Function at 0x100012d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x1009f000]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x98], 0xfee699a
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x8a816242
je 0x10001e7b
jmp 0x10001314
mov eax, dword [ebp - 0xa0]
sub eax, 0x908d0966
je 0x10002334
jmp 0x1000132a
mov eax, dword [ebp - 0xa0]
sub eax, 0x9858a41f
je 0x1000193c
jmp 0x10001340
mov eax, dword [ebp - 0xa0]
sub eax, 0x99062739
je 0x10002025
jmp 0x10001356
mov eax, dword [ebp - 0xa0]
sub eax, 0x9aa3dd7e
je 0x1000235a
jmp 0x1000136c
mov eax, dword [ebp - 0xa0]
sub eax, 0x9e34e3d3
je 0x100024c9
jmp 0x10001382
mov eax, dword [ebp - 0xa0]
sub eax, 0xa882e722
je 0x100023e3
jmp 0x10001398
mov eax, dword [ebp - 0xa0]
sub eax, 0xac6842d2
je 0x10001f97
jmp 0x100013ae
mov eax, dword [ebp - 0xa0]
sub eax, 0xb59a4f06
je 0x10002001
jmp 0x100013c4
mov eax, dword [ebp - 0xa0]
sub eax, 0xb61b6192
je 0x1000230e
jmp 0x100013da
mov eax, dword [ebp - 0xa0]
sub eax, 0xb701bdcd
je 0x10001b7d
jmp 0x100013f0
mov eax, dword [ebp - 0xa0]
sub eax, 0xbb820097
je 0x1000239b
jmp 0x10001406
mov eax, dword [ebp - 0xa0]
sub eax, 0xbd5d0ce4
je 0x10001c69
jmp 0x1000141c
mov eax, dword [ebp - 0xa0]
sub eax, 0xc0965413
je 0x10001a6e
jmp 0x10001432
mov eax, dword [ebp - 0xa0]
sub eax, 0xd6ecf11f
je 0x1000187d
jmp 0x10001448
mov eax, dword [ebp - 0xa0]
sub eax, 0xdc9b395e
je 0x10001dd3
jmp 0x1000145e
mov eax, dword [ebp - 0xa0]
sub eax, 0xdce3ccfb
je 0x10002091
jmp 0x10001474
mov eax, dword [ebp - 0xa0]
sub eax, 0xef3e4bbf
je 0x10001d7b
jmp 0x1000148a
mov eax, dword [ebp - 0xa0]
sub eax, 0xf016dc80
je 0x10001fea
jmp 0x100014a0
mov eax, dword [ebp - 0xa0]
sub eax, 0xf69324a1
je 0x10001af3
jmp 0x100014b6
mov eax, dword [ebp - 0xa0]
sub eax, 0xf867451f
je 0x10001c4c
jmp 0x100014cc
mov eax, dword [ebp - 0xa0]
sub eax, 0xfb801231
je 0x100023aa
jmp 0x100014e2
mov eax, dword [ebp - 0xa0]
sub eax, 0x3a21d90
je 0x10001cbc
jmp 0x100014f8
mov eax, dword [ebp - 0xa0]
sub eax, 0x692fac8
je 0x10001b1d
jmp 0x1000150e
mov eax, dword [ebp - 0xa0]
sub eax, 0x816357a
je 0x100021fb
jmp 0x10001524
mov eax, dword [ebp - 0xa0]
sub eax, 0x82a555e
je 0x10001fca
jmp 0x1000153a
mov eax, dword [ebp - 0xa0]
sub eax, 0xc4d39a0
je 0x10002446
jmp 0x10001550
mov eax, dword [ebp - 0xa0]
sub eax, 0xfee699a
je 0x100017a7
jmp 0x10001566
mov eax, dword [ebp - 0xa0]
sub eax, 0x1530cab2
je 0x10002222
jmp 0x1000157c
mov eax, dword [ebp - 0xa0]
sub eax, 0x1688e87a
je 0x10002107
jmp 0x10001592
mov eax, dword [ebp - 0xa0]
sub eax, 0x18a4c305
je 0x10002437
jmp 0x100015a8
mov eax, dword [ebp - 0xa0]
sub eax, 0x1dcbe3b2
je 0x100021d3
jmp 0x100015be
mov eax, dword [ebp - 0xa0]
sub eax, 0x23906943
je 0x10001e8a
jmp 0x100015d4
mov eax, dword [ebp - 0xa0]
sub eax, 0x2e84f060
je 0x1000231d
jmp 0x100015ea
mov eax, dword [ebp - 0xa0]
sub eax, 0x320b3e77
je 0x1000238a
jmp 0x10001600
mov eax, dword [ebp - 0xa0]
sub eax, 0x35f7d311
je 0x10002298
jmp 0x10001616
mov eax, dword [ebp - 0xa0]
sub eax, 0x46392737
je 0x10001f88
jmp 0x1000162c
mov eax, dword [ebp - 0xa0]
sub eax, 0x4b68ea68
je 0x10001c3d
jmp 0x10001642
mov eax, dword [ebp - 0xa0]
sub eax, 0x5251fa3a
je 0x1000214c
jmp 0x10001658
mov eax, dword [ebp - 0xa0]
sub eax, 0x541a5095
je 0x10001d8a
jmp 0x1000166e
mov eax, dword [ebp - 0xa0]
sub eax, 0x545cf954
je 0x10001faf
jmp 0x10001684
mov eax, dword [ebp - 0xa0]
sub eax, 0x59bc89ab
je 0x100018f3
jmp 0x1000169a
mov eax, dword [ebp - 0xa0]
sub eax, 0x5b3bb26d
je 0x10001a5f
jmp 0x100016b0
mov eax, dword [ebp - 0xa0]
sub eax, 0x5b9a2540
je 0x10001c87
jmp 0x100016c6
mov eax, dword [ebp - 0xa0]
sub eax, 0x6346d46f
je 0x10001c9e
jmp 0x100016dc
mov eax, dword [ebp - 0xa0]
sub eax, 0x639fe0cd
je 0x10001ef7
jmp 0x100016f2
mov eax, dword [ebp - 0xa0]
sub eax, 0x66bcb019
je 0x1000248f
jmp 0x10001708
mov eax, dword [ebp - 0xa0]
sub eax, 0x6b321e59
je 0x1000185f
jmp 0x1000171e
mov eax, dword [ebp - 0xa0]
sub eax, 0x6f97d1d0
je 0x100021e2
jmp 0x10001734
mov eax, dword [ebp - 0xa0]
sub eax, 0x738e4e72
je 0x100019b9
jmp 0x1000174a
mov eax, dword [ebp - 0xa0]
sub eax, 0x74377ba8
je 0x10001d2a
jmp 0x10001760
mov eax, dword [ebp - 0xa0]
sub eax, 0x750939f1
je 0x10001b2c
jmp 0x10001776
mov eax, dword [ebp - 0xa0]
sub eax, 0x7a8e2176
je 0x10001ea6
jmp 0x1000178c
mov eax, dword [ebp - 0xa0]
sub eax, 0x7de1385d
je 0x1000194b
jmp 0x100017a2
jmp 0x100024d3
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, esp
mov dword [ebp - 0x88], ecx
sub esp, 0x104
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c420
add esp, 0xc
mov eax, dword [ebp - 0x8c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x98], 0x6b321e59
jmp 0x100024d3
mov edx, dword [ebp - 0x5c]
mov eax, 0xd6ecf11f
mov ecx, 0x7de1385d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
mov edx, ecx
sub edx, 0x220b76c7
sub edx, 1
add edx, 0x220b76c7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb820097
mov ecx, 0x59bc89ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [0x100a0340]
mov ecx, dword [0x100a033c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb820097
mov ecx, 0x9858a41f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0x320b3e77
jmp 0x100024d3
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfb801231
mov ecx, 0x738e4e72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
mov edx, ecx
sub edx, 0x65de411d
sub edx, 1
add edx, 0x65de411d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb801231
mov ecx, 0x5b3bb26d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0xc0965413
jmp 0x100024d3
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x94]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x98], 0xf69324a1
jmp 0x100024d3
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov edx, dword [ebp - 0x80]
mov esi, 0xffffffff
mov eax, 0x750939f1
mov ecx, 0x692fac8
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0x320b3e77
jmp 0x100024d3
mov eax, dword [0x100a0340]
mov ecx, dword [0x100a033c]
mov edx, eax
add edx, 0x7fad42fe
sub edx, 1
sub edx, 0x7fad42fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa882e722
mov ecx, 0xb701bdcd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
mov edx, ecx
add edx, 0x1d4f6892
sub edx, 1
sub edx, 0x1d4f6892
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa882e722
mov ecx, 0x4b68ea68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0xf867451f
jmp 0x100024d3
mov eax, dword [ebp - 0x50]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov dword [ebp - 0x98], 0xbd5d0ce4
jmp 0x100024d3
mov dl, byte [ebp - 0x49]
mov eax, 0x5b9a2540
mov ecx, 0x541a5095
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x98], 0x6346d46f
jmp 0x100024d3
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x3a21d90
jmp 0x100024d3
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x18a4c305
mov ecx, 0x74377ba8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [0x100a0340]
mov ecx, dword [0x100a033c]
mov edx, eax
sub edx, 0x1ea35a5b
sub edx, 1
add edx, 0x1ea35a5b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18a4c305
mov ecx, 0xef3e4bbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0x320b3e77
jmp 0x100024d3
mov eax, dword [0x100a0340]
mov ecx, dword [0x100a033c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc4d39a0
mov ecx, 0xdc9b395e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc4d39a0
mov ecx, 0x8a816242
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0x23906943
jmp 0x100024d3
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0x7a8e2176
jmp 0x100024d3
mov eax, dword [0x100a0340]
mov ecx, dword [0x100a033c]
mov edx, eax
add edx, 0xce0ac4f1
sub edx, 1
sub edx, 0xce0ac4f1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66bcb019
mov ecx, 0x639fe0cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov word [eax], 0
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x66bcb019
mov ecx, 0x46392737
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0xac6842d2
jmp 0x100024d3
mov eax, dword [ebp - 0x6c]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x98], 0x545cf954
jmp 0x100024d3
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x98], 0x82a555e
jmp 0x100024d3
mov edx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
mov eax, 0x2e84f060
mov ecx, 0xf016dc80
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x98], 0xb59a4f06
jmp 0x100024d3
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x98], 0x99062739
jmp 0x100024d3
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x38]
add ecx, 0x97a79b6
add ecx, eax
sub ecx, 0x97a79b6
mov eax, dword [ebp - 0x6c]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e790
add esp, 8
mov edx, eax
mov eax, 0xdce3ccfb
mov ecx, 0x1dcbe3b2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov eax, dword [ebp - 0x64]
mov dword [eax], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x40b27548
add edx, eax
sub edx, 0x40b27548
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x98], 0x1688e87a
jmp 0x100024d3
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x59b97c79
add eax, ecx
add eax, 0x59b97c79
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x4a8322ee
add eax, ecx
add eax, 0x4a8322ee
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x98], 0x5251fa3a
jmp 0x100024d3
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c580
add esp, 0xc
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x5c2f62e2
add esi, eax
add esi, 0x5c2f62e2
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov dword [ebp - 0x98], 0x1dcbe3b2
jmp 0x100024d3
mov dword [ebp - 0x98], 0x6f97d1d0
jmp 0x100024d3
mov eax, dword [ebp - 0x6c]
mov ax, word [eax]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x98], 0x816357a
jmp 0x100024d3
mov cx, word [ebp - 0x22]
sub cx, 0x6bd1
add cx, 1
add cx, 0x6bd1
mov eax, dword [ebp - 0x6c]
mov word [eax], cx
mov dword [ebp - 0x98], 0x1530cab2
jmp 0x100024d3
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
mov edx, ecx
add edx, 0x8f6695d5
sub edx, 1
sub edx, 0x8f6695d5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e34e3d3
mov ecx, 0x35f7d311
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov ecx, dword [0x100a0340]
mov eax, dword [0x100a033c]
mov edx, ecx
sub edx, 0xead253fe
sub edx, 1
add edx, 0xead253fe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9e34e3d3
mov ecx, 0xb61b6192
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x100024d3
mov dword [ebp - 0x98], 0xac6842d2
jmp 0x100024d3
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x98], 0x908d0966
jmp 0x100024d3
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x98], 0x9aa3dd7e
jmp 0x100024d3
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x320b3e77
jmp 0x100024d3
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000b820
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x98], 0x59bc89ab
jmp 0x100024d3
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x98], 0x738e4e72
jmp 0x100024d3
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x98], 0xb701bdcd
jmp 0x100024d3
mov dword [ebp - 0x98], 0x74377ba8
jmp 0x100024d3
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0xdc9b395e
jmp 0x100024d3
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x593151c1
add ecx, eax
sub ecx, 0x593151c1
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov word [eax], 0
mov dword [ebp - 0x98], 0x639fe0cd
jmp 0x100024d3
mov dword [ebp - 0x98], 0x35f7d311
jmp 0x100012f8