Function at 0x100011b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x9c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x10066800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
mov edx, ecx
sub edx, 0x41d2fa5a
sub edx, 1
add edx, 0x41d2fa5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x96], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x95], al
mov dword [ebp - 0x9c], 0xd96b58dc
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
sub eax, 0x87c5fa17
je 0x100027fa
jmp 0x10001233
mov eax, dword [ebp - 0xa4]
sub eax, 0x890c33cc
je 0x10002a9c
jmp 0x10001249
mov eax, dword [ebp - 0xa4]
sub eax, 0x892f7900
je 0x10002aba
jmp 0x1000125f
mov eax, dword [ebp - 0xa4]
sub eax, 0x89eac210
je 0x10002651
jmp 0x10001275
mov eax, dword [ebp - 0xa4]
sub eax, 0x8e6802b2
je 0x10002ae8
jmp 0x1000128b
mov eax, dword [ebp - 0xa4]
sub eax, 0x912f3e3c
je 0x10002b7d
jmp 0x100012a1
mov eax, dword [ebp - 0xa4]
sub eax, 0x9218e5bd
je 0x10002951
jmp 0x100012b7
mov eax, dword [ebp - 0xa4]
sub eax, 0x934abe84
je 0x100026dc
jmp 0x100012cd
mov eax, dword [ebp - 0xa4]
sub eax, 0x9512c877
je 0x10001d85
jmp 0x100012e3
mov eax, dword [ebp - 0xa4]
sub eax, 0x98e5b6bb
je 0x10001dfa
jmp 0x100012f9
mov eax, dword [ebp - 0xa4]
sub eax, 0x9ad28226
je 0x100027c3
jmp 0x1000130f
mov eax, dword [ebp - 0xa4]
sub eax, 0x9bd3bed1
je 0x100024ae
jmp 0x10001325
mov eax, dword [ebp - 0xa4]
sub eax, 0x9bf262d1
je 0x10002b11
jmp 0x1000133b
mov eax, dword [ebp - 0xa4]
sub eax, 0xa1feb2e5
je 0x10001b17
jmp 0x10001351
mov eax, dword [ebp - 0xa4]
sub eax, 0xa261fd48
je 0x10002900
jmp 0x10001367
mov eax, dword [ebp - 0xa4]
sub eax, 0xa4320ea4
je 0x10001f6d
jmp 0x1000137d
mov eax, dword [ebp - 0xa4]
sub eax, 0xa46f5c1c
je 0x10001973
jmp 0x10001393
mov eax, dword [ebp - 0xa4]
sub eax, 0xa53e6c96
je 0x1000207e
jmp 0x100013a9
mov eax, dword [ebp - 0xa4]
sub eax, 0xa99aba09
je 0x10002a39
jmp 0x100013bf
mov eax, dword [ebp - 0xa4]
sub eax, 0xac20e026
je 0x10002b8c
jmp 0x100013d5
mov eax, dword [ebp - 0xa4]
sub eax, 0xb1721513
je 0x10002192
jmp 0x100013eb
mov eax, dword [ebp - 0xa4]
sub eax, 0xb506717f
je 0x10001b68
jmp 0x10001401
mov eax, dword [ebp - 0xa4]
sub eax, 0xb7339818
je 0x100022d2
jmp 0x10001417
mov eax, dword [ebp - 0xa4]
sub eax, 0xbd6c866f
je 0x10001cf8
jmp 0x1000142d
mov eax, dword [ebp - 0xa4]
sub eax, 0xbdc0dad4
je 0x10001ce9
jmp 0x10001443
mov eax, dword [ebp - 0xa4]
sub eax, 0xc4a23907
je 0x100029a2
jmp 0x10001459
mov eax, dword [ebp - 0xa4]
sub eax, 0xc7a9bd61
je 0x10001ee7
jmp 0x1000146f
mov eax, dword [ebp - 0xa4]
sub eax, 0xca4ae7b2
je 0x10001a0e
jmp 0x10001485
mov eax, dword [ebp - 0xa4]
sub eax, 0xcf6a4345
je 0x10001c6a
jmp 0x1000149b
mov eax, dword [ebp - 0xa4]
sub eax, 0xd0cbbef0
je 0x100021b0
jmp 0x100014b1
mov eax, dword [ebp - 0xa4]
sub eax, 0xd24e236d
je 0x10002583
jmp 0x100014c7
mov eax, dword [ebp - 0xa4]
sub eax, 0xd4703798
je 0x100025cc
jmp 0x100014dd
mov eax, dword [ebp - 0xa4]
sub eax, 0xd7036f1d
je 0x10001e2f
jmp 0x100014f3
mov eax, dword [ebp - 0xa4]
sub eax, 0xd80bb804
je 0x10002823
jmp 0x10001509
mov eax, dword [ebp - 0xa4]
sub eax, 0xd96b58dc
je 0x100018aa
jmp 0x1000151f
mov eax, dword [ebp - 0xa4]
sub eax, 0xeb59249b
je 0x100019a0
jmp 0x10001535
mov eax, dword [ebp - 0xa4]
sub eax, 0xf648f144
je 0x100029c2
jmp 0x1000154b
mov eax, dword [ebp - 0xa4]
sub eax, 0xf786da4e
je 0x10001c21
jmp 0x10001561
mov eax, dword [ebp - 0xa4]
sub eax, 0xfd19708d
je 0x10001ed8
jmp 0x10001577
mov eax, dword [ebp - 0xa4]
sub eax, 0x375e9fb
je 0x10001f82
jmp 0x1000158d
mov eax, dword [ebp - 0xa4]
sub eax, 0x5b4668f
je 0x100027d2
jmp 0x100015a3
mov eax, dword [ebp - 0xa4]
sub eax, 0xb8d5a00
je 0x100025db
jmp 0x100015b9
mov eax, dword [ebp - 0xa4]
sub eax, 0xca13aab
je 0x10001e80
jmp 0x100015cf
mov eax, dword [ebp - 0xa4]
sub eax, 0xd653905
je 0x10002899
jmp 0x100015e5
mov eax, dword [ebp - 0xa4]
sub eax, 0xd8fc8e3
je 0x10001ef6
jmp 0x100015fb
mov eax, dword [ebp - 0xa4]
sub eax, 0x10a1dd55
je 0x10002b9e
jmp 0x10001611
mov eax, dword [ebp - 0xa4]
sub eax, 0x1bbd6fd6
je 0x10002308
jmp 0x10001627
mov eax, dword [ebp - 0xa4]
sub eax, 0x1d6503af
je 0x10002253
jmp 0x1000163d
mov eax, dword [ebp - 0xa4]
sub eax, 0x207af79f
je 0x10002ad9
jmp 0x10001653
mov eax, dword [ebp - 0xa4]
sub eax, 0x218ed3e1
je 0x100026eb
jmp 0x10001669
mov eax, dword [ebp - 0xa4]
sub eax, 0x22fe7150
je 0x100020b0
jmp 0x1000167f
mov eax, dword [ebp - 0xa4]
sub eax, 0x24878505
je 0x10002704
jmp 0x10001695
mov eax, dword [ebp - 0xa4]
sub eax, 0x2b421701
je 0x10001e18
jmp 0x100016ab
mov eax, dword [ebp - 0xa4]
sub eax, 0x32c539e5
je 0x10002a7f
jmp 0x100016c1
mov eax, dword [ebp - 0xa4]
sub eax, 0x3427deef
je 0x10002440
jmp 0x100016d7
mov eax, dword [ebp - 0xa4]
sub eax, 0x354ed64c
je 0x10001c12
jmp 0x100016ed
mov eax, dword [ebp - 0xa4]
sub eax, 0x39aaffc8
je 0x100021e5
jmp 0x10001703
mov eax, dword [ebp - 0xa4]
sub eax, 0x3f35de09
je 0x10001b08
jmp 0x10001719
mov eax, dword [ebp - 0xa4]
sub eax, 0x40449f60
je 0x100018d9
jmp 0x1000172f
mov eax, dword [ebp - 0xa4]
sub eax, 0x43b861db
je 0x1000208d
jmp 0x10001745
mov eax, dword [ebp - 0xa4]
sub eax, 0x44870df0
je 0x10001d94
jmp 0x1000175b
mov eax, dword [ebp - 0xa4]
sub eax, 0x464a6b14
je 0x100029b3
jmp 0x10001771
mov eax, dword [ebp - 0xa4]
sub eax, 0x47f4db11
je 0x100028f1
jmp 0x10001787
mov eax, dword [ebp - 0xa4]
sub eax, 0x4c909de7
je 0x100022c3
jmp 0x1000179d
mov eax, dword [ebp - 0xa4]
sub eax, 0x4e32e3c8
je 0x10002bcb
mov al, byte [ebp - 0x96]
mov cl, byte [ebp - 0x95]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x464a6b14
mov ecx, 0x40449f60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x80], eax
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
mov edx, eax
sub edx, 0x5c06601b
sub edx, 1
add edx, 0x5c06601b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x464a6b14
mov ecx, 0x6bbf306c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x9c], 0xeb59249b
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf648f144
mov ecx, 0xca4ae7b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov ecx, dword [ebp - 0xa0]
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10009e80
add esp, 0xc
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
mov edx, eax
sub edx, 0xbcec78b1
sub edx, 1
add edx, 0xbcec78b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf648f144
mov ecx, 0x68e9b638
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xa261fd48
jmp 0x10002bd5
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
mov edx, eax
add edx, 0xe3977ae2
sub edx, 1
sub edx, 0xe3977ae2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa99aba09
mov ecx, 0xb506717f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa99aba09
mov ecx, 0x354ed64c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xf786da4e
jmp 0x10002bd5
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32c539e5
mov ecx, 0xcf6a4345
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x32c539e5
mov ecx, 0xbdc0dad4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xbd6c866f
jmp 0x10002bd5
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x7c]
mov esi, 0xffffffff
mov eax, 0x44870df0
mov ecx, 0x9512c877
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xa261fd48
jmp 0x10002bd5
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x9c], 0x6ff0673c
jmp 0x10002bd5
mov edx, dword [ebp - 0x78]
mov eax, 0x2b421701
mov ecx, 0xd8fc8e3
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x9c], 0xd7036f1d
jmp 0x10002bd5
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
mov edx, eax
sub edx, 0xc4132552
sub edx, 1
add edx, 0xc4132552
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x890c33cc
mov ecx, 0xca13aab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x890c33cc
mov ecx, 0xfd19708d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xc7a9bd61
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xa261fd48
jmp 0x10002bd5
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x9c], 0xa4320ea4
jmp 0x10002bd5
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x9c], 0x375e9fb
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
mov edx, ecx
sub edx, 0x37cb445f
sub edx, 1
add edx, 0x37cb445f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x892f7900
mov ecx, 0x7a6ed75d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0x43b861db
jmp 0x10002bd5
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x9c], 0x22fe7150
jmp 0x10002bd5
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov dword [ebp - 0x9c], 0x66afb961
jmp 0x10002bd5
mov dl, byte [ebp - 0x31]
mov eax, 0x5b4668f
mov ecx, 0xd0cbbef0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x9c], 0x39aaffc8
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8e6802b2
mov ecx, 0x1d6503af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e6802b2
mov ecx, 0x4c909de7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xb7339818
jmp 0x10002bd5
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100151a0
call fcn.1000c170
add esp, 8
mov edx, eax
mov eax, 0x1bbd6fd6
mov ecx, 0x5ad20d9c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9bf262d1
mov ecx, 0x76d22993
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
sub edx, 0xa04e29ee
add edx, eax
add edx, 0xa04e29ee
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x493e8b0b
add ecx, eax
sub ecx, 0x493e8b0b
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10009fe0
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x9c], 0x9bd3bed1
jmp 0x10002bd5
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov esi, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x8a370a98
add esi, eax
sub esi, 0x8a370a98
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov dword [ebp - 0x9c], 0x5ad20d9c
jmp 0x10002bd5
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x912f3e3c
mov ecx, 0xd4703798
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xb8d5a00
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
mov edx, ecx
sub edx, 0xb5c91148
sub edx, 1
add edx, 0xb5c91148
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac20e026
mov ecx, 0x89eac210
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x68]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x16], ax
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac20e026
mov ecx, 0x934abe84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0x218ed3e1
jmp 0x10002bd5
mov eax, dword [ebp - 0x68]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0x9c], 0x24878505
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
mov edx, ecx
add edx, 0xc8487bb1
sub edx, 1
sub edx, 0xc8487bb1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x10a1dd55
mov ecx, 0x72d9ad39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0x43b861db
jmp 0x10002bd5
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x9c], 0x87c5fa17
jmp 0x10002bd5
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x9c], 0xd80bb804
jmp 0x10002bd5
mov ecx, dword [0x10067b9c]
mov eax, dword [0x10067b98]
mov edx, ecx
add edx, 0x7efb511c
sub edx, 1
sub edx, 0x7efb511c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x524a5323
mov ecx, 0xd653905
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x524a5323
mov ecx, 0x47f4db11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xa261fd48
jmp 0x10002bd5
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
mov edx, eax
sub edx, 0x4d5f0bf3
sub edx, 1
add edx, 0x4d5f0bf3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e32e3c8
mov ecx, 0x9218e5bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov eax, dword [0x10067b9c]
mov ecx, dword [0x10067b98]
mov edx, eax
add edx, 0x705c73b2
sub edx, 1
sub edx, 0x705c73b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e32e3c8
mov ecx, 0xc4a23907
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002bd5
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10009100
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x9c], 0x40449f60
jmp 0x10002bd5
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10009e80
add esp, 0xc
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x9c], 0xca4ae7b2
jmp 0x10002bd5
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x9c], 0xb506717f
jmp 0x10002bd5
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x9c], 0xcf6a4345
jmp 0x10002bd5
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0xca13aab
jmp 0x10002bd5
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov dword [ebp - 0x9c], 0x7a6ed75d
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0x521cffd1
jmp 0x10002bd5
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9c], 0x1d6503af
jmp 0x10002bd5
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9c], 0x76d22993
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0xd24e236d
jmp 0x10002bd5
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x9c], 0x89eac210
jmp 0x10002bd5
mov dword [ebp - 0x9c], 0x72d9ad39
jmp 0x10002bd5
jmp 0x10001217