Function at 0x100012f0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x10064404]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
add edx, 0xbbf042a5
sub edx, 1
sub edx, 0xbbf042a5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0xa8], 0xdcc1f9f8
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x8098f980
je 0x10002da6
jmp 0x10001373
mov eax, dword [ebp - 0xb0]
sub eax, 0x85f04bd8
je 0x10003219
jmp 0x10001389
mov eax, dword [ebp - 0xb0]
sub eax, 0x8af0a28d
je 0x10002e2b
jmp 0x1000139f
mov eax, dword [ebp - 0xb0]
sub eax, 0x8c3cf91d
je 0x10002377
jmp 0x100013b5
mov eax, dword [ebp - 0xb0]
sub eax, 0x90dad1b8
je 0x1000257f
jmp 0x100013cb
mov eax, dword [ebp - 0xb0]
sub eax, 0x91945135
je 0x10002f36
jmp 0x100013e1
mov eax, dword [ebp - 0xb0]
sub eax, 0x934191b8
je 0x10002317
jmp 0x100013f7
mov eax, dword [ebp - 0xb0]
sub eax, 0x935533a7
je 0x1000407e
jmp 0x1000140d
mov eax, dword [ebp - 0xb0]
sub eax, 0x948650e1
je 0x10003c8b
jmp 0x10001423
mov eax, dword [ebp - 0xb0]
sub eax, 0x97915c3f
je 0x10001fcd
jmp 0x10001439
mov eax, dword [ebp - 0xb0]
sub eax, 0x99a179ef
je 0x10002088
jmp 0x1000144f
mov eax, dword [ebp - 0xb0]
sub eax, 0x9ef462a7
je 0x10003c7c
jmp 0x10001465
mov eax, dword [ebp - 0xb0]
sub eax, 0xa135b475
je 0x1000408d
jmp 0x1000147b
mov eax, dword [ebp - 0xb0]
sub eax, 0xa14d56ff
je 0x1000218d
jmp 0x10001491
mov eax, dword [ebp - 0xb0]
sub eax, 0xa2ec5a97
je 0x10003414
jmp 0x100014a7
mov eax, dword [ebp - 0xb0]
sub eax, 0xa332d2bd
je 0x10002954
jmp 0x100014bd
mov eax, dword [ebp - 0xb0]
sub eax, 0xa3c2f068
je 0x10002a25
jmp 0x100014d3
mov eax, dword [ebp - 0xb0]
sub eax, 0xa3e0d4b8
je 0x1000405a
jmp 0x100014e9
mov eax, dword [ebp - 0xb0]
sub eax, 0xa6218788
je 0x10003a16
jmp 0x100014ff
mov eax, dword [ebp - 0xb0]
sub eax, 0xa69c5cab
je 0x10002b5d
jmp 0x10001515
mov eax, dword [ebp - 0xb0]
sub eax, 0xa7370389
je 0x10002478
jmp 0x1000152b
mov eax, dword [ebp - 0xb0]
sub eax, 0xa82b83bc
je 0x1000222b
jmp 0x10001541
mov eax, dword [ebp - 0xb0]
sub eax, 0xa8354a4a
je 0x10002688
jmp 0x10001557
mov eax, dword [ebp - 0xb0]
sub eax, 0xa8ad3f90
je 0x10003119
jmp 0x1000156d
mov eax, dword [ebp - 0xb0]
sub eax, 0xa9e2d2c5
je 0x10004022
jmp 0x10001583
mov eax, dword [ebp - 0xb0]
sub eax, 0xabcc6f4b
je 0x10003187
jmp 0x10001599
mov eax, dword [ebp - 0xb0]
sub eax, 0xabe36dbb
je 0x10003e4d
jmp 0x100015af
mov eax, dword [ebp - 0xb0]
sub eax, 0xb1e93161
je 0x10002679
jmp 0x100015c5
mov eax, dword [ebp - 0xb0]
sub eax, 0xb4470b8d
je 0x1000219c
jmp 0x100015db
mov eax, dword [ebp - 0xb0]
sub eax, 0xbc5ccc02
je 0x10002b0c
jmp 0x100015f1
mov eax, dword [ebp - 0xb0]
sub eax, 0xc1458479
je 0x10002abb
jmp 0x10001607
mov eax, dword [ebp - 0xb0]
sub eax, 0xc3c2f146
je 0x1000397e
jmp 0x1000161d
mov eax, dword [ebp - 0xb0]
sub eax, 0xc504972b
je 0x100028de
jmp 0x10001633
mov eax, dword [ebp - 0xb0]
sub eax, 0xc72997b7
je 0x10003548
jmp 0x10001649
mov eax, dword [ebp - 0xb0]
sub eax, 0xc8efb2ab
je 0x100036db
jmp 0x1000165f
mov eax, dword [ebp - 0xb0]
sub eax, 0xcafb6caa
je 0x100039f8
jmp 0x10001675
mov eax, dword [ebp - 0xb0]
sub eax, 0xd0591e37
je 0x10003f1d
jmp 0x1000168b
mov eax, dword [ebp - 0xb0]
sub eax, 0xd0a40da3
je 0x10002aac
jmp 0x100016a1
mov eax, dword [ebp - 0xb0]
sub eax, 0xd1a2a9d5
je 0x100035e8
jmp 0x100016b7
mov eax, dword [ebp - 0xb0]
sub eax, 0xd2154e64
je 0x10002c80
jmp 0x100016cd
mov eax, dword [ebp - 0xb0]
sub eax, 0xd5969deb
je 0x10003901
jmp 0x100016e3
mov eax, dword [ebp - 0xb0]
sub eax, 0xd6e24128
je 0x10003d85
jmp 0x100016f9
mov eax, dword [ebp - 0xb0]
sub eax, 0xd8079fcc
je 0x100029dc
jmp 0x1000170f
mov eax, dword [ebp - 0xb0]
sub eax, 0xdcc1f9f8
je 0x10001e8e
jmp 0x10001725
mov eax, dword [ebp - 0xb0]
sub eax, 0xdfcbebf7
je 0x10003751
jmp 0x1000173b
mov eax, dword [ebp - 0xb0]
sub eax, 0xdfea17cc
je 0x10003afd
jmp 0x10001751
mov eax, dword [ebp - 0xb0]
sub eax, 0xe1e22ccc
je 0x1000308f
jmp 0x10001767
mov eax, dword [ebp - 0xb0]
sub eax, 0xe42a5371
je 0x10002bc4
jmp 0x1000177d
mov eax, dword [ebp - 0xb0]
sub eax, 0xe56dd11c
je 0x10002cc9
jmp 0x10001793
mov eax, dword [ebp - 0xb0]
sub eax, 0xe8aac13f
je 0x10002f07
jmp 0x100017a9
mov eax, dword [ebp - 0xb0]
sub eax, 0xee412cf2
je 0x100027aa
jmp 0x100017bf
mov eax, dword [ebp - 0xb0]
sub eax, 0xf1b2224d
je 0x100023b7
jmp 0x100017d5
mov eax, dword [ebp - 0xb0]
sub eax, 0xf1f30de9
je 0x10002eb1
jmp 0x100017eb
mov eax, dword [ebp - 0xb0]
sub eax, 0xf4e93925
je 0x10002427
jmp 0x10001801
mov eax, dword [ebp - 0xb0]
sub eax, 0xf5c13cb0
je 0x100024ee
jmp 0x10001817
mov eax, dword [ebp - 0xb0]
sub eax, 0xf5e51b9b
je 0x100020e8
jmp 0x1000182d
mov eax, dword [ebp - 0xb0]
sub eax, 0xf807dbe8
je 0x10002f87
jmp 0x10001843
mov eax, dword [ebp - 0xb0]
sub eax, 0xfc5f0060
je 0x10004001
jmp 0x10001859
mov eax, dword [ebp - 0xb0]
sub eax, 0xfe52fe36
je 0x100032d8
jmp 0x1000186f
mov eax, dword [ebp - 0xb0]
sub eax, 0x13986c5
je 0x10002c2f
jmp 0x10001885
mov eax, dword [ebp - 0xb0]
sub eax, 0x15ecf0d
je 0x10003ef0
jmp 0x1000189b
mov eax, dword [ebp - 0xb0]
sub eax, 0x20f10c2
je 0x10003d4a
jmp 0x100018b1
mov eax, dword [ebp - 0xb0]
sub eax, 0x5eba116
je 0x10002097
jmp 0x100018c7
mov eax, dword [ebp - 0xb0]
sub eax, 0x61d8507
je 0x100029cd
jmp 0x100018dd
mov eax, dword [ebp - 0xb0]
sub eax, 0xa009df0
je 0x100025ed
mov bl, byte [ebp - 0xa2]
mov dh, byte [ebp - 0xa1]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f51ce75
mov ecx, 0x1a36fda0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [ebp - 0xac]
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0x768c30d3
sub edx, 1
add edx, 0x768c30d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5445969a
mov ecx, 0x99a179ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x5eba116
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
add edx, 0x99c87506
sub edx, 1
sub edx, 0x99c87506
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdfea17cc
mov ecx, 0xf5e51b9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100106e0
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0xd69c4df2
sub edx, 1
add edx, 0xd69c4df2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdfea17cc
mov ecx, 0xa14d56ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xb4470b8d
jmp 0x100040d8
mov eax, dword [ebp - 0x94]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x61], al
mov dword [ebp - 0xa8], 0x36a931ac
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
add edx, 0xd142cdb5
sub edx, 1
sub edx, 0xd142cdb5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x57ff2362
mov ecx, 0x46fc73b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0x13d3e9f7
sub edx, 1
add edx, 0x13d3e9f7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4fba2d2e
mov ecx, 0x22759c14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0xa8], 0xf1b2224d
jmp 0x100040d8
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x26d12cc1
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
add edx, 0x2d8ef424
sub edx, 1
sub edx, 0x2d8ef424
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6e24128
mov ecx, 0xa7370389
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
add edx, 0x1812a2c3
sub edx, 1
sub edx, 0x1812a2c3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4030d505
mov ecx, 0xf5c13cb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4030d505
mov ecx, 0x2da5c192
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x41bf935e
mov ecx, 0xa009df0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xa8354a4a
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
add edx, 0x2a4492d4
sub edx, 1
sub edx, 0x2a4492d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x304e3d56
mov ecx, 0x2f3e893e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dl, byte [ebp - 0x55]
mov eax, 0x21f39ef8
mov ecx, 0x52dbfe9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
add edx, 0x180e474a
sub edx, 1
sub edx, 0x180e474a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x39f83c39
mov ecx, 0xa332d2bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x39f83c39
mov ecx, 0x61d8507
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xd8079fcc
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xabe36dbb
mov ecx, 0xa3c2f068
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x84]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
add edx, 0x5381b7a0
sub edx, 1
sub edx, 0x5381b7a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xabe36dbb
mov ecx, 0xd0a40da3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xc1458479
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0x3b69ae0b
sub edx, 1
add edx, 0x3b69ae0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60a16251
mov ecx, 0xbc5ccc02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
add edx, 0x4ca0f3fc
sub edx, 1
sub edx, 0x4ca0f3fc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60a16251
mov ecx, 0xa69c5cab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dl, byte [ebp - 0x49]
mov eax, 0x7b81500a
mov ecx, 0x60e2a8eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0xcbd2f09d
sub edx, 1
add edx, 0xcbd2f09d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd98f04e
mov ecx, 0x260c778e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0xdf41ef96
sub edx, 1
add edx, 0xdf41ef96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b205617
mov ecx, 0xd2154e64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x609ca209
mov ecx, 0xe56dd11c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x609ca209
mov ecx, 0x1101c0fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xa6218788
jmp 0x100040d8
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72c7b065
mov ecx, 0xf1f30de9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x627ec6c2
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x1f15f973
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
add edx, 0x6b567296
sub edx, 1
sub edx, 0x6b567296
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15ecf0d
mov ecx, 0xf807dbe8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0xf76b8417
sub edx, 1
add edx, 0xf76b8417
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15ecf0d
mov ecx, 0x48d3bc32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub eax, 0x54fb272d
xor ecx, ecx
add ecx, 0x18
add eax, ecx
add eax, 0x54fb272d
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
mov word [ebp - 0x32], ax
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22b42d3c
mov ecx, 0x36e1caf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd0591e37
mov ecx, 0xabcc6f4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ax, word [ebp - 0x32]
movzx eax, ax
imul eax, eax, 0x28
mov dword [ebp - 0x30], eax
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
add edx, 0x2e90abd8
sub edx, 1
sub edx, 0x2e90abd8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd0591e37
mov ecx, 0x4387cd7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001a190
call fcn.10011670
add esp, 8
mov edx, eax
mov eax, 0x60f45965
mov ecx, 0x63135292
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xf81c4a11
add edx, eax
sub edx, 0xf81c4a11
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10010840
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
add edx, 0x8604eca9
sub edx, 1
sub edx, 0x8604eca9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x194e2f86
mov ecx, 0x49bd04b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc5f0060
mov ecx, 0x6463aede
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x20e7e98e
mov ecx, 0xd1a2a9d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x63135292
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
sub edx, 0x75995d44
sub edx, 1
add edx, 0x75995d44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa9e2d2c5
mov ecx, 0xdfcbebf7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x948650e1
mov ecx, 0x30d28f56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x382ba2f9
jmp 0x100040d8
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0xe8c4b8d7
sub edx, 1
add edx, 0xe8c4b8d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3e0d4b8
mov ecx, 0x1e1e768a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0xa6218788
jmp 0x100040d8
mov eax, dword [0x100656a8]
mov ecx, dword [0x100656a4]
mov edx, eax
sub edx, 0x1c1120d0
sub edx, 1
add edx, 0x1c1120d0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x935533a7
mov ecx, 0x43c8baa8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100106e0
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0xf5e51b9b
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xc72997b7
jmp 0x100040d8
mov ecx, dword [0x100656a8]
mov eax, dword [0x100656a4]
mov edx, ecx
sub edx, 0x8c37eb54
sub edx, 1
add edx, 0x8c37eb54
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x60a90cdd
mov ecx, 0x45925400
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x137a3ec3
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xf4e93925
jmp 0x100040d8
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa8], 0xa3c2f068
jmp 0x100040d8
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa8], 0xf807dbe8
jmp 0x100040d8
mov ax, word [ebp - 0x32]
mov dword [ebp - 0xa8], 0xabcc6f4b
jmp 0x100040d8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa8], 0x6463aede
jmp 0x100040d8
mov dword [ebp - 0xa8], 0xc8efb2ab
jmp 0x100040d8
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa8], 0xc3c2f146
jmp 0x100040d8
mov dword [ebp - 0xa8], 0x43c8baa8
jmp 0x100040d8
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov dword [ebp - 0xa8], 0x446c3cec
jmp 0x100040d8
jmp 0x10001357