Function at 0x100012b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x10035600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x94], 0xb36490d3
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x82063225
je 0x10001bae
jmp 0x100012f5
mov eax, dword [ebp - 0x9c]
sub eax, 0x8aadd105
je 0x10001edb
jmp 0x1000130b
mov eax, dword [ebp - 0x9c]
sub eax, 0x90667a67
je 0x10001b52
jmp 0x10001321
mov eax, dword [ebp - 0x9c]
sub eax, 0x95cd47d2
je 0x10001ac0
jmp 0x10001337
mov eax, dword [ebp - 0x9c]
sub eax, 0x9e0a3083
je 0x100021f1
jmp 0x1000134d
mov eax, dword [ebp - 0x9c]
sub eax, 0xa8156fa7
je 0x10001be3
jmp 0x10001363
mov eax, dword [ebp - 0x9c]
sub eax, 0xabe1edeb
je 0x10001a17
jmp 0x10001379
mov eax, dword [ebp - 0x9c]
sub eax, 0xae93b649
je 0x100021a7
jmp 0x1000138f
mov eax, dword [ebp - 0x9c]
sub eax, 0xb36490d3
je 0x10001746
jmp 0x100013a5
mov eax, dword [ebp - 0x9c]
sub eax, 0xb480a0e7
je 0x10001bc5
jmp 0x100013bb
mov eax, dword [ebp - 0x9c]
sub eax, 0xb795884f
je 0x100017bc
jmp 0x100013d1
mov eax, dword [ebp - 0x9c]
sub eax, 0xba0598a8
je 0x100018e8
jmp 0x100013e7
mov eax, dword [ebp - 0x9c]
sub eax, 0xc2ae8011
je 0x100022d1
jmp 0x100013fd
mov eax, dword [ebp - 0x9c]
sub eax, 0xc7bf1322
je 0x100021e2
jmp 0x10001413
mov eax, dword [ebp - 0x9c]
sub eax, 0xcb137655
je 0x10002013
jmp 0x10001429
mov eax, dword [ebp - 0x9c]
sub eax, 0xd4617163
je 0x10001f45
jmp 0x1000143f
mov eax, dword [ebp - 0x9c]
sub eax, 0xddf4dae3
je 0x10001f06
jmp 0x10001455
mov eax, dword [ebp - 0x9c]
sub eax, 0xe3daa7ca
je 0x10001c27
jmp 0x1000146b
mov eax, dword [ebp - 0x9c]
sub eax, 0xef9c062d
je 0x10001f85
jmp 0x10001481
mov eax, dword [ebp - 0x9c]
sub eax, 0xf20e28b5
je 0x1000225a
jmp 0x10001497
mov eax, dword [ebp - 0x9c]
sub eax, 0x41ef14
je 0x10001c18
jmp 0x100014ad
mov eax, dword [ebp - 0x9c]
sub eax, 0x347bdfa
je 0x10001eb7
jmp 0x100014c3
mov eax, dword [ebp - 0x9c]
sub eax, 0xc461b52
je 0x10001956
jmp 0x100014d9
mov eax, dword [ebp - 0x9c]
sub eax, 0x100456a0
je 0x10001d54
jmp 0x100014ef
mov eax, dword [ebp - 0x9c]
sub eax, 0x10f15cae
je 0x10001d84
jmp 0x10001505
mov eax, dword [ebp - 0x9c]
sub eax, 0x19ec1881
je 0x100020aa
jmp 0x1000151b
mov eax, dword [ebp - 0x9c]
sub eax, 0x1d33be35
je 0x10001e9f
jmp 0x10001531
mov eax, dword [ebp - 0x9c]
sub eax, 0x259d31c1
je 0x10002198
jmp 0x10001547
mov eax, dword [ebp - 0x9c]
sub eax, 0x2b578b7e
je 0x10001b09
jmp 0x1000155d
mov eax, dword [ebp - 0x9c]
sub eax, 0x31273b0b
je 0x10002316
jmp 0x10001573
mov eax, dword [ebp - 0x9c]
sub eax, 0x32ccf57b
je 0x10001931
jmp 0x10001589
mov eax, dword [ebp - 0x9c]
sub eax, 0x331e9bdb
je 0x10001922
jmp 0x1000159f
mov eax, dword [ebp - 0x9c]
sub eax, 0x360d2aef
je 0x100020b9
jmp 0x100015b5
mov eax, dword [ebp - 0x9c]
sub eax, 0x36cd64cb
je 0x1000226c
jmp 0x100015cb
mov eax, dword [ebp - 0x9c]
sub eax, 0x36dcdc99
je 0x10001d93
jmp 0x100015e1
mov eax, dword [ebp - 0x9c]
sub eax, 0x38893b19
je 0x10001a26
jmp 0x100015f7
mov eax, dword [ebp - 0x9c]
sub eax, 0x3b2f79b9
je 0x10001b61
jmp 0x1000160d
mov eax, dword [ebp - 0x9c]
sub eax, 0x3e22fdfd
je 0x10001e90
jmp 0x10001623
mov eax, dword [ebp - 0x9c]
sub eax, 0x4c2a2ef7
je 0x100018d9
jmp 0x10001639
mov eax, dword [ebp - 0x9c]
sub eax, 0x547b9079
je 0x100021c9
jmp 0x1000164f
mov eax, dword [ebp - 0x9c]
sub eax, 0x5a243cf6
je 0x10002208
jmp 0x10001665
mov eax, dword [ebp - 0x9c]
sub eax, 0x5aa8f0a4
je 0x10001f9d
jmp 0x1000167b
mov eax, dword [ebp - 0x9c]
sub eax, 0x63b3db7a
je 0x1000236f
jmp 0x10001691
mov eax, dword [ebp - 0x9c]
sub eax, 0x657f3ec3
je 0x10001c78
jmp 0x100016a7
mov eax, dword [ebp - 0x9c]
sub eax, 0x6e0ceba2
je 0x100019a7
jmp 0x100016bd
mov eax, dword [ebp - 0x9c]
sub eax, 0x6f4e323c
je 0x10002307
jmp 0x100016d3
mov eax, dword [ebp - 0x9c]
sub eax, 0x72090eab
je 0x10001bfa
jmp 0x100016e9
mov eax, dword [ebp - 0x9c]
sub eax, 0x72604e21
je 0x10001e09
jmp 0x100016ff
mov eax, dword [ebp - 0x9c]
sub eax, 0x789523ab
je 0x10001d45
jmp 0x10001715
mov eax, dword [ebp - 0x9c]
sub eax, 0x7c4aff0a
je 0x10002237
jmp 0x1000172b
mov eax, dword [ebp - 0x9c]
sub eax, 0x7cff9b5a
je 0x10002384
jmp 0x10001741
jmp 0x10002397
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x2b35d6b7
sub edx, 1
add edx, 0x2b35d6b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x36cd64cb
mov ecx, 0xb795884f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x98]
push eax
mov ecx, esp
mov dword [ebp - 0x8c], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x88], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
sub esp, 0x104
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100072d0
add esp, 0xc
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x36cd64cb
mov ecx, 0x4c2a2ef7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0xba0598a8
jmp 0x10002397
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov edx, dword [ebp - 0x84]
mov eax, 0x331e9bdb
mov ecx, 0x32ccf57b
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0xf20e28b5
jmp 0x10002397
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x94], 0xc461b52
jmp 0x10002397
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
sub edx, 0xc073463a
sub edx, 1
add edx, 0xc073463a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2ae8011
mov ecx, 0x6e0ceba2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2ae8011
mov ecx, 0xabe1edeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0x38893b19
jmp 0x10002397
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov edx, dword [ebp - 0x78]
mov esi, 0xffffffff
mov eax, 0x3b2f79b9
mov ecx, 0x95cd47d2
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f4e323c
mov ecx, 0x2b578b7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f4e323c
mov ecx, 0x90667a67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0xf20e28b5
jmp 0x10002397
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x94], 0x82063225
jmp 0x10002397
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0xb480a0e7
jmp 0x10002397
mov edx, dword [ebp - 0x74]
mov eax, 0xa8156fa7
mov ecx, 0xe3daa7ca
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x94], 0x72090eab
jmp 0x10002397
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x41ef14
jmp 0x10002397
mov dword [ebp - 0x94], 0xf20e28b5
jmp 0x10002397
mov eax, dword [0x10036950]
mov ecx, dword [0x1003694c]
mov edx, eax
add edx, 0x4bc90577
sub edx, 1
sub edx, 0x4bc90577
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x31273b0b
mov ecx, 0x657f3ec3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
add edx, 0xb974e1ed
sub edx, 1
sub edx, 0xb974e1ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x31273b0b
mov ecx, 0x789523ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0x100456a0
jmp 0x10002397
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
sub ecx, 0xb134c72e
add ecx, eax
add ecx, 0xb134c72e
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov dword [ebp - 0x94], 0x10f15cae
jmp 0x10002397
mov dword [ebp - 0x94], 0x36dcdc99
jmp 0x10002397
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0xcddd55fc
sub edx, 1
add edx, 0xcddd55fc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x63b3db7a
mov ecx, 0x72604e21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x5426212f
sub edx, 1
add edx, 0x5426212f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x63b3db7a
mov ecx, 0x3e22fdfd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0x1d33be35
jmp 0x10002397
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x94], 0x347bdfa
jmp 0x10002397
mov eax, dword [ebp - 0x30]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x38]
mov eax, 0x9e0a3083
mov ecx, 0x8aadd105
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x26], ax
mov dword [ebp - 0x94], 0xddf4dae3
jmp 0x10002397
mov ax, word [ebp - 0x26]
movzx ecx, ax
mov eax, dword [ebp - 0x2c]
sub eax, 0x9f2572b
add eax, ecx
add eax, 0x9f2572b
mov ecx, dword [ebp - 0x64]
movzx ecx, word [ecx]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x94], 0xd4617163
jmp 0x10002397
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10013190
call fcn.10009640
add esp, 8
mov edx, eax
mov eax, 0xef9c062d
mov ecx, 0x259d31c1
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
mov dword [ebp - 0x94], 0x5aa8f0a4
jmp 0x10002397
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x2b95a595
sub edx, 1
add edx, 0x2b95a595
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7cff9b5a
mov ecx, 0xcb137655
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x10036950]
mov eax, dword [0x1003694c]
mov edx, ecx
sub edx, 0x2ad89798
sub edx, 1
add edx, 0x2ad89798
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7cff9b5a
mov ecx, 0x19ec1881
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x10002397
mov dword [ebp - 0x94], 0x360d2aef
jmp 0x10002397
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10007430
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov dword [ebp - 0x94], 0x259d31c1
jmp 0x10002397
mov dword [ebp - 0x94], 0xae93b649
jmp 0x10002397
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x16], ax
mov dword [ebp - 0x94], 0x547b9079
jmp 0x10002397
mov eax, dword [ebp - 0x64]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0x94], 0xc7bf1322
jmp 0x10002397
mov dword [ebp - 0x94], 0x36dcdc99
jmp 0x10002397
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x94], 0x5a243cf6
jmp 0x10002397
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x7c4aff0a
jmp 0x10002397
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0xf20e28b5
jmp 0x10002397
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100066d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x98]
push eax
mov ecx, esp
mov dword [ebp - 0xa4], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0xa4]
mov edx, eax
mov eax, dword [ebp - 0xa0]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100072d0
add esp, 0xc
mov dword [ebp - 0x94], 0xb795884f
jmp 0x10002397
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x94], 0x6e0ceba2
jmp 0x10002397
mov dword [ebp - 0x94], 0x2b578b7e
jmp 0x10002397
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x94], 0x657f3ec3
jmp 0x10002397
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x94], 0x72604e21
jmp 0x10002397
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x94], 0xcb137655
jmp 0x100012d9