Function at 0x10001310
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x10069800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa4], 0x6046c8a9
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
sub eax, 0x80086c37
je 0x10002bf3
jmp 0x10001354
mov eax, dword [ebp - 0xac]
sub eax, 0x8291c7b4
je 0x10001d76
jmp 0x1000136a
mov eax, dword [ebp - 0xac]
sub eax, 0x837b7afc
je 0x10002939
jmp 0x10001380
mov eax, dword [ebp - 0xac]
sub eax, 0x8c9221a7
je 0x10002804
jmp 0x10001396
mov eax, dword [ebp - 0xac]
sub eax, 0x9642174c
je 0x10001bf1
jmp 0x100013ac
mov eax, dword [ebp - 0xac]
sub eax, 0x9a1d2930
je 0x100026d5
jmp 0x100013c2
mov eax, dword [ebp - 0xac]
sub eax, 0x9d05bc9b
je 0x100024d1
jmp 0x100013d8
mov eax, dword [ebp - 0xac]
sub eax, 0x9d8f16db
je 0x100020fd
jmp 0x100013ee
mov eax, dword [ebp - 0xac]
sub eax, 0xa490f2e8
je 0x100020ee
jmp 0x10001404
mov eax, dword [ebp - 0xac]
sub eax, 0xa7880c8d
je 0x100028e8
jmp 0x1000141a
mov eax, dword [ebp - 0xac]
sub eax, 0xa7ad9035
je 0x1000236d
jmp 0x10001430
mov eax, dword [ebp - 0xac]
sub eax, 0xa8060b86
je 0x10002275
jmp 0x10001446
mov eax, dword [ebp - 0xac]
sub eax, 0xb0b9261d
je 0x100024e0
jmp 0x1000145c
mov eax, dword [ebp - 0xac]
sub eax, 0xb884f462
je 0x100023b1
jmp 0x10001472
mov eax, dword [ebp - 0xac]
sub eax, 0xb99409af
je 0x10001e6a
jmp 0x10001488
mov eax, dword [ebp - 0xac]
sub eax, 0xba64a9cf
je 0x100019e9
jmp 0x1000149e
mov eax, dword [ebp - 0xac]
sub eax, 0xbb7841cc
je 0x10002aec
jmp 0x100014b4
mov eax, dword [ebp - 0xac]
sub eax, 0xc11c7bdb
je 0x10001d25
jmp 0x100014ca
mov eax, dword [ebp - 0xac]
sub eax, 0xc3f93cda
je 0x10002098
jmp 0x100014e0
mov eax, dword [ebp - 0xac]
sub eax, 0xc7e9a97a
je 0x10001f47
jmp 0x100014f6
mov eax, dword [ebp - 0xac]
sub eax, 0xc8895b0b
je 0x1000206d
jmp 0x1000150c
mov eax, dword [ebp - 0xac]
sub eax, 0xc9fea1f7
je 0x10001fcc
jmp 0x10001522
mov eax, dword [ebp - 0xac]
sub eax, 0xd616b441
je 0x1000205e
jmp 0x10001538
mov eax, dword [ebp - 0xac]
sub eax, 0xdf0dcc2d
je 0x10002b97
jmp 0x1000154e
mov eax, dword [ebp - 0xac]
sub eax, 0xe3bb8b63
je 0x1000217b
jmp 0x10001564
mov eax, dword [ebp - 0xac]
sub eax, 0xe3bd3ea5
je 0x10001ed1
jmp 0x1000157a
mov eax, dword [ebp - 0xac]
sub eax, 0xe6196329
je 0x10002a5a
jmp 0x10001590
mov eax, dword [ebp - 0xac]
sub eax, 0xe7584a75
je 0x100027ac
jmp 0x100015a6
mov eax, dword [ebp - 0xac]
sub eax, 0xeaccb8a9
je 0x10002992
jmp 0x100015bc
mov eax, dword [ebp - 0xac]
sub eax, 0xeba6d97a
je 0x100020b6
jmp 0x100015d2
mov eax, dword [ebp - 0xac]
sub eax, 0xf1690259
je 0x10002a00
jmp 0x100015e8
mov eax, dword [ebp - 0xac]
sub eax, 0xf38449af
je 0x10002a49
jmp 0x100015fe
mov eax, dword [ebp - 0xac]
sub eax, 0xfd70480b
je 0x10001e88
jmp 0x10001614
mov eax, dword [ebp - 0xac]
sub eax, 0xfde28d28
je 0x100027f5
jmp 0x1000162a
mov eax, dword [ebp - 0xac]
sub eax, 0x42f965
je 0x10001b7c
jmp 0x10001640
mov eax, dword [ebp - 0xac]
sub eax, 0xe481360
je 0x10002ba6
jmp 0x10001656
mov eax, dword [ebp - 0xac]
sub eax, 0xf0b61e9
je 0x1000238b
jmp 0x1000166c
mov eax, dword [ebp - 0xac]
sub eax, 0x12eb334a
je 0x1000225d
jmp 0x10001682
mov eax, dword [ebp - 0xac]
sub eax, 0x140bfc4b
je 0x10002736
jmp 0x10001698
mov eax, dword [ebp - 0xac]
sub eax, 0x142f0d9e
je 0x10002c38
jmp 0x100016ae
mov eax, dword [ebp - 0xac]
sub eax, 0x1998a180
je 0x10002cce
jmp 0x100016c4
mov eax, dword [ebp - 0xac]
sub eax, 0x1b9ab24d
je 0x10002c97
jmp 0x100016da
mov eax, dword [ebp - 0xac]
sub eax, 0x1bed8352
je 0x10001aff
jmp 0x100016f0
mov eax, dword [ebp - 0xac]
sub eax, 0x1e07200b
je 0x10002ce0
jmp 0x10001706
mov eax, dword [ebp - 0xac]
sub eax, 0x221856d1
je 0x10001cb4
jmp 0x1000171c
mov eax, dword [ebp - 0xac]
sub eax, 0x278e9cc3
je 0x10002c4d
jmp 0x10001732
mov eax, dword [ebp - 0xac]
sub eax, 0x2d9f2ea5
je 0x100020d0
jmp 0x10001748
mov eax, dword [ebp - 0xac]
sub eax, 0x3052f8f8
je 0x10002149
jmp 0x1000175e
mov eax, dword [ebp - 0xac]
sub eax, 0x32334f7b
je 0x10001c00
jmp 0x10001774
mov eax, dword [ebp - 0xac]
sub eax, 0x34546ea4
je 0x10001c3e
jmp 0x1000178a
mov eax, dword [ebp - 0xac]
sub eax, 0x3bab99cf
je 0x1000254e
jmp 0x100017a0
mov eax, dword [ebp - 0xac]
sub eax, 0x3e3d9d8c
je 0x1000223d
jmp 0x100017b6
mov eax, dword [ebp - 0xac]
sub eax, 0x3ea59d65
je 0x1000241f
jmp 0x100017cc
mov eax, dword [ebp - 0xac]
sub eax, 0x4382051f
je 0x10001f56
jmp 0x100017e2
mov eax, dword [ebp - 0xac]
sub eax, 0x46174616
je 0x10002962
jmp 0x100017f8
mov eax, dword [ebp - 0xac]
sub eax, 0x48ae0d20
je 0x100028f7
jmp 0x1000180e
mov eax, dword [ebp - 0xac]
sub eax, 0x49359d75
je 0x100022eb
jmp 0x10001824
mov eax, dword [ebp - 0xac]
sub eax, 0x4f3f1d76
je 0x1000287a
jmp 0x1000183a
mov eax, dword [ebp - 0xac]
sub eax, 0x541d3137
je 0x10002b11
jmp 0x10001850
mov eax, dword [ebp - 0xac]
sub eax, 0x55053c90
je 0x10001d16
jmp 0x10001866
mov eax, dword [ebp - 0xac]
sub eax, 0x570a7e46
je 0x1000222e
jmp 0x1000187c
mov eax, dword [ebp - 0xac]
sub eax, 0x5a91e59e
je 0x100021cc
jmp 0x10001892
mov eax, dword [ebp - 0xac]
sub eax, 0x5bb321a0
je 0x10001bd3
jmp 0x100018a8
mov eax, dword [ebp - 0xac]
sub eax, 0x5d1f7915
je 0x10002ada
jmp 0x100018be
mov eax, dword [ebp - 0xac]
sub eax, 0x6046c8a9
je 0x10001973
mov eax, dword [ebp - 0xa8]
push eax
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x98], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x94], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x90], ecx
sub esp, 0x104
mov ecx, esp
mov dword [ebp - 0x8c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x88], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c9a0
add esp, 0xc
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe6196329
mov ecx, 0x1bed8352
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0x7910dcb4
jmp 0x10002cea
mov eax, dword [ebp - 0x64]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x5d], al
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d1f7915
mov ecx, 0x5bb321a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dl, byte [ebp - 0x5d]
mov eax, 0x9642174c
mov ecx, 0x32334f7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xeaccb8a9
jmp 0x10002cea
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x98]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0xa4], 0x34546ea4
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0x2ae8f04e
sub edx, 1
sub edx, 0x2ae8f04e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbb7841cc
mov ecx, 0x221856d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb7841cc
mov ecx, 0x55053c90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xc11c7bdb
jmp 0x10002cea
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0x43894abf
sub edx, 1
add edx, 0x43894abf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x541d3137
mov ecx, 0x8291c7b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x55], al
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x541d3137
mov ecx, 0xb99409af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dl, byte [ebp - 0x55]
mov eax, 0x4382051f
mov ecx, 0xfd70480b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf0dcc2d
mov ecx, 0xe3bd3ea5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0xccfa9613
sub edx, 1
sub edx, 0xccfa9613
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdf0dcc2d
mov ecx, 0xc7e9a97a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xeaccb8a9
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x8983f887
sub edx, 1
add edx, 0x8983f887
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe481360
mov ecx, 0xc9fea1f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x54], eax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
add edx, 0x6549361a
sub edx, 1
sub edx, 0x6549361a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe481360
mov ecx, 0xd616b441
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xc8895b0b
jmp 0x10002cea
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov dword [ebp - 0xa4], 0xc3f93cda
jmp 0x10002cea
mov dl, byte [ebp - 0x4d]
mov eax, 0xeba6d97a
mov ecx, 0x9d8f16db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xa4], 0x2d9f2ea5
jmp 0x10002cea
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xa490f2e8
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xeaccb8a9
jmp 0x10002cea
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0xa4], 0x3052f8f8
jmp 0x10002cea
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xa4], 0xe3bb8b63
jmp 0x10002cea
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
sub edx, 0xb4935f67
sub edx, 1
add edx, 0xb4935f67
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80086c37
mov ecx, 0x5a91e59e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80086c37
mov ecx, 0x570a7e46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0x3e3d9d8c
jmp 0x10002cea
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xa4], 0x12eb334a
jmp 0x10002cea
mov eax, dword [ebp - 0x3c]
add eax, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa4], 0xa8060b86
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x8b4bcccb
sub edx, 1
add edx, 0x8b4bcccb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x142f0d9e
mov ecx, 0x49359d75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x142f0d9e
mov ecx, 0xa7ad9035
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dl, byte [ebp - 0x31]
mov eax, 0x79a69256
mov ecx, 0xf0b61e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa4], 0xb884f462
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x278e9cc3
mov ecx, 0x3ea59d65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x2c]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x4e902d8f
add ecx, eax
add ecx, 0x4e902d8f
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0x4253a078
sub edx, 1
add edx, 0x4253a078
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x278e9cc3
mov ecx, 0x9d05bc9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xb0b9261d
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1b9ab24d
mov ecx, 0x3bab99cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ed10
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1b9ab24d
mov ecx, 0x7cf41804
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov dword [ebp - 0xa4], 0x140bfc4b
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
sub edx, 0xd69733b6
sub edx, 1
add edx, 0xd69733b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x608118fb
mov ecx, 0xe7584a75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x608118fb
mov ecx, 0xfde28d28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0x8c9221a7
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
mov edx, ecx
add edx, 0x1338cf4f
sub edx, 1
sub edx, 0x1338cf4f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1998a180
mov ecx, 0x4f3f1d76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x16], ax
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
mov edx, eax
add edx, 0x7eb3febe
sub edx, 1
sub edx, 0x7eb3febe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1998a180
mov ecx, 0xa7880c8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov dword [ebp - 0xa4], 0x48ae0d20
jmp 0x10002cea
mov eax, dword [ebp - 0x74]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0xa4], 0x654a68f4
jmp 0x10002cea
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa4], 0x46174616
jmp 0x10002cea
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa0]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xeaccb8a9
jmp 0x10002cea
mov ecx, dword [0x1006ab38]
mov eax, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1e07200b
mov ecx, 0xf1690259
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov eax, dword [0x1006ab38]
mov ecx, dword [0x1006ab34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1e07200b
mov ecx, 0xf38449af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cea
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000bda0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xa8]
push eax
sub esp, 8
mov ecx, esp
mov dword [ebp - 0xb4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], ecx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c9a0
add esp, 0xc
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0xa4], 0xba64a9cf
jmp 0x10002cea
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa4], 0x42f965
jmp 0x10002cea
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa4], 0x221856d1
jmp 0x10002cea
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xa4], 0x8291c7b4
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xe3bd3ea5
jmp 0x10002cea
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xa4], 0xc9fea1f7
jmp 0x10002cea
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
add ecx, 0xd3d8dba0
add ecx, eax
sub ecx, 0xd3d8dba0
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov word [eax], 0
mov dword [ebp - 0xa4], 0x5a91e59e
jmp 0x10002cea
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa4], 0x49359d75
jmp 0x10002cea
mov eax, dword [ebp - 0x2c]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
add ecx, 0xdee5ceab
add ecx, eax
sub ecx, 0xdee5ceab
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa4], 0x3ea59d65
jmp 0x10002cea
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000ed10
add esp, 8
mov dword [ebp - 0xa4], 0x3bab99cf
jmp 0x10002cea
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa4], 0x4f3f1d76
jmp 0x10002cea
mov dword [ebp - 0xa4], 0xf1690259
jmp 0x10001338