Function at 0x1000eef0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [0x1009a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x19c], 0xf1692d78
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
sub eax, 0x86c7d59b
je 0x1000f701
jmp 0x1000ef35
mov eax, dword [ebp - 0x1a4]
sub eax, 0x87146d5d
je 0x1000f7a1
jmp 0x1000ef4b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8a7187f4
je 0x1000f575
jmp 0x1000ef61
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8e7ccd5d
je 0x100101c8
jmp 0x1000ef77
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9613686e
je 0x1000f971
jmp 0x1000ef8d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9689d45d
je 0x1001050a
jmp 0x1000efa3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9bd3e2b7
je 0x1000fad4
jmp 0x1000efb9
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa280347a
je 0x1000f5f3
jmp 0x1000efcf
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa77490e7
je 0x1000f8a2
jmp 0x1000efe5
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb3179572
je 0x1000f6e4
jmp 0x1000effb
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb5463357
je 0x10010447
jmp 0x1000f011
mov eax, dword [ebp - 0x1a4]
sub eax, 0xba172f0e
je 0x100104a7
jmp 0x1000f027
mov eax, dword [ebp - 0x1a4]
sub eax, 0xba5a68f8
je 0x1000f792
jmp 0x1000f03d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbb504468
je 0x10010621
jmp 0x1000f053
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbdc4b0be
je 0x1000ff3b
jmp 0x1000f069
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbeaebba1
je 0x10010456
jmp 0x1000f07f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbebe407e
je 0x1000fdc3
jmp 0x1000f095
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc6523bca
je 0x1000fd52
jmp 0x1000f0ab
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc8ebd453
je 0x1000fec0
jmp 0x1000f0c1
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcf1d7b6d
je 0x100103da
jmp 0x1000f0d7
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd26220f0
je 0x10010376
jmp 0x1000f0ed
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd3d011b8
je 0x100101f1
jmp 0x1000f103
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd7f0b9a9
je 0x1000f602
jmp 0x1000f119
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd875ea7c
je 0x1000fd18
jmp 0x1000f12f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdb75d1fd
je 0x100101b9
jmp 0x1000f145
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe024ec22
je 0x1000fd27
jmp 0x1000f15b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe40e4dac
je 0x10010717
jmp 0x1000f171
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe45418f4
je 0x1000fe31
jmp 0x1000f187
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe4cf9211
je 0x1000f7ea
jmp 0x1000f19d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe642590e
je 0x100105fd
jmp 0x1000f1b3
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf1692d78
je 0x1000f554
jmp 0x1000f1c9
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf1e510ff
je 0x1001063d
jmp 0x1000f1df
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1b5c72e
je 0x1001031e
jmp 0x1000f1f5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x254d286
je 0x10010759
jmp 0x1000f20b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3e55196
je 0x100101aa
jmp 0x1000f221
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7f87010
je 0x10010567
jmp 0x1000f237
mov eax, dword [ebp - 0x1a4]
sub eax, 0x910c42b
je 0x1000f902
jmp 0x1000f24d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xacc10f7
je 0x100102be
jmp 0x1000f263
mov eax, dword [ebp - 0x1a4]
sub eax, 0x12f80545
je 0x1000fbea
jmp 0x1000f279
mov eax, dword [ebp - 0x1a4]
sub eax, 0x14844493
je 0x1000ff2c
jmp 0x1000f28f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x166bab7a
je 0x1000f8b1
jmp 0x1000f2a5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x17bef3f0
je 0x10010071
jmp 0x1000f2bb
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1a30b0e7
je 0x1001023a
jmp 0x1000f2d1
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1e632e0a
je 0x10010391
jmp 0x1000f2e7
mov eax, dword [ebp - 0x1a4]
sub eax, 0x20eb816b
je 0x1001052b
jmp 0x1000f2fd
mov eax, dword [ebp - 0x1a4]
sub eax, 0x265ec6b3
je 0x1000fc8d
jmp 0x1000f313
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2e93a5a7
je 0x100102cd
jmp 0x1000f329
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2f3d9a61
je 0x1001064c
jmp 0x1000f33f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2ffcfb89
je 0x100105b2
jmp 0x1000f355
mov eax, dword [ebp - 0x1a4]
sub eax, 0x310a9c15
je 0x1000f653
jmp 0x1000f36b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3252be2e
je 0x1000fff2
jmp 0x1000f381
mov eax, dword [ebp - 0x1a4]
sub eax, 0x32ff2a42
je 0x100105cd
jmp 0x1000f397
mov eax, dword [ebp - 0x1a4]
sub eax, 0x390a25e2
je 0x1000fb7a
jmp 0x1000f3ad
mov eax, dword [ebp - 0x1a4]
sub eax, 0x41dba352
je 0x10010367
jmp 0x1000f3c3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4320c6e5
je 0x100105dc
jmp 0x1000f3d9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x43c2c2ec
je 0x1000f980
jmp 0x1000f3ef
mov eax, dword [ebp - 0x1a4]
sub eax, 0x451da0d7
je 0x1000fa5e
jmp 0x1000f405
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4806ea16
je 0x100106fa
jmp 0x1000f41b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x54935578
je 0x1000fc17
jmp 0x1000f431
mov eax, dword [ebp - 0x1a4]
sub eax, 0x55e7e08e
je 0x1000fa22
jmp 0x1000f447
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5e086e81
je 0x1000fa43
jmp 0x1000f45d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5e2c2398
je 0x1000fe52
jmp 0x1000f473
mov eax, dword [ebp - 0x1a4]
sub eax, 0x6270e7ce
je 0x1000f6d5
jmp 0x1000f489
mov eax, dword [ebp - 0x1a4]
sub eax, 0x65d839b6
je 0x1000fd72
jmp 0x1000f49f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x67954277
je 0x100100c2
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x19c], 0x8a7187f4
jmp 0x10010775
mov eax, dword [ebp - 0x1a0]
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x174], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002fea0
add esp, 0xc
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x17c], eax
mov eax, 0xa280347a
mov ecx, 0xd7f0b9a9
cmp dword [ebp - 0x17c], 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0x77025212
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
sub edx, 0x7e66d087
sub edx, 1
add edx, 0x7e66d087
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20eb816b
mov ecx, 0x310a9c15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
lea eax, [ebp - 0x120]
mov dword [ebp - 0x164], eax
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20eb816b
mov ecx, 0x6270e7ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0xb3179572
jmp 0x10010775
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x19c], 0x86c7d59b
jmp 0x10010775
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x17c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x184], eax
mov edx, 0xffffffff
mov eax, 0x87146d5d
mov ecx, 0xba5a68f8
cmp dword [ebp - 0x184], edx
cmove eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0x77025212
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f87010
mov ecx, 0xe4cf9211
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x160], eax
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
mov edx, ecx
sub edx, 0xafafacc1
sub edx, 1
add edx, 0xafafacc1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7f87010
mov ecx, 0xa77490e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0x166bab7a
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0x4cc400b9
sub edx, 1
sub edx, 0x4cc400b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ffcfb89
mov ecx, 0x910c42b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
setne al
and al, 1
mov byte [ebp - 0x159], al
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0xc6b59176
sub edx, 1
sub edx, 0xc6b59176
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ffcfb89
mov ecx, 0x9613686e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0x43c2c2ec
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
sub edx, 0xc1635e74
sub edx, 1
add edx, 0xc1635e74
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32ff2a42
mov ecx, 0x7ed20b38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dl, byte [ebp - 0x159]
mov eax, 0x5e086e81
mov ecx, 0x390a25e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x19c], 0x451da0d7
jmp 0x10010775
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
mov edx, ecx
add edx, 0x5319a17a
sub edx, 1
sub edx, 0x5319a17a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4320c6e5
mov ecx, 0x9bd3e2b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x158]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
mov edx, ecx
sub edx, 0x18bd7db7
sub edx, 1
add edx, 0x18bd7db7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4320c6e5
mov ecx, 0x720e36ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x188]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x19c], 0x12f80545
jmp 0x10010775
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x150]
add eax, 0xd749b22
add eax, ecx
sub eax, 0xd749b22
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x19c], 0x54935578
jmp 0x10010775
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
mov edx, ecx
sub edx, 0x94b80f36
sub edx, 1
add edx, 0x94b80f36
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe642590e
mov ecx, 0x265ec6b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
mov edx, ecx
add edx, 0x974d40a1
sub edx, 1
sub edx, 0x974d40a1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe642590e
mov ecx, 0xd875ea7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0xe024ec22
jmp 0x10010775
movzx eax, word [ebp - 0x196]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x194]
add eax, 4
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x19c], 0xc6523bca
jmp 0x10010775
mov eax, dword [ebp - 0x144]
mov ax, word [eax + 2]
mov word [ebp - 0x140], ax
mov dword [ebp - 0x19c], 0x65d839b6
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0x2bfeb070
sub edx, 1
sub edx, 0x2bfeb070
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb504468
mov ecx, 0xbebe407e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov ax, word [ebp - 0x140]
movzx ecx, ax
mov eax, dword [ebp - 0x148]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x13d], al
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0xf6d70
sub edx, 1
sub edx, 0xf6d70
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb504468
mov ecx, 0xe45418f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dl, byte [ebp - 0x13d]
mov eax, 0xd26220f0
mov ecx, 0x5e2c2398
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf1e510ff
mov ecx, 0xc8ebd453
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x194]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x194]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x138], eax
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1e510ff
mov ecx, 0x14844493
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0xbdc4b0be
jmp 0x10010775
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
add ecx, 0xbf6f65ef
add ecx, eax
sub ecx, 0xbf6f65ef
movzx eax, word [ebp - 0x196]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1003dec5
call fcn.10033810
add esp, 8
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x19c], 0x7c7de32b
jmp 0x10010775
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x19c], 0x17bef3f0
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0x3c221be1
sub edx, 1
sub edx, 0x3c221be1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f3d9a61
mov ecx, 0x67954277
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0xdb75d1fd
jmp 0x10010775
mov dword [ebp - 0x19c], 0x8e7ccd5d
jmp 0x10010775
mov ax, word [ebp - 0x196]
add ax, 0xac7f
add ax, 1
sub ax, 0xac7f
mov word [ebp - 0x126], ax
mov dword [ebp - 0x19c], 0xd3d011b8
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4806ea16
mov ecx, 0x1a30b0e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov ax, word [ebp - 0x126]
mov word [ebp - 0x196], ax
mov ecx, dword [0x1009b71c]
mov eax, dword [0x1009b718]
mov edx, ecx
add edx, 0x2f748834
sub edx, 1
sub edx, 0x2f748834
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4806ea16
mov ecx, 0xacc10f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0x2e93a5a7
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
sub edx, 0xb4201885
sub edx, 1
add edx, 0xb4201885
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe40e4dac
mov ecx, 0x1b5c72e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe40e4dac
mov ecx, 0x41dba352
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0xe024ec22
jmp 0x10010775
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x19c], 0x1e632e0a
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7871036b
mov ecx, 0xcf1d7b6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x188]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7871036b
mov ecx, 0xb5463357
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0xbeaebba1
jmp 0x10010775
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0xf319ce82
sub edx, 1
sub edx, 0xf319ce82
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x254d286
mov ecx, 0xba172f0e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov eax, dword [ebp - 0x178]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1009b71c]
mov ecx, dword [0x1009b718]
mov edx, eax
add edx, 0x77e023f7
sub edx, 1
sub edx, 0x77e023f7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x254d286
mov ecx, 0x9689d45d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10010775
mov dword [ebp - 0x19c], 0x77025212
jmp 0x10010775
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x120]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x19c], 0x310a9c15
jmp 0x10010775
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x19c], 0xe4cf9211
jmp 0x10010775
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x19c], 0x910c42b
jmp 0x10010775
mov dword [ebp - 0x19c], 0x7ed20b38
jmp 0x10010775
mov eax, dword [ebp - 0x158]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x9bd3e2b7
jmp 0x10010775
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov dword [ebp - 0x19c], 0x265ec6b3
jmp 0x10010775
mov ax, word [ebp - 0x140]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x19c], 0xbebe407e
jmp 0x10010775
mov dword [ebp - 0x19c], 0xc8ebd453
jmp 0x10010775
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x12c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10030000
add esp, 0xc
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x180]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov dword [ebp - 0x19c], 0x67954277
jmp 0x10010775
mov ax, word [ebp - 0x126]
mov word [ebp - 0x196], ax
mov dword [ebp - 0x19c], 0x1a30b0e7
jmp 0x10010775
mov dword [ebp - 0x19c], 0x1b5c72e
jmp 0x10010775
mov eax, dword [ebp - 0x178]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0xba172f0e
jmp 0x1000ef19