Function at 0x100012c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x1006b000]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x92], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x91], al
mov dword [ebp - 0x98], 0x9f62f044
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x80b3b23b
je 0x100025a5
jmp 0x1000133b
mov eax, dword [ebp - 0xa0]
sub eax, 0x83165aa5
je 0x1000268c
jmp 0x10001351
mov eax, dword [ebp - 0xa0]
sub eax, 0x8fe28dfe
je 0x100024cb
jmp 0x10001367
mov eax, dword [ebp - 0xa0]
sub eax, 0x90de4110
je 0x1000208e
jmp 0x1000137d
mov eax, dword [ebp - 0xa0]
sub eax, 0x9261a44a
je 0x10002066
jmp 0x10001393
mov eax, dword [ebp - 0xa0]
sub eax, 0x9b31ee29
je 0x100020b4
jmp 0x100013a9
mov eax, dword [ebp - 0xa0]
sub eax, 0x9ce0b2b9
je 0x10002224
jmp 0x100013bf
mov eax, dword [ebp - 0xa0]
sub eax, 0x9cf725ed
je 0x10001af7
jmp 0x100013d5
mov eax, dword [ebp - 0xa0]
sub eax, 0x9f62f044
je 0x10001868
jmp 0x100013eb
mov eax, dword [ebp - 0xa0]
sub eax, 0x9fca6b14
je 0x10001fc2
jmp 0x10001401
mov eax, dword [ebp - 0xa0]
sub eax, 0xa573a705
je 0x10002562
jmp 0x10001417
mov eax, dword [ebp - 0xa0]
sub eax, 0xa7a1ef3b
je 0x10001f98
jmp 0x1000142d
mov eax, dword [ebp - 0xa0]
sub eax, 0xbbf35115
je 0x10002433
jmp 0x10001443
mov eax, dword [ebp - 0xa0]
sub eax, 0xbda1b44d
je 0x10001b24
jmp 0x10001459
mov eax, dword [ebp - 0xa0]
sub eax, 0xc43fcff3
je 0x10001d94
jmp 0x1000146f
mov eax, dword [ebp - 0xa0]
sub eax, 0xc9233d02
je 0x10002596
jmp 0x10001485
mov eax, dword [ebp - 0xa0]
sub eax, 0xcfb50e64
je 0x10001cd9
jmp 0x1000149b
mov eax, dword [ebp - 0xa0]
sub eax, 0xd7172f3d
je 0x1000260e
jmp 0x100014b1
mov eax, dword [ebp - 0xa0]
sub eax, 0xdde80123
je 0x1000196b
jmp 0x100014c7
mov eax, dword [ebp - 0xa0]
sub eax, 0xe0757585
je 0x10001e96
jmp 0x100014dd
mov eax, dword [ebp - 0xa0]
sub eax, 0xed4938e6
je 0x10001cca
jmp 0x100014f3
mov eax, dword [ebp - 0xa0]
sub eax, 0xf89f210f
je 0x100026ff
jmp 0x10001509
mov eax, dword [ebp - 0xa0]
sub eax, 0xfb5fae2b
je 0x10002415
jmp 0x1000151f
mov eax, dword [ebp - 0xa0]
sub eax, 0xffe82a66
je 0x1000244c
jmp 0x10001535
mov eax, dword [ebp - 0xa0]
sub eax, 0x74c222f
je 0x10002075
jmp 0x1000154b
mov eax, dword [ebp - 0xa0]
sub eax, 0x1258fe98
je 0x100019a6
jmp 0x10001561
mov eax, dword [ebp - 0xa0]
sub eax, 0x1292d607
je 0x10001d26
jmp 0x10001577
mov eax, dword [ebp - 0xa0]
sub eax, 0x129a4e45
je 0x10001c0c
jmp 0x1000158d
mov eax, dword [ebp - 0xa0]
sub eax, 0x165cacc8
je 0x10001897
jmp 0x100015a3
mov eax, dword [ebp - 0xa0]
sub eax, 0x16f86e2d
je 0x10001f23
jmp 0x100015b9
mov eax, dword [ebp - 0xa0]
sub eax, 0x18edab02
je 0x10002535
jmp 0x100015cf
mov eax, dword [ebp - 0xa0]
sub eax, 0x18f2e61c
je 0x10002585
jmp 0x100015e5
mov eax, dword [ebp - 0xa0]
sub eax, 0x1af36c5d
je 0x10001e20
jmp 0x100015fb
mov eax, dword [ebp - 0xa0]
sub eax, 0x2a8e0716
je 0x100022f9
jmp 0x10001611
mov eax, dword [ebp - 0xa0]
sub eax, 0x2c3b3932
je 0x10001b6d
jmp 0x10001627
mov eax, dword [ebp - 0xa0]
sub eax, 0x2e3dbb18
je 0x100020cb
jmp 0x1000163d
mov eax, dword [ebp - 0xa0]
sub eax, 0x3213a4aa
je 0x10001f6c
jmp 0x10001653
mov eax, dword [ebp - 0xa0]
sub eax, 0x32a849f7
je 0x10002544
jmp 0x10001669
mov eax, dword [ebp - 0xa0]
sub eax, 0x32e3f981
je 0x10002308
jmp 0x1000167f
mov eax, dword [ebp - 0xa0]
sub eax, 0x3a90c221
je 0x10001e2f
jmp 0x10001695
mov eax, dword [ebp - 0xa0]
sub eax, 0x3c1d9eab
je 0x1000211f
jmp 0x100016ab
mov eax, dword [ebp - 0xa0]
sub eax, 0x3c6db0a0
je 0x10001c1b
jmp 0x100016c1
mov eax, dword [ebp - 0xa0]
sub eax, 0x416f0b50
je 0x100026a1
jmp 0x100016d7
mov eax, dword [ebp - 0xa0]
sub eax, 0x45c0c702
je 0x10001c60
jmp 0x100016ed
mov eax, dword [ebp - 0xa0]
sub eax, 0x4993ca15
je 0x10001b15
jmp 0x10001703
mov eax, dword [ebp - 0xa0]
sub eax, 0x4a6d3a52
je 0x10002473
jmp 0x10001719
mov eax, dword [ebp - 0xa0]
sub eax, 0x4aea5208
je 0x1000264e
jmp 0x1000172f
mov eax, dword [ebp - 0xa0]
sub eax, 0x4f62bf65
je 0x1000200b
jmp 0x10001745
mov eax, dword [ebp - 0xa0]
sub eax, 0x5028c004
je 0x10001f14
jmp 0x1000175b
mov eax, dword [ebp - 0xa0]
sub eax, 0x522b30b8
je 0x10001a1c
jmp 0x10001771
mov eax, dword [ebp - 0xa0]
sub eax, 0x57b42230
je 0x10002668
jmp 0x10001787
mov eax, dword [ebp - 0xa0]
sub eax, 0x595be2c9
je 0x10002155
jmp 0x1000179d
mov eax, dword [ebp - 0xa0]
sub eax, 0x5f1810b9
je 0x10001e4d
jmp 0x100017b3
mov eax, dword [ebp - 0xa0]
sub eax, 0x6087f1aa
je 0x10002275
jmp 0x100017c9
mov eax, dword [ebp - 0xa0]
sub eax, 0x69efda75
je 0x10001ef6
jmp 0x100017df
mov eax, dword [ebp - 0xa0]
sub eax, 0x6e89ce10
je 0x10001ee7
jmp 0x100017f5
mov eax, dword [ebp - 0xa0]
sub eax, 0x7a783669
je 0x1000267a
jmp 0x1000180b
mov eax, dword [ebp - 0xa0]
sub eax, 0x7b6ea6ca
je 0x10002424
jmp 0x10001821
mov eax, dword [ebp - 0xa0]
sub eax, 0x7e824a67
je 0x1000237e
jmp 0x10001837
mov eax, dword [ebp - 0xa0]
sub eax, 0x7f1f63bc
je 0x10002482
jmp 0x1000184d
mov eax, dword [ebp - 0xa0]
sub eax, 0x7fd3b90c
je 0x1000195c
jmp 0x10001863
jmp 0x1000271d
mov al, byte [ebp - 0x92]
mov cl, byte [ebp - 0x91]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9233d02
mov ecx, 0x165cacc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
mov edx, ecx
add edx, 0x74cbf421
sub edx, 1
sub edx, 0x74cbf421
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc9233d02
mov ecx, 0x7fd3b90c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0xdde80123
jmp 0x1000271d
mov ecx, dword [ebp - 0x9c]
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0x1258fe98
jmp 0x1000271d
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
mov edx, ecx
sub edx, 0xfbdf8c4a
sub edx, 1
add edx, 0xfbdf8c4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x80b3b23b
mov ecx, 0x522b30b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c980
add esp, 0xc
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
mov edx, ecx
sub edx, 0x9f50d7d4
sub edx, 1
add edx, 0x9f50d7d4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x80b3b23b
mov ecx, 0x9cf725ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dl, byte [ebp - 0x51]
mov eax, 0x4993ca15
mov ecx, 0xbda1b44d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x18f2e61c
jmp 0x1000271d
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7172f3d
mov ecx, 0x2c3b3932
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd7172f3d
mov ecx, 0x129a4e45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x3c6db0a0
jmp 0x1000271d
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x98], 0x45c0c702
jmp 0x1000271d
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov edx, dword [ebp - 0x78]
mov esi, 0xffffffff
mov eax, 0xcfb50e64
mov ecx, 0xed4938e6
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x18f2e61c
jmp 0x1000271d
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x98], 0x1292d607
jmp 0x1000271d
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4aea5208
mov ecx, 0xc43fcff3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
mov edx, ecx
add edx, 0x45f806e7
sub edx, 1
sub edx, 0x45f806e7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4aea5208
mov ecx, 0x1af36c5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x3a90c221
jmp 0x1000271d
mov dl, byte [ebp - 0x45]
mov eax, 0x5f1810b9
mov ecx, 0x16f86e2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57b42230
mov ecx, 0xe0757585
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57b42230
mov ecx, 0x6e89ce10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x69efda75
jmp 0x1000271d
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x5028c004
jmp 0x1000271d
mov dword [ebp - 0x98], 0x18f2e61c
jmp 0x1000271d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0x3213a4aa
jmp 0x1000271d
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x98], 0xa7a1ef3b
jmp 0x1000271d
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov dword [ebp - 0x98], 0x9fca6b14
jmp 0x1000271d
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a783669
mov ecx, 0x4f62bf65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
mov word [ebp - 0x36], ax
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
mov edx, eax
sub edx, 0x2276a21a
sub edx, 1
add edx, 0x2276a21a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a783669
mov ecx, 0x9261a44a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x74c222f
jmp 0x1000271d
mov ax, word [ebp - 0x36]
movzx eax, ax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x98], 0x90de4110
jmp 0x1000271d
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0x34]
mov eax, 0x7f1f63bc
mov ecx, 0x9b31ee29
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x98], 0x2e3dbb18
jmp 0x1000271d
mov ecx, dword [ebp - 0x30]
add ecx, 0x12dc1c45
add ecx, 0x18
sub ecx, 0x12dc1c45
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x98], 0x3c1d9eab
jmp 0x1000271d
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ecf0
add esp, 8
mov edx, eax
mov eax, 0x595be2c9
mov ecx, 0x7b6ea6ca
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x5dd9fd96
add edx, eax
sub edx, 0x5dd9fd96
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x29b360d
add ecx, eax
add ecx, 0x29b360d
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cae0
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x98], 0x9ce0b2b9
jmp 0x1000271d
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
mov edx, eax
add edx, 0xf1e212fe
sub edx, 1
sub edx, 0xf1e212fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83165aa5
mov ecx, 0x6087f1aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
mov edx, ecx
sub edx, 0x5b4bc263
sub edx, 1
add edx, 0x5b4bc263
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x83165aa5
mov ecx, 0x2a8e0716
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x32e3f981
jmp 0x1000271d
mov ecx, dword [0x1006c338]
mov eax, dword [0x1006c334]
mov edx, ecx
add edx, 0x8a792deb
sub edx, 1
sub edx, 0x8a792deb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x416f0b50
mov ecx, 0x7e824a67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x1c]
sub esi, 0x145d89a6
add esi, eax
add esi, 0x145d89a6
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
mov edx, eax
add edx, 0x9e3660c6
sub edx, 1
sub edx, 0x9e3660c6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x416f0b50
mov ecx, 0xfb5fae2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x7b6ea6ca
jmp 0x1000271d
mov dword [ebp - 0x98], 0xbbf35115
jmp 0x1000271d
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x98], 0xffe82a66
jmp 0x1000271d
mov cx, word [ebp - 0x12]
add cx, 0xa0b5
add cx, 1
sub cx, 0xa0b5
mov eax, dword [ebp - 0x64]
mov word [eax], cx
mov dword [ebp - 0x98], 0x4a6d3a52
jmp 0x1000271d
mov dword [ebp - 0x98], 0x9fca6b14
jmp 0x1000271d
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf89f210f
mov ecx, 0x8fe28dfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x1006c338]
mov ecx, dword [0x1006c334]
mov edx, eax
add edx, 0x5c3a7f21
sub edx, 1
sub edx, 0x5c3a7f21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf89f210f
mov ecx, 0x18edab02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000271d
mov dword [ebp - 0x98], 0x32a849f7
jmp 0x1000271d
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xa573a705
jmp 0x1000271d
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x18f2e61c
jmp 0x1000271d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bd80
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x98], 0x165cacc8
jmp 0x1000271d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c980
add esp, 0xc
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x98], 0x522b30b8
jmp 0x1000271d
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x98], 0x2c3b3932
jmp 0x1000271d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x98], 0xc43fcff3
jmp 0x1000271d
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x98], 0xe0757585
jmp 0x1000271d
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x98], 0x4f62bf65
jmp 0x1000271d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x98], 0x6087f1aa
jmp 0x1000271d
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov dword [ebp - 0x98], 0x7e824a67
jmp 0x1000271d
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x98], 0x8fe28dfe
jmp 0x1000131f