Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [0x10066200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x19c], 0xf2b00b1b
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
sub eax, 0x8550b09b
je 0x10001f41
jmp 0x100010f4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x88631334
je 0x1000171b
jmp 0x1000110a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8d26ed71
je 0x10001bf8
jmp 0x10001120
mov eax, dword [ebp - 0x1a4]
sub eax, 0x94ea4345
je 0x10001b61
jmp 0x10001136
mov eax, dword [ebp - 0x1a4]
sub eax, 0x98d78c2d
je 0x10001df8
jmp 0x1000114c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x998fdd70
je 0x10002058
jmp 0x10001162
mov eax, dword [ebp - 0x1a4]
sub eax, 0xad5e74e3
je 0x10001dbf
jmp 0x10001178
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaf594700
je 0x10001ff9
jmp 0x1000118e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc98dc204
je 0x1000221e
jmp 0x100011a4
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcb563af3
je 0x1000172a
jmp 0x100011ba
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcdd3c61c
je 0x10001c37
jmp 0x100011d0
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd15c6804
je 0x10002049
jmp 0x100011e6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd52cfb44
je 0x10002077
jmp 0x100011fc
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd5d76e3b
je 0x10002197
jmp 0x10001212
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd8c87f35
je 0x1000166a
jmp 0x10001228
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdd11eecf
je 0x10001a3e
jmp 0x1000123e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe1e5bb58
je 0x10001c80
jmp 0x10001254
mov eax, dword [ebp - 0x1a4]
sub eax, 0xebef1b75
je 0x10001898
jmp 0x1000126a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xecead403
je 0x10001ce7
jmp 0x10001280
mov eax, dword [ebp - 0x1a4]
sub eax, 0xedb2890c
je 0x10001a6e
jmp 0x10001296
mov eax, dword [ebp - 0x1a4]
sub eax, 0xee41cf32
je 0x10001974
jmp 0x100012ac
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf2b00b1b
je 0x10001587
jmp 0x100012c2
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf9b6e8b1
je 0x1000220f
jmp 0x100012d8
mov eax, dword [ebp - 0x1a4]
sub eax, 0xfbd5cc56
je 0x10001817
jmp 0x100012ee
mov eax, dword [ebp - 0x1a4]
sub eax, 0xfdad8249
je 0x100022cd
jmp 0x10001304
mov eax, dword [ebp - 0x1a4]
sub eax, 0xfeb6009d
je 0x10001e6f
jmp 0x1000131a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2697896
je 0x100015f5
jmp 0x10001330
mov eax, dword [ebp - 0x1a4]
sub eax, 0x281c857
je 0x10001abb
jmp 0x10001346
mov eax, dword [ebp - 0x1a4]
sub eax, 0x37026b4
je 0x10001847
jmp 0x1000135c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x402ca6c
je 0x100020a4
jmp 0x10001372
mov eax, dword [ebp - 0x1a4]
sub eax, 0x69798d8
je 0x10002188
jmp 0x10001388
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa4d689f
je 0x10001679
jmp 0x1000139e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x1debd241
je 0x10002233
jmp 0x100013b4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2c02c41e
je 0x10001be9
jmp 0x100013ca
mov eax, dword [ebp - 0x1a4]
sub eax, 0x2fa961b4
je 0x100018f7
jmp 0x100013e0
mov eax, dword [ebp - 0x1a4]
sub eax, 0x343b24bb
je 0x10001a8b
jmp 0x100013f6
mov eax, dword [ebp - 0x1a4]
sub eax, 0x376f620e
je 0x10001b18
jmp 0x1000140c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3b422403
je 0x10001ecc
jmp 0x10001422
mov eax, dword [ebp - 0x1a4]
sub eax, 0x3ff63163
je 0x10001d5d
jmp 0x10001438
mov eax, dword [ebp - 0x1a4]
sub eax, 0x41343bdd
je 0x10001aac
jmp 0x1000144e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x47a26780
je 0x10001772
jmp 0x10001464
mov eax, dword [ebp - 0x1a4]
sub eax, 0x4fda811c
je 0x10001a4d
jmp 0x1000147a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x541155ce
je 0x100022a3
jmp 0x10001490
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5602b5c4
je 0x1000211a
jmp 0x100014a6
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5704a3a7
je 0x100021ba
jmp 0x100014bc
mov eax, dword [ebp - 0x1a4]
sub eax, 0x583ce98c
je 0x100021ef
jmp 0x100014d2
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5b5f5c71
je 0x10001e2a
jmp 0x100014e8
mov eax, dword [ebp - 0x1a4]
sub eax, 0x5e3f04aa
je 0x10001906
jmp 0x100014fe
mov eax, dword [ebp - 0x1a4]
sub eax, 0x61bf5eff
je 0x1000228e
jmp 0x10001514
mov eax, dword [ebp - 0x1a4]
sub eax, 0x63ab165c
je 0x10001838
jmp 0x1000152a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x6fc43891
je 0x10001cd8
jmp 0x10001540
mov eax, dword [ebp - 0x1a4]
sub eax, 0x78e000f3
je 0x100022b8
jmp 0x10001556
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7b82c5f2
je 0x10001dce
jmp 0x1000156c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x7e7b0ea5
je 0x100021fe
jmp 0x10001582
jmp 0x100022d7
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf9b6e8b1
mov ecx, 0x2697896
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
push eax
mov eax, esp
mov dword [ebp - 0x188], eax
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
mov edx, eax
add edx, 0xd0542bfb
sub edx, 1
sub edx, 0xd0542bfb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9b6e8b1
mov ecx, 0xd8c87f35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0xa4d689f
jmp 0x100022d7
mov eax, dword [ebp - 0x1a0]
push eax
mov ecx, esp
mov dword [ebp - 0x178], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x18c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10007bf0
add esp, 0xc
mov eax, dword [ebp - 0x18c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x194], eax
mov eax, 0x88631334
mov ecx, 0xcb563af3
cmp dword [ebp - 0x194], 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x7e7b0ea5
jmp 0x100022d7
mov ecx, dword [ebp - 0x194]
mov edx, dword [ebp - 0x190]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x19c], 0x47a26780
jmp 0x100022d7
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x194]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov eax, dword [ebp - 0x188]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x15d], al
mov dword [ebp - 0x19c], 0xfbd5cc56
jmp 0x100022d7
mov dl, byte [ebp - 0x15d]
mov eax, 0x37026b4
mov ecx, 0x63ab165c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x7e7b0ea5
jmp 0x100022d7
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
mov edx, eax
sub edx, 0x3b1fe21c
sub edx, 1
add edx, 0x3b1fe21c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc98dc204
mov ecx, 0xebef1b75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x15c], eax
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
mov edx, eax
add edx, 0xff975124
sub edx, 1
sub edx, 0xff975124
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc98dc204
mov ecx, 0x2fa961b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x5e3f04aa
jmp 0x100022d7
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1debd241
mov ecx, 0xee41cf32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x158], eax
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
mov edx, ecx
add edx, 0xc7219086
sub edx, 1
sub edx, 0xc7219086
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1debd241
mov ecx, 0xdd11eecf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x4fda811c
jmp 0x100022d7
mov edx, dword [ebp - 0x158]
mov eax, 0xedb2890c
mov ecx, 0x281c857
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x19c], 0x343b24bb
jmp 0x100022d7
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x41343bdd
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x7e7b0ea5
jmp 0x100022d7
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov dword [ebp - 0x19c], 0x376f620e
jmp 0x100022d7
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61bf5eff
mov ecx, 0x94ea4345
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x14c], eax
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x61bf5eff
mov ecx, 0x2c02c41e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x8d26ed71
jmp 0x100022d7
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x150]
sub ecx, 0x76feb67a
add ecx, eax
add ecx, 0x76feb67a
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov word [eax], 0
mov dword [ebp - 0x19c], 0xcdd3c61c
jmp 0x100022d7
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x541155ce
mov ecx, 0xe1e5bb58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x174]
movzx eax, word [eax]
mov dword [ebp - 0x148], eax
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x541155ce
mov ecx, 0x6fc43891
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0xecead403
jmp 0x100022d7
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
mov edx, ecx
add edx, 0x640e7cb4
sub edx, 1
sub edx, 0x640e7cb4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78e000f3
mov ecx, 0x3ff63163
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x144], eax
mov eax, dword [0x10067558]
mov ecx, dword [0x10067554]
mov edx, eax
add edx, 0xe737a877
sub edx, 1
sub edx, 0xe737a877
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78e000f3
mov ecx, 0xad5e74e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x7b82c5f2
jmp 0x100022d7
mov eax, dword [ebp - 0x144]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x148]
mov eax, 0xd5d76e3b
mov ecx, 0x98d78c2d
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x19c], 0x5b5f5c71
jmp 0x100022d7
mov eax, dword [ebp - 0x13c]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x174]
movzx eax, word [eax]
imul eax, eax, 0x28
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x19c], 0xfeb6009d
jmp 0x100022d7
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
add ecx, 0x571c582e
add ecx, eax
sub ecx, 0x571c582e
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100131a0
call fcn.10009f60
add esp, 8
mov edx, eax
mov eax, 0x3b422403
mov ecx, 0xd15c6804
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xd1b6ff7f
add edx, eax
add edx, 0xd1b6ff7f
mov eax, dword [ebp - 0x16c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x12d], al
mov dword [ebp - 0x19c], 0x8550b09b
jmp 0x100022d7
mov eax, dword [ebp - 0x168]
mov cl, byte [ebp - 0x12d]
mov byte [eax], cl
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x180]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10007d50
add esp, 0xc
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x3500ee6c
add eax, ecx
sub eax, 0x3500ee6c
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x19c], 0xaf594700
jmp 0x100022d7
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x128]
mov esi, dword [ebp - 0x124]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov dword [ebp - 0x19c], 0xd15c6804
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x998fdd70
jmp 0x100022d7
mov eax, dword [ebp - 0x174]
mov ax, word [eax]
mov word [ebp - 0x11e], ax
mov dword [ebp - 0x19c], 0xd52cfb44
jmp 0x100022d7
mov cx, word [ebp - 0x11e]
add cx, 0x9572
add cx, 1
sub cx, 0x9572
mov eax, dword [ebp - 0x174]
mov word [eax], cx
mov dword [ebp - 0x19c], 0x402ca6c
jmp 0x100022d7
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
mov edx, ecx
add edx, 0x372d3881
sub edx, 1
sub edx, 0x372d3881
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfdad8249
mov ecx, 0x5602b5c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov ecx, dword [0x10067558]
mov eax, dword [0x10067554]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfdad8249
mov ecx, 0x69798d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x100022d7
mov dword [ebp - 0x19c], 0xcdd3c61c
jmp 0x100022d7
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x5704a3a7
jmp 0x100022d7
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x190]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x583ce98c
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x7e7b0ea5
jmp 0x100022d7
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10006fd0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x19c], 0x2697896
jmp 0x100022d7
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x19c], 0xebef1b75
jmp 0x100022d7
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x19c], 0xee41cf32
jmp 0x100022d7
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x19c], 0x94ea4345
jmp 0x100022d7
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x19c], 0xe1e5bb58
jmp 0x100022d7
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x19c], 0x3ff63163
jmp 0x100022d7
mov dword [ebp - 0x19c], 0x5602b5c4
jmp 0x100010d8