Function at 0x10001310
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x1003b600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x99], al
mov dword [ebp - 0xa0], 0x7caf2c74
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], eax
sub eax, 0x839e102c
je 0x100023d8
jmp 0x1000138b
mov eax, dword [ebp - 0xa8]
sub eax, 0x8a1060d9
je 0x10002afa
jmp 0x100013a1
mov eax, dword [ebp - 0xa8]
sub eax, 0x8afe4c44
je 0x10003220
jmp 0x100013b7
mov eax, dword [ebp - 0xa8]
sub eax, 0x8bfd3797
je 0x100032eb
jmp 0x100013cd
mov eax, dword [ebp - 0xa8]
sub eax, 0x8d49048c
je 0x10002027
jmp 0x100013e3
mov eax, dword [ebp - 0xa8]
sub eax, 0x8d9c605e
je 0x100030cd
jmp 0x100013f9
mov eax, dword [ebp - 0xa8]
sub eax, 0x8f24833a
je 0x100020e1
jmp 0x1000140f
mov eax, dword [ebp - 0xa8]
sub eax, 0x8fb1a05e
je 0x10002bf0
jmp 0x10001425
mov eax, dword [ebp - 0xa8]
sub eax, 0x9b145250
je 0x10002036
jmp 0x1000143b
mov eax, dword [ebp - 0xa8]
sub eax, 0x9b257ac4
je 0x10002c68
jmp 0x10001451
mov eax, dword [ebp - 0xa8]
sub eax, 0x9e0d9b10
je 0x10001d69
jmp 0x10001467
mov eax, dword [ebp - 0xa8]
sub eax, 0x9ec0b6f8
je 0x10002757
jmp 0x1000147d
mov eax, dword [ebp - 0xa8]
sub eax, 0xa1f74590
je 0x100026eb
jmp 0x10001493
mov eax, dword [ebp - 0xa8]
sub eax, 0xa2fde6dc
je 0x10002b90
jmp 0x100014a9
mov eax, dword [ebp - 0xa8]
sub eax, 0xa6f94cf0
je 0x100021ca
jmp 0x100014bf
mov eax, dword [ebp - 0xa8]
sub eax, 0xafe24ad2
je 0x10002a75
jmp 0x100014d5
mov eax, dword [ebp - 0xa8]
sub eax, 0xb20a7f24
je 0x100027c5
jmp 0x100014eb
mov eax, dword [ebp - 0xa8]
sub eax, 0xb3538867
je 0x1000234b
jmp 0x10001501
mov eax, dword [ebp - 0xa8]
sub eax, 0xb3acec2e
je 0x10003027
jmp 0x10001517
mov eax, dword [ebp - 0xa8]
sub eax, 0xb4372628
je 0x10002704
jmp 0x1000152d
mov eax, dword [ebp - 0xa8]
sub eax, 0xc12d81df
je 0x10002e40
jmp 0x10001543
mov eax, dword [ebp - 0xa8]
sub eax, 0xc77f8b16
je 0x1000252e
jmp 0x10001559
mov eax, dword [ebp - 0xa8]
sub eax, 0xc7826b29
je 0x10003172
jmp 0x1000156f
mov eax, dword [ebp - 0xa8]
sub eax, 0xc8789687
je 0x10002510
jmp 0x10001585
mov eax, dword [ebp - 0xa8]
sub eax, 0xc90c0bfc
je 0x100022c6
jmp 0x1000159b
mov eax, dword [ebp - 0xa8]
sub eax, 0xcb4fb067
je 0x10002724
jmp 0x100015b1
mov eax, dword [ebp - 0xa8]
sub eax, 0xcf2cba91
je 0x10002483
jmp 0x100015c7
mov eax, dword [ebp - 0xa8]
sub eax, 0xd10ac14d
je 0x10002842
jmp 0x100015dd
mov eax, dword [ebp - 0xa8]
sub eax, 0xdc4c482e
je 0x1000331d
jmp 0x100015f3
mov eax, dword [ebp - 0xa8]
sub eax, 0xe2129596
je 0x100030dc
jmp 0x10001609
mov eax, dword [ebp - 0xa8]
sub eax, 0xe7868e13
je 0x10002c77
jmp 0x1000161f
mov eax, dword [ebp - 0xa8]
sub eax, 0xea3b62eb
je 0x100031de
jmp 0x10001635
mov eax, dword [ebp - 0xa8]
sub eax, 0xf0292efa
je 0x10001c26
jmp 0x1000164b
mov eax, dword [ebp - 0xa8]
sub eax, 0xf59fb28d
je 0x10003056
jmp 0x10001661
mov eax, dword [ebp - 0xa8]
sub eax, 0xf5f392b1
je 0x10003038
jmp 0x10001677
mov eax, dword [ebp - 0xa8]
sub eax, 0xf7c6a2eb
je 0x10003047
jmp 0x1000168d
mov eax, dword [ebp - 0xa8]
sub eax, 0xf8cbc14b
je 0x10002de0
jmp 0x100016a3
mov eax, dword [ebp - 0xa8]
sub eax, 0xfbe663cb
je 0x10002f70
jmp 0x100016b9
mov eax, dword [ebp - 0xa8]
sub eax, 0xfe22d734
je 0x10001b5e
jmp 0x100016cf
mov eax, dword [ebp - 0xa8]
sub eax, 0xfe2df58e
je 0x10002d5b
jmp 0x100016e5
mov eax, dword [ebp - 0xa8]
sub eax, 0xff70a2c5
je 0x100030f7
jmp 0x100016fb
mov eax, dword [ebp - 0xa8]
sub eax, 0x21e2472
je 0x10002f02
jmp 0x10001711
mov eax, dword [ebp - 0xa8]
sub eax, 0x46f01c0
je 0x100026af
jmp 0x10001727
mov eax, dword [ebp - 0xa8]
sub eax, 0x5f87504
je 0x1000253d
jmp 0x1000173d
mov eax, dword [ebp - 0xa8]
sub eax, 0x720801f
je 0x1000296f
jmp 0x10001753
mov eax, dword [ebp - 0xa8]
sub eax, 0x8484d34
je 0x100026c6
jmp 0x10001769
mov eax, dword [ebp - 0xa8]
sub eax, 0x8a43f1b
je 0x10001e56
jmp 0x1000177f
mov eax, dword [ebp - 0xa8]
sub eax, 0xdc84d91
je 0x10002ef3
jmp 0x10001795
mov eax, dword [ebp - 0xa8]
sub eax, 0x11ec8ac8
je 0x10003293
jmp 0x100017ab
mov eax, dword [ebp - 0xa8]
sub eax, 0x173ec721
je 0x100029c0
jmp 0x100017c1
mov eax, dword [ebp - 0xa8]
sub eax, 0x1771f1c9
je 0x10002851
jmp 0x100017d7
mov eax, dword [ebp - 0xa8]
sub eax, 0x21a4d696
je 0x10001f9b
jmp 0x100017ed
mov eax, dword [ebp - 0xa8]
sub eax, 0x21f703ce
je 0x10003009
jmp 0x10001803
mov eax, dword [ebp - 0xa8]
sub eax, 0x25b19b95
je 0x10001c17
jmp 0x10001819
mov eax, dword [ebp - 0xa8]
sub eax, 0x28f36f89
je 0x10001e74
jmp 0x1000182f
mov eax, dword [ebp - 0xa8]
sub eax, 0x29813ea0
je 0x10002b9f
jmp 0x10001845
mov eax, dword [ebp - 0xa8]
sub eax, 0x2add3b43
je 0x1000226d
jmp 0x1000185b
mov eax, dword [ebp - 0xa8]
sub eax, 0x2c3a2537
je 0x1000240d
jmp 0x10001871
mov eax, dword [ebp - 0xa8]
sub eax, 0x303c30aa
je 0x10003018
jmp 0x10001887
mov eax, dword [ebp - 0xa8]
sub eax, 0x3357a123
je 0x10001d11
jmp 0x1000189d
mov eax, dword [ebp - 0xa8]
sub eax, 0x369eaac9
je 0x10001c9c
jmp 0x100018b3
mov eax, dword [ebp - 0xa8]
sub eax, 0x3c21deb3
je 0x10001d20
jmp 0x100018c9
mov eax, dword [ebp - 0xa8]
sub eax, 0x3c62296c
je 0x100021e8
jmp 0x100018df
mov eax, dword [ebp - 0xa8]
sub eax, 0x3ed364b5
je 0x100021f7
jmp 0x100018f5
mov eax, dword [ebp - 0xa8]
sub eax, 0x4137b3f5
je 0x10002b81
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
add edx, 0xee2a9a43
sub edx, 1
sub edx, 0xee2a9a43
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf5f392b1
mov ecx, 0x25b19b95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0xf0292efa
jmp 0x1000334a
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
sub edx, 0xb31d5c5a
sub edx, 1
add edx, 0xb31d5c5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf7c6a2eb
mov ecx, 0x369eaac9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
sub edx, 0xa75e133f
sub edx, 1
add edx, 0xa75e133f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf7c6a2eb
mov ecx, 0x3357a123
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x3c21deb3
jmp 0x1000334a
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf59fb28d
mov ecx, 0x9e0d9b10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov ecx, dword [ebp - 0xa4]
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000d540
add esp, 0xc
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x59], al
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf59fb28d
mov ecx, 0x8a43f1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dl, byte [ebp - 0x59]
mov eax, 0x28f36f89
mov ecx, 0x6e5d16dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
sub edx, 0x7b4bbb77
sub edx, 1
add edx, 0x7b4bbb77
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d9c605e
mov ecx, 0x5e3d882e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
sub edx, 0x493f1cb0
sub edx, 1
add edx, 0x493f1cb0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2129596
mov ecx, 0x8d49048c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x9b145250
jmp 0x1000334a
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xa0], 0x7a138236
jmp 0x1000334a
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x45], al
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff70a2c5
mov ecx, 0xa6f94cf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dl, byte [ebp - 0x45]
mov eax, 0x3ed364b5
mov ecx, 0x3c62296c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0xb3acec2e
jmp 0x1000334a
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
add edx, 0xe2f1ac62
sub edx, 1
sub edx, 0xe2f1ac62
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc7826b29
mov ecx, 0x2add3b43
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
add edx, 0xc0856fae
sub edx, 1
sub edx, 0xc0856fae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7826b29
mov ecx, 0xc90c0bfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x4925d9b5
jmp 0x1000334a
mov eax, dword [ebp - 0x44]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
sub edx, 0x9a712475
sub edx, 1
add edx, 0x9a712475
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e6e99b5
mov ecx, 0x839e102c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x54b46c5c
jmp 0x1000334a
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
sub edx, 0x60d326ed
sub edx, 1
add edx, 0x60d326ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x66c2d4db
mov ecx, 0xcf2cba91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
sub edx, 0xe084c177
sub edx, 1
add edx, 0xe084c177
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x66c2d4db
mov ecx, 0x570cf671
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x3c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0], 0xc77f8b16
jmp 0x1000334a
mov dword [ebp - 0xa0], 0xb3acec2e
jmp 0x1000334a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x62e012ba
jmp 0x1000334a
mov eax, dword [ebp - 0x6c]
mov word [eax], 0
mov dword [ebp - 0xa0], 0x8484d34
jmp 0x1000334a
mov eax, dword [ebp - 0x6c]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x2e], ax
mov dword [ebp - 0xa0], 0xa1f74590
jmp 0x1000334a
mov ax, word [ebp - 0x2e]
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa0], 0xb4372628
jmp 0x1000334a
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
mov eax, 0xc12d81df
mov ecx, 0xcb4fb067
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
sub eax, 0x5b007b17
add eax, ecx
add eax, 0x5b007b17
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xa0], 0x9ec0b6f8
jmp 0x1000334a
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f35722b
mov ecx, 0xb20a7f24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x6c]
movzx eax, word [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f35722b
mov ecx, 0xd10ac14d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x1771f1c9
jmp 0x1000334a
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x24]
sub ecx, 0xbd3af4ec
add ecx, eax
add ecx, 0xbd3af4ec
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000f8b0
add esp, 8
mov edx, eax
mov eax, 0x77549b38
mov ecx, 0xa2fde6dc
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
add edx, 0xc087cf4f
sub edx, 1
sub edx, 0xc087cf4f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8afe4c44
mov ecx, 0x173ec721
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x68b5926f
add esi, eax
add esi, 0x68b5926f
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8afe4c44
mov ecx, 0xafe24ad2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x45b248d9
jmp 0x1000334a
mov eax, dword [ebp - 0x18]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
sub edx, 0xa8b75c0a
sub edx, 1
add edx, 0xa8b75c0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e8c6c14
mov ecx, 0x4137b3f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x29813ea0
jmp 0x1000334a
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
add edx, 0xc7753ca4
sub edx, 1
sub edx, 0xc7753ca4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11ec8ac8
mov ecx, 0x8fb1a05e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x6c]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x11ec8ac8
mov ecx, 0x9b257ac4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0xe7868e13
jmp 0x1000334a
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
sub edx, 0xed87b141
sub edx, 1
add edx, 0xed87b141
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4d441145
mov ecx, 0x63b76830
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x797a75d3
jmp 0x1000334a
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
add edx, 0xdd40d524
sub edx, 1
sub edx, 0xdd40d524
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8bfd3797
mov ecx, 0x65395902
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [0x1003c940]
mov ecx, dword [0x1003c93c]
mov edx, eax
add edx, 0xd836260c
sub edx, 1
sub edx, 0xd836260c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63d1ae33
mov ecx, 0x716d388e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x21e2472
jmp 0x1000334a
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdc4c482e
mov ecx, 0xfbe663cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1003c940]
mov eax, dword [0x1003c93c]
mov edx, ecx
add edx, 0x41096e70
sub edx, 1
sub edx, 0x41096e70
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdc4c482e
mov ecx, 0x21f703ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x303c30aa
jmp 0x1000334a
mov dword [ebp - 0xa0], 0xb3acec2e
jmp 0x1000334a
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000c940
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa0], 0xfe22d734
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x369eaac9
jmp 0x1000334a
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000d540
add esp, 0xc
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], 0x9e0d9b10
jmp 0x1000334a
mov dword [ebp - 0xa0], 0x5e3d882e
jmp 0x1000334a
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa0], 0x21a4d696
jmp 0x1000334a
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xa0], 0x8f24833a
jmp 0x1000334a
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xa0], 0x2add3b43
jmp 0x1000334a
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0xaa1d012a
add ecx, eax
add ecx, 0xaa1d012a
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0xa0], 0x506d29b0
jmp 0x1000334a
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x5a5eaab4
add esi, eax
sub esi, 0x5a5eaab4
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xa0], 0x173ec721
jmp 0x1000334a
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa0], 0x8fb1a05e
jmp 0x1000334a
mov dword [ebp - 0xa0], 0xf8cbc14b
jmp 0x1000334a
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0], 0xfbe663cb
jmp 0x1000136f