Function at 0x1000aa40
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x8c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [0x10094880]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x8c], 0xdf3cc719
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x94], eax
sub eax, 0x8219580f
je 0x1000bd91
jmp 0x1000aa84
mov eax, dword [ebp - 0x94]
sub eax, 0x823eef5d
je 0x1000bb13
jmp 0x1000aa9a
mov eax, dword [ebp - 0x94]
sub eax, 0x83610259
je 0x1000b215
jmp 0x1000aab0
mov eax, dword [ebp - 0x94]
sub eax, 0x8426fad6
je 0x1000b3fd
jmp 0x1000aac6
mov eax, dword [ebp - 0x94]
sub eax, 0x846fb01c
je 0x1000b7a6
jmp 0x1000aadc
mov eax, dword [ebp - 0x94]
sub eax, 0x8e563ca0
je 0x1000b1bc
jmp 0x1000aaf2
mov eax, dword [ebp - 0x94]
sub eax, 0x911ec675
je 0x1000b64b
jmp 0x1000ab08
mov eax, dword [ebp - 0x94]
sub eax, 0x91cea512
je 0x1000b63c
jmp 0x1000ab1e
mov eax, dword [ebp - 0x94]
sub eax, 0x9cc402f8
je 0x1000bd1a
jmp 0x1000ab34
mov eax, dword [ebp - 0x94]
sub eax, 0x9dad17d8
je 0x1000bc12
jmp 0x1000ab4a
mov eax, dword [ebp - 0x94]
sub eax, 0x9e95b4ee
je 0x1000b82b
jmp 0x1000ab60
mov eax, dword [ebp - 0x94]
sub eax, 0xa1913202
je 0x1000b224
jmp 0x1000ab76
mov eax, dword [ebp - 0x94]
sub eax, 0xa6074555
je 0x1000b26a
jmp 0x1000ab8c
mov eax, dword [ebp - 0x94]
sub eax, 0xabeed0d3
je 0x1000b721
jmp 0x1000aba2
mov eax, dword [ebp - 0x94]
sub eax, 0xaddee78c
je 0x1000b8ff
jmp 0x1000abb8
mov eax, dword [ebp - 0x94]
sub eax, 0xbaf6b312
je 0x1000b146
jmp 0x1000abce
mov eax, dword [ebp - 0x94]
sub eax, 0xbfd70c63
je 0x1000b3d0
jmp 0x1000abe4
mov eax, dword [ebp - 0x94]
sub eax, 0xc843636c
je 0x1000bc21
jmp 0x1000abfa
mov eax, dword [ebp - 0x94]
sub eax, 0xcfa82b05
je 0x1000ba3b
jmp 0x1000ac10
mov eax, dword [ebp - 0x94]
sub eax, 0xcfc5bc41
je 0x1000be80
jmp 0x1000ac26
mov eax, dword [ebp - 0x94]
sub eax, 0xd4666142
je 0x1000bc58
jmp 0x1000ac3c
mov eax, dword [ebp - 0x94]
sub eax, 0xdf3cc719
je 0x1000af9b
jmp 0x1000ac52
mov eax, dword [ebp - 0x94]
sub eax, 0xe032b4a1
je 0x1000b6c1
jmp 0x1000ac68
mov eax, dword [ebp - 0x94]
sub eax, 0xe1207b42
je 0x1000b056
jmp 0x1000ac7e
mov eax, dword [ebp - 0x94]
sub eax, 0xecb3230a
je 0x1000b8e2
jmp 0x1000ac94
mov eax, dword [ebp - 0x94]
sub eax, 0xeed5d2a9
je 0x1000bc88
jmp 0x1000acaa
mov eax, dword [ebp - 0x94]
sub eax, 0xf10c53b5
je 0x1000b550
jmp 0x1000acc0
mov eax, dword [ebp - 0x94]
sub eax, 0xf1ba78d8
je 0x1000bb04
jmp 0x1000acd6
mov eax, dword [ebp - 0x94]
sub eax, 0xf8dc3296
je 0x1000be6e
jmp 0x1000acec
mov eax, dword [ebp - 0x94]
sub eax, 0x60da073
je 0x1000b895
jmp 0x1000ad02
mov eax, dword [ebp - 0x94]
sub eax, 0xd35badf
je 0x1000bb2c
jmp 0x1000ad18
mov eax, dword [ebp - 0x94]
sub eax, 0xd731647
je 0x1000b5be
jmp 0x1000ad2e
mov eax, dword [ebp - 0x94]
sub eax, 0x119bc1e5
je 0x1000b506
jmp 0x1000ad44
mov eax, dword [ebp - 0x94]
sub eax, 0x12252a44
je 0x1000bc41
jmp 0x1000ad5a
mov eax, dword [ebp - 0x94]
sub eax, 0x2082cee6
je 0x1000bda3
jmp 0x1000ad70
mov eax, dword [ebp - 0x94]
sub eax, 0x2abc7315
je 0x1000b730
jmp 0x1000ad86
mov eax, dword [ebp - 0x94]
sub eax, 0x302dba3a
je 0x1000bee0
jmp 0x1000ad9c
mov eax, dword [ebp - 0x94]
sub eax, 0x3049794f
je 0x1000b3ee
jmp 0x1000adb2
mov eax, dword [ebp - 0x94]
sub eax, 0x318131c7
je 0x1000b9cb
jmp 0x1000adc8
mov eax, dword [ebp - 0x94]
sub eax, 0x32ac7eca
je 0x1000b119
jmp 0x1000adde
mov eax, dword [ebp - 0x94]
sub eax, 0x36590ffb
je 0x1000afe8
jmp 0x1000adf4
mov eax, dword [ebp - 0x94]
sub eax, 0x373f6f36
je 0x1000b532
jmp 0x1000ae0a
mov eax, dword [ebp - 0x94]
sub eax, 0x39033f5a
je 0x1000bb9a
jmp 0x1000ae20
mov eax, dword [ebp - 0x94]
sub eax, 0x3d75501c
je 0x1000bac3
jmp 0x1000ae36
mov eax, dword [ebp - 0x94]
sub eax, 0x49947a42
je 0x1000b980
jmp 0x1000ae4c
mov eax, dword [ebp - 0x94]
sub eax, 0x4da8cc82
je 0x1000b44e
jmp 0x1000ae62
mov eax, dword [ebp - 0x94]
sub eax, 0x4f263a42
je 0x1000b8ca
jmp 0x1000ae78
mov eax, dword [ebp - 0x94]
sub eax, 0x51810c08
je 0x1000b137
jmp 0x1000ae8e
mov eax, dword [ebp - 0x94]
sub eax, 0x55ba13c7
je 0x1000bc03
jmp 0x1000aea4
mov eax, dword [ebp - 0x94]
sub eax, 0x56e60923
je 0x1000b2e0
jmp 0x1000aeba
mov eax, dword [ebp - 0x94]
sub eax, 0x58c50cc1
je 0x1000bead
jmp 0x1000aed0
mov eax, dword [ebp - 0x94]
sub eax, 0x5b6024fb
je 0x1000bcd1
jmp 0x1000aee6
mov eax, dword [ebp - 0x94]
sub eax, 0x5c711046
je 0x1000be1d
jmp 0x1000aefc
mov eax, dword [ebp - 0x94]
sub eax, 0x61bfd4f6
je 0x1000b874
jmp 0x1000af12
mov eax, dword [ebp - 0x94]
sub eax, 0x72ff0fc9
je 0x1000bd2b
jmp 0x1000af28
mov eax, dword [ebp - 0x94]
sub eax, 0x745eb992
je 0x1000b995
jmp 0x1000af3e
mov eax, dword [ebp - 0x94]
sub eax, 0x75c99584
je 0x1000b81c
jmp 0x1000af54
mov eax, dword [ebp - 0x94]
sub eax, 0x769b3e5f
je 0x1000b922
jmp 0x1000af6a
mov eax, dword [ebp - 0x94]
sub eax, 0x7abdc2b6
je 0x1000be9e
jmp 0x1000af80
mov eax, dword [ebp - 0x94]
sub eax, 0x7ca15be0
je 0x1000b515
jmp 0x1000af96
jmp 0x1000beea
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x8c], 0x36590ffb
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72ff0fc9
mov ecx, 0xe1207b42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x90]
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x58], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x54], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100258a0
add esp, 0xc
mov eax, dword [ebp - 0x84]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72ff0fc9
mov ecx, 0x32ac7eca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dl, byte [ebp - 0x49]
mov eax, 0x51810c08
mov ecx, 0xbaf6b312
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0xeed5d2a9
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
sub edx, 0xeba0139a
sub edx, 1
add edx, 0xeba0139a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8219580f
mov ecx, 0x8e563ca0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
mov edx, eax
add edx, 0x88bf1900
sub edx, 1
sub edx, 0x88bf1900
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8219580f
mov ecx, 0x83610259
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0xa1913202
jmp 0x1000beea
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x48]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x8c], 0xa6074555
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
sub edx, 0xebf9364e
sub edx, 1
add edx, 0xebf9364e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2082cee6
mov ecx, 0x56e60923
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x74]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x3e], al
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
sub edx, 0x2b36e6f2
sub edx, 1
add edx, 0x2b36e6f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2082cee6
mov ecx, 0xbfd70c63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dl, byte [ebp - 0x3e]
mov eax, 0x8426fad6
mov ecx, 0x3049794f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0xeed5d2a9
jmp 0x1000beea
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
mov edx, eax
add edx, 0x6a29fd9b
sub edx, 1
sub edx, 0x6a29fd9b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c711046
mov ecx, 0x4da8cc82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
sub edx, 0xfa650014
sub edx, 1
add edx, 0xfa650014
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5c711046
mov ecx, 0x119bc1e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x7ca15be0
jmp 0x1000beea
mov eax, dword [ebp - 0x6c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x8c], 0x373f6f36
jmp 0x1000beea
mov dl, byte [ebp - 0x3d]
mov eax, 0xf10c53b5
mov ecx, 0x9e95b4ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8dc3296
mov ecx, 0xd731647
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
add edx, 0x327ba1a3
sub edx, 1
sub edx, 0x327ba1a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf8dc3296
mov ecx, 0x91cea512
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x911ec675
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
sub edx, 0x2d9d1ba1
sub edx, 1
add edx, 0x2d9d1ba1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcfc5bc41
mov ecx, 0xe032b4a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x3c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
mov edx, eax
sub edx, 0x9ecd81d4
sub edx, 1
add edx, 0x9ecd81d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfc5bc41
mov ecx, 0xabeed0d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x2abc7315
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
add edx, 0xa487e24f
sub edx, 1
sub edx, 0xa487e24f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7abdc2b6
mov ecx, 0x846fb01c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
mov edx, ecx
sub edx, 0x24406cfa
sub edx, 1
add edx, 0x24406cfa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7abdc2b6
mov ecx, 0x75c99584
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0xeed5d2a9
jmp 0x1000beea
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov dword [ebp - 0x8c], 0x61bfd4f6
jmp 0x1000beea
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x8c], 0x60da073
jmp 0x1000beea
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x38]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov word [eax], 0
mov dword [ebp - 0x8c], 0x4f263a42
jmp 0x1000beea
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x8c], 0xecb3230a
jmp 0x1000beea
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x8c], 0xaddee78c
jmp 0x1000beea
mov eax, dword [ebp - 0x30]
movzx esi, word [eax]
mov edx, dword [ebp - 0x34]
mov eax, 0xc843636c
mov ecx, 0x769b3e5f
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
sub ecx, 0x6f4067e9
add ecx, 0x18
add ecx, 0x6f4067e9
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x8c], 0x49947a42
jmp 0x1000beea
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x8c], 0x745eb992
jmp 0x1000beea
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10033c60
call fcn.10029200
add esp, 8
mov edx, eax
mov eax, 0x318131c7
mov ecx, 0xf1ba78d8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x8c], 0xcfa82b05
jmp 0x1000beea
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0xc817b5f6
add ecx, eax
sub ecx, 0xc817b5f6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10025a00
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0xe35511b
add eax, ecx
add eax, 0xe35511b
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x8c], 0x3d75501c
jmp 0x1000beea
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov dword [ebp - 0x8c], 0xf1ba78d8
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x823eef5d
jmp 0x1000beea
mov eax, dword [ebp - 0x5c]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x8c], 0xd35badf
jmp 0x1000beea
mov ecx, dword [0x10095d4c]
mov eax, dword [0x10095d48]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58c50cc1
mov ecx, 0x39033f5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov cx, word [ebp - 0x12]
sub cx, 0xd691
add cx, 1
add cx, 0xd691
mov eax, dword [ebp - 0x5c]
mov word [eax], cx
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
mov edx, eax
sub edx, 0x395e6d6a
sub edx, 1
add edx, 0x395e6d6a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58c50cc1
mov ecx, 0x55ba13c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x9dad17d8
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x4f263a42
jmp 0x1000beea
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x8c], 0x12252a44
jmp 0x1000beea
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x8c], 0xd4666142
jmp 0x1000beea
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x8c], 0xeed5d2a9
jmp 0x1000beea
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x302dba3a
mov ecx, 0x5b6024fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov eax, dword [0x10095d4c]
mov ecx, dword [0x10095d48]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x302dba3a
mov ecx, 0x9cc402f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x8c], eax
jmp 0x1000beea
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10024b00
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100258a0
add esp, 0xc
mov eax, dword [ebp - 0x84]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x8c], 0xe1207b42
jmp 0x1000beea
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x8c], 0x8e563ca0
jmp 0x1000beea
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x74]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x8c], 0x56e60923
jmp 0x1000beea
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0x8c], 0x4da8cc82
jmp 0x1000beea
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x8c], 0xd731647
jmp 0x1000beea
mov eax, dword [ebp - 0x3c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x8c], 0xe032b4a1
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x846fb01c
jmp 0x1000beea
mov ax, word [ebp - 0x12]
mov ax, word [ebp - 0x12]
mov ax, word [ebp - 0x12]
mov cx, word [ebp - 0x12]
sub cx, 0xc6e9
add cx, 1
add cx, 0xc6e9
mov eax, dword [ebp - 0x5c]
mov word [eax], cx
mov dword [ebp - 0x8c], 0x39033f5a
jmp 0x1000beea
mov dword [ebp - 0x8c], 0x5b6024fb
jmp 0x1000aa68