Function at 0x1000e9d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x10097680]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x94], 0x7167f728
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x835a1ea3
je 0x1000f703
jmp 0x1000ea14
mov eax, dword [ebp - 0x9c]
sub eax, 0x85d5012c
je 0x1001048c
jmp 0x1000ea2a
mov eax, dword [ebp - 0x9c]
sub eax, 0x87bdc188
je 0x1001041b
jmp 0x1000ea40
mov eax, dword [ebp - 0x9c]
sub eax, 0x88a44351
je 0x1000fa5c
jmp 0x1000ea56
mov eax, dword [ebp - 0x9c]
sub eax, 0x8c89c733
je 0x1000f8c5
jmp 0x1000ea6c
mov eax, dword [ebp - 0x9c]
sub eax, 0x8eb90c85
je 0x1000ff91
jmp 0x1000ea82
mov eax, dword [ebp - 0x9c]
sub eax, 0x9b0b8f44
je 0x1000f257
jmp 0x1000ea98
mov eax, dword [ebp - 0x9c]
sub eax, 0xa35c1b68
je 0x1000f162
jmp 0x1000eaae
mov eax, dword [ebp - 0x9c]
sub eax, 0xa6d540b5
je 0x1000fc84
jmp 0x1000eac4
mov eax, dword [ebp - 0x9c]
sub eax, 0xa921597e
je 0x1000f9b3
jmp 0x1000eada
mov eax, dword [ebp - 0x9c]
sub eax, 0xab9520a2
je 0x1000ffa0
jmp 0x1000eaf0
mov eax, dword [ebp - 0x9c]
sub eax, 0xb5002398
je 0x1000f266
jmp 0x1000eb06
mov eax, dword [ebp - 0x9c]
sub eax, 0xb6fc081a
je 0x10010321
jmp 0x1000eb1c
mov eax, dword [ebp - 0x9c]
sub eax, 0xb7f616b5
je 0x1000f7f6
jmp 0x1000eb32
mov eax, dword [ebp - 0x9c]
sub eax, 0xb85ee89a
je 0x1000fb9f
jmp 0x1000eb48
mov eax, dword [ebp - 0x9c]
sub eax, 0xb946fa45
je 0x1000fecf
jmp 0x1000eb5e
mov eax, dword [ebp - 0x9c]
sub eax, 0xb9b42b04
je 0x100100bf
jmp 0x1000eb74
mov eax, dword [ebp - 0x9c]
sub eax, 0xba8c28d3
je 0x1000fdc3
jmp 0x1000eb8a
mov eax, dword [ebp - 0x9c]
sub eax, 0xbd23b194
je 0x1000ff3d
jmp 0x1000eba0
mov eax, dword [ebp - 0x9c]
sub eax, 0xbd2ce6db
je 0x1001030f
jmp 0x1000ebb6
mov eax, dword [ebp - 0x9c]
sub eax, 0xc2e3cc59
je 0x1001006e
jmp 0x1000ebcc
mov eax, dword [ebp - 0x9c]
sub eax, 0xc3099046
je 0x10010394
jmp 0x1000ebe2
mov eax, dword [ebp - 0x9c]
sub eax, 0xc343e060
je 0x1000fa4d
jmp 0x1000ebf8
mov eax, dword [ebp - 0x9c]
sub eax, 0xc59c0d95
je 0x1000ffe9
jmp 0x1000ec0e
mov eax, dword [ebp - 0x9c]
sub eax, 0xc8647816
je 0x1000fc2b
jmp 0x1000ec24
mov eax, dword [ebp - 0x9c]
sub eax, 0xc945c3ab
je 0x10010330
jmp 0x1000ec3a
mov eax, dword [ebp - 0x9c]
sub eax, 0xcfabaed7
je 0x1000fd23
jmp 0x1000ec50
mov eax, dword [ebp - 0x9c]
sub eax, 0xd7e1d34d
je 0x100103b5
jmp 0x1000ec66
mov eax, dword [ebp - 0x9c]
sub eax, 0xd9adad7e
je 0x1001045a
jmp 0x1000ec7c
mov eax, dword [ebp - 0x9c]
sub eax, 0xd9d732c3
je 0x10010117
jmp 0x1000ec92
mov eax, dword [ebp - 0x9c]
sub eax, 0xda6823a7
je 0x1000f409
jmp 0x1000eca8
mov eax, dword [ebp - 0x9c]
sub eax, 0xdff8557e
je 0x1001005f
jmp 0x1000ecbe
mov eax, dword [ebp - 0x9c]
sub eax, 0xe0dc46f5
je 0x100102ad
jmp 0x1000ecd4
mov eax, dword [ebp - 0x9c]
sub eax, 0xe2ddcd84
je 0x1000f6f4
jmp 0x1000ecea
mov eax, dword [ebp - 0x9c]
sub eax, 0xe5293607
je 0x1000ff65
jmp 0x1000ed00
mov eax, dword [ebp - 0x9c]
sub eax, 0xebb30fc7
je 0x1000f87c
jmp 0x1000ed16
mov eax, dword [ebp - 0x9c]
sub eax, 0xebf7edf9
je 0x1000f608
jmp 0x1000ed2c
mov eax, dword [ebp - 0x9c]
sub eax, 0xec66d97c
je 0x1000fb57
jmp 0x1000ed42
mov eax, dword [ebp - 0x9c]
sub eax, 0xed508483
je 0x100101fa
jmp 0x1000ed58
mov eax, dword [ebp - 0x9c]
sub eax, 0xed9ba8b4
je 0x1000fbbd
jmp 0x1000ed6e
mov eax, dword [ebp - 0x9c]
sub eax, 0xef60dd37
je 0x1000fe59
jmp 0x1000ed84
mov eax, dword [ebp - 0x9c]
sub eax, 0xf49c86a5
je 0x1000f779
jmp 0x1000ed9a
mov eax, dword [ebp - 0x9c]
sub eax, 0xf5cbd698
je 0x1001043c
jmp 0x1000edb0
mov eax, dword [ebp - 0x9c]
sub eax, 0xf8caffb1
je 0x10010177
jmp 0x1000edc6
mov eax, dword [ebp - 0x9c]
sub eax, 0xf955be
je 0x1000fcb7
jmp 0x1000eddc
mov eax, dword [ebp - 0x9c]
sub eax, 0x858a470
je 0x1000f93d
jmp 0x1000edf2
mov eax, dword [ebp - 0x9c]
sub eax, 0x1652528d
je 0x1000ff4c
jmp 0x1000ee08
mov eax, dword [ebp - 0x9c]
sub eax, 0x17f794ca
je 0x100103a6
jmp 0x1000ee1e
mov eax, dword [ebp - 0x9c]
sub eax, 0x1a0703ca
je 0x1000f0ec
jmp 0x1000ee34
mov eax, dword [ebp - 0x9c]
sub eax, 0x1dcecf6e
je 0x100103fa
jmp 0x1000ee4a
mov eax, dword [ebp - 0x9c]
sub eax, 0x1e0a694c
je 0x1001029c
jmp 0x1000ee60
mov eax, dword [ebp - 0x9c]
sub eax, 0x234c766b
je 0x10010409
jmp 0x1000ee76
mov eax, dword [ebp - 0x9c]
sub eax, 0x26075938
je 0x10010126
jmp 0x1000ee8c
mov eax, dword [ebp - 0x9c]
sub eax, 0x28535401
je 0x1000fb7c
jmp 0x1000eea2
mov eax, dword [ebp - 0x9c]
sub eax, 0x28d8907f
je 0x1000f4d7
jmp 0x1000eeb8
mov eax, dword [ebp - 0x9c]
sub eax, 0x2945107b
je 0x1000f4c8
jmp 0x1000eece
mov eax, dword [ebp - 0x9c]
sub eax, 0x3322a5e6
je 0x1000f82b
jmp 0x1000eee4
mov eax, dword [ebp - 0x9c]
sub eax, 0x351087dc
je 0x1001024b
jmp 0x1000eefa
mov eax, dword [ebp - 0x9c]
sub eax, 0x352f7a67
je 0x1000f45a
jmp 0x1000ef10
mov eax, dword [ebp - 0x9c]
sub eax, 0x363f0397
je 0x1000f80d
jmp 0x1000ef26
mov eax, dword [ebp - 0x9c]
sub eax, 0x3e9eedfc
je 0x1000fe4a
jmp 0x1000ef3c
mov eax, dword [ebp - 0x9c]
sub eax, 0x4c2bb32c
je 0x1001037a
jmp 0x1000ef52
mov eax, dword [ebp - 0x9c]
sub eax, 0x4dd54fb3
je 0x1001042a
jmp 0x1000ef68
mov eax, dword [ebp - 0x9c]
sub eax, 0x50899baa
je 0x1000f676
jmp 0x1000ef7e
mov eax, dword [ebp - 0x9c]
sub eax, 0x5728ff7b
je 0x1000f239
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
sub edx, 0xff4fca98
sub edx, 1
add edx, 0xff4fca98
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe0dc46f5
mov ecx, 0xa35c1b68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x98]
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10030530
add esp, 0xc
mov eax, dword [ebp - 0x88]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
setne al
and al, 1
mov byte [ebp - 0x56], al
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
add edx, 0x34963a00
sub edx, 1
sub edx, 0x34963a00
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0dc46f5
mov ecx, 0x5728ff7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0xed508483
jmp 0x10010496
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x751d281f
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0xd348f401
sub edx, 1
add edx, 0xd348f401
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6fc081a
mov ecx, 0x352f7a67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb6fc081a
mov ecx, 0x2945107b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0xed508483
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
add edx, 0xd7b6c277
sub edx, 1
sub edx, 0xd7b6c277
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc945c3ab
mov ecx, 0x5c3f6663
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4c2bb32c
mov ecx, 0x50899baa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4c2bb32c
mov ecx, 0xe2ddcd84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0x835a1ea3
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
add edx, 0xedaa1979
sub edx, 1
sub edx, 0xedaa1979
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc3099046
mov ecx, 0xf49c86a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x50]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0x483ab49b
sub edx, 1
add edx, 0x483ab49b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3099046
mov ecx, 0x5e8208eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x94], 0x363f0397
jmp 0x10010496
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x3322a5e6
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
add edx, 0xf0764d8b
sub edx, 1
sub edx, 0xf0764d8b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17f794ca
mov ecx, 0xebb30fc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17f794ca
mov ecx, 0x8c89c733
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0xed508483
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
sub edx, 0x4b4c770e
sub edx, 1
add edx, 0x4b4c770e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd7e1d34d
mov ecx, 0xa921597e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x44]
sub ecx, 0x563600bf
add ecx, eax
add ecx, 0x563600bf
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
add edx, 0x86b3ca6d
sub edx, 1
sub edx, 0x86b3ca6d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd7e1d34d
mov ecx, 0xc343e060
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0x88a44351
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
sub edx, 0x8101ff35
sub edx, 1
add edx, 0x8101ff35
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1dcecf6e
mov ecx, 0x7c0de371
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x38], ax
mov dword [ebp - 0x94], 0x28535401
jmp 0x10010496
mov ax, word [ebp - 0x38]
movzx ecx, ax
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov dword [ebp - 0x94], 0xb85ee89a
jmp 0x10010496
mov dl, byte [ebp - 0x35]
mov eax, 0xab9520a2
mov ecx, 0xed9ba8b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x234c766b
mov ecx, 0xc8647816
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0xeb76ed9a
sub edx, 1
add edx, 0xeb76ed9a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x234c766b
mov ecx, 0xa6d540b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0x5cc2ad5a
jmp 0x10010496
mov eax, dword [ebp - 0x2c]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x1d7393e8
add ecx, eax
sub ecx, 0x1d7393e8
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003deed
call fcn.10033ea0
add esp, 8
mov edx, eax
mov eax, 0xcfabaed7
mov ecx, 0xef60dd37
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x24428604
add edx, eax
add edx, 0x24428604
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0xcf902abb
add eax, ecx
sub eax, 0xcf902abb
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x94], 0xba8c28d3
jmp 0x10010496
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10030690
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov esi, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x5b44df84
add esi, eax
sub esi, 0x5b44df84
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov dword [ebp - 0x94], 0x3e9eedfc
jmp 0x10010496
mov dword [ebp - 0x94], 0xef60dd37
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
mov edx, ecx
add edx, 0xafadd88e
sub edx, 1
sub edx, 0xafadd88e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x87bdc188
mov ecx, 0xb946fa45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x87bdc188
mov ecx, 0xbd23b194
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0x1652528d
jmp 0x10010496
mov eax, dword [ebp - 0x68]
mov ax, word [eax]
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x94], 0xe5293607
jmp 0x10010496
mov cx, word [ebp - 0x1e]
xor eax, eax
sub ax, cx
xor ecx, ecx
sub cx, 1
add ax, cx
xor ecx, ecx
sub cx, ax
mov eax, dword [ebp - 0x68]
mov word [eax], cx
mov dword [ebp - 0x94], 0x8eb90c85
jmp 0x10010496
mov dword [ebp - 0x94], 0xec66d97c
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4dd54fb3
mov ecx, 0xc59c0d95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x10098d2c]
mov eax, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4dd54fb3
mov ecx, 0xdff8557e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0xc2e3cc59
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0x5191dae4
sub edx, 1
add edx, 0x5191dae4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5cbd698
mov ecx, 0xb9b42b04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5cbd698
mov ecx, 0xd9d732c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov dword [ebp - 0x94], 0x26075938
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0xc2bab3de
sub edx, 1
add edx, 0xc2bab3de
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9adad7e
mov ecx, 0xf8caffb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0xfa164635
sub edx, 1
add edx, 0xfa164635
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9adad7e
mov ecx, 0x5aa3be10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0xdda4c507
sub edx, 1
add edx, 0xdda4c507
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85d5012c
mov ecx, 0x351087dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov eax, dword [0x10098d2c]
mov ecx, dword [0x10098d28]
mov edx, eax
sub edx, 0xd19ec582
sub edx, 1
add edx, 0xd19ec582
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85d5012c
mov ecx, 0x1e0a694c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10010496
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002f720
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10030530
add esp, 0xc
mov eax, dword [ebp - 0x88]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], 0xa35c1b68
jmp 0x10010496
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x94], 0x5b5ca9a8
jmp 0x10010496
mov dword [ebp - 0x94], 0x352f7a67
jmp 0x10010496
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x94], 0x5c3f6663
jmp 0x10010496
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x94], 0x50899baa
jmp 0x10010496
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x94], 0xf49c86a5
jmp 0x10010496
mov dword [ebp - 0x94], 0xebb30fc7
jmp 0x10010496
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov dword [ebp - 0x94], 0xa921597e
jmp 0x10010496
mov dword [ebp - 0x94], 0x7c0de371
jmp 0x10010496
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x94], 0xc8647816
jmp 0x10010496
mov dword [ebp - 0x94], 0xb946fa45
jmp 0x10010496
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x94], 0xc59c0d95
jmp 0x10010496
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xb9b42b04
jmp 0x10010496
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xf8caffb1
jmp 0x10010496
mov dword [ebp - 0x94], 0x351087dc
jmp 0x1000e9f8