebp - 0xb4]
sub eax, 0x80779012
je 0x10002b96
jmp 0x1000145b
mov eax, dword [ebp - 0xb4]
sub eax, 0x80db5ce8
je 0x10002709
jmp 0x10001471
mov eax, dword [ebp - 0xb4]
sub eax, 0x82b6d45b
je 0x100044d0
jmp 0x10001487
mov eax, dword [ebp - 0xb4]
sub eax, 0x8359d63c
je 0x10002243
jmp 0x1000149d
mov eax, dword [ebp - 0xb4]
sub eax, 0x86cefc7c
je 0x1000295a
jmp 0x100014b3
mov eax, dword [ebp - 0xb4]
sub eax, 0x87ba2d23
je 0x1000414e
jmp 0x100014c9
mov eax, dword [ebp - 0xb4]
sub eax, 0x8a03bbc2
je 0x1000260f
jmp 0x100014df
mov eax, dword [ebp - 0xb4]
sub eax, 0x8c64266b
je 0x10003fd4
jmp 0x100014f5
mov eax, dword [ebp - 0xb4]
sub eax, 0x8ca79bbf
je 0x10002c5d
jmp 0x1000150b
mov eax, dword [ebp - 0xb4]
sub eax, 0x8cfed23d
je 0x10003208
jmp 0x10001521
mov eax, dword [ebp - 0xb4]
sub eax, 0x8f6643c3
je 0x1000471d
jmp 0x10001537
mov eax, dword [ebp - 0xb4]
sub eax, 0x98af9c6d
je 0x1000266f
jmp 0x1000154d
mov eax, dword [ebp - 0xb4]
sub eax, 0x99dc7f6f
je 0x100044c1
jmp 0x10001563
mov eax, dword [ebp - 0xb4]
sub eax, 0x9fd3eaa2
je 0x10003f57
jmp 0x10001579
mov eax, dword [ebp - 0xb4]
sub eax, 0xa033926f
je 0x100047a6
jmp 0x1000158f
mov eax, dword [ebp - 0xb4]
sub eax, 0xa190cea9
je 0x100029f9
jmp 0x100015a5
mov eax, dword [ebp - 0xb4]
sub eax, 0xa2d0363f
je 0x10004588
jmp 0x100015bb
mov eax, dword [ebp - 0xb4]
sub eax, 0xa6cd1209
je 0x100046c2
jmp 0x100015d1
mov eax, dword [ebp - 0xb4]
sub eax, 0xa9b553ea
je 0x1000261e
jmp 0x100015e7
mov eax, dword [ebp - 0xb4]
sub eax, 0xac5ea28d
je 0x1000327e
jmp 0x100015fd
mov eax, dword [ebp - 0xb4]
sub eax, 0xb03e44d1
je 0x100029d0
jmp 0x10001613
mov eax, dword [ebp - 0xb4]
sub eax, 0xb0e858c4
je 0x10004918
jmp 0x10001629
mov eax, dword [ebp - 0xb4]
sub eax, 0xb14b1bae
je 0x10002eb0
jmp 0x1000163f
mov eax, dword [ebp - 0xb4]
sub eax, 0xb16463be
je 0x10002dc4
jmp 0x10001655
mov eax, dword [ebp - 0xb4]
sub eax, 0xb2c5bcd9
je 0x1000465d
jmp 0x1000166b
mov eax, dword [ebp - 0xb4]
sub eax, 0xb4e6c221
je 0x100043e0
jmp 0x10001681
mov eax, dword [ebp - 0xb4]
sub eax, 0xb5b997dc
je 0x10003363
jmp 0x10001697
mov eax, dword [ebp - 0xb4]
sub eax, 0xb6493ca8
je 0x100047fa
jmp 0x100016ad
mov eax, dword [ebp - 0xb4]
sub eax, 0xb68f7847
je 0x100034f4
jmp 0x100016c3
mov eax, dword [ebp - 0xb4]
sub eax, 0xb91cddc9
je 0x10002388
jmp 0x100016d9
mov eax, dword [ebp - 0xb4]
sub eax, 0xbb56c9eb
je 0x10004759
jmp 0x100016ef
mov eax, dword [ebp - 0xb4]
sub eax, 0xbe01e138
je 0x100031b7
jmp 0x10001705
mov eax, dword [ebp - 0xb4]
sub eax, 0xbe7d826e
je 0x100048e3
jmp 0x1000171b
mov eax, dword [ebp - 0xb4]
sub eax, 0xc2ed9cec
je 0x10004777
jmp 0x10001731
mov eax, dword [ebp - 0xb4]
sub eax, 0xc42f68d0
je 0x10002909
jmp 0x10001747
mov eax, dword [ebp - 0xb4]
sub eax, 0xc5eb94cd
je 0x1000373d
jmp 0x1000175d
mov eax, dword [ebp - 0xb4]
sub eax, 0xc6f19644
je 0x100042bb
jmp 0x10001773
mov eax, dword [ebp - 0xb4]
sub eax, 0xc72caa09
je 0x1000340a
jmp 0x10001789
mov eax, dword [ebp - 0xb4]
sub eax, 0xc9cb4663
je 0x10003e37
jmp 0x1000179f
mov eax, dword [ebp - 0xb4]
sub eax, 0xce3bbe2c
je 0x10002cd3
jmp 0x100017b5
mov eax, dword [ebp - 0xb4]
sub eax, 0xcf363707
je 0x10002c0c
jmp 0x100017cb
mov eax, dword [ebp - 0xb4]
sub eax, 0xd170f1a0
je 0x1000276e
jmp 0x100017e1
mov eax, dword [ebp - 0xb4]
sub eax, 0xd304bfb5
je 0x10003083
jmp 0x100017f7
mov eax, dword [ebp - 0xb4]
sub eax, 0xd3a0d2b6
je 0x100024c8
jmp 0x1000180d
mov eax, dword [ebp - 0xb4]
sub eax, 0xd4d6cbbe
je 0x100032cf
jmp 0x10001823
mov eax, dword [ebp - 0xb4]
sub eax, 0xd58d059d
je 0x10004036
jmp 0x10001839
mov eax, dword [ebp - 0xb4]
sub eax, 0xd69f0073
je 0x100047c4
jmp 0x1000184f
mov eax, dword [ebp - 0xb4]
sub eax, 0xd9fb77a9
je 0x10004027
jmp 0x10001865
mov eax, dword [ebp - 0xb4]
sub eax, 0xdca88e6a
je 0x10003074
jmp 0x1000187b
mov eax, dword [ebp - 0xb4]
sub eax, 0xdd1e6957
je 0x10002d27
jmp 0x10001891
mov eax, dword [ebp - 0xb4]
sub eax, 0xdd9d38c9
je 0x100047e5
jmp 0x100018a7
mov eax, dword [ebp - 0xb4]
sub eax, 0xe22d2502
je 0x10002379
jmp 0x100018bd
mov eax, dword [ebp - 0xb4]
sub eax, 0xe38f9a70
je 0x10004218
jmp 0x100018d3
mov eax, dword [ebp - 0xb4]
sub eax, 0xe5a36424
je 0x10004285
jmp 0x100018e9
mov eax, dword [ebp - 0xb4]
sub eax, 0xe75c0742
je 0x10004809
jmp 0x100018ff
mov eax, dword [ebp - 0xb4]
sub eax, 0xe9174f17
je 0x10003851
jmp 0x10001915
mov eax, dword [ebp - 0xb4]
sub eax, 0xeab79aee
je 0x10004331
jmp 0x1000192b
mov eax, dword [ebp - 0xb4]
sub eax, 0xec6902de
je 0x100029df
jmp 0x10001941
mov eax, dword [ebp - 0xb4]
sub eax, 0xecbf58b8
je 0x100042a0
jmp 0x10001957
mov eax, dword [ebp - 0xb4]
sub eax, 0xeeda9cfc
je 0x10004607
jmp 0x1000196d
mov eax, dword [ebp - 0xb4]
sub eax, 0xeef40f70
je 0x10004465
jmp 0x10001983
mov eax, dword [ebp - 0xb4]
sub eax, 0xf413e73b
je 0x10003789
jmp 0x10001999
mov eax, dword [ebp - 0xb4]
sub eax, 0xf52c4c60
je 0x100048c5
jmp 0x100019af
mov eax, dword [ebp - 0xb4]
sub eax, 0xf6708e8c
je 0x10002252
mov dword [ebp - 0xac], 0xf6708e8c
jmp 0x100049d3
mov dword [ebp - 0xac], 0xb91cddc9
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0x1920f9a2
sub edx, 1
sub edx, 0x1920f9a2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa6cd1209
mov ecx, 0xfb6f2703
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5a36424
mov ecx, 0x728ad2ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0xa9b553ea
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0x4bcacae2
sub edx, 1
sub edx, 0x4bcacae2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8f6643c3
mov ecx, 0x98af9c6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
sub edx, 0xe6dbe983
sub edx, 1
add edx, 0xe6dbe983
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8f6643c3
mov ecx, 0x753b4cf8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
sub edx, 0x693879e
sub edx, 1
add edx, 0x693879e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xecbf58b8
mov ecx, 0xd170f1a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x60c06ea1
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0xed601f34
sub edx, 1
sub edx, 0xed601f34
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb56c9eb
mov ecx, 0x86cefc7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0x524bca0a
sub edx, 1
sub edx, 0x524bca0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb56c9eb
mov ecx, 0xb03e44d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x47cf158a
jmp 0x100049d3
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xac], 0xa190cea9
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
sub edx, 0x9834ca42
sub edx, 1
add edx, 0x9834ca42
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc6f19644
mov ecx, 0x2fd62c0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0x1601d806
sub edx, 1
sub edx, 0x1601d806
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x49012c26
mov ecx, 0xcf363707
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0xc5f38201
sub edx, 1
sub edx, 0xc5f38201
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b6fbd9a
mov ecx, 0x8ca79bbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0x6ab554b7
sub edx, 1
sub edx, 0x6ab554b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc2ed9cec
mov ecx, 0xce3bbe2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2ed9cec
mov ecx, 0xdd1e6957
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b6fbd9a
mov ecx, 0x5493484e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0xeebee8be
sub edx, 1
sub edx, 0xeebee8be
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x82b6d45b
mov ecx, 0x3acbcc45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dl, byte [ebp - 0x4d]
mov eax, 0x29d146f4
mov ecx, 0x1fc81242
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0xd304bfb5
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5310e4b0
mov ecx, 0x1e9ae4b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
sub edx, 0xf9034c6e
sub edx, 1
add edx, 0xf9034c6e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5310e4b0
mov ecx, 0x8cfed23d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
sub edx, 0xf44ebacf
sub edx, 1
add edx, 0xf44ebacf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd69f0073
mov ecx, 0xac5ea28d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0xcb59036d
sub edx, 1
sub edx, 0xcb59036d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd69f0073
mov ecx, 0xd4d6cbbe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x6d4f611a
jmp 0x100049d3
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x703bf890
mov ecx, 0xc72caa09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x2597883b
jmp 0x100049d3
mov eax, dword [ebp - 0x7c]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0x688a783f
sub edx, 1
sub edx, 0x688a783f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30fc6837
mov ecx, 0x4d57602e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x2252973c
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0xb7cd5817
sub edx, 1
sub edx, 0xb7cd5817
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58469a0d
mov ecx, 0x58412fbe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0x5d07a9c2
sub edx, 1
sub edx, 0x5d07a9c2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb6493ca8
mov ecx, 0x2f2f9d85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
sub edx, 0xa0ccd2f8
add edx, eax
add edx, 0xa0ccd2f8
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011a30
add esp, 0xc
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x3d64d37e
add esi, eax
add esi, 0x3d64d37e
mov eax, dword [ebp - 0x74]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x70]
mov byte [eax], cl
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
sub edx, 0xb3e75b63
sub edx, 1
add edx, 0xb3e75b63
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe75c0742
mov ecx, 0x5a94dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0x7c]
mov ax, word [eax]
mov word [ebp - 0x18], ax
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0xf7749ea8
sub edx, 1
sub edx, 0xf7749ea8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe7d826e
mov ecx, 0x5b5ebd82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x20adf860
jmp 0x100049d3
mov eax, dword [ebp - 0x7c]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0e858c4
mov ecx, 0xd9fb77a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x3f078377
jmp 0x100049d3
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x1a37e42f
jmp 0x100049d3
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
add edx, 0x7b3332b2
sub edx, 1
sub edx, 0x7b3332b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73fa8826
mov ecx, 0xfc0fcafc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100118d0
add esp, 0xc
mov eax, dword [ebp - 0xa8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0x188ef4d7
jmp 0x100049d3
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], 0xd3a0d2b6
jmp 0x100049d3
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xac], 0x80db5ce8
jmp 0x100049d3
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0xad3685f8
sub edx, 1
sub edx, 0xad3685f8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2758281b
mov ecx, 0xeab79aee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [0x1006b4a8]
mov eax, dword [0x1006b4a4]
mov edx, ecx
add edx, 0xefd62f53
sub edx, 1
sub edx, 0xefd62f53
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2758281b
mov ecx, 0xb4e6c221
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x2fd62c0c
jmp 0x100049d3
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
mov edx, eax
sub edx, 0x7cc79df8
sub edx, 1
add edx, 0x7cc79df8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7803aa34
mov ecx, 0x99dc7f6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0x8ca79bbf
jmp 0x100049d3
mov dword [ebp - 0xac], 0x3acbcc45
jmp 0x100049d3
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov eax, dword [0x1006b4a8]
mov ecx, dword [0x1006b4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52bf1677
mov ecx, 0xeeda9cfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x100049d3
mov dword [ebp - 0xac], 0xb5b997dc
jmp 0x100049d3
mov dword [ebp - 0xac], 0xf7ba3698
jmp 0x100049d3
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xac], 0xfb6f2703
jmp 0x100049d3
mov dword [ebp - 0xac], 0x98af9c6d
jmp 0x100049d3
mov dword [ebp - 0xac], 0x86cefc7c
jmp 0x100049d3
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0xce3bbe2c
jmp 0x100049d3
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x14ac2952
jmp 0x100049d3
mov dword [ebp - 0xac], 0xac5ea28d
jmp 0x100049d3
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xac], 0x12ea5ad
jmp 0x100049d3
mov dword [ebp - 0xac], 0x2f2f9d85
jmp 0x100049d3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
sub edx, 0xbda055d4
add edx, eax
add edx, 0xbda055d4
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011a30
add esp, 0xc
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x74]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x70]
mov byte [eax], cl
mov dword [ebp - 0xac], 0x801e2f52
jmp 0x100049d3
mov dword [ebp - 0xac], 0xfac87da1
jmp 0x100049d3
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0xc9cb4663
jmp 0x100049d3
mov eax, dword [ebp - 0x7c]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0xac], 0x8c64266b
jmp 0x100049d3
jmp 0x10001429