Function at 0x10001320
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x1006e800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa8], 0x7ee444f2
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x8328ce49
je 0x10004645
jmp 0x10001364
mov eax, dword [ebp - 0xb0]
sub eax, 0x859b8605
je 0x100033cb
jmp 0x1000137a
mov eax, dword [ebp - 0xb0]
sub eax, 0x863988fa
je 0x1000421a
jmp 0x10001390
mov eax, dword [ebp - 0xb0]
sub eax, 0x88b43587
je 0x100047d7
jmp 0x100013a6
mov eax, dword [ebp - 0xb0]
sub eax, 0x8a4094c1
je 0x10002351
jmp 0x100013bc
mov eax, dword [ebp - 0xb0]
sub eax, 0x8d9d6604
je 0x10002f9a
jmp 0x100013d2
mov eax, dword [ebp - 0xb0]
sub eax, 0x8e92d476
je 0x10004681
jmp 0x100013e8
mov eax, dword [ebp - 0xb0]
sub eax, 0x8eaf1557
je 0x100040c4
jmp 0x100013fe
mov eax, dword [ebp - 0xb0]
sub eax, 0x90e0ba4e
je 0x10003667
jmp 0x10001414
mov eax, dword [ebp - 0xb0]
sub eax, 0x93122005
je 0x10003077
jmp 0x1000142a
mov eax, dword [ebp - 0xb0]
sub eax, 0x95c93d18
je 0x1000216b
jmp 0x10001440
mov eax, dword [ebp - 0xb0]
sub eax, 0x972eb362
je 0x10003469
jmp 0x10001456
mov eax, dword [ebp - 0xb0]
sub eax, 0x9a2644c6
je 0x10002e01
jmp 0x1000146c
mov eax, dword [ebp - 0xb0]
sub eax, 0x9a74d572
je 0x100038e5
jmp 0x10001482
mov eax, dword [ebp - 0xb0]
sub eax, 0x9b3d61b9
je 0x100037e2
jmp 0x10001498
mov eax, dword [ebp - 0xb0]
sub eax, 0xa084d327
je 0x100029c9
jmp 0x100014ae
mov eax, dword [ebp - 0xb0]
sub eax, 0xa36240ae
je 0x1000285d
jmp 0x100014c4
mov eax, dword [ebp - 0xb0]
sub eax, 0xa54decf6
je 0x10002256
jmp 0x100014da
mov eax, dword [ebp - 0xb0]
sub eax, 0xa55e99fa
je 0x10003158
jmp 0x100014f0
mov eax, dword [ebp - 0xb0]
sub eax, 0xa589cf1e
je 0x10002112
jmp 0x10001506
mov eax, dword [ebp - 0xb0]
sub eax, 0xa8bf620d
je 0x100036dd
jmp 0x1000151c
mov eax, dword [ebp - 0xb0]
sub eax, 0xa987bc83
je 0x10002db0
jmp 0x10001532
mov eax, dword [ebp - 0xb0]
sub eax, 0xaa598fbf
je 0x100024d7
jmp 0x10001548
mov eax, dword [ebp - 0xb0]
sub eax, 0xaabfddc1
je 0x100035e1
jmp 0x1000155e
mov eax, dword [ebp - 0xb0]
sub eax, 0xae58fa4c
je 0x100047c8
jmp 0x10001574
mov eax, dword [ebp - 0xb0]
sub eax, 0xaf1df29c
je 0x10003650
jmp 0x1000158a
mov eax, dword [ebp - 0xb0]
sub eax, 0xb05d82c2
je 0x10004041
jmp 0x100015a0
mov eax, dword [ebp - 0xb0]
sub eax, 0xb1cb0551
je 0x10002918
jmp 0x100015b6
mov eax, dword [ebp - 0xb0]
sub eax, 0xb31dddc0
je 0x1000440a
jmp 0x100015cc
mov eax, dword [ebp - 0xb0]
sub eax, 0xb36add4d
je 0x10004663
jmp 0x100015e2
mov eax, dword [ebp - 0xb0]
sub eax, 0xb5b4f6c0
je 0x10002baf
jmp 0x100015f8
mov eax, dword [ebp - 0xb0]
sub eax, 0xb6ae9678
je 0x10003e82
jmp 0x1000160e
mov eax, dword [ebp - 0xb0]
sub eax, 0xb6b74028
je 0x10003256
jmp 0x10001624
mov eax, dword [ebp - 0xb0]
sub eax, 0xb6bc8374
je 0x10003f5a
jmp 0x1000163a
mov eax, dword [ebp - 0xb0]
sub eax, 0xb7093fec
je 0x100026fc
jmp 0x10001650
mov eax, dword [ebp - 0xb0]
sub eax, 0xbed0f0b2
je 0x10003a62
jmp 0x10001666
mov eax, dword [ebp - 0xb0]
sub eax, 0xc1f3f055
je 0x10003548
jmp 0x1000167c
mov eax, dword [ebp - 0xb0]
sub eax, 0xc5feaf6d
je 0x10002bd8
jmp 0x10001692
mov eax, dword [ebp - 0xb0]
sub eax, 0xc67b0580
je 0x10004395
jmp 0x100016a8
mov eax, dword [ebp - 0xb0]
sub eax, 0xc78de496
je 0x10004124
jmp 0x100016be
mov eax, dword [ebp - 0xb0]
sub eax, 0xc83324a5
je 0x10003b46
jmp 0x100016d4
mov eax, dword [ebp - 0xb0]
sub eax, 0xc84b1576
je 0x1000422f
jmp 0x100016ea
mov eax, dword [ebp - 0xb0]
sub eax, 0xcad78c03
je 0x10003d02
jmp 0x10001700
mov eax, dword [ebp - 0xb0]
sub eax, 0xce0f3fc4
je 0x100031bf
jmp 0x10001716
mov eax, dword [ebp - 0xb0]
sub eax, 0xce422a98
je 0x10003726
jmp 0x1000172c
mov eax, dword [ebp - 0xb0]
sub eax, 0xcf3302dc
je 0x10002c4e
jmp 0x10001742
mov eax, dword [ebp - 0xb0]
sub eax, 0xd060871e
je 0x1000248e
jmp 0x10001758
mov eax, dword [ebp - 0xb0]
sub eax, 0xd1675802
je 0x10003782
jmp 0x1000176e
mov eax, dword [ebp - 0xb0]
sub eax, 0xd1b8b239
je 0x10004073
jmp 0x10001784
mov eax, dword [ebp - 0xb0]
sub eax, 0xd2664695
je 0x100044df
jmp 0x1000179a
mov eax, dword [ebp - 0xb0]
sub eax, 0xd286c256
je 0x10003d11
jmp 0x100017b0
mov eax, dword [ebp - 0xb0]
sub eax, 0xd3f2966b
je 0x10002a3f
jmp 0x100017c6
mov eax, dword [ebp - 0xb0]
sub eax, 0xd75cb391
je 0x10003059
jmp 0x100017dc
mov eax, dword [ebp - 0xb0]
sub eax, 0xd976d5f7
je 0x10003a01
jmp 0x100017f2
mov eax, dword [ebp - 0xb0]
sub eax, 0xdac40d53
je 0x10004135
jmp 0x10001808
mov eax, dword [ebp - 0xb0]
sub eax, 0xdbe3ab7b
je 0x10004612
jmp 0x1000181e
mov eax, dword [ebp - 0xb0]
sub eax, 0xdc506f8f
je 0x100020ad
jmp 0x10001834
mov eax, dword [ebp - 0xb0]
sub eax, 0xe0488576
je 0x100032c4
jmp 0x1000184a
mov eax, dword [ebp - 0xb0]
sub eax, 0xe2452666
je 0x100025bf
jmp 0x10001860
mov eax, dword [ebp - 0xb0]
sub eax, 0xe56890dd
je 0x10003c05
jmp 0x10001876
mov eax, dword [ebp - 0xb0]
sub eax, 0xe59e7aec
je 0x10003e05
jmp 0x1000188c
mov eax, dword [ebp - 0xb0]
sub eax, 0xe68b764b
je 0x10002686
jmp 0x100018a2
mov eax, dword [ebp - 0xb0]
sub eax, 0xe749dad4
je 0x100022c6
jmp 0x100018b8
mov eax, dword [ebp - 0xb0]
sub eax, 0xe75120f0
je 0x10003dbc
jmp 0x100018ce
mov eax, dword [ebp - 0xb0]
sub eax, 0xea59f9bb
je 0x10002635
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x9c], eax
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x6b4c4b68
sub edx, 1
sub edx, 0x6b4c4b68
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5ab9e6c3
mov ecx, 0xa589cf1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x12e2809c
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
sub edx, 0x888e8d80
sub edx, 1
add edx, 0x888e8d80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdbe3ab7b
mov ecx, 0xea5ee3b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdac40d53
mov ecx, 0x5e62759b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0xac]
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10011a50
add esp, 0xc
mov eax, dword [ebp - 0xa4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov edx, dword [ebp - 0x98]
mov eax, 0x8a4094c1
mov ecx, 0x20bc5b79
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0x397d3427
sub edx, 1
sub edx, 0x397d3427
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x22c90f2c
mov ecx, 0x159e4f0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x79b17c8a
mov ecx, 0xaa598fbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0xc78de496
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0xef8621a
sub edx, 1
sub edx, 0xef8621a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8328ce49
mov ecx, 0xea59f9bb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0x3299d011
sub edx, 1
sub edx, 0x3299d011
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x863988fa
mov ecx, 0xb7093fec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x46ec086c
sub edx, 1
sub edx, 0x46ec086c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x863988fa
mov ecx, 0x72260b3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x11f29417
jmp 0x1000485f
mov eax, dword [ebp - 0x60]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x59], al
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x37461146
sub edx, 1
sub edx, 0x37461146
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8f9c4ce
mov ecx, 0xa084d327
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0x6b81c07b
sub edx, 1
sub edx, 0x6b81c07b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58615af5
mov ecx, 0xd3f2966b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x58615af5
mov ecx, 0xf2dc8ecb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0xc78de496
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
sub edx, 0xebc97290
sub edx, 1
add edx, 0xebc97290
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x65edff14
mov ecx, 0xcf3302dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x65edff14
mov ecx, 0x50fb980b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
sub edx, 0xe9f4a2fb
sub edx, 1
add edx, 0xe9f4a2fb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e92d476
mov ecx, 0x9a2644c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0x31d7cd1a
sub edx, 1
sub edx, 0x31d7cd1a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8e92d476
mov ecx, 0xd3aa48c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0xf2ae9daf
sub edx, 1
sub edx, 0xf2ae9daf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x539b5557
mov ecx, 0x38032a70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dl, byte [ebp - 0x4d]
mov eax, 0x93122005
mov ecx, 0x172b0d11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0xb82abd49
sub edx, 1
sub edx, 0xb82abd49
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x40b79b2d
mov ecx, 0xfd137dd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0x661d1b02
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb31dddc0
mov ecx, 0x6bb594fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2058a259
mov ecx, 0xe0488576
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2058a259
mov ecx, 0xf23f6b37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov word [eax], 0
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
sub edx, 0x3668e70
sub edx, 1
add edx, 0x3668e70
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b6be923
mov ecx, 0x52b7a894
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x8b6a2b64
sub edx, 1
sub edx, 0x8b6a2b64
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2bd7825
mov ecx, 0x2cf5b5df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov dword [ebp - 0xa8], 0x3383554b
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x645173bd
sub edx, 1
sub edx, 0x645173bd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23207d7e
mov ecx, 0x4b78f74e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa8], 0x90e0ba4e
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0x2f70a2de
sub edx, 1
sub edx, 0x2f70a2de
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4180146a
mov ecx, 0xa8bf620d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x112a6d76
mov ecx, 0xce422a98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x30]
sub eax, 0x188db29d
add eax, 0x18
add eax, 0x188db29d
mov dword [ebp - 0x2c], eax
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x112a6d76
mov ecx, 0xd1675802
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
sub edx, 0x8b1f4038
sub edx, 1
add edx, 0x8b1f4038
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4180146a
mov ecx, 0xf562a585
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x2c]
add ecx, 0x3b449f76
add ecx, eax
sub ecx, 0x3b449f76
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x6d552112
add ecx, eax
sub ecx, 0x6d552112
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001d1a0
call fcn.10013dc0
add esp, 8
mov edx, eax
mov eax, 0x2e9d8a12
mov ecx, 0xbed0f0b2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011bb0
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0xff94484e
sub edx, 1
sub edx, 0xff94484e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x70cf32fe
mov ecx, 0xd976d5f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x7648381c
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd2664695
mov ecx, 0x48b6f41c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
mov edx, ecx
add edx, 0xf516f09a
sub edx, 1
sub edx, 0xf516f09a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6d8d95c
mov ecx, 0xbbd7bb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x5a3ef625
jmp 0x1000485f
mov dword [ebp - 0xa8], 0xd286c256
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
sub edx, 0x86cd457a
sub edx, 1
add edx, 0x86cd457a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfefec3e9
mov ecx, 0xf75631ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3264af0
mov ecx, 0xe59e7aec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3264af0
mov ecx, 0x13323a77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [ebp - 0x78]
mov cx, word [ebp - 0xe]
mov word [eax], cx
mov dword [ebp - 0xa8], 0x972eb362
jmp 0x1000485f
mov ecx, dword [0x1006fb48]
mov eax, dword [0x1006fb44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x76c19c69
mov ecx, 0x3a389488
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x4fc7d55e
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x8fc20cac
sub edx, 1
sub edx, 0x8fc20cac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae58fa4c
mov ecx, 0x8eaf1557
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
add edx, 0x9099d5c
sub edx, 1
sub edx, 0x9099d5c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae58fa4c
mov ecx, 0x3fa0450f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10010e30
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa8], 0xa54decf6
jmp 0x1000485f
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], 0xb7093fec
jmp 0x1000485f
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0x533c382e
jmp 0x1000485f
mov eax, dword [0x1006fb48]
mov ecx, dword [0x1006fb44]
mov edx, eax
sub edx, 0xaa71f182
sub edx, 1
add edx, 0xaa71f182
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f3cf512
mov ecx, 0xfb3a3e02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000485f
mov dword [ebp - 0xa8], 0xce0f3fc4
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x48b6f41c
jmp 0x1000485f
mov dword [ebp - 0xa8], 0xea5ee3b1
jmp 0x1000485f
mov dword [ebp - 0xa8], 0xea59f9bb
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x33f556af
jmp 0x1000485f
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xa8], 0x9a2644c6
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x8eaf1557
jmp 0x1000485f
mov dword [ebp - 0xa8], 0x7da0caf0
jmp 0x1000485f
jmp 0x10001348