Function at 0x10007840
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1008c280]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x94], 0x4fc4a5b0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x872d8127
je 0x100087e2
jmp 0x10007884
mov eax, dword [ebp - 0x9c]
sub eax, 0x8750dc92
je 0x10008c97
jmp 0x1000789a
mov eax, dword [ebp - 0x9c]
sub eax, 0x8bad4627
je 0x10008f17
jmp 0x100078b0
mov eax, dword [ebp - 0x9c]
sub eax, 0x9477efd6
je 0x10008b61
jmp 0x100078c6
mov eax, dword [ebp - 0x9c]
sub eax, 0x95d7c6d3
je 0x1000804b
jmp 0x100078dc
mov eax, dword [ebp - 0x9c]
sub eax, 0x9db0ff29
je 0x100080ed
jmp 0x100078f2
mov eax, dword [ebp - 0x9c]
sub eax, 0x9e8d13a7
je 0x10008785
jmp 0x10007908
mov eax, dword [ebp - 0x9c]
sub eax, 0x9f6e3a05
je 0x1000882c
jmp 0x1000791e
mov eax, dword [ebp - 0x9c]
sub eax, 0x9fce1366
je 0x10008473
jmp 0x10007934
mov eax, dword [ebp - 0x9c]
sub eax, 0xa31de98a
je 0x10008422
jmp 0x1000794a
mov eax, dword [ebp - 0x9c]
sub eax, 0xa3c344a1
je 0x100080fc
jmp 0x10007960
mov eax, dword [ebp - 0x9c]
sub eax, 0xa3ff34a0
je 0x10008cf5
jmp 0x10007976
mov eax, dword [ebp - 0x9c]
sub eax, 0xa4e123c1
je 0x100083bb
jmp 0x1000798c
mov eax, dword [ebp - 0x9c]
sub eax, 0xa8abb29d
je 0x1000831a
jmp 0x100079a2
mov eax, dword [ebp - 0x9c]
sub eax, 0xae03fe15
je 0x10008c88
jmp 0x100079b8
mov eax, dword [ebp - 0x9c]
sub eax, 0xaeae260f
je 0x10008249
jmp 0x100079ce
mov eax, dword [ebp - 0x9c]
sub eax, 0xb1aa7dc3
je 0x10007fd5
jmp 0x100079e4
mov eax, dword [ebp - 0x9c]
sub eax, 0xb537db55
je 0x10008a3f
jmp 0x100079fa
mov eax, dword [ebp - 0x9c]
sub eax, 0xb5e9c44a
je 0x10008ce6
jmp 0x10007a10
mov eax, dword [ebp - 0x9c]
sub eax, 0xbaeec3d0
je 0x1000898a
jmp 0x10007a26
mov eax, dword [ebp - 0x9c]
sub eax, 0xc15f8a6c
je 0x10008482
jmp 0x10007a3c
mov eax, dword [ebp - 0x9c]
sub eax, 0xc6dc34a1
je 0x100083d9
jmp 0x10007a52
mov eax, dword [ebp - 0x9c]
sub eax, 0xc7a8f49a
je 0x10008bfa
jmp 0x10007a68
mov eax, dword [ebp - 0x9c]
sub eax, 0xcded6bb9
je 0x10007fc6
jmp 0x10007a7e
mov eax, dword [ebp - 0x9c]
sub eax, 0xd1a87a74
je 0x10008d56
jmp 0x10007a94
mov eax, dword [ebp - 0x9c]
sub eax, 0xd3471179
je 0x10008e98
jmp 0x10007aaa
mov eax, dword [ebp - 0x9c]
sub eax, 0xd42dbcc8
je 0x10008ddb
jmp 0x10007ac0
mov eax, dword [ebp - 0x9c]
sub eax, 0xd4b7071d
je 0x100084f8
jmp 0x10007ad6
mov eax, dword [ebp - 0x9c]
sub eax, 0xd8bfcf84
je 0x10008dc9
jmp 0x10007aec
mov eax, dword [ebp - 0x9c]
sub eax, 0xd8cd7811
je 0x1000868a
jmp 0x10007b02
mov eax, dword [ebp - 0x9c]
sub eax, 0xda8e2104
je 0x1000866c
jmp 0x10007b18
mov eax, dword [ebp - 0x9c]
sub eax, 0xdf1415e2
je 0x100089b8
jmp 0x10007b2e
mov eax, dword [ebp - 0x9c]
sub eax, 0xe78444b2
je 0x10008900
jmp 0x10007b44
mov eax, dword [ebp - 0x9c]
sub eax, 0xe8e9496f
je 0x10008f35
jmp 0x10007b5a
mov eax, dword [ebp - 0x9c]
sub eax, 0xea4901e4
je 0x10008587
jmp 0x10007b70
mov eax, dword [ebp - 0x9c]
sub eax, 0xf042a1c2
je 0x10008b84
jmp 0x10007b86
mov eax, dword [ebp - 0x9c]
sub eax, 0xf2784b57
je 0x100080cf
jmp 0x10007b9c
mov eax, dword [ebp - 0x9c]
sub eax, 0xf764ad0e
je 0x10008d67
jmp 0x10007bb2
mov eax, dword [ebp - 0x9c]
sub eax, 0x3adf122
je 0x1000886a
jmp 0x10007bc8
mov eax, dword [ebp - 0x9c]
sub eax, 0x49b908a
je 0x100082b7
jmp 0x10007bde
mov eax, dword [ebp - 0x9c]
sub eax, 0xaeb3a83
je 0x10008b52
jmp 0x10007bf4
mov eax, dword [ebp - 0x9c]
sub eax, 0xcc1d7a5
je 0x10008f4d
jmp 0x10007c0a
mov eax, dword [ebp - 0x9c]
sub eax, 0x1d3ad513
je 0x10008852
jmp 0x10007c20
mov eax, dword [ebp - 0x9c]
sub eax, 0x1ff9da60
je 0x10008329
jmp 0x10007c36
mov eax, dword [ebp - 0x9c]
sub eax, 0x2e9eb2c1
je 0x10009009
jmp 0x10007c4c
mov eax, dword [ebp - 0x9c]
sub eax, 0x2ef800c9
je 0x100089ee
jmp 0x10007c62
mov eax, dword [ebp - 0x9c]
sub eax, 0x3aeca564
je 0x1000865d
jmp 0x10007c78
mov eax, dword [ebp - 0x9c]
sub eax, 0x41826a3e
je 0x100087f9
jmp 0x10007c8e
mov eax, dword [ebp - 0x9c]
sub eax, 0x494538f4
je 0x10008e86
jmp 0x10007ca4
mov eax, dword [ebp - 0x9c]
sub eax, 0x49882b12
je 0x10008ca6
jmp 0x10007cba
mov eax, dword [ebp - 0x9c]
sub eax, 0x4a5d0515
je 0x100086a1
jmp 0x10007cd0
mov eax, dword [ebp - 0x9c]
sub eax, 0x4fc4a5b0
je 0x10007e61
jmp 0x10007ce6
mov eax, dword [ebp - 0x9c]
sub eax, 0x50a1d8b4
je 0x100086ea
jmp 0x10007cfc
mov eax, dword [ebp - 0x9c]
sub eax, 0x533e796b
je 0x10008ea7
jmp 0x10007d12
mov eax, dword [ebp - 0x9c]
sub eax, 0x5523cf37
je 0x10008f00
jmp 0x10007d28
mov eax, dword [ebp - 0x9c]
sub eax, 0x55f95397
je 0x10008767
jmp 0x10007d3e
mov eax, dword [ebp - 0x9c]
sub eax, 0x583db17b
je 0x1000888a
jmp 0x10007d54
mov eax, dword [ebp - 0x9c]
sub eax, 0x5a2e88d6
je 0x10008596
jmp 0x10007d6a
mov eax, dword [ebp - 0x9c]
sub eax, 0x5c765032
je 0x10007ed7
jmp 0x10007d80
mov eax, dword [ebp - 0x9c]
sub eax, 0x616f7564
je 0x10008d47
jmp 0x10007d96
mov eax, dword [ebp - 0x9c]
sub eax, 0x6390ed57
je 0x1000823a
jmp 0x10007dac
mov eax, dword [ebp - 0x9c]
sub eax, 0x6474da50
je 0x1000814d
jmp 0x10007dc2
mov eax, dword [ebp - 0x9c]
sub eax, 0x65eb2cb4
je 0x10008cbf
jmp 0x10007dd8
mov eax, dword [ebp - 0x9c]
sub eax, 0x6a1e7789
je 0x1000860c
jmp 0x10007dee
mov eax, dword [ebp - 0x9c]
sub eax, 0x6ab9bb6f
je 0x10008d15
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
sub edx, 0xc711f556
sub edx, 1
add edx, 0xc711f556
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf764ad0e
mov ecx, 0x5c765032
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x98]
push eax
sub esp, 0x100
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1001ead0
add esp, 0xc
mov eax, dword [ebp - 0x84]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x58], eax
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
sub edx, 0xc3f9d491
sub edx, 1
add edx, 0xc3f9d491
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf764ad0e
mov ecx, 0xcded6bb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0xb1aa7dc3
jmp 0x1000906a
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
add edx, 0x38c6dd89
sub edx, 1
sub edx, 0x38c6dd89
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd8bfcf84
mov ecx, 0x95d7c6d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x58]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x52], al
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
sub edx, 0x5a454c2b
sub edx, 1
add edx, 0x5a454c2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd8bfcf84
mov ecx, 0xf2784b57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dl, byte [ebp - 0x52]
mov eax, 0x9db0ff29
mov ecx, 0xa3c344a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0xd1a87a74
jmp 0x1000906a
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
sub edx, 0x97dc445a
sub edx, 1
add edx, 0x97dc445a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd42dbcc8
mov ecx, 0x6474da50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x8c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
add edx, 0xfe89e29a
sub edx, 1
sub edx, 0xfe89e29a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd42dbcc8
mov ecx, 0x6390ed57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0xaeae260f
jmp 0x1000906a
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x494538f4
mov ecx, 0x49b908a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x7c]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x51], al
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
add edx, 0xe5443fdb
sub edx, 1
sub edx, 0xe5443fdb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x494538f4
mov ecx, 0xa8abb29d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0x1ff9da60
jmp 0x1000906a
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3471179
mov ecx, 0x6e25bb63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dl, byte [ebp - 0x51]
mov eax, 0xc15f8a6c
mov ecx, 0xc6dc34a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x533e796b
mov ecx, 0xa31de98a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
add edx, 0x206bb710
sub edx, 1
sub edx, 0x206bb710
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x533e796b
mov ecx, 0x9fce1366
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0xd1a87a74
jmp 0x1000906a
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
add edx, 0x45369862
sub edx, 1
sub edx, 0x45369862
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x75162663
mov ecx, 0xd4b7071d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x50], eax
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
add edx, 0x5c8d6e12
sub edx, 1
sub edx, 0x5c8d6e12
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75162663
mov ecx, 0xea4901e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0x5a2e88d6
jmp 0x1000906a
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
sub edx, 0x13a8c276
sub edx, 1
add edx, 0x13a8c276
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5523cf37
mov ecx, 0x6a1e7789
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5523cf37
mov ecx, 0x3aeca564
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0xda8e2104
jmp 0x1000906a
mov edx, dword [ebp - 0x78]
mov eax, 0xd8cd7811
mov ecx, 0x9e8d13a7
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x94], 0x4a5d0515
jmp 0x1000906a
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8bad4627
mov ecx, 0x50a1d8b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8bad4627
mov ecx, 0x55f95397
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0x7e20fd78
jmp 0x1000906a
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x94], 0x872d8127
jmp 0x1000906a
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x94], 0x41826a3e
jmp 0x1000906a
mov eax, dword [ebp - 0x44]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x48]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov dword [ebp - 0x94], 0x9f6e3a05
jmp 0x1000906a
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x94], 0x1d3ad513
jmp 0x1000906a
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x94], 0x3adf122
jmp 0x1000906a
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x38]
mov eax, 0xa3ff34a0
mov ecx, 0x583db17b
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
add edx, 0x390d8ffb
sub edx, 1
sub edx, 0x390d8ffb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe8e9496f
mov ecx, 0xe78444b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 0xc1d87286
add eax, 0x18
sub eax, 0xc1d87286
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x68]
movzx ecx, word [ecx]
imul ecx, ecx, 0x28
sub eax, 0x354eb841
add eax, ecx
add eax, 0x354eb841
mov dword [ebp - 0x34], eax
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
add edx, 0xb313ea5a
sub edx, 1
sub edx, 0xb313ea5a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe8e9496f
mov ecx, 0xbaeec3d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0x7fee67d7
jmp 0x1000906a
mov ecx, dword [ebp - 0x30]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1002c5e3
call fcn.10022430
add esp, 8
mov edx, eax
mov eax, 0x2ef800c9
mov ecx, 0x8750dc92
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
sub edx, 0x93940a2e
sub edx, 1
add edx, 0x93940a2e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc1d7a5
mov ecx, 0xb537db55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x92b4692f
add edx, eax
add edx, 0x92b4692f
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x24599b28
add ecx, eax
sub ecx, 0x24599b28
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1001ec30
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
mov edx, eax
sub edx, 0x82dc2d6c
sub edx, 1
add edx, 0x82dc2d6c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc1d7a5
mov ecx, 0xaeb3a83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0x9477efd6
jmp 0x1000906a
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x94], 0xf042a1c2
jmp 0x1000906a
mov ecx, dword [0x1008d76c]
mov eax, dword [0x1008d768]
mov edx, ecx
add edx, 0xb7be2419
sub edx, 1
sub edx, 0xb7be2419
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2e9eb2c1
mov ecx, 0xc7a8f49a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov esi, dword [ebp - 0x24]
add esi, 0x1ecee4ce
add esi, eax
sub esi, 0x1ecee4ce
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov eax, dword [0x1008d76c]
mov ecx, dword [0x1008d768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e9eb2c1
mov ecx, 0xae03fe15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000906a
mov dword [ebp - 0x94], 0x8750dc92
jmp 0x1000906a
mov dword [ebp - 0x94], 0x49882b12
jmp 0x1000906a
mov eax, dword [ebp - 0x68]
mov ax, word [eax]
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x94], 0x65eb2cb4
jmp 0x1000906a
mov cx, word [ebp - 0x1a]
add cx, 0x50a2
add cx, 1
sub cx, 0x50a2
mov eax, dword [ebp - 0x68]
mov word [eax], cx
mov dword [ebp - 0x94], 0xb5e9c44a
jmp 0x1000906a
mov dword [ebp - 0x94], 0x9f6e3a05
jmp 0x1000906a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x6ab9bb6f
jmp 0x1000906a
mov dword [ebp - 0x94], 0xd1a87a74
jmp 0x1000906a
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1001dd30
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1001ead0
add esp, 0xc
mov eax, dword [ebp - 0x84]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], 0x5c765032
jmp 0x1000906a
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x94], 0x95d7c6d3
jmp 0x1000906a
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x8c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x6474da50
jmp 0x1000906a
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x94], 0x49b908a
jmp 0x1000906a
mov dword [ebp - 0x94], 0x6e25bb63
jmp 0x1000906a
mov dword [ebp - 0x94], 0xa31de98a
jmp 0x1000906a
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov dword [ebp - 0x94], 0x6a1e7789
jmp 0x1000906a
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x50a1d8b4
jmp 0x1000906a
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x94], 0xe78444b2
jmp 0x1000906a
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xaa5877b2
add edx, eax
add edx, 0xaa5877b2
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xc6ac3a95
add edx, eax
sub edx, 0xc6ac3a95
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1001ec30
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x94], 0xb537db55
jmp 0x1000906a
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov dword [ebp - 0x94], 0xc7a8f49a
jmp 0x10007868