Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb8], eax
mov eax, dword [0x1006e400]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xb4], 0xbdeae6ff
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xbc], eax
sub eax, 0x810a6961
je 0x10001f49
jmp 0x100010f4
mov eax, dword [ebp - 0xbc]
sub eax, 0x8426be5a
je 0x1000241a
jmp 0x1000110a
mov eax, dword [ebp - 0xbc]
sub eax, 0x87a25530
je 0x10001eaf
jmp 0x10001120
mov eax, dword [ebp - 0xbc]
sub eax, 0x88f67b84
je 0x10001d3a
jmp 0x10001136
mov eax, dword [ebp - 0xbc]
sub eax, 0x8c293067
je 0x10001915
jmp 0x1000114c
mov eax, dword [ebp - 0xbc]
sub eax, 0x91f10407
je 0x10001da5
jmp 0x10001162
mov eax, dword [ebp - 0xbc]
sub eax, 0x9668446a
je 0x10002587
jmp 0x10001178
mov eax, dword [ebp - 0xbc]
sub eax, 0x99ec29cf
je 0x10001906
jmp 0x1000118e
mov eax, dword [ebp - 0xbc]
sub eax, 0x9af85d19
je 0x100025aa
jmp 0x100011a4
mov eax, dword [ebp - 0xbc]
sub eax, 0x9c853310
je 0x10002247
jmp 0x100011ba
mov eax, dword [ebp - 0xbc]
sub eax, 0xa296cb1d
je 0x10001a26
jmp 0x100011d0
mov eax, dword [ebp - 0xbc]
sub eax, 0xaa7dbbd6
je 0x1000253d
jmp 0x100011e6
mov eax, dword [ebp - 0xbc]
sub eax, 0xab25bd39
je 0x10001fe1
jmp 0x100011fc
mov eax, dword [ebp - 0xbc]
sub eax, 0xb17399ad
je 0x1000229f
jmp 0x10001212
mov eax, dword [ebp - 0xbc]
sub eax, 0xb99bab28
je 0x10001e1b
jmp 0x10001228
mov eax, dword [ebp - 0xbc]
sub eax, 0xbb8a9dce
je 0x10002059
jmp 0x1000123e
mov eax, dword [ebp - 0xbc]
sub eax, 0xbd4e9552
je 0x10001a77
jmp 0x10001254
mov eax, dword [ebp - 0xbc]
sub eax, 0xbdeae6ff
je 0x1000168f
jmp 0x1000126a
mov eax, dword [ebp - 0xbc]
sub eax, 0xc1b90487
je 0x10001754
jmp 0x10001280
mov eax, dword [ebp - 0xbc]
sub eax, 0xc2cde351
je 0x10001c7d
jmp 0x10001296
mov eax, dword [ebp - 0xbc]
sub eax, 0xc69bf5f5
je 0x100023ef
jmp 0x100012ac
mov eax, dword [ebp - 0xbc]
sub eax, 0xd2c8799f
je 0x10001966
jmp 0x100012c2
mov eax, dword [ebp - 0xbc]
sub eax, 0xd3b20380
je 0x100021ce
jmp 0x100012d8
mov eax, dword [ebp - 0xbc]
sub eax, 0xe1db629d
je 0x1000214e
jmp 0x100012ee
mov eax, dword [ebp - 0xbc]
sub eax, 0xe3a94cbc
je 0x10002598
jmp 0x10001304
mov eax, dword [ebp - 0xbc]
sub eax, 0xe7f93878
je 0x100026f7
jmp 0x1000131a
mov eax, dword [ebp - 0xbc]
sub eax, 0xeeb0d75c
je 0x1000217d
jmp 0x10001330
mov eax, dword [ebp - 0xbc]
sub eax, 0xf070e26a
je 0x10002130
jmp 0x10001346
mov eax, dword [ebp - 0xbc]
sub eax, 0xf0c3cc98
je 0x1000179d
jmp 0x1000135c
mov eax, dword [ebp - 0xbc]
sub eax, 0xf66c9e16
je 0x10001ca6
jmp 0x10001372
mov eax, dword [ebp - 0xbc]
sub eax, 0xf7bd86c0
je 0x100019c9
jmp 0x10001388
mov eax, dword [ebp - 0xbc]
sub eax, 0xfa3bdc69
je 0x1000252e
jmp 0x1000139e
mov eax, dword [ebp - 0xbc]
sub eax, 0xfb78a8ed
je 0x10001f58
jmp 0x100013b4
mov eax, dword [ebp - 0xbc]
sub eax, 0xfeee4d7b
je 0x100026a0
jmp 0x100013ca
mov eax, dword [ebp - 0xbc]
sub eax, 0xff290cd5
je 0x100023fe
jmp 0x100013e0
mov eax, dword [ebp - 0xbc]
sub eax, 0x66d73e4
je 0x100026d3
jmp 0x100013f6
mov eax, dword [ebp - 0xbc]
sub eax, 0x914cc4d
je 0x1000237d
jmp 0x1000140c
mov eax, dword [ebp - 0xbc]
sub eax, 0xf38e953
je 0x10002040
jmp 0x10001422
mov eax, dword [ebp - 0xbc]
sub eax, 0x14f47bb2
je 0x10002444
jmp 0x10001438
mov eax, dword [ebp - 0xbc]
sub eax, 0x16098c9a
je 0x10001d96
jmp 0x1000144e
mov eax, dword [ebp - 0xbc]
sub eax, 0x1fbed43f
je 0x10002238
jmp 0x10001464
mov eax, dword [ebp - 0xbc]
sub eax, 0x20edd959
je 0x10002017
jmp 0x1000147a
mov eax, dword [ebp - 0xbc]
sub eax, 0x2669a16c
je 0x1000183f
jmp 0x10001490
mov eax, dword [ebp - 0xbc]
sub eax, 0x2776aa78
je 0x100024a4
jmp 0x100014a6
mov eax, dword [ebp - 0xbc]
sub eax, 0x28234892
je 0x10002649
jmp 0x100014bc
mov eax, dword [ebp - 0xbc]
sub eax, 0x2e3710ce
je 0x10001b5f
jmp 0x100014d2
mov eax, dword [ebp - 0xbc]
sub eax, 0x3282314d
je 0x100026e2
jmp 0x100014e8
mov eax, dword [ebp - 0xbc]
sub eax, 0x36632ef8
je 0x10001ea0
jmp 0x100014fe
mov eax, dword [ebp - 0xbc]
sub eax, 0x38675262
je 0x10001821
jmp 0x10001514
mov eax, dword [ebp - 0xbc]
sub eax, 0x3984a158
je 0x10001be4
jmp 0x1000152a
mov eax, dword [ebp - 0xbc]
sub eax, 0x405b5353
je 0x10002453
jmp 0x10001540
mov eax, dword [ebp - 0xbc]
sub eax, 0x42204a40
je 0x10001b41
jmp 0x10001556
mov eax, dword [ebp - 0xbc]
sub eax, 0x42a4bb16
je 0x10002724
jmp 0x1000156c
mov eax, dword [ebp - 0xbc]
sub eax, 0x42c365c2
je 0x10001fbe
jmp 0x10001582
mov eax, dword [ebp - 0xbc]
sub eax, 0x45826f51
je 0x10001ef8
jmp 0x10001598
mov eax, dword [ebp - 0xbc]
sub eax, 0x4e46f965
je 0x10002569
jmp 0x100015ae
mov eax, dword [ebp - 0xbc]
sub eax, 0x4fe15582
je 0x100020cf
jmp 0x100015c4
mov eax, dword [ebp - 0xbc]
sub eax, 0x5bc37d7a
je 0x10001b6e
jmp 0x100015da
mov eax, dword [ebp - 0xbc]
sub eax, 0x5e5a7670
je 0x10001cc4
jmp 0x100015f0
mov eax, dword [ebp - 0xbc]
sub eax, 0x5e79854f
je 0x10002395
jmp 0x10001606
mov eax, dword [ebp - 0xbc]
sub eax, 0x60a66750
je 0x100025c8
jmp 0x1000161c
mov eax, dword [ebp - 0xbc]
sub eax, 0x6757724c
je 0x100018b5
jmp 0x10001632
mov eax, dword [ebp - 0xbc]
sub eax, 0x67e62d14
je 0x100026b5
jmp 0x10001648
mov eax, dword [ebp - 0xbc]
sub eax, 0x6910e966
je 0x100025b9
jmp 0x1000165e
mov eax, dword [ebp - 0xbc]
sub eax, 0x79a81d54
je 0x10001c8c
mov eax, dword [ebp - 0xb8]
push eax
sub esp, 0x100
mov ecx, esp
mov dword [ebp - 0xa0], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x9c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x98], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x94], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x90], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x8c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x88], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10010f00
add esp, 0xc
mov eax, dword [ebp - 0xa4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xb4], 0xc1b90487
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe3a94cbc
mov ecx, 0xf0c3cc98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x78]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
sub edx, 0x1c0de899
sub edx, 1
add edx, 0x1c0de899
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3a94cbc
mov ecx, 0x38675262
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dl, byte [ebp - 0x71]
mov eax, 0x2669a16c
mov ecx, 0x8c293067
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
sub edx, 0xfae2bcec
sub edx, 1
add edx, 0xfae2bcec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9af85d19
mov ecx, 0x6757724c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
add edx, 0x4c5bd883
sub edx, 1
sub edx, 0x4c5bd883
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9af85d19
mov ecx, 0x99ec29cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x9668446a
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
sub edx, 0x5692cdb1
sub edx, 1
add edx, 0x5692cdb1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6910e966
mov ecx, 0xd2c8799f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
add edx, 0xf719b8d8
sub edx, 1
sub edx, 0xf719b8d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6910e966
mov ecx, 0xf7bd86c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x7eb01b00
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
sub edx, 0x930348b2
sub edx, 1
add edx, 0x930348b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60a66750
mov ecx, 0xbd4e9552
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x5d], al
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60a66750
mov ecx, 0x42204a40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dl, byte [ebp - 0x5d]
mov eax, 0x5bc37d7a
mov ecx, 0x2e3710ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x9668446a
jmp 0x10002742
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
add edx, 0xaa83839b
sub edx, 1
sub edx, 0xaa83839b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x28234892
mov ecx, 0x3984a158
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
add edx, 0xc7c7f27b
sub edx, 1
sub edx, 0xc7c7f27b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x28234892
mov ecx, 0xc2cde351
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x79a81d54
jmp 0x10002742
mov edx, dword [ebp - 0x5c]
mov eax, 0x5e5a7670
mov ecx, 0xfb78a8ed
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
add edx, 0x1729c75c
sub edx, 1
sub edx, 0x1729c75c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfeee4d7b
mov ecx, 0x88f67b84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
add edx, 0xd3c3efab
sub edx, 1
sub edx, 0xd3c3efab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfeee4d7b
mov ecx, 0x16098c9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x91f10407
jmp 0x10002742
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
add edx, 0x7f13fe30
sub edx, 1
sub edx, 0x7f13fe30
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x67e62d14
mov ecx, 0xb99bab28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x58]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
sub edx, 0x7eb6b130
sub edx, 1
add edx, 0x7eb6b130
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x67e62d14
mov ecx, 0x36632ef8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x87a25530
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66d73e4
mov ecx, 0x45826f51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
sub edx, 0x1534a63e
sub edx, 1
add edx, 0x1534a63e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66d73e4
mov ecx, 0x810a6961
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x9668446a
jmp 0x10002742
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xb4], 0x42c365c2
jmp 0x10002742
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xb4], 0xab25bd39
jmp 0x10002742
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov word [eax], 0
mov dword [ebp - 0xb4], 0x20edd959
jmp 0x10002742
mov eax, dword [ebp - 0x88]
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xb4], 0xf38e953
jmp 0x10002742
mov eax, dword [ebp - 0x44]
movzx eax, word [eax + 2]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xb4], 0xbb8a9dce
jmp 0x10002742
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
add edx, 0xb1f670d
sub edx, 1
sub edx, 0xb1f670d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3282314d
mov ecx, 0x4fe15582
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
add edx, 0xbc5ef00
sub edx, 1
sub edx, 0xbc5ef00
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3282314d
mov ecx, 0xf070e26a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dl, byte [ebp - 0x39]
mov eax, 0x405b5353
mov ecx, 0xe1db629d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xb4], 0xeeb0d75c
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
sub edx, 0xd1f79025
sub edx, 1
add edx, 0xd1f79025
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7f93878
mov ecx, 0xd3b20380
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + 0x10]
mov eax, dword [ebp - 0x38]
sub eax, 0x9d2e60f9
add eax, ecx
add eax, 0x9d2e60f9
mov dword [ebp - 0x30], eax
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
sub edx, 0x16114868
sub edx, 1
add edx, 0x16114868
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7f93878
mov ecx, 0x1fbed43f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0x9c853310
jmp 0x10002742
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x88]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001d3b0
call fcn.10013270
add esp, 8
mov edx, eax
mov eax, 0xb17399ad
mov ecx, 0xc69bf5f5
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x80]
mov dword [eax], 0
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x80]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x7c]
mov byte [eax], cl
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xa215fabd
add edx, eax
sub edx, 0xa215fabd
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xcd6e6202
add ecx, eax
add ecx, 0xcd6e6202
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011060
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xb4], 0x914cc4d
jmp 0x10002742
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xb4], 0x5e79854f
jmp 0x10002742
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x24]
add esi, 0xcd94abf2
add esi, eax
sub esi, 0xcd94abf2
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x7c]
mov byte [eax], cl
mov dword [ebp - 0xb4], 0xc69bf5f5
jmp 0x10002742
mov dword [ebp - 0xb4], 0xff290cd5
jmp 0x10002742
mov eax, dword [ebp - 0x88]
mov ax, word [eax]
mov word [ebp - 0x1e], ax
mov dword [ebp - 0xb4], 0x8426be5a
jmp 0x10002742
mov cx, word [ebp - 0x1e]
sub cx, 0xaa2b
add cx, 1
add cx, 0xaa2b
mov eax, dword [ebp - 0x88]
mov word [eax], cx
mov dword [ebp - 0xb4], 0x14f47bb2
jmp 0x10002742
mov dword [ebp - 0xb4], 0x20edd959
jmp 0x10002742
mov eax, dword [0x1006f748]
mov ecx, dword [0x1006f744]
mov edx, eax
sub edx, 0x81a5048f
sub edx, 1
add edx, 0x81a5048f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42a4bb16
mov ecx, 0x2776aa78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006f748]
mov eax, dword [0x1006f744]
mov edx, ecx
sub edx, 0xe73fea77
sub edx, 1
add edx, 0xe73fea77
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x42a4bb16
mov ecx, 0xfa3bdc69
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb4], eax
jmp 0x10002742
mov dword [ebp - 0xb4], 0xaa7dbbd6
jmp 0x10002742
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xb4], 0x4e46f965
jmp 0x10002742
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb4], 0x9668446a
jmp 0x10002742
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10010300
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xb4], 0xf0c3cc98
jmp 0x10002742
mov dword [ebp - 0xb4], 0x6757724c
jmp 0x10002742
mov dword [ebp - 0xb4], 0xd2c8799f
jmp 0x10002742
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xb4], 0xbd4e9552
jmp 0x10002742
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov dword [ebp - 0xb4], 0x3984a158
jmp 0x10002742
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xb4], 0x88f67b84
jmp 0x10002742
mov eax, dword [ebp - 0x58]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb4], 0xb99bab28
jmp 0x10002742
mov dword [ebp - 0xb4], 0x45826f51
jmp 0x10002742
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb4], 0x4fe15582
jmp 0x10002742
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xb4], 0xd3b20380
jmp 0x10002742
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb4], 0x2776aa78
jmp 0x100010d8