Function at 0x10001220
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov eax, dword [ebp + 8]
mov eax, dword [0x100a8200]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x1a4], 0x7626f930
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], eax
sub eax, 0x80f02509
je 0x1000281c
jmp 0x1000126b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x829bdd64
je 0x10002915
jmp 0x10001281
mov eax, dword [ebp - 0x1a8]
sub eax, 0x83022540
je 0x1000220e
jmp 0x10001297
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9032f623
je 0x10001bf5
jmp 0x100012ad
mov eax, dword [ebp - 0x1a8]
sub eax, 0x910c6ffa
je 0x10001b15
jmp 0x100012c3
mov eax, dword [ebp - 0x1a8]
sub eax, 0x91c1cd5a
je 0x100019c1
jmp 0x100012d9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9256c063
je 0x10001c7a
jmp 0x100012ef
mov eax, dword [ebp - 0x1a8]
sub eax, 0x961d196c
je 0x10002169
jmp 0x10001305
mov eax, dword [ebp - 0x1a8]
sub eax, 0x97fb1224
je 0x10001c3e
jmp 0x1000131b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x99eabfdd
je 0x10002948
jmp 0x10001331
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9a3f505a
je 0x10001cf0
jmp 0x10001347
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9d979e1e
je 0x100021cb
jmp 0x1000135d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9e8c635d
je 0x100027a4
jmp 0x10001373
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa3c13659
je 0x10001969
jmp 0x10001389
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb0804a41
je 0x10001948
jmp 0x1000139f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbbbe7e6f
je 0x100025b7
jmp 0x100013b5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xbe04e6d9
je 0x1000233c
jmp 0x100013cb
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc8d3c90e
je 0x100027ec
jmp 0x100013e1
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc9281387
je 0x10001f0a
jmp 0x100013f7
mov eax, dword [ebp - 0x1a8]
sub eax, 0xca616a3d
je 0x10002050
jmp 0x1000140d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd0e791f6
je 0x100028e9
jmp 0x10001423
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd69e35d6
je 0x10002094
jmp 0x10001439
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe2990d68
je 0x10001a4b
jmp 0x1000144f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe701e23b
je 0x10001c5f
jmp 0x10001465
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe8f84d7d
je 0x100023b2
jmp 0x1000147b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xef99a630
je 0x10002420
jmp 0x10001491
mov eax, dword [ebp - 0x1a8]
sub eax, 0xefc433fe
je 0x100027fb
jmp 0x100014a7
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf1adff86
je 0x10002079
jmp 0x100014bd
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf2e64895
je 0x1000265d
jmp 0x100014d3
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf4ae1504
je 0x10001b66
jmp 0x100014e9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x133e6d9
je 0x100024be
jmp 0x100014ff
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb75fba7
je 0x10002178
jmp 0x10001515
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc3a8814
je 0x10001f80
jmp 0x1000152b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf5c1b0d
je 0x100020e5
jmp 0x10001541
mov eax, dword [ebp - 0x1a8]
sub eax, 0x10059e9a
je 0x10002771
jmp 0x10001557
mov eax, dword [ebp - 0x1a8]
sub eax, 0x113d8ccc
je 0x100022ac
jmp 0x1000156d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1394ca5d
je 0x10002549
jmp 0x10001583
mov eax, dword [ebp - 0x1a8]
sub eax, 0x17cc4ae5
je 0x10002002
jmp 0x10001599
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1db9286e
je 0x10001d96
jmp 0x100015af
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1e09c76d
je 0x10001b06
jmp 0x100015c5
mov eax, dword [ebp - 0x1a8]
sub eax, 0x205cc55e
je 0x10001ecb
jmp 0x100015db
mov eax, dword [ebp - 0x1a8]
sub eax, 0x209e3ed9
je 0x10001d87
jmp 0x100015f1
mov eax, dword [ebp - 0x1a8]
sub eax, 0x29eb938d
je 0x100018d2
jmp 0x10001607
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2c07b1a2
je 0x10002411
jmp 0x1000161d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2f6c783d
je 0x1000266c
jmp 0x10001633
mov eax, dword [ebp - 0x1a8]
sub eax, 0x31999ae2
je 0x10001e0c
jmp 0x10001649
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3cdadeea
je 0x10002780
jmp 0x1000165f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3e4eb1c9
je 0x10002450
jmp 0x10001675
mov eax, dword [ebp - 0x1a8]
sub eax, 0x3e4f694e
je 0x10001ebc
jmp 0x1000168b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x43e63055
je 0x100026fb
jmp 0x100016a1
mov eax, dword [ebp - 0x1a8]
sub eax, 0x48c8731b
je 0x1000268d
jmp 0x100016b7
mov eax, dword [ebp - 0x1a8]
sub eax, 0x499ea756
je 0x10001a75
jmp 0x100016cd
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4c2e1670
je 0x1000253a
jmp 0x100016e3
mov eax, dword [ebp - 0x1a8]
sub eax, 0x558a4bbe
je 0x1000232d
jmp 0x100016f9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x57519ecc
je 0x10001978
jmp 0x1000170f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5e7e1874
je 0x1000201f
jmp 0x10001725
mov eax, dword [ebp - 0x1a8]
sub eax, 0x612caa93
je 0x10001b87
jmp 0x1000173b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x615dc6a4
je 0x10001a5a
jmp 0x10001751
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6858b448
je 0x10001d78
jmp 0x10001767
mov eax, dword [ebp - 0x1a8]
sub eax, 0x69ad4a4d
je 0x10001ff3
jmp 0x1000177d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x70f1e94a
je 0x1000185c
jmp 0x10001793
mov eax, dword [ebp - 0x1a8]
sub eax, 0x71d01433
je 0x100028c2
jmp 0x100017a9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x742ee1ea
je 0x100028f8
jmp 0x100017bf
mov eax, dword [ebp - 0x1a8]
sub eax, 0x75894639
je 0x10002795
jmp 0x100017d5
mov eax, dword [ebp - 0x1a8]
sub eax, 0x7626f930
je 0x10001806
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
add edx, 0x9ef91c16
sub edx, 1
sub edx, 0x9ef91c16
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75894639
mov ecx, 0x29eb938d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
sub edx, 0xd238ac78
sub edx, 1
add edx, 0xd238ac78
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x75894639
mov ecx, 0xb0804a41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dl, byte [ebp - 0x171]
mov eax, 0xa3c13659
mov ecx, 0x57519ecc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x3cdadeea
jmp 0x10002952
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e8c635d
mov ecx, 0x91c1cd5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x180], eax
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
mov edx, eax
add edx, 0x49d60c60
sub edx, 1
sub edx, 0x49d60c60
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e8c635d
mov ecx, 0xe2990d68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x615dc6a4
jmp 0x10002952
lea eax, [ebp - 0x114]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x1a4], 0x499ea756
jmp 0x10002952
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x170]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x114]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x184], eax
mov edx, 0xffffffff
mov eax, 0x910c6ffa
mov ecx, 0x1e09c76d
cmp dword [ebp - 0x184], edx
cmove eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x3cdadeea
jmp 0x10002952
mov eax, dword [ebp - 0x184]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x1a4], 0xf4ae1504
jmp 0x10002952
cmp dword [ebp - 0x188], 0
setne al
and al, 1
mov byte [ebp - 0x169], al
mov dword [ebp - 0x1a4], 0x612caa93
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc8d3c90e
mov ecx, 0x9032f623
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8d3c90e
mov ecx, 0x97fb1224
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dl, byte [ebp - 0x169]
mov eax, 0xe701e23b
mov ecx, 0x1db9286e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x1a4], 0x9256c063
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
sub edx, 0x25d4f25c
sub edx, 1
add edx, 0x25d4f25c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xefc433fe
mov ecx, 0x9a3f505a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
sub edx, 0x78e539c7
sub edx, 1
add edx, 0x78e539c7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xefc433fe
mov ecx, 0x6858b448
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x209e3ed9
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x3cdadeea
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
add edx, 0xc84ead2b
sub edx, 1
sub edx, 0xc84ead2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x80f02509
mov ecx, 0x31999ae2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x188]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x164], eax
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
add edx, 0x33d208b3
sub edx, 1
sub edx, 0x33d208b3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x80f02509
mov ecx, 0x3e4f694e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x205cc55e
jmp 0x10002952
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x1a4], 0xc9281387
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
add edx, 0xf7229ef5
sub edx, 1
sub edx, 0xf7229ef5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7e6150dc
mov ecx, 0xc3a8814
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x160]
sub eax, 0x3f02beb2
add eax, ecx
add eax, 0x3f02beb2
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7e6150dc
mov ecx, 0x69ad4a4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x17cc4ae5
jmp 0x10002952
mov ax, word [ebp - 0x196]
mov word [ebp - 0x156], ax
mov dword [ebp - 0x1a4], 0x5e7e1874
jmp 0x10002952
mov ax, word [ebp - 0x156]
movzx eax, ax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x194]
add eax, 4
add eax, 2
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1a4], 0xca616a3d
jmp 0x10002952
mov eax, dword [ebp - 0x150]
movzx esi, word [eax]
mov edx, dword [ebp - 0x154]
mov eax, 0x1394ca5d
mov ecx, 0xf1adff86
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x1a4], 0xd69e35d6
jmp 0x10002952
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
mov edx, eax
sub edx, 0x4faf225e
sub edx, 1
add edx, 0x4faf225e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71d01433
mov ecx, 0xf5c1b0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x14c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x194]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x148], eax
movzx eax, word [ebp - 0x196]
imul eax, eax, 0x28
mov dword [ebp - 0x144], eax
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71d01433
mov ecx, 0x961d196c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0xb75fba7
jmp 0x10002952
mov eax, dword [ebp - 0x148]
mov edx, dword [ebp - 0x144]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e220
mov edx, eax
mov eax, 0x9d979e1e
mov ecx, 0x558a4bbe
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1a4], 0x83022540
jmp 0x10002952
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x19d], al
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0xc]
sub eax, 0x2e890cda
add eax, ecx
add eax, 0x2e890cda
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x1a4], 0x113d8ccc
jmp 0x10002952
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c010
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x19c]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x180]
mov eax, dword [ebp - 0x19c]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
lea eax, [ebp - 0x124]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x19d], al
mov dword [ebp - 0x1a4], 0x558a4bbe
jmp 0x10002952
mov dword [ebp - 0x1a4], 0xbe04e6d9
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
sub edx, 0xd353a96e
sub edx, 1
add edx, 0xd353a96e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd0e791f6
mov ecx, 0xe8f84d7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov ax, word [ebp - 0x196]
mov word [ebp - 0x12c], ax
mov eax, dword [0x100a9530]
mov ecx, dword [0x100a952c]
mov edx, eax
sub edx, 0x6a63db29
sub edx, 1
add edx, 0x6a63db29
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0e791f6
mov ecx, 0x2c07b1a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0xef99a630
jmp 0x10002952
mov ax, word [ebp - 0x12c]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x12a], ax
mov dword [ebp - 0x1a4], 0x3e4eb1c9
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x742ee1ea
mov ecx, 0x133e6d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov ax, word [ebp - 0x12a]
mov word [ebp - 0x196], ax
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x742ee1ea
mov ecx, 0x4c2e1670
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x17cc4ae5
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x829bdd64
mov ecx, 0xbbbe7e6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x128], eax
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
add edx, 0x3d298f2a
sub edx, 1
sub edx, 0x3d298f2a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x829bdd64
mov ecx, 0xf2e64895
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x2f6c783d
jmp 0x10002952
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1a4], 0x48c8731b
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x99eabfdd
mov ecx, 0x43e63055
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov ecx, dword [0x100a9530]
mov eax, dword [0x100a952c]
mov edx, ecx
add edx, 0x3031a04e
sub edx, 1
sub edx, 0x3031a04e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x99eabfdd
mov ecx, 0x10059e9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x3cdadeea
jmp 0x10002952
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b2b0
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1a4], 0x29eb938d
jmp 0x10002952
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x1a4], 0x91c1cd5a
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x9032f623
jmp 0x10002952
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1a4], 0x9a3f505a
jmp 0x10002952
mov eax, dword [ebp - 0x188]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x1a4], 0x31999ae2
jmp 0x10002952
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1a4], 0xf5c1b0d
jmp 0x10002952
mov dword [ebp - 0x1a4], 0xe8f84d7d
jmp 0x10002952
mov ax, word [ebp - 0x12a]
mov word [ebp - 0x196], ax
mov dword [ebp - 0x1a4], 0x133e6d9
jmp 0x10002952
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1a4], 0xbbbe7e6f
jmp 0x10002952
mov dword [ebp - 0x1a4], 0x43e63055
jmp 0x1000124f