Function at 0x10010720
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x1009a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
add edx, 0xf19fca8
sub edx, 1
sub edx, 0xf19fca8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0xa8], 0x79d0c4bd
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x82534b8a
je 0x100111ac
jmp 0x100107a4
mov eax, dword [ebp - 0xb0]
sub eax, 0x85cd2dcc
je 0x10011e4a
jmp 0x100107ba
mov eax, dword [ebp - 0xb0]
sub eax, 0x87fefd3d
je 0x1001213f
jmp 0x100107d0
mov eax, dword [ebp - 0xb0]
sub eax, 0x88a0c24c
je 0x10011dc5
jmp 0x100107e6
mov eax, dword [ebp - 0xb0]
sub eax, 0x8d6008c8
je 0x10012151
jmp 0x100107fc
mov eax, dword [ebp - 0xb0]
sub eax, 0x944b95a2
je 0x100121f1
jmp 0x10010812
mov eax, dword [ebp - 0xb0]
sub eax, 0x985ef114
je 0x10011d4f
jmp 0x10010828
mov eax, dword [ebp - 0xb0]
sub eax, 0x9c8e4861
je 0x1001155f
jmp 0x1001083e
mov eax, dword [ebp - 0xb0]
sub eax, 0x9d831722
je 0x1001223b
jmp 0x10010854
mov eax, dword [ebp - 0xb0]
sub eax, 0xa1a8a7a6
je 0x100110a6
jmp 0x1001086a
mov eax, dword [ebp - 0xb0]
sub eax, 0xa8d841d9
je 0x10011f78
jmp 0x10010880
mov eax, dword [ebp - 0xb0]
sub eax, 0xa9438ca1
je 0x10011276
jmp 0x10010896
mov eax, dword [ebp - 0xb0]
sub eax, 0xaa3f1b45
je 0x10011f4f
jmp 0x100108ac
mov eax, dword [ebp - 0xb0]
sub eax, 0xab3c736e
je 0x10011ba1
jmp 0x100108c2
mov eax, dword [ebp - 0xb0]
sub eax, 0xb427b3d3
je 0x10011b68
jmp 0x100108d8
mov eax, dword [ebp - 0xb0]
sub eax, 0xc0621dc2
je 0x10010f2f
jmp 0x100108ee
mov eax, dword [ebp - 0xb0]
sub eax, 0xcc1b9e64
je 0x100112c7
jmp 0x10010904
mov eax, dword [ebp - 0xb0]
sub eax, 0xccfaea1e
je 0x10011ec0
jmp 0x1001091a
mov eax, dword [ebp - 0xb0]
sub eax, 0xd2b4790d
je 0x10011d29
jmp 0x10010930
mov eax, dword [ebp - 0xb0]
sub eax, 0xd49480b6
je 0x1001235f
jmp 0x10010946
mov eax, dword [ebp - 0xb0]
sub eax, 0xe51def68
je 0x10011f36
jmp 0x1001095c
mov eax, dword [ebp - 0xb0]
sub eax, 0xe5fb2b58
je 0x10011b32
jmp 0x10010972
mov eax, dword [ebp - 0xb0]
sub eax, 0xec3cb0af
je 0x100113a7
jmp 0x10010988
mov eax, dword [ebp - 0xb0]
sub eax, 0xf03421d8
je 0x100114a9
jmp 0x1001099e
mov eax, dword [ebp - 0xb0]
sub eax, 0xf1beaea5
je 0x1001185e
jmp 0x100109b4
mov eax, dword [ebp - 0xb0]
sub eax, 0xfa7cddbd
je 0x100110c4
jmp 0x100109ca
mov eax, dword [ebp - 0xb0]
sub eax, 0x77e897a
je 0x1001141d
jmp 0x100109e0
mov eax, dword [ebp - 0xb0]
sub eax, 0x857d902
je 0x10011fd3
jmp 0x100109f6
mov eax, dword [ebp - 0xb0]
sub eax, 0xdce494d
je 0x1001119d
jmp 0x10010a0c
mov eax, dword [ebp - 0xb0]
sub eax, 0x1386d2f8
je 0x10011fa1
jmp 0x10010a22
mov eax, dword [ebp - 0xb0]
sub eax, 0x15f3c091
je 0x1001180d
jmp 0x10010a38
mov eax, dword [ebp - 0xb0]
sub eax, 0x1ac1b44f
je 0x10011d38
jmp 0x10010a4e
mov eax, dword [ebp - 0xb0]
sub eax, 0x271c4a54
je 0x100121cc
jmp 0x10010a64
mov eax, dword [ebp - 0xb0]
sub eax, 0x2a755c4e
je 0x10012180
jmp 0x10010a7a
mov eax, dword [ebp - 0xb0]
sub eax, 0x2abd813e
je 0x10010eb1
jmp 0x10010a90
mov eax, dword [ebp - 0xb0]
sub eax, 0x328b4d83
je 0x10012268
jmp 0x10010aa6
mov eax, dword [ebp - 0xb0]
sub eax, 0x3339f002
je 0x100120a4
jmp 0x10010abc
mov eax, dword [ebp - 0xb0]
sub eax, 0x35e753eb
je 0x10011a33
jmp 0x10010ad2
mov eax, dword [ebp - 0xb0]
sub eax, 0x35e9b584
je 0x1001193b
jmp 0x10010ae8
mov eax, dword [ebp - 0xb0]
sub eax, 0x38d1b9af
je 0x100110d3
jmp 0x10010afe
mov eax, dword [ebp - 0xb0]
sub eax, 0x3c2adaba
je 0x10011906
jmp 0x10010b14
mov eax, dword [ebp - 0xb0]
sub eax, 0x3d383248
je 0x10012171
jmp 0x10010b2a
mov eax, dword [ebp - 0xb0]
sub eax, 0x3fb3ce4d
je 0x10012250
jmp 0x10010b40
mov eax, dword [ebp - 0xb0]
sub eax, 0x4047682d
je 0x10011b0a
jmp 0x10010b56
mov eax, dword [ebp - 0xb0]
sub eax, 0x42907a79
je 0x10011afb
jmp 0x10010b6c
mov eax, dword [ebp - 0xb0]
sub eax, 0x44d2662e
je 0x1001191e
jmp 0x10010b82
mov eax, dword [ebp - 0xb0]
sub eax, 0x45375be9
je 0x10012371
jmp 0x10010b98
mov eax, dword [ebp - 0xb0]
sub eax, 0x4627670a
je 0x10011652
jmp 0x10010bae
mov eax, dword [ebp - 0xb0]
sub eax, 0x46c99d8f
je 0x1001198c
jmp 0x10010bc4
mov eax, dword [ebp - 0xb0]
sub eax, 0x498614f8
je 0x100114b8
jmp 0x10010bda
mov eax, dword [ebp - 0xb0]
sub eax, 0x4a3ca972
je 0x1001212a
jmp 0x10010bf0
mov eax, dword [ebp - 0xb0]
sub eax, 0x4ad1509c
je 0x100120b3
jmp 0x10010c06
mov eax, dword [ebp - 0xb0]
sub eax, 0x4f1daba2
je 0x100118f7
jmp 0x10010c1c
mov eax, dword [ebp - 0xb0]
sub eax, 0x4fc86d5a
je 0x1001150e
jmp 0x10010c32
mov eax, dword [ebp - 0xb0]
sub eax, 0x5037b39d
je 0x10012024
jmp 0x10010c48
mov eax, dword [ebp - 0xb0]
sub eax, 0x51347017
je 0x10010f20
jmp 0x10010c5e
mov eax, dword [ebp - 0xb0]
sub eax, 0x533ca8f2
je 0x100114d6
jmp 0x10010c74
mov eax, dword [ebp - 0xb0]
sub eax, 0x571629c9
je 0x10011a7c
jmp 0x10010c8a
mov eax, dword [ebp - 0xb0]
sub eax, 0x571b9a22
je 0x10011357
jmp 0x10010ca0
mov eax, dword [ebp - 0xb0]
sub eax, 0x573a82b9
je 0x100117fe
jmp 0x10010cb6
mov eax, dword [ebp - 0xb0]
sub eax, 0x58147ae3
je 0x10011f5e
jmp 0x10010ccc
mov eax, dword [ebp - 0xb0]
sub eax, 0x59a76114
je 0x10012092
jmp 0x10010ce2
mov eax, dword [ebp - 0xb0]
sub eax, 0x613c0e14
je 0x10011348
jmp 0x10010cf8
mov eax, dword [ebp - 0xb0]
sub eax, 0x628b9346
je 0x10011e3b
jmp 0x10010d0e
mov eax, dword [ebp - 0xb0]
sub eax, 0x63cf2824
je 0x1001132a
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3339f002
mov ecx, 0x51347017
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0xc0621dc2
jmp 0x1001237b
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xa8], 0x6efc9899
jmp 0x1001237b
mov dl, byte [ebp - 0x61]
mov eax, 0xfa7cddbd
mov ecx, 0x38d1b9af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x857d902
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a3ca972
mov ecx, 0x77b24ac6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x82534b8a
jmp 0x1001237b
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xa8], 0xa9438ca1
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
sub edx, 0xeb2c7f68
sub edx, 1
add edx, 0xeb2c7f68
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87fefd3d
mov ecx, 0xcc1b9e64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x5c]
mov ecx, 0xffffffff
cmp eax, ecx
sete al
and al, 1
mov byte [ebp - 0x55], al
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
sub edx, 0x6ba8910e
sub edx, 1
add edx, 0x6ba8910e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87fefd3d
mov ecx, 0x63cf2824
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x857d902
jmp 0x1001237b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa8], 0xec3cb0af
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
sub edx, 0x36e314b4
sub edx, 1
add edx, 0x36e314b4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d6008c8
mov ecx, 0x77e897a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
add edx, 0xf11eab08
sub edx, 1
sub edx, 0xf11eab08
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8d6008c8
mov ecx, 0xf03421d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x498614f8
jmp 0x1001237b
mov edx, dword [ebp - 0x50]
mov eax, 0x533ca8f2
mov ecx, 0x72125fa2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xa8], 0x6883f6a0
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
add edx, 0x8694d0e8
sub edx, 1
sub edx, 0x8694d0e8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d383248
mov ecx, 0x9c8e4861
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3d383248
mov ecx, 0x65ad6eb6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
sub edx, 0x1d789b72
sub edx, 1
add edx, 0x1d789b72
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a755c4e
mov ecx, 0x6b446b14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x15f3c091
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
sub edx, 0xe6af0ec
sub edx, 1
add edx, 0xe6af0ec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x944b95a2
mov ecx, 0xf1beaea5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x48]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
add edx, 0xe9a5effd
sub edx, 1
sub edx, 0xe9a5effd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x944b95a2
mov ecx, 0x4f1daba2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x3c2adaba
jmp 0x1001237b
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xa8], 0x44d2662e
jmp 0x1001237b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xa8], 0x35e9b584
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
sub edx, 0x31c64999
sub edx, 1
add edx, 0x31c64999
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d831722
mov ecx, 0x46c99d8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
add edx, 0x2e94efe3
sub edx, 1
sub edx, 0x2e94efe3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9d831722
mov ecx, 0x7984e210
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3fb3ce4d
mov ecx, 0x571629c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub eax, 0x1b5c93e5
add eax, 0x18
add eax, 0x1b5c93e5
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, 0x6a61ef47
add eax, ecx
sub eax, 0x6a61ef47
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
imul eax, eax, 0x28
mov dword [ebp - 0x30], eax
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3fb3ce4d
mov ecx, 0x42907a79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x4047682d
jmp 0x1001237b
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa8], 0xe5fb2b58
jmp 0x1001237b
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003b0cb
call fcn.10030ec0
add esp, 8
mov edx, eax
mov eax, 0xb427b3d3
mov ecx, 0x985ef114
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa8], 0xab3c736e
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
add edx, 0xf81ae333
sub edx, 1
sub edx, 0xf81ae333
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x328b4d83
mov ecx, 0x69fe5ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x1ac1b44f
jmp 0x1001237b
mov eax, dword [ebp - 0x68]
mov cl, byte [ebp - 0x1b]
mov byte [eax], cl
mov dword [ebp - 0xa8], 0x985ef114
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
sub edx, 0x40f08caa
sub edx, 1
add edx, 0x40f08caa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7c6a8f9d
mov ecx, 0x88a0c24c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
add edx, 0xce9804d1
sub edx, 1
sub edx, 0xce9804d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7c6a8f9d
mov ecx, 0x628b9346
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x85cd2dcc
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
mov edx, ecx
add edx, 0x48848e26
sub edx, 1
sub edx, 0x48848e26
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd49480b6
mov ecx, 0xccfaea1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
add ax, 0x5ebe
add ax, 1
sub ax, 0x5ebe
mov word [ebp - 0x1a], ax
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
add edx, 0x9707a69f
sub edx, 1
sub edx, 0x9707a69f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd49480b6
mov ecx, 0x69047206
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov eax, dword [ebp - 0x74]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov dword [ebp - 0xa8], 0xaa3f1b45
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x3c2adaba
jmp 0x1001237b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa8], 0xa8d841d9
jmp 0x1001237b
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa8], 0x1386d2f8
jmp 0x1001237b
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0x857d902
jmp 0x1001237b
mov eax, dword [0x1009b574]
mov ecx, dword [0x1009b570]
mov edx, eax
add edx, 0xc3c0545b
sub edx, 1
sub edx, 0xc3c0545b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x45375be9
mov ecx, 0x5037b39d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov ecx, dword [0x1009b574]
mov eax, dword [0x1009b570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x45375be9
mov ecx, 0x59a76114
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001237b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002c7c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa8], 0x2abd813e
jmp 0x1001237b
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002d560
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa8], 0x79aea3e4
jmp 0x1001237b
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa8], 0x77b24ac6
jmp 0x1001237b
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa8], 0xcc1b9e64
jmp 0x1001237b
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa8], 0x77e897a
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x9c8e4861
jmp 0x1001237b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x4627670a
jmp 0x1001237b
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xa8], 0x753cfbc3
jmp 0x1001237b
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov dword [ebp - 0xa8], 0xf1beaea5
jmp 0x1001237b
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa8], 0x46c99d8f
jmp 0x1001237b
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa8], 0x571629c9
jmp 0x1001237b
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
add edx, 0x2731006f
add edx, eax
sub edx, 0x2731006f
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x5c73c770
add edx, eax
sub edx, 0x5c73c770
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002d6c0
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xa8], 0x69fe5ab9
jmp 0x1001237b
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa8], 0xccfaea1e
jmp 0x1001237b
mov dword [ebp - 0xa8], 0x5037b39d
jmp 0x10010788