Function at 0x10001580
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x1006e204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
sub edx, 0x25a27749
sub edx, 1
add edx, 0x25a27749
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0xa8], 0x51df06b3
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x860b4be3
je 0x10003555
jmp 0x10001604
mov eax, dword [ebp - 0xb0]
sub eax, 0x86b89a24
je 0x100042fc
jmp 0x1000161a
mov eax, dword [ebp - 0xb0]
sub eax, 0x874f2eeb
je 0x100038da
jmp 0x10001630
mov eax, dword [ebp - 0xb0]
sub eax, 0x8815d283
je 0x1000468f
jmp 0x10001646
mov eax, dword [ebp - 0xb0]
sub eax, 0x8a81d799
je 0x10004705
jmp 0x1000165c
mov eax, dword [ebp - 0xb0]
sub eax, 0x8a9d8072
je 0x1000460a
jmp 0x10001672
mov eax, dword [ebp - 0xb0]
sub eax, 0x8e405edb
je 0x10003b16
jmp 0x10001688
mov eax, dword [ebp - 0xb0]
sub eax, 0x96b58bcb
je 0x10003496
jmp 0x1000169e
mov eax, dword [ebp - 0xb0]
sub eax, 0x96ed3599
je 0x10004c56
jmp 0x100016b4
mov eax, dword [ebp - 0xb0]
sub eax, 0x9936e9f7
je 0x10004eed
jmp 0x100016ca
mov eax, dword [ebp - 0xb0]
sub eax, 0x997c1a33
je 0x1000505c
jmp 0x100016e0
mov eax, dword [ebp - 0xb0]
sub eax, 0x9a2c7212
je 0x10005110
jmp 0x100016f6
mov eax, dword [ebp - 0xb0]
sub eax, 0x9d9b4933
je 0x10004079
jmp 0x1000170c
mov eax, dword [ebp - 0xb0]
sub eax, 0x9f04f1b3
je 0x10004a3c
jmp 0x10001722
mov eax, dword [ebp - 0xb0]
sub eax, 0xa16e89d4
je 0x10004be5
jmp 0x10001738
mov eax, dword [ebp - 0xb0]
sub eax, 0xa3e220d1
je 0x10004756
jmp 0x1000174e
mov eax, dword [ebp - 0xb0]
sub eax, 0xa532fe3f
je 0x1000454b
jmp 0x10001764
mov eax, dword [ebp - 0xb0]
sub eax, 0xa7526117
je 0x1000286a
jmp 0x1000177a
mov eax, dword [ebp - 0xb0]
sub eax, 0xa89746d5
je 0x100044fa
jmp 0x10001790
mov eax, dword [ebp - 0xb0]
sub eax, 0xa9320151
je 0x10003aa0
jmp 0x100017a6
mov eax, dword [ebp - 0xb0]
sub eax, 0xaaafd3e1
je 0x100030fd
jmp 0x100017bc
mov eax, dword [ebp - 0xb0]
sub eax, 0xac16e9fb
je 0x10004ede
jmp 0x100017d2
mov eax, dword [ebp - 0xb0]
sub eax, 0xaf6e3b92
je 0x10002efd
jmp 0x100017e8
mov eax, dword [ebp - 0xb0]
sub eax, 0xb032d27d
je 0x10002bb1
jmp 0x100017fe
mov eax, dword [ebp - 0xb0]
sub eax, 0xb33c9f34
je 0x100039d9
jmp 0x10001814
mov eax, dword [ebp - 0xb0]
sub eax, 0xb8acbf8f
je 0x10004ea2
jmp 0x1000182a
mov eax, dword [ebp - 0xb0]
sub eax, 0xbcd3d8f4
je 0x10002f82
jmp 0x10001840
mov eax, dword [ebp - 0xb0]
sub eax, 0xbe6313c9
je 0x100042b3
jmp 0x10001856
mov eax, dword [ebp - 0xb0]
sub eax, 0xc1424afe
je 0x10002e63
jmp 0x1000186c
mov eax, dword [ebp - 0xb0]
sub eax, 0xc15596dd
je 0x10003b99
jmp 0x10001882
mov eax, dword [ebp - 0xb0]
sub eax, 0xc41db1d5
je 0x10003667
jmp 0x10001898
mov eax, dword [ebp - 0xb0]
sub eax, 0xc5047214
je 0x100050f0
jmp 0x100018ae
mov eax, dword [ebp - 0xb0]
sub eax, 0xc6c8892c
je 0x10003564
jmp 0x100018c4
mov eax, dword [ebp - 0xb0]
sub eax, 0xc6d81011
je 0x10004b60
jmp 0x100018da
mov eax, dword [ebp - 0xb0]
sub eax, 0xc6f30a04
je 0x10003dba
jmp 0x100018f0
mov eax, dword [ebp - 0xb0]
sub eax, 0xc732e89a
je 0x1000276e
jmp 0x10001906
mov eax, dword [ebp - 0xb0]
sub eax, 0xc8004cd3
je 0x10004ecf
jmp 0x1000191c
mov eax, dword [ebp - 0xb0]
sub eax, 0xcaf817e4
je 0x10004904
jmp 0x10001932
mov eax, dword [ebp - 0xb0]
sub eax, 0xcaf9ba61
je 0x10002f9c
jmp 0x10001948
mov eax, dword [ebp - 0xb0]
sub eax, 0xce72d546
je 0x10002700
jmp 0x1000195e
mov eax, dword [ebp - 0xb0]
sub eax, 0xcfe96bba
je 0x10004680
jmp 0x10001974
mov eax, dword [ebp - 0xb0]
sub eax, 0xd11647e5
je 0x10004b6f
jmp 0x1000198a
mov eax, dword [ebp - 0xb0]
sub eax, 0xd27d0705
je 0x1000448b
jmp 0x100019a0
mov eax, dword [ebp - 0xb0]
sub eax, 0xd35078de
je 0x10002b0e
jmp 0x100019b6
mov eax, dword [ebp - 0xb0]
sub eax, 0xd6cfceac
je 0x10004ec0
jmp 0x100019cc
mov eax, dword [ebp - 0xb0]
sub eax, 0xd6dfc9f5
je 0x10002c42
jmp 0x100019e2
mov eax, dword [ebp - 0xb0]
sub eax, 0xd7b55460
je 0x10003cd9
jmp 0x100019f8
mov eax, dword [ebp - 0xb0]
sub eax, 0xd7d9ddf0
je 0x10004d89
jmp 0x10001a0e
mov eax, dword [ebp - 0xb0]
sub eax, 0xd881c554
je 0x10004a7c
jmp 0x10001a24
mov eax, dword [ebp - 0xb0]
sub eax, 0xd9200f63
je 0x10003e88
jmp 0x10001a3a
mov eax, dword [ebp - 0xb0]
sub eax, 0xd9a24fbe
je 0x10002c61
jmp 0x10001a50
mov eax, dword [ebp - 0xb0]
sub eax, 0xd9a63c89
je 0x10002ce4
jmp 0x10001a66
mov eax, dword [ebp - 0xb0]
sub eax, 0xd9d4ffe5
je 0x10004f65
jmp 0x10001a7c
mov eax, dword [ebp - 0xb0]
sub eax, 0xda7fb90e
je 0x1000437b
jmp 0x10001a92
mov eax, dword [ebp - 0xb0]
sub eax, 0xdc53a85f
je 0x10003283
jmp 0x10001aa8
mov eax, dword [ebp - 0xb0]
sub eax, 0xdc80567c
je 0x100038cb
jmp 0x10001abe
mov eax, dword [ebp - 0xb0]
sub eax, 0xe0ce71bc
je 0x10002913
jmp 0x10001ad4
mov eax, dword [ebp - 0xb0]
sub eax, 0xe0d79c9c
je 0x10003fcb
jmp 0x10001aea
mov eax, dword [ebp - 0xb0]
sub eax, 0xe11b61d7
je 0x10002eac
jmp 0x10001b00
mov eax, dword [ebp - 0xb0]
sub eax, 0xe260398b
je 0x10002dcf
jmp 0x10001b16
mov eax, dword [ebp - 0xb0]
sub eax, 0xe2c5ec19
je 0x10003650
jmp 0x10001b2c
mov eax, dword [ebp - 0xb0]
sub eax, 0xe56993a7
je 0x100037b3
jmp 0x10001b42
mov eax, dword [ebp - 0xb0]
sub eax, 0xe7dfb66e
je 0x10004e63
jmp 0x10001b58
mov eax, dword [ebp - 0xb0]
sub eax, 0xeaf6b890
je 0x10004e93
jmp 0x10001b6e
mov eax, dword [ebp - 0xb0]
sub eax, 0xeafb96e7
je 0x10003055
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x34ba353d
mov ecx, 0xc732e89a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x34ba353d
mov ecx, 0x2fbd53b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6cfceac
mov ecx, 0xb4445df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [ebp - 0xac]
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10012090
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x64], eax
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
add edx, 0xa7392fae
sub edx, 1
sub edx, 0xa7392fae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcaf817e4
mov ecx, 0x2408d76d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dl, byte [ebp - 0x5a]
mov eax, 0x7bd76b52
mov ecx, 0x69f4ca1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
add edx, 0x28bc5d43
sub edx, 1
sub edx, 0x28bc5d43
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f04f1b3
mov ecx, 0xf4ad9f7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0xd9a24fbe
jmp 0x10005179
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0xd9a63c89
jmp 0x10005179
mov eax, dword [ebp - 0x88]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x59], al
mov dword [ebp - 0xa8], 0x6cb96044
jmp 0x10005179
mov dl, byte [ebp - 0x59]
mov eax, 0xbcd3d8f4
mov ecx, 0x28a5940
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac16e9fb
mov ecx, 0xe11b61d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
add edx, 0xb9764353
sub edx, 1
sub edx, 0xb9764353
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd881c554
mov ecx, 0xaf6e3b92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
add edx, 0x5d5e3fe8
sub edx, 1
sub edx, 0x5d5e3fe8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd881c554
mov ecx, 0xfc8da08a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xa8], 0xcaf9ba61
jmp 0x10005179
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa8], 0x10b500c9
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
sub edx, 0x986735af
sub edx, 1
add edx, 0x986735af
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9936e9f7
mov ecx, 0x5433a57b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dl, byte [ebp - 0x49]
mov eax, 0x5f713ab1
mov ecx, 0x24ce033
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
add edx, 0xc5428034
sub edx, 1
sub edx, 0xc5428034
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f597b1c
mov ecx, 0x259edf23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0xc6c8892c
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0x8201cb3c
sub edx, 1
add edx, 0x8201cb3c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c1d54e8
mov ecx, 0x9a4a343
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov dword [ebp - 0xa8], 0xc41db1d5
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
add edx, 0x976f022
sub edx, 1
sub edx, 0x976f022
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2aec969d
mov ecx, 0x3222f475
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0x287dc0b3
sub edx, 1
add edx, 0x287dc0b3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2aec969d
mov ecx, 0x6d7da2d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0x874f2eeb
jmp 0x10005179
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov dword [ebp - 0xa8], 0x47762894
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
sub edx, 0x854d6faf
sub edx, 1
add edx, 0x854d6faf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x69a17e34
mov ecx, 0x4749c9b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
add edx, 0x9ed51d13
sub edx, 1
sub edx, 0x9ed51d13
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b919361
mov ecx, 0x8e405edb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
mov edx, eax
add edx, 0x18
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0xe23c7e08
sub edx, 1
add edx, 0xe23c7e08
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b919361
mov ecx, 0x52e43b25
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x30]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x34]
add ecx, 0xcc7ac674
add ecx, eax
sub ecx, 0xcc7ac674
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa8], 0xfad78075
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6644b26c
mov ecx, 0x3bead0dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
sub edx, 0xbe63cfb4
sub edx, 1
add edx, 0xbe63cfb4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3b09e800
mov ecx, 0x5d9ee072
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ee07d96
mov ecx, 0xfcd41914
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0x528c226e
jmp 0x10005179
mov dword [ebp - 0xa8], 0x3dcb4512
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7dfb66e
mov ecx, 0x86b89a24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0x2c51aeb0
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
add edx, 0xdace23b0
sub edx, 1
sub edx, 0xdace23b0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a41753a
mov ecx, 0x4ba18c76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0xc41db1d5
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0x42752a85
sub edx, 1
add edx, 0x42752a85
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec134da8
mov ecx, 0xa532fe3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0x3c88eb1
sub edx, 1
add edx, 0x3c88eb1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35336303
mov ecx, 0x7ece6ab1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
sub edx, 0x678ca52d
sub edx, 1
add edx, 0x678ca52d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec134da8
mov ecx, 0xcfe96bba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0x8815d283
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
add edx, 0x87ac7ab8
sub edx, 1
sub edx, 0x87ac7ab8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeaf6b890
mov ecx, 0x8a81d799
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0xe329b5f0
sub edx, 1
add edx, 0xe329b5f0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x997c1a33
mov ecx, 0xa3e220d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x997c1a33
mov ecx, 0x2204d679
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f7ad879
mov ecx, 0xf8bdb84d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0xa8], 0xb032d27d
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x381f567f
mov ecx, 0x15387a9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov dword [ebp - 0xa8], 0xaf6e3b92
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
mov edx, ecx
sub edx, 0x933c627c
sub edx, 1
add edx, 0x933c627c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc5047214
mov ecx, 0xa16e89d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
mov edx, eax
sub edx, 0x54b33c26
sub edx, 1
add edx, 0x54b33c26
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5047214
mov ecx, 0x2a4f31e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov ecx, dword [0x1006f4a8]
mov eax, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9a2c7212
mov ecx, 0x59641dad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [0x1006f4a8]
mov ecx, dword [0x1006f4a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2473ada2
mov ecx, 0x7d79163b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x10005179
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa8], 0x5f671986
jmp 0x10005179
mov dword [ebp - 0xa8], 0x8a81d799
jmp 0x10005179
mov dword [ebp - 0xa8], 0xf9715435
jmp 0x10005179
mov dword [ebp - 0xa8], 0xa7526117
jmp 0x10005179
mov dword [ebp - 0xa8], 0x4393362d
jmp 0x10005179
mov dword [ebp - 0xa8], 0xc1424afe
jmp 0x10005179
mov dword [ebp - 0xa8], 0xaaafd3e1
jmp 0x10005179
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xa8], 0x24e5f7a1
jmp 0x10005179
mov dword [ebp - 0xa8], 0xa3e220d1
jmp 0x10005179
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa8], 0xa16e89d4
jmp 0x10005179
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], 0x59641dad
jmp 0x10005179
jmp 0x100015e8