Function at 0x1000e4b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x1008b280]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xac], 0x98b38ebe
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x8e61c950
je 0x1000f0ed
jmp 0x1000e4f4
mov eax, dword [ebp - 0xb4]
sub eax, 0x933d68ed
je 0x1000f5ee
jmp 0x1000e50a
mov eax, dword [ebp - 0xb4]
sub eax, 0x9601ca73
je 0x1000fcb8
jmp 0x1000e520
mov eax, dword [ebp - 0xb4]
sub eax, 0x9756f2a5
je 0x1000fbf4
jmp 0x1000e536
mov eax, dword [ebp - 0xb4]
sub eax, 0x98b38ebe
je 0x1000ead1
jmp 0x1000e54c
mov eax, dword [ebp - 0xb4]
sub eax, 0x98b5f1fe
je 0x1000fa21
jmp 0x1000e562
mov eax, dword [ebp - 0xb4]
sub eax, 0x98f66f48
je 0x1000fa58
jmp 0x1000e578
mov eax, dword [ebp - 0xb4]
sub eax, 0x9de932da
je 0x1000f8f9
jmp 0x1000e58e
mov eax, dword [ebp - 0xb4]
sub eax, 0xa0570f4e
je 0x1000f6d9
jmp 0x1000e5a4
mov eax, dword [ebp - 0xb4]
sub eax, 0xa29fef9d
je 0x1000fa08
jmp 0x1000e5ba
mov eax, dword [ebp - 0xb4]
sub eax, 0xa3a36cb2
je 0x1000f4f2
jmp 0x1000e5d0
mov eax, dword [ebp - 0xb4]
sub eax, 0xa9188e35
je 0x1000ec82
jmp 0x1000e5e6
mov eax, dword [ebp - 0xb4]
sub eax, 0xab4aa42e
je 0x1000f2e1
jmp 0x1000e5fc
mov eax, dword [ebp - 0xb4]
sub eax, 0xaea2caf0
je 0x1000f0cf
jmp 0x1000e612
mov eax, dword [ebp - 0xb4]
sub eax, 0xafa037d2
je 0x1000eee4
jmp 0x1000e628
mov eax, dword [ebp - 0xb4]
sub eax, 0xb0c048bd
je 0x1000f3f5
jmp 0x1000e63e
mov eax, dword [ebp - 0xb4]
sub eax, 0xb1ec4baf
je 0x1000fc50
jmp 0x1000e654
mov eax, dword [ebp - 0xb4]
sub eax, 0xb6b188c5
je 0x1000ed76
jmp 0x1000e66a
mov eax, dword [ebp - 0xb4]
sub eax, 0xbe443798
je 0x1000f072
jmp 0x1000e680
mov eax, dword [ebp - 0xb4]
sub eax, 0xca43dbc5
je 0x1000f63f
jmp 0x1000e696
mov eax, dword [ebp - 0xb4]
sub eax, 0xd0d6f7ed
je 0x1000fc68
jmp 0x1000e6ac
mov eax, dword [ebp - 0xb4]
sub eax, 0xd33fe610
je 0x1000ecf8
jmp 0x1000e6c2
mov eax, dword [ebp - 0xb4]
sub eax, 0xd4bfda65
je 0x1000fc41
jmp 0x1000e6d8
mov eax, dword [ebp - 0xb4]
sub eax, 0xdfc450da
je 0x1000fd33
jmp 0x1000e6ee
mov eax, dword [ebp - 0xb4]
sub eax, 0xe393068b
je 0x1000ef54
jmp 0x1000e704
mov eax, dword [ebp - 0xb4]
sub eax, 0xe8fe0086
je 0x1000f828
jmp 0x1000e71a
mov eax, dword [ebp - 0xb4]
sub eax, 0xea8e66e0
je 0x1000f264
jmp 0x1000e730
mov eax, dword [ebp - 0xb4]
sub eax, 0xf1311f92
je 0x1000f819
jmp 0x1000e746
mov eax, dword [ebp - 0xb4]
sub eax, 0xf33fc203
je 0x1000f9e8
jmp 0x1000e75c
mov eax, dword [ebp - 0xb4]
sub eax, 0xf4590f2e
je 0x1000edca
jmp 0x1000e772
mov eax, dword [ebp - 0xb4]
sub eax, 0xf57b24c8
je 0x1000fa79
jmp 0x1000e788
mov eax, dword [ebp - 0xb4]
sub eax, 0xf8f579ee
je 0x1000f19d
jmp 0x1000e79e
mov eax, dword [ebp - 0xb4]
sub eax, 0xff53a810
je 0x1000f063
jmp 0x1000e7b4
mov eax, dword [ebp - 0xb4]
sub eax, 0x6799fd3
je 0x1000ec73
jmp 0x1000e7ca
mov eax, dword [ebp - 0xb4]
sub eax, 0x72e7652
je 0x1000f5a7
jmp 0x1000e7e0
mov eax, dword [ebp - 0xb4]
sub eax, 0x7c9cce7
je 0x1000f273
jmp 0x1000e7f6
mov eax, dword [ebp - 0xb4]
sub eax, 0xbf4be02
je 0x1000f213
jmp 0x1000e80c
mov eax, dword [ebp - 0xb4]
sub eax, 0x16b64ce6
je 0x1000f553
jmp 0x1000e822
mov eax, dword [ebp - 0xb4]
sub eax, 0x1868cec9
je 0x1000eb47
jmp 0x1000e838
mov eax, dword [ebp - 0xb4]
sub eax, 0x18815a57
je 0x1000f876
jmp 0x1000e84e
mov eax, dword [ebp - 0xb4]
sub eax, 0x1a5b781a
je 0x1000f571
jmp 0x1000e864
mov eax, dword [ebp - 0xb4]
sub eax, 0x1b5ba17e
je 0x1000ef63
jmp 0x1000e87a
mov eax, dword [ebp - 0xb4]
sub eax, 0x20687a2d
je 0x1000f6f7
jmp 0x1000e890
mov eax, dword [ebp - 0xb4]
sub eax, 0x20d5aa7e
je 0x1000f37f
jmp 0x1000e8a6
mov eax, dword [ebp - 0xb4]
sub eax, 0x21a27e26
je 0x1000f0fc
jmp 0x1000e8bc
mov eax, dword [ebp - 0xb4]
sub eax, 0x28edf794
je 0x1000fb30
jmp 0x1000e8d2
mov eax, dword [ebp - 0xb4]
sub eax, 0x34f31b78
je 0x1000ee40
jmp 0x1000e8e8
mov eax, dword [ebp - 0xb4]
sub eax, 0x370b5a7b
je 0x1000f9cf
jmp 0x1000e8fe
mov eax, dword [ebp - 0xb4]
sub eax, 0x384191d0
je 0x1000ed49
jmp 0x1000e914
mov eax, dword [ebp - 0xb4]
sub eax, 0x39f06333
je 0x1000fac2
jmp 0x1000e92a
mov eax, dword [ebp - 0xb4]
sub eax, 0x404a5a49
je 0x1000fb50
jmp 0x1000e940
mov eax, dword [ebp - 0xb4]
sub eax, 0x41c766ad
je 0x1000f9c0
jmp 0x1000e956
mov eax, dword [ebp - 0xb4]
sub eax, 0x461d22e2
je 0x1000f370
jmp 0x1000e96c
mov eax, dword [ebp - 0xb4]
sub eax, 0x4a59270d
je 0x1000fc90
jmp 0x1000e982
mov eax, dword [ebp - 0xb4]
sub eax, 0x4b2bf46b
je 0x1000ed67
jmp 0x1000e998
mov eax, dword [ebp - 0xb4]
sub eax, 0x4b9be8cd
je 0x1000fb3f
jmp 0x1000e9ae
mov eax, dword [ebp - 0xb4]
sub eax, 0x4e5cbf24
je 0x1000f475
jmp 0x1000e9c4
mov eax, dword [ebp - 0xb4]
sub eax, 0x51f218b0
je 0x1000fbc1
jmp 0x1000e9da
mov eax, dword [ebp - 0xb4]
sub eax, 0x5c92aea2
je 0x1000f097
jmp 0x1000e9f0
mov eax, dword [ebp - 0xb4]
sub eax, 0x61f9288b
je 0x1000fbb2
jmp 0x1000ea06
mov eax, dword [ebp - 0xb4]
sub eax, 0x628e48f8
je 0x1000f484
jmp 0x1000ea1c
mov eax, dword [ebp - 0xb4]
sub eax, 0x634c7b9c
je 0x1000f740
jmp 0x1000ea32
mov eax, dword [ebp - 0xb4]
sub eax, 0x653c027a
je 0x1000fc7b
jmp 0x1000ea48
mov eax, dword [ebp - 0xb4]
sub eax, 0x65eff42b
je 0x1000f94a
jmp 0x1000ea5e
mov eax, dword [ebp - 0xb4]
sub eax, 0x66558c2d
je 0x1000efac
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
add edx, 0x6e9e522d
sub edx, 1
sub edx, 0x6e9e522d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x404a5a49
mov ecx, 0x1868cec9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0xb0]
push eax
sub esp, 0x100
mov ecx, esp
mov dword [ebp - 0x98], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x94], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x90], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x8c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x88], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002b8e0
add esp, 0xc
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
setne al
and al, 1
mov byte [ebp - 0x6d], al
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
sub edx, 0x6b75d0e8
sub edx, 1
add edx, 0x6b75d0e8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x404a5a49
mov ecx, 0x6799fd3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0xa9188e35
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
sub edx, 0x8572851a
sub edx, 1
add edx, 0x8572851a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x61f9288b
mov ecx, 0xd33fe610
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
mov edx, eax
sub edx, 0x80e1edc3
sub edx, 1
add edx, 0x80e1edc3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61f9288b
mov ecx, 0x384191d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dl, byte [ebp - 0x6d]
mov eax, 0x4b2bf46b
mov ecx, 0xb6b188c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x4b9be8cd
jmp 0x1000fd3d
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xac], 0xf4590f2e
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
add edx, 0x407a7075
sub edx, 1
sub edx, 0x407a7075
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x51f218b0
mov ecx, 0x34f31b78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x64], eax
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x51f218b0
mov ecx, 0x6dd9a14f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x64]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov edx, dword [ebp - 0x94]
mov esi, 0xffffffff
mov eax, 0x1b5ba17e
mov ecx, 0xe393068b
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x4b9be8cd
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9756f2a5
mov ecx, 0x66558c2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0xbe443798
jmp 0x1000fd3d
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xac], 0x5c92aea2
jmp 0x1000fd3d
mov edx, dword [ebp - 0x5c]
mov eax, 0x7e33fc89
mov ecx, 0x21a27e26
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x58]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x8e61c950
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x4b9be8cd
jmp 0x1000fd3d
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xac], 0x72df721a
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
add edx, 0x6ef0b5a6
sub edx, 1
sub edx, 0x6ef0b5a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd4bfda65
mov ecx, 0xbf4be02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
mov edx, eax
add edx, 0xe972bbc3
sub edx, 1
sub edx, 0xe972bbc3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4bfda65
mov ecx, 0xea8e66e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x7c9cce7
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb1ec4baf
mov ecx, 0xab4aa42e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x80]
movzx eax, word [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x4a], ax
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
sub edx, 0x1acccea0
sub edx, 1
add edx, 0x1acccea0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb1ec4baf
mov ecx, 0x461d22e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x20d5aa7e
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
add edx, 0xd5d32aee
sub edx, 1
sub edx, 0xd5d32aee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd0d6f7ed
mov ecx, 0xb0c048bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov ax, word [ebp - 0x4a]
movzx eax, ax
mov dword [ebp - 0x48], eax
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
add edx, 0xd3bd9a0c
sub edx, 1
sub edx, 0xd3bd9a0c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd0d6f7ed
mov ecx, 0x4e5cbf24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x628e48f8
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x653c027a
mov ecx, 0xa3a36cb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x41], al
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
mov edx, eax
add edx, 0xa853b61f
sub edx, 1
sub edx, 0xa853b61f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x653c027a
mov ecx, 0x16b64ce6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dl, byte [ebp - 0x41]
mov eax, 0x98b5f1fe
mov ecx, 0x1a5b781a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
add eax, 0x17983a72
add eax, 0x18
sub eax, 0x17983a72
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xac], 0x72e7652
jmp 0x1000fd3d
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x80]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x38601e1c
add ecx, eax
sub ecx, 0x38601e1c
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xac], 0x933d68ed
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
mov edx, eax
sub edx, 0x225ecde6
sub edx, 1
add edx, 0x225ecde6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a59270d
mov ecx, 0xca43dbc5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov ecx, dword [ebp - 0x38]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100398e6
call fcn.1002f240
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x31], al
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
add edx, 0xaf9679cf
sub edx, 1
sub edx, 0xaf9679cf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a59270d
mov ecx, 0xa0570f4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dl, byte [ebp - 0x31]
mov eax, 0x20687a2d
mov ecx, 0x9de932da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9601ca73
mov ecx, 0x634c7b9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov eax, dword [ebp - 0x78]
mov dword [eax], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x78]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
sub edx, 0xa63e14ea
sub edx, 1
add edx, 0xa63e14ea
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9601ca73
mov ecx, 0xf1311f92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0xe8fe0086
jmp 0x1000fd3d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x30]
sub eax, 0x5a5282d6
add eax, ecx
add eax, 0x5a5282d6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x77312053
add eax, ecx
sub eax, 0x77312053
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xac], 0x18815a57
jmp 0x1000fd3d
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002ba40
add esp, 0xc
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xe3e62553
add esi, eax
sub esi, 0xe3e62553
mov eax, dword [ebp - 0x78]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov dword [ebp - 0xac], 0x9de932da
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
mov edx, eax
add edx, 0x4b990579
sub edx, 1
sub edx, 0x4b990579
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6eeea18d
mov ecx, 0x65eff42b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
mov edx, ecx
sub edx, 0x7650b7a6
sub edx, 1
add edx, 0x7650b7a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6eeea18d
mov ecx, 0x41c766ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x370b5a7b
jmp 0x1000fd3d
mov eax, dword [ebp - 0x80]
mov ax, word [eax]
mov word [ebp - 0x1c], ax
mov dword [ebp - 0xac], 0xf33fc203
jmp 0x1000fd3d
mov ax, word [ebp - 0x1c]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x1a], ax
mov dword [ebp - 0xac], 0xa29fef9d
jmp 0x1000fd3d
mov eax, dword [ebp - 0x80]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov dword [ebp - 0xac], 0x7c9cce7
jmp 0x1000fd3d
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x98f66f48
jmp 0x1000fd3d
mov eax, dword [ebp - 0xa0]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0xf57b24c8
jmp 0x1000fd3d
mov eax, dword [0x1008c754]
mov ecx, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdfc450da
mov ecx, 0x39f06333
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov ecx, dword [0x1008c754]
mov eax, dword [0x1008c750]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdfc450da
mov ecx, 0x28edf794
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x4b9be8cd
jmp 0x1000fd3d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002ab40
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002b8e0
add esp, 0xc
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], 0x1868cec9
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0xd33fe610
jmp 0x1000fd3d
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xac], 0x34f31b78
jmp 0x1000fd3d
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xac], 0x66558c2d
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0xbf4be02
jmp 0x1000fd3d
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xac], 0xab4aa42e
jmp 0x1000fd3d
mov ax, word [ebp - 0x4a]
mov dword [ebp - 0xac], 0xb0c048bd
jmp 0x1000fd3d
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xac], 0xa3a36cb2
jmp 0x1000fd3d
mov ecx, dword [ebp - 0x38]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100398e6
call fcn.1002f240
add esp, 8
mov dword [ebp - 0xac], 0xca43dbc5
jmp 0x1000fd3d
mov eax, dword [ebp - 0x78]
mov dword [eax], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x4214570a
add edx, eax
add edx, 0x4214570a
mov eax, dword [ebp - 0x78]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x74]
mov byte [eax], cl
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0x634c7b9c
jmp 0x1000fd3d
mov dword [ebp - 0xac], 0x39f06333
jmp 0x1000e4d8