Function at 0x1000e1a0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [0x10096480]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x19c], 0x3dd791ee
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
sub eax, 0x80b3c2a3
je 0x1000f467
jmp 0x1000e1e4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x836d8445
je 0x1000e8a8
jmp 0x1000e1fa
mov eax, dword [ebp - 0x1a4]
sub eax, 0x86fcacbc
je 0x1000f158
jmp 0x1000e210
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8d6b2cd2
je 0x1000ef8a
jmp 0x1000e226
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8ee6d361
je 0x1000eb0f
jmp 0x1000e23c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8f610464
je 0x1000ec74
jmp 0x1000e252
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9aa8ac04
je 0x1000ed79
jmp 0x1000e268
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9f903a6e
je 0x1000ea15
jmp 0x1000e27e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9faaab3b
je 0x1000f2f0
jmp 0x1000e294
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa4cc823f
je 0x1000eb85
jmp 0x1000e2aa
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa5fad2a6
je 0x1000f7a4
jmp 0x1000e2c0
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa69bff43
je 0x1000f20c
jmp 0x1000e2d6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa9fea372
je 0x1000ec1c
jmp 0x1000e2ec
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb46bdff2
je 0x1000ee53
jmp 0x1000e302
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb57c9a39
je 0x1000ed2a
jmp 0x1000e318
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb59ba3f0
je 0x1000eaf2
jmp 0x1000e32e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb83d6929
je 0x1000ead1
jmp 0x1000e344
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbfa8c6bb
je 0x1000e725
jmp 0x1000e35a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc281e3e6
je 0x1000f714
jmp 0x1000e370
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc637d3c1
je 0x1000eaae
jmp 0x1000e386
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc7034a73
je 0x1000f2ff
jmp 0x1000e39c
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc85bb847
je 0x1000f5f4
jmp 0x1000e3b2
mov eax, dword [ebp - 0x1a4]
sub eax, 0xca0c3e1c
je 0x1000f484
jmp 0x1000e3c8
mov eax, dword [ebp - 0x1a4]
sub eax, 0xca6c4ec3
je 0x1000f0b7
jmp 0x1000e3de
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcaeabe9d
je 0x1000f458
jmp 0x1000e3f4
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcd7028f1
je 0x1000f57e
jmp 0x1000e40a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd11d60d2
je 0x1000f27a
jmp 0x1000e420
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdbb8aeda
je 0x1000f4b7
jmp 0x1000e436
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe0845710
je 0x1000ed39
jmp 0x1000e44c
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe2964fe4
je 0x1000ea06
jmp 0x1000e462
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe9780922
je 0x1000eff8
jmp 0x1000e478
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf1b0ac7c
je 0x1000ef42
jmp 0x1000e48e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf1f4c0e1
je 0x1000f58f
jmp 0x1000e4a4
mov eax, dword [ebp - 0x1a4]
sub eax, 0xfec66dd9
je 0x1000edc0
jmp 0x1000e4ba
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3c8f2a
je 0x1000ee13
jmp 0x1000e4d0
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa185a84
je 0x1000f7c7
jmp 0x1000e4e6
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1d49e824
je 0x1000ea57
jmp 0x1000e4fc
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1e8bcf16
je 0x1000ec0d
jmp 0x1000e512
mov eax, dword [ebp - 0x1a4]
sub eax, 0x23ff1e80
je 0x1000f6a4
jmp 0x1000e528
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2995106f
je 0x1000edf2
jmp 0x1000e53e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2c9eeb83
je 0x1000f358
jmp 0x1000e554
mov eax, dword [ebp - 0x1a4]
sub eax, 0x308a5e6c
je 0x1000ec2b
jmp 0x1000e56a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x33e7137c
je 0x1000f795
jmp 0x1000e580
mov eax, dword [ebp - 0x1a4]
sub eax, 0x35ba7377
je 0x1000f6c5
jmp 0x1000e596
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3dd791ee
je 0x1000e6fb
jmp 0x1000e5ac
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4686e003
je 0x1000f3ce
jmp 0x1000e5c2
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4783bc87
je 0x1000e88d
jmp 0x1000e5d8
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4a8992a1
je 0x1000eea4
jmp 0x1000e5ee
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4cd8940e
je 0x1000eda1
jmp 0x1000e604
mov eax, dword [ebp - 0x1a4]
sub eax, 0x59bf732b
je 0x1000f76e
jmp 0x1000e61a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5aeaf24c
je 0x1000e85d
jmp 0x1000e630
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5bfbf8a1
je 0x1000f0a8
jmp 0x1000e646
mov eax, dword [ebp - 0x1a4]
sub eax, 0x61a7d6f5
je 0x1000f349
jmp 0x1000e65c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x61d00ca2
je 0x1000f508
jmp 0x1000e672
mov eax, dword [ebp - 0x1a4]
sub eax, 0x62afb264
je 0x1000e87e
jmp 0x1000e688
mov eax, dword [ebp - 0x1a4]
sub eax, 0x6565fdd4
je 0x1000ef51
jmp 0x1000e69e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x6c5eae5c
je 0x1000ea48
jmp 0x1000e6b4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x6df88072
je 0x1000f32a
jmp 0x1000e6ca
mov eax, dword [ebp - 0x1a4]
sub eax, 0x797375c0
je 0x1000e776
jmp 0x1000e6e0
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7f6ef142
je 0x1000e916
jmp 0x1000e6f6
jmp 0x1000f7d1
push eax
mov eax, esp
mov dword [ebp - 0x188], eax
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x19c], 0xbfa8c6bb
jmp 0x1000f7d1
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
mov edx, eax
sub edx, 0x1a22ad9c
sub edx, 1
add edx, 0x1a22ad9c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1f4c0e1
mov ecx, 0x797375c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x1a0]
push eax
mov ecx, esp
mov dword [ebp - 0x17c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x178], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x18c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d790
add esp, 0xc
mov eax, dword [ebp - 0x18c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
setne al
and al, 1
mov byte [ebp - 0x161], al
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1f4c0e1
mov ecx, 0x5aeaf24c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dl, byte [ebp - 0x161]
mov eax, 0x62afb264
mov ecx, 0x4783bc87
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xdbb8aeda
jmp 0x1000f7d1
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x19c], 0x836d8445
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc85bb847
mov ecx, 0x7f6ef142
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x160]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x194]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x15c], eax
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc85bb847
mov ecx, 0xe2964fe4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0x9f903a6e
jmp 0x1000f7d1
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x188]
mov esi, 0xffffffff
mov eax, 0x1d49e824
mov ecx, 0x6c5eae5c
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xdbb8aeda
jmp 0x1000f7d1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov dword [ebp - 0x19c], 0xc637d3c1
jmp 0x1000f7d1
mov eax, dword [ebp - 0x184]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov dword [ebp - 0x19c], 0xb83d6929
jmp 0x1000f7d1
mov dl, byte [ebp - 0x155]
mov eax, 0xb59ba3f0
mov ecx, 0x308a5e6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x19c], 0x8ee6d361
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
add edx, 0xa42f2d19
sub edx, 1
sub edx, 0xa42f2d19
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x23ff1e80
mov ecx, 0xa4cc823f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
sub edx, 0x59ce4e18
sub edx, 1
add edx, 0x59ce4e18
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x23ff1e80
mov ecx, 0x1e8bcf16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xa9fea372
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xdbb8aeda
jmp 0x1000f7d1
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35ba7377
mov ecx, 0x8f610464
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
add edx, 0x7ef3ab5a
sub edx, 1
sub edx, 0x7ef3ab5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x35ba7377
mov ecx, 0xb57c9a39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xe0845710
jmp 0x1000f7d1
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
add eax, 0x58ff5e69
add eax, ecx
sub eax, 0x58ff5e69
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x19c], 0x9aa8ac04
jmp 0x1000f7d1
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov word [eax], 0
mov dword [ebp - 0x19c], 0x4cd8940e
jmp 0x1000f7d1
mov eax, dword [ebp - 0x174]
mov ax, word [eax]
mov word [ebp - 0x14c], ax
mov dword [ebp - 0x19c], 0xfec66dd9
jmp 0x1000f7d1
mov ax, word [ebp - 0x14c]
movzx eax, ax
mov ecx, dword [ebp - 0x178]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x19c], 0x2995106f
jmp 0x1000f7d1
mov dl, byte [ebp - 0x149]
mov eax, 0x2c9eeb83
mov ecx, 0x3c8f2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x19c], 0xb46bdff2
jmp 0x1000f7d1
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
mov edx, eax
add edx, 0x47d1eb10
sub edx, 1
sub edx, 0x47d1eb10
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc281e3e6
mov ecx, 0x4a8992a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x144]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x148]
sub ecx, 0xc7d0e587
add ecx, eax
add ecx, 0xc7d0e587
mov eax, dword [ebp - 0x174]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x6d859389
add ecx, eax
sub ecx, 0x6d859389
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x140], eax
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
mov edx, eax
add edx, 0x91c1cc45
sub edx, 1
sub edx, 0x91c1cc45
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc281e3e6
mov ecx, 0xf1b0ac7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0x6565fdd4
jmp 0x1000f7d1
mov ecx, dword [ebp - 0x140]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003beb5
call fcn.10031100
add esp, 8
mov edx, eax
mov eax, 0x8d6b2cd2
mov ecx, 0xa69bff43
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59bf732b
mov ecx, 0xe9780922
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x134], eax
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
sub edx, 0x5255e7d3
sub edx, 1
add edx, 0x5255e7d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59bf732b
mov ecx, 0x5bfbf8a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xca6c4ec3
jmp 0x1000f7d1
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
sub edx, 0x31cdbda7
add edx, eax
add edx, 0x31cdbda7
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x13c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0xd14b8e12
add eax, ecx
add eax, 0xd14b8e12
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x19c], 0x86fcacbc
jmp 0x1000f7d1
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x12c]
add ecx, 0xdf8edcb9
add ecx, eax
sub ecx, 0xdf8edcb9
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x130]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002d8f0
add esp, 0xc
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x198]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xfad1b8f8
add esi, eax
add esi, 0xfad1b8f8
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov dword [ebp - 0x19c], 0xa69bff43
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x33e7137c
mov ecx, 0xd11d60d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
add edx, 0xc7519d75
sub edx, 1
sub edx, 0xc7519d75
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x33e7137c
mov ecx, 0x9faaab3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xc7034a73
jmp 0x1000f7d1
mov eax, dword [ebp - 0x174]
mov ax, word [eax]
sub ax, 0xac7c
add ax, 1
add ax, 0xac7c
mov word [ebp - 0x122], ax
mov dword [ebp - 0x19c], 0x6df88072
jmp 0x1000f7d1
mov eax, dword [ebp - 0x174]
mov cx, word [ebp - 0x122]
mov word [eax], cx
mov dword [ebp - 0x19c], 0x61a7d6f5
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0x4cd8940e
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
sub edx, 0x59e07425
sub edx, 1
add edx, 0x59e07425
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa5fad2a6
mov ecx, 0x4686e003
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
sub edx, 0x82a5a509
sub edx, 1
add edx, 0x82a5a509
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa5fad2a6
mov ecx, 0xcaeabe9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0x80b3c2a3
jmp 0x1000f7d1
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x19c], 0xca0c3e1c
jmp 0x1000f7d1
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x190]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0xdbb8aeda
jmp 0x1000f7d1
mov eax, dword [0x10097af4]
mov ecx, dword [0x10097af0]
mov edx, eax
add edx, 0xdbb2bc17
sub edx, 1
sub edx, 0xdbb2bc17
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa185a84
mov ecx, 0x61d00ca2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov ecx, dword [0x10097af4]
mov eax, dword [0x10097af0]
mov edx, ecx
sub edx, 0x745cab5f
sub edx, 1
add edx, 0x745cab5f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa185a84
mov ecx, 0xcd7028f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000f7d1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002c980
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x18c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d790
add esp, 0xc
mov eax, dword [ebp - 0x18c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x19c], 0x797375c0
jmp 0x1000f7d1
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x160]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x194]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x19c], 0x7f6ef142
jmp 0x1000f7d1
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0xa4cc823f
jmp 0x1000f7d1
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x19c], 0x8f610464
jmp 0x1000f7d1
mov eax, dword [ebp - 0x144]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x148]
sub ecx, 0x51d5bd3e
add ecx, eax
add ecx, 0x51d5bd3e
mov eax, dword [ebp - 0x174]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x2a510c32
add ecx, eax
add ecx, 0x2a510c32
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x19c], 0x4a8992a1
jmp 0x1000f7d1
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x19c], 0xe9780922
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0xd11d60d2
jmp 0x1000f7d1
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x4686e003
jmp 0x1000f7d1
mov dword [ebp - 0x19c], 0x61d00ca2
jmp 0x1000e1c8