Function at 0x100012e0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1008ba00]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x94], 0xa42a6691
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x80008ece
je 0x100021e3
jmp 0x10001324
mov eax, dword [ebp - 0x9c]
sub eax, 0x859e801d
je 0x100023f9
jmp 0x1000133a
mov eax, dword [ebp - 0x9c]
sub eax, 0x8e4ccb30
je 0x10001b79
jmp 0x10001350
mov eax, dword [ebp - 0x9c]
sub eax, 0x91816ced
je 0x1000253f
jmp 0x10001366
mov eax, dword [ebp - 0x9c]
sub eax, 0x995961f6
je 0x10001942
jmp 0x1000137c
mov eax, dword [ebp - 0x9c]
sub eax, 0x9c8d121a
je 0x1000257d
jmp 0x10001392
mov eax, dword [ebp - 0x9c]
sub eax, 0x9ef7366f
je 0x1000266f
jmp 0x100013a8
mov eax, dword [ebp - 0x9c]
sub eax, 0xa42a6691
je 0x1000183b
jmp 0x100013be
mov eax, dword [ebp - 0x9c]
sub eax, 0xa5fd4b18
je 0x1000255d
jmp 0x100013d4
mov eax, dword [ebp - 0x9c]
sub eax, 0xa6b0a761
je 0x10001f95
jmp 0x100013ea
mov eax, dword [ebp - 0x9c]
sub eax, 0xa7f8791f
je 0x100020b7
jmp 0x10001400
mov eax, dword [ebp - 0x9c]
sub eax, 0xaa86f3a5
je 0x1000224f
jmp 0x10001416
mov eax, dword [ebp - 0x9c]
sub eax, 0xab3b6909
je 0x10001d4b
jmp 0x1000142c
mov eax, dword [ebp - 0x9c]
sub eax, 0xb54542a2
je 0x10001d34
jmp 0x10001442
mov eax, dword [ebp - 0x9c]
sub eax, 0xb86ed267
je 0x1000218a
jmp 0x10001458
mov eax, dword [ebp - 0x9c]
sub eax, 0xbb675c82
je 0x1000256e
jmp 0x1000146e
mov eax, dword [ebp - 0x9c]
sub eax, 0xc2b93270
je 0x100025f8
jmp 0x10001484
mov eax, dword [ebp - 0x9c]
sub eax, 0xc3b441c8
je 0x100023d6
jmp 0x1000149a
mov eax, dword [ebp - 0x9c]
sub eax, 0xc533d6e2
je 0x1000265d
jmp 0x100014b0
mov eax, dword [ebp - 0x9c]
sub eax, 0xc88336ee
je 0x10001caf
jmp 0x100014c6
mov eax, dword [ebp - 0x9c]
sub eax, 0xd4ddf639
je 0x100020d7
jmp 0x100014dc
mov eax, dword [ebp - 0x9c]
sub eax, 0xd974e3f1
je 0x10001fe6
jmp 0x100014f2
mov eax, dword [ebp - 0x9c]
sub eax, 0xde413f8a
je 0x10001e6d
jmp 0x10001508
mov eax, dword [ebp - 0x9c]
sub eax, 0xe3027a2b
je 0x100025b0
jmp 0x1000151e
mov eax, dword [ebp - 0x9c]
sub eax, 0xfb9137cd
je 0x10002527
jmp 0x10001534
mov eax, dword [ebp - 0x9c]
sub eax, 0x38f4090
je 0x10001951
jmp 0x1000154a
mov eax, dword [ebp - 0x9c]
sub eax, 0x48acfcc
je 0x100022ef
jmp 0x10001560
mov eax, dword [ebp - 0x9c]
sub eax, 0x51a7e97
je 0x10001b88
jmp 0x10001576
mov eax, dword [ebp - 0x9c]
sub eax, 0xbd095ec
je 0x10001b14
jmp 0x1000158c
mov eax, dword [ebp - 0x9c]
sub eax, 0x1e273f0e
je 0x10001a9e
jmp 0x100015a2
mov eax, dword [ebp - 0x9c]
sub eax, 0x1ec36cba
je 0x10001e21
jmp 0x100015b8
mov eax, dword [ebp - 0x9c]
sub eax, 0x24787fa9
je 0x100021c0
jmp 0x100015ce
mov eax, dword [ebp - 0x9c]
sub eax, 0x24ec36e5
je 0x1000258c
jmp 0x100015e4
mov eax, dword [ebp - 0x9c]
sub eax, 0x2e605018
je 0x10002518
jmp 0x100015fa
mov eax, dword [ebp - 0x9c]
sub eax, 0x309c03aa
je 0x100018a9
jmp 0x10001610
mov eax, dword [ebp - 0x9c]
sub eax, 0x32196835
je 0x10002488
jmp 0x10001626
mov eax, dword [ebp - 0x9c]
sub eax, 0x34380df9
je 0x10002110
jmp 0x1000163c
mov eax, dword [ebp - 0x9c]
sub eax, 0x350d2668
je 0x100022fe
jmp 0x10001652
mov eax, dword [ebp - 0x9c]
sub eax, 0x3e3e547c
je 0x10001d9c
jmp 0x10001668
mov eax, dword [ebp - 0x9c]
sub eax, 0x3ebf2438
je 0x1000213f
jmp 0x1000167e
mov eax, dword [ebp - 0x9c]
sub eax, 0x4703d996
je 0x10002412
jmp 0x10001694
mov eax, dword [ebp - 0x9c]
sub eax, 0x4920a699
je 0x100019d8
jmp 0x100016aa
mov eax, dword [ebp - 0x9c]
sub eax, 0x4a78a410
je 0x100025a1
jmp 0x100016c0
mov eax, dword [ebp - 0x9c]
sub eax, 0x4b9cb04e
je 0x10002616
jmp 0x100016d6
mov eax, dword [ebp - 0x9c]
sub eax, 0x4f556db0
je 0x10001c5e
jmp 0x100016ec
mov eax, dword [ebp - 0x9c]
sub eax, 0x52490c87
je 0x10001e56
jmp 0x10001702
mov eax, dword [ebp - 0x9c]
sub eax, 0x5b8a62e5
je 0x1000234f
jmp 0x10001718
mov eax, dword [ebp - 0x9c]
sub eax, 0x5de7182b
je 0x10001d25
jmp 0x1000172e
mov eax, dword [ebp - 0x9c]
sub eax, 0x6053bf9f
je 0x10001bf4
jmp 0x10001744
mov eax, dword [ebp - 0x9c]
sub eax, 0x63e75605
je 0x10001f6f
jmp 0x1000175a
mov eax, dword [ebp - 0x9c]
sub eax, 0x6628c11b
je 0x10001e30
jmp 0x10001770
mov eax, dword [ebp - 0x9c]
sub eax, 0x67b749fd
je 0x10001a8f
jmp 0x10001786
mov eax, dword [ebp - 0x9c]
sub eax, 0x68eb94d0
je 0x1000207e
jmp 0x1000179c
mov eax, dword [ebp - 0x9c]
sub eax, 0x69d39f02
je 0x100023c7
jmp 0x100017b2
mov eax, dword [ebp - 0x9c]
sub eax, 0x6af52391
je 0x10001edb
jmp 0x100017c8
mov eax, dword [ebp - 0x9c]
sub eax, 0x6ba97528
je 0x10001f60
jmp 0x100017de
mov eax, dword [ebp - 0x9c]
sub eax, 0x7389e6ac
je 0x10001a21
jmp 0x100017f4
mov eax, dword [ebp - 0x9c]
sub eax, 0x74607721
je 0x100020f0
jmp 0x1000180a
mov eax, dword [ebp - 0x9c]
sub eax, 0x77b73517
je 0x10001f7e
jmp 0x10001820
mov eax, dword [ebp - 0x9c]
sub eax, 0x79e8a230
je 0x1000206f
jmp 0x10001836
jmp 0x1000269b
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbb675c82
mov ecx, 0x309c03aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb675c82
mov ecx, 0x995961f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0x38f4090
jmp 0x1000269b
mov eax, dword [ebp - 0x98]
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cad0
add esp, 0xc
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov edx, dword [ebp - 0x84]
mov eax, 0x4920a699
mov ecx, 0x1e273f0e
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c8d121a
mov ecx, 0x7389e6ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9c8d121a
mov ecx, 0x67b749fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0xa5fd4b18
jmp 0x1000269b
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
mov edx, ecx
add edx, 0xd1c8e207
sub edx, 1
sub edx, 0xd1c8e207
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x24ec36e5
mov ecx, 0xbd095ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x50], eax
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
mov edx, eax
sub edx, 0x16057c74
sub edx, 1
add edx, 0x16057c74
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24ec36e5
mov ecx, 0x8e4ccb30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0x51a7e97
jmp 0x1000269b
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x94], 0x6053bf9f
jmp 0x1000269b
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov edx, dword [ebp - 0x78]
mov esi, 0xffffffff
mov eax, 0xb54542a2
mov ecx, 0x4f556db0
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
mov edx, eax
add edx, 0x2d5ca93b
sub edx, 1
sub edx, 0x2d5ca93b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a78a410
mov ecx, 0xc88336ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
mov edx, ecx
sub edx, 0x52be7664
sub edx, 1
add edx, 0x52be7664
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a78a410
mov ecx, 0x5de7182b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0xa5fd4b18
jmp 0x1000269b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x94], 0xab3b6909
jmp 0x1000269b
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
mov edx, eax
sub edx, 0x315fd147
sub edx, 1
add edx, 0x315fd147
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe3027a2b
mov ecx, 0x3e3e547c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe3027a2b
mov ecx, 0x1ec36cba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0x6628c11b
jmp 0x1000269b
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov edx, dword [ebp - 0x74]
mov eax, 0x52490c87
mov ecx, 0x77b73517
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x94], 0xde413f8a
jmp 0x1000269b
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc2b93270
mov ecx, 0x6af52391
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
mov edx, ecx
sub edx, 0x36e86c8d
sub edx, 1
add edx, 0x36e86c8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc2b93270
mov ecx, 0x6ba97528
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0x63e75605
jmp 0x1000269b
mov dword [ebp - 0x94], 0xa5fd4b18
jmp 0x1000269b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x94], 0xa6b0a761
jmp 0x1000269b
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
mov edx, eax
add edx, 0xbdb10224
sub edx, 1
sub edx, 0xbdb10224
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b9cb04e
mov ecx, 0xd974e3f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
mov edx, eax
add edx, 0xdc88708d
sub edx, 1
sub edx, 0xdc88708d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b9cb04e
mov ecx, 0x79e8a230
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0x68eb94d0
jmp 0x1000269b
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov dword [ebp - 0x94], 0xa7f8791f
jmp 0x1000269b
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x94], 0xd4ddf639
jmp 0x1000269b
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 6]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x94], 0x74607721
jmp 0x1000269b
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov eax, 0x4703d996
mov ecx, 0x34380df9
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub eax, 0xb61af710
add eax, 0x18
add eax, 0xb61af710
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x94], 0x3ebf2438
jmp 0x1000269b
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x10]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd83b0052
add ecx, eax
sub ecx, 0xd83b0052
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x3da23525
add ecx, eax
sub ecx, 0x3da23525
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x94], 0xb86ed267
jmp 0x1000269b
mov ecx, dword [ebp - 0x24]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ee40
add esp, 8
mov edx, eax
mov eax, 0x24787fa9
mov ecx, 0x48acfcc
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x94], 0x80008ece
jmp 0x1000269b
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x94], 0xaa86f3a5
jmp 0x1000269b
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000cc30
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x4d271325
add esi, eax
sub esi, 0x4d271325
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov dword [ebp - 0x94], 0x48acfcc
jmp 0x1000269b
mov dword [ebp - 0x94], 0x350d2668
jmp 0x1000269b
mov eax, dword [0x1008cd40]
mov ecx, dword [0x1008cd3c]
mov edx, eax
add edx, 0xec792b66
sub edx, 1
sub edx, 0xec792b66
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc533d6e2
mov ecx, 0x5b8a62e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc533d6e2
mov ecx, 0x69d39f02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0xc3b441c8
jmp 0x1000269b
mov ax, word [ebp - 0x14]
sub ax, 0xc0f4
add ax, 1
add ax, 0xc0f4
mov word [ebp - 0x12], ax
mov dword [ebp - 0x94], 0x859e801d
jmp 0x1000269b
mov eax, dword [ebp - 0x64]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x94], 0xa7f8791f
jmp 0x1000269b
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
mov edx, ecx
add edx, 0x8843ae80
sub edx, 1
sub edx, 0x8843ae80
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9ef7366f
mov ecx, 0x32196835
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1008cd40]
mov eax, dword [0x1008cd3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9ef7366f
mov ecx, 0x2e605018
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000269b
mov dword [ebp - 0x94], 0xfb9137cd
jmp 0x1000269b
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x94], 0x91816ced
jmp 0x1000269b
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xa5fd4b18
jmp 0x1000269b
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bed0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x94], 0x309c03aa
jmp 0x1000269b
mov dword [ebp - 0x94], 0x7389e6ac
jmp 0x1000269b
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x94], 0xbd095ec
jmp 0x1000269b
mov dword [ebp - 0x94], 0xc88336ee
jmp 0x1000269b
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x94], 0x3e3e547c
jmp 0x1000269b
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x6af52391
jmp 0x1000269b
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0xd974e3f1
jmp 0x1000269b
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x94], 0x5b8a62e5
jmp 0x1000269b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x32196835
jmp 0x10001308