Function at 0x1001490
Capabilities:
Get common file path

Disassembly:
movzx eax, byte [0x10560b4]
sub esp, 0x24
movzx ecx, word [0x1056012]
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov edx, edi
sub edx, eax
movzx eax, word [0x1056032]
add ecx, eax
sub edx, 0x5b
cmp ecx, 0x3d9
jne 0x10014d2
imul esi, dword [0x10560b8], 0x16e56
sub esi, 0xb6ff
jmp 0x10014e7
mov eax, dword [0x10560b8]
mov esi, 0x2a
add eax, 0xffffff48
mov word [0x1056026], ax
push edx
call fcn.01001050
add esp, 4
mov dword [esp + 0x34], eax
cmp esi, dword [0x10560b8]
jb 0x1001521
mov ecx, dword [section..data]
imul ecx, dword [0x105602c]
mov word [0x105602c], cx
lea ecx, [esi + esi*2]
add ecx, ecx
sub ecx, dword [section..data]
mov dword [0x10560b8], ecx
sub al, byte [0x10560b4]
lea ebx, [edi + 0x645]
push dword [esp + 0x34]
add ebx, esi
mov dword [0x1057488], 0x1058750
add al, bl
mov byte [0x10560b4], al
call fcn.01001100
mov edx, dword [0x10560b8]
add esp, 4
movzx ecx, word [0x1056012]
movzx esi, ax
imul eax, edx, 0x16e56
add ebx, eax
mov al, byte [esp + 0x34]
sub al, bl
add al, 0x2a
mov byte [0x10560b4], al
movzx eax, word [0x1056032]
add ecx, eax
cmp ecx, 0x3d9
jne 0x100159f
lea eax, [edx*2 - 0xb7b9]
mov dword [esp + 0x34], eax
mov eax, esi
imul eax, eax, 0x16e56
add edx, eax
mov dword [0x10560b8], edx
jmp 0x10015b9
mov eax, dword [esp + 0x34]
sub esi, edx
sub esi, 0x5b
sub eax, edx
add eax, 0x2a
mov word [0x1056026], si
mov dword [0x10560b8], eax
push ebp
push dword [esp + 0x38]
call fcn.01001050
movzx esi, byte [0x10560b4]
mov ebp, 0x1a49
inc esi
mov dword [esp + 0x34], ebp
add esi, ebx
add esp, 4
mov dword [0x10560b0], esi
cmp word [0x1056028], bp
jne 0x10015fa
movzx eax, word [0x1056024]
mov ebx, 0xffffffa5
add dword [0x10560b8], eax
push esi
call fcn.010011f0
push 0x4314
movzx ecx, ax
imul eax, dword [0x10560b8], 0x16e56
push 0x104b5c0
push 0x1058750
push ecx
push esi
add ebx, eax
call fcn.0103d990
mov edx, dword [0x10560b0]
mov al, dl
mov cl, dl
add al, al
add cl, al
add cl, cl
sub cl, bl
push edx
mov byte [0x10560b4], cl
call fcn.01001050
mov esi, dword [section..data]
add esp, 0x1c
cmp word [0x1056022], 0
je 0x100165f
mov edx, esi
sub edx, ebx
sub edx, 0x5b
jmp 0x1001665
mov edx, dword [0x10560b8]
mov edi, edx
mov dword [esp + 0x20], 0x23db22b
cmp word [0x1056028], bp
jne 0x1001688
movzx eax, word [0x1056024]
mov ecx, 0xffffffa5
add edx, eax
jmp 0x100168e
mov ecx, dword [0x10560b0]
movzx ebx, byte [0x10560b4]
add ecx, 0xd
movzx eax, word [0x1056032]
add ebx, edi
add ebx, ecx
movzx ecx, word [0x1056012]
add ecx, eax
cmp ecx, 0x3d9
jne 0x10016cb
imul eax, esi, 0x16e56
lea edi, [edx*2 - 0xb7b9]
add edx, eax
mov dword [0x10560b8], edx
jmp 0x10016e3
sub esi, edx
mov eax, edi
sub esi, 0x5b
sub eax, edx
add eax, 0x2a
mov word [0x1056026], si
mov dword [0x10560b8], eax
push ebx
call fcn.01001100
mov ebx, dword [0x10560b8]
add esp, 4
mov cl, byte [0x10560b4]
movzx eax, ax
mov dword [esp + 0x10], eax
movzx eax, cl
lea edx, [ebx + 0xd]
lea edx, [edx + edi*2]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], 0xa
lea edi, [eax - 0xb7b9]
mov dword [esp + 0x28], 0x6f
add edi, edx
mov al, dl
mov dl, 0x56
mov dword [section..data], edi
imul dl
mov edx, 0x105602c
add cl, al
jmp 0x1001740
movzx eax, word [0x1056010]
cmp ebx, eax
je 0x1001759
add word [edx], di
lea eax, [ebx + 1]
add eax, edi
mov dword [esp + 0x38], eax
jmp 0x100175d
mov eax, dword [esp + 0x38]
sub edx, 2
cmp edx, 0x1056012
jg 0x1001740
mov bp, word [0x1056022]
lea edx, [ebx + 1]
add edx, eax
mov dword [esp + 0x1c], 0xc7
mov dword [esp + 0x38], edx
mov dword [esp + 0x14], 0
test bp, bp
je 0x10017a8
mov ebx, dword [esp + 0x10]
movzx ebx, bx
movzx eax, cl
sub ebx, eax
sub ebx, 0x5b
mov dword [esp + 0x18], ebx
mov dword [0x10560b8], ebx
jmp 0x10017b2
mov al, bl
add al, 0xd
add al, byte [esp + 0x10]
add cl, al
movzx esi, cl
cmp esi, ebx
jb 0x10017e2
mov eax, dword [esp + 0x10]
lea ebx, [esi + esi*2]
imul eax, dword [0x105602c]
add ebx, ebx
mov word [0x105602c], ax
mov eax, dword [esp + 0x10]
movzx eax, ax
sub ebx, eax
mov dword [esp + 0x18], ebx
mov dword [0x10560b8], ebx
test bp, bp
je 0x10017ff
mov eax, dword [esp + 0x10]
movzx ebx, ax
sub ebx, esi
sub ebx, 0x5b
mov dword [esp + 0x18], ebx
mov dword [0x10560b8], ebx
jmp 0x100180d
mov al, bl
add al, 0xd
add al, byte [esp + 0x10]
add cl, al
mov eax, dword [esp + 0x10]
mov bp, word [0x1056028]
mov si, word [0x1056022]
jmp 0x1001820
inc dword [esp + 0x14]
inc edx
movzx ecx, cl
add edx, ecx
mov dword [0x10560b0], edx
test si, si
je 0x1001843
movzx ebx, ax
sub ebx, ecx
sub ebx, 0x5b
mov dword [0x10560b8], ebx
mov ecx, ebx
sub ecx, dword [esp + 0x38]
sub ecx, 0x5b
mov dword [esp + 0x18], ecx
test si, si
je 0x1001862
mov ecx, ebx
sub ecx, edx
sub ecx, 0x5b
mov dword [esp + 0x18], ecx
jmp 0x1001870
lea eax, [ebx + ecx]
add edx, 0xd
add edx, eax
mov dword [0x10560b0], edx
mov eax, dword [esp + 0x10]
movzx esi, ax
cmp ecx, esi
jbe 0x10018ce
mov edi, ecx
xor edx, edx
sub edi, ebx
add ecx, 0xffff4847
add edi, 0x2a
add ecx, ebx
test ax, ax
mov dword [section..data], edi
mov dword [esp + 0x18], ecx
sete dl
test edx, edx
je 0x10018c0
cmp edx, edi
jb 0x10018c0
mov eax, ebx
lea edi, [edx + edx*2]
imul eax, dword [0x105602c]
add edi, edi
sub edi, ebx
mov dword [section..data], edi
mov word [0x105602c], ax
lea eax, [esi + edi]
add edx, 0xd
add edx, eax
mov dword [0x10560b0], edx
mov al, dl
sub al, cl
add al, 0x2a
mov byte [esp + 0x38], al
cmp edx, ecx
jae 0x10018fe
lea ecx, [ecx*2 + 0xd]
movzx eax, al
add ecx, ebx
mov dword [esp + 0x18], ecx
lea edx, [ecx - 0xb7b9]
add edx, eax
mov al, byte [esp + 0x38]
mov dword [0x10560b0], edx
cmp dword [esp + 0x20], 1
jb 0x1001a14
sub dl, cl
add dl, 0x2a
mov byte [0x10560b4], dl
call fcn.01001320
mov ecx, dword [0x10560b0]
movzx eax, byte [0x10560b4]
mov dword [esp + 0x10], ecx
cmp ecx, eax
mov ecx, dword [esp + 0x18]
jb 0x1001941
mov eax, ecx
imul eax, dword [0x105602c]
mov word [0x105602c], ax
mov ebx, dword [0x10560b8]
mov eax, dword [esp + 0x10]
dec dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
lea edx, [ebx + 1]
add edx, ecx
mov cl, al
sub cl, dl
mov dword [esp + 0x38], edx
add cl, 0x2a
mov byte [0x10560b4], cl
cmp ebp, 0x23
jge 0x10019c8
sub ebx, esi
push 0x4a1
sub ebx, 0x5b
push 0x1057490
mov dword [0x10560b0], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov si, word [0x1056022]
mov edx, dword [esp + 0x38]
mov ebx, dword [0x10560b8]
mov dword [esp + 0x10], eax
test si, si
je 0x10019ae
mov cl, byte [esp + 0x14]
sub cl, dl
sub cl, 0x5b
jmp 0x10019cf
mov cl, byte [0x10560b4]
add edx, 0xd
movzx eax, cl
add eax, ebp
add edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], edx
jmp 0x10019cf
mov si, word [0x1056022]
mov bp, word [0x1056028]
lea eax, [eax + eax*2]
mov edi, dword [section..data]
add eax, eax
sub eax, ebx
movzx eax, ax
mov dword [esp + 0x10], eax
movzx eax, bp
cmp eax, edx
jbe 0x10019fa
mov eax, dword [esp + 0x10]
jmp 0x1001820
movzx eax, cl
mov word [0x105602e], ax
mov al, dl
mov ah, 0x56
imul ah
add cl, al
mov eax, dword [esp + 0x10]
jmp 0x1001820
mov dword [esp + 0x18], ebx
mov esi, 0x1a49
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], ebx
cmp bp, si
jne 0x1001a3d
add al, byte [0x1056024]
mov edx, 0xffffffa5
mov byte [esp + 0x38], al
mov al, cl
mov ah, 0x56
imul ah
add byte [esp + 0x38], al
cmp edx, ecx
jbe 0x1001a6f
add ecx, 0xffff4847
movzx eax, bp
add ecx, ebx
cmp eax, ebx
ja 0x1001a6f
imul eax, ebx, 0x16e56
mov word [0x105602e], di
add edi, eax
mov dword [section..data], edi
movzx eax, bp
cmp eax, edi
ja 0x1001a8f
imul eax, edi, 0x16e56
mov word [0x105602e], bx
add ebx, eax
mov dword [esp + 0x18], ebx
mov dword [0x10560b8], ebx
mov eax, dword [esp + 0x10]
lea esi, [ecx - 0xb7b9]
movzx eax, ax
add esi, ebx
mov dword [esp + 0x14], esi
mov ecx, 0x10560a0
mov dword [esp + 0x20], 0x23db22b
lea eax, [eax + ebx*2]
mov ebx, esi
movzx esi, byte [esp + 0x38]
sub eax, ebx
sub eax, 0x45
mov dword [esp + 0x10], eax
mov eax, esi
cdq
cmp eax, dword [0x1056030]
jne 0x1001ad5
cmp edx, dword [0x1056034]
je 0x1001ae0
add dword [ecx], edi
lea ebx, [esi + 1]
adc dword [ecx + 4], 0
add ebx, edi
sub ecx, 8
cmp ecx, 0x1056038
jg 0x1001ac5
mov cl, byte [esp + 0x10]
mov eax, dword [0x1056038]
sub cl, bl
mov edx, dword [0x105603c]
add cl, 0x2a
add eax, dword [0x10560b8]
mov dword [esp + 0x14], ebx
adc edx, dword [0x10560bc]
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x38], cl
cmp eax, 0x3d9
jne 0x1001b3c
test edx, edx
jne 0x1001b3c
mov esi, dword [esp + 0x10]
movzx eax, cl
lea edx, [eax*2 - 0xb7b9]
mov al, byte [esp + 0x10]
mov ah, 0x56
imul ah
add cl, al
jmp 0x1001b67
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
movzx eax, cl
mov ecx, esi
sub ecx, eax
mov dword [0x105608c], 0
sub ecx, 0x5b
mov dword [0x1056088], ecx
mov cl, dl
sub cl, byte [esp + 0x38]
add cl, 0x2a
mov eax, 0x104b1d8
sub eax, 0x105dd44
lea eax, [eax + 0x104b5c0]
add eax, esi
mov dword [esp + 0x10], eax
mov al, dl
mov ah, 0x56
imul ah
add cl, al
mov eax, dword [esp + 0x10]
mov byte [0x10560b4], cl
lea eax, [eax + eax*2]
mov byte [esp + 0x38], cl
add eax, eax
sub eax, ebx
movzx esi, ax
mov eax, 0x1a49
mov dword [esp + 0x18], esi
cmp bp, ax
jne 0x1001bb7
add cl, byte [0x1056024]
mov byte [esp + 0x38], cl
jmp 0x1001bc2
mov eax, dword [esp + 0x10]
cmp eax, 0xbb95
jbe 0x1001c31
movzx ecx, word [0x1056012]
movzx eax, si
inc eax
add eax, ebx
mov dword [esp + 0x10], eax
movzx eax, word [0x1056032]
add ecx, eax
cmp ecx, 0x3d9
jne 0x1001c00
mov cl, byte [esp + 0x38]
movzx eax, cl
lea eax, [eax*2 - 0xb7b9]
mov dword [esp + 0x10], eax
mov al, dl
mov ah, 0x56
imul ah
add cl, al
jmp 0x1001c23
mov al, byte [esp + 0x38]
mov cx, dx
movzx eax, al
sub cx, ax
sub cx, 0x5b
mov word [0x1056026], cx
mov cl, byte [esp + 0x10]
sub cl, byte [esp + 0x38]
add cl, 0x2a
mov eax, dword [esp + 0x10]
mov byte [0x10560b4], cl
mov byte [esp + 0x38], cl
cmp eax, edx
jb 0x1001c4f
mov eax, ebx
imul eax, dword [0x105602c]
mov word [0x105602c], ax
mov eax, dword [esp + 0x10]
lea edx, [eax + eax*2]
add edx, edx
sub edx, ebx
cmp word [0x1056022], 0
je 0x1001c68
mov edi, ebx
sub edi, eax
sub edi, 0x5b
mov dword [section..data], edi
jmp 0x1001c7e
mov esi, dword [esp + 0x10]
lea eax, [edi + ebx]
add esi, 0xd
add esi, eax
mov dword [esp + 0x10], esi
mov eax, esi
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x20], 0
jbe 0x100210b
sub eax, esi
add eax, ebx
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, 0x1a49
cmp bp, ax
jne 0x1001cb9
add cl, byte [0x1056024]
mov eax, 0xffffffa5
mov byte [esp + 0x38], cl
mov byte [0x10560b4], cl
mov dword [esp + 0x10], eax
jmp 0x1001cbd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
cmp ecx, 3
jae 0x1001cde
dec ecx
lea eax, [eax + eax*2]
mov dword [esp + 0x28], ecx
imul ecx, ecx, 0x6e56
lea eax, [ecx + eax*2]
sub eax, ebx
movzx ebp, ax
jmp 0x1001ce2
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
movzx eax, byte [esp + 0x38]
add esi, 0xd
movzx ecx, bp
add ecx, ebx
add ecx, esi
mov dword [esp + 0x18], ecx
mov dword [0x10560b0], ecx
cmp ecx, eax
jb 0x1001d26
mov eax, edx
imul eax, dword [0x105602c]
mov word [0x105602c], ax
mov al, cl
add al, al
add cl, al
add cl, cl
sub cl, dl
mov byte [esp + 0x38], cl
mov byte [0x10560b4], cl
movzx ecx, word [0x1056012]
movzx eax, word [0x1056032]
add eax, ecx
mov dword [esp + 0x10], eax
cmp eax, 0x3d9
jne 0x1001d5c
imul eax, ebx, 0x16e56
lea esi, [edx*2 - 0xb7b9]
mov dword [esp + 0x18], esi
mov dword [0x10560b0], esi
add edx, eax
jmp 0x1001d72
mov eax, ebx
sub eax, edx
sub eax, 0x5b
mov word [0x1056026], ax
mov eax, dword [esp + 0x18]
sub eax, edx
lea edx, [eax + 0x2a]
mov eax, edi
mov dword [esp + 0x14], edx
sub eax, ebp
add eax, dword [esp + 0x1c]
movzx ebp, ax
mov esi, ebp
mov dword [esp + 0x2c], esi
cmp esi, 0x117fc
jle 0x1001e75
mov ecx, ebx
sub ecx, esi
sub ecx, 0x5b
mov dword [esp + 0x18], ecx
mov dword [0x10560b0], ecx
cmp edi, edx
jne 0x1001e1e
movzx eax, byte [esp + 0x38]
cmp ecx, eax
jb 0x1001dcf
mov eax, edx
imul eax, dword [0x105602c]
mov word [0x105602c], ax
mov al, cl
add cl, cl
add al, cl
add al, al
sub al, dl
mov byte [0x10560b4], al
push esi
call fcn.01001100
mov cl, byte [0x10560b4]
add esp, 4
mov edx, dword [esp + 0x14]
movzx eax, cl
mov byte [esp + 0x38], cl
cmp word [0x1056028], ax
ja 0x1001e04
movzx eax, cl
imul eax, eax, 0x16e56
mov word [0x105602e], dx
add edx, eax
mov ebx, dword [0x10560b8]
movzx eax, cl
mov ecx, edx
sub ecx, eax
sub ecx, 0x5b
mov dword [esp + 0x18], ecx
mov dword [0x10560b0], ecx
movzx esi, word [0x1056012]
movzx eax, word [0x1056032]
add esi, eax
cmp esi, 0x3d9
jne 0x1001e55
imul eax, ebx, 0x16e56
lea ecx, [edx*2 - 0xb7b9]
mov dword [esp + 0x18], ecx
mov dword [0x10560b0], ecx
add edx, eax
mov dword [esp + 0x14], edx
jmp 0x1001e7d
mov ecx, dword [esp + 0x18]
mov eax, ebx
sub eax, edx
sub eax, 0x5b
mov word [0x1056026], ax
mov eax, ecx
sub eax, edx
add eax, 0x2a
mov edx, eax
mov dword [esp + 0x14], edx
jmp 0x1001e7d
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x20], 0x1b
jae 0x1001ef6
cmp esi, 0x3d9
jne 0x1001ea8
lea eax, [edx*2 - 0xb7b9]
mov dword [0x10560b0], eax
imul eax, ebx, 0x16e56
add edx, eax
mov dword [esp + 0x14], edx
mov esi, edx
jmp 0x1001ebb
sub ebx, edx
sub ecx, edx
sub ebx, 0x5b
add ecx, 0x2a
mov word [0x1056026], bx
mov esi, ecx
push 0xb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [0x10560b8]
lea eax, [esi + esi]
mov esi, dword [0x10560b0]
sub eax, ebx
add eax, dword [esp + 0x2c]
mov cl, byte [0x10560b4]
mov edi, dword [section..data]
lea edx, [esi - 0x39]
mov byte [esp + 0x38], cl
add edx, eax
mov dword [esp + 0x14], edx
jmp 0x1001efe
mov cl, byte [esp + 0x38]
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0x11
jae 0x1001f3d
mov ax, word [0x1056028]
cmp ax, word [esp + 0x30]
jne 0x1001f23
add ebp, dword [0x1056024]
mov esi, 0xffffffa5
mov dword [0x10560b0], esi
movzx eax, ax
cmp eax, esi
ja 0x1001f39
imul eax, esi, 0x16e56
mov word [0x105602e], bx
add ebx, eax
dec dword [esp + 0x1c]
cmp word [0x1056022], 0
jne 0x1001f68
movzx ecx, bp
lea eax, [ebx + 0xd]
add eax, ecx
add edx, 0xd
add eax, esi
mov dword [0x10560b0], eax
movzx eax, byte [esp + 0x38]
add eax, ecx
add edx, eax
mov dword [esp + 0x14], edx
jmp 0x1001f75
movzx eax, cl
sub ax, dx
sub ax, 0x5b
movzx ebp, ax
mov eax, 0x1a49
cmp word [0x1056028], ax
jne 0x1001f9a
movzx eax, word [0x1056024]
add edx, eax
mov dword [0x10560b0], 0xffffffa5
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 0x20]
lea eax, [ebx + 1]
add eax, edi
mov dword [0x10560b8], eax
call fcn.01001320
mov esi, dword [0x10560b8]
mov edx, dword [esp + 0x14]
cmp edx, esi
jb 0x1001fd4
mov eax, ebp
lea esi, [edx + edx*2]
imul eax, dword [0x105602c]
add esi, esi
mov word [0x105602c], ax
movzx eax, bp
sub esi, eax
mov edi, dword [esp + 0x24]
add edx, edx
movzx eax, word [0x1056032]
sub edx, esi
sub edx, 0x46
dec ebx
sub edi, edx
mov dword [esp + 0x14], edx
sub edi, 0x5b
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x24], 5
mov dword [section..data], edi
jae 0x1002087
movzx ebx, word [0x1056012]
add ebx, eax
cmp ebx, 0x3d9
jne 0x1002022
movzx eax, bp
lea ecx, [eax*2 - 0xb7b9]
jmp 0x1002035
mov ecx, dword [0x10560b0]
mov eax, esi
sub eax, ebp
sub eax, 0x5b
mov word [0x1056026], ax
dec dword [esp + 0x24]
mov dword [esp + 0x10], ecx
cmp ebx, 0x3d9
jne 0x1002067
mov cl, byte [0x10560b4]
lea eax, [edx*2 - 0xb7b9]
mov dword [esp + 0x10], eax
imul eax, esi, 0x16e56
add edx, eax
mov eax, dword [esp + 0x10]
jmp 0x10020f4
mov eax, esi
sub eax, edx
sub eax, 0x5b
mov word [0x1056026], ax
mov eax, ecx
mov cl, byte [0x10560b4]
sub eax, edx
lea edx, [eax + 0x2a]
mov eax, dword [esp + 0x10]
jmp 0x10020f4
movzx ecx, word [0x1056012]
add ecx, eax
cmp ecx, 0x3d9
jne 0x10020bc
mov cl, byte [0x10560b4]
mov bl, 0x56
movzx eax, cl
lea eax, [eax*2 - 0xb7b9]
mov dword [esp + 0x10], eax
mov al, byte [esp + 0x1c]
imul bl
add cl, al
mov eax, dword [esp + 0x10]
jmp 0x10020ee
movzx eax, byte [0x10560b4]
mov cx, word [esp + 0x1c]
mov edx, dword [esp + 0x14]
sub cx, ax
mov eax, dword [0x10560b0]
sub cx, 0x5b
mov word [0x1056026], cx
mov cl, al
sub cl, byte [0x10560b4]
mov dword [esp + 0x10], eax
add cl, 0x2a
mov byte [0x10560b4], cl
mov bp, word [0x1056028]
lea ebx, [edx - 0x4a]
add ebx, esi
mov dword [0x10560b8], ebx
jmp 0x1001b8f
mov edx, 0x1a49
cmp bp, dx
jne 0x100212c
add cl, byte [0x1056024]
mov ebx, 0xffffffa5
mov byte [0x10560b4], cl
mov dword [0x10560b8], ebx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add dword [0x10560d0], eax
adc dword [0x10560d4], 0
cmp bp, dx
pop ebp
jne 0x100215a
movzx eax, word [0x1056024]
add ebx, eax
mov byte [0x10560b4], 0xa5
mov dword [0x10560b8], ebx
mov eax, 0xffff4e74
mov dword [0x10560b0], 0xffff4e4a
sub eax, ebx
mov dword [esp + 0x34], eax
movzx eax, word [0x10560bc]
mov ebx, dword [esp + 0x34]
push eax
push ebx
push 0xffff4e4a
call fcn.0103ce10
mov ecx, dword [0x10560b0]
imul eax, ecx, 0x16e56
push ecx
push dword [0x1057488]
add ebx, eax
call fcn.01002240
add esp, 0x14
mov dword [0x10560b8], eax
cmp dword [0x10560b0], 0x63802d1b
jne 0x100221e
mov ecx, dword [section..data]
lea eax, [ebx + ebx*2]
add eax, eax
sub eax, ecx
mov dword [0x10560b8], eax
cmp ebx, eax
jb 0x10021dd
imul ecx, dword [0x105602c]
mov dword [0x10560b8], eax
mov word [0x105602c], cx
lcall 0x15, 0x8b75503b
pushal
add eax, 0x602cb901
add eax, 0xb83d8b01
pushal
add eax, 0x3a348d01
lea ebx, [esi + 1]
jmp 0x1002200
movzx eax, word [0x1056010]
cmp edi, eax
je 0x1002211
add word [ecx], dx
lea ebx, [esi + 1]
sub ecx, 2
cmp ecx, 0x1056012
jg 0x1002200
jmp 0x1002224
mov edx, dword [section..data]
sub dl, byte [0x10560b4]
pop edi
add dl, bl
pop esi
mov byte [0x10560b4], dl
movzx eax, dl
pop ebx
add esp, 0x24
ret