Function at 0x1009ade0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5c0
mov esi, esp
mov dword [esi + 0x30], ebp
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [esi + 0x5ac], eax
mov dword [esi + 0x5b8], 0xffffffff
lea eax, [esi + 0x5b0]
mov dword [esi + 0x5b4], 0x100b4bd0
mov ecx, dword fs:[0]
mov dword [esi + 0x5b0], ecx
mov dword fs:[0], eax
mov eax, esp
lea ecx, [esi + 0x4a8]
mov dword [esi + 0x58], ecx
mov dword [eax + 4], ecx
mov dword [eax], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call eax
sub esp, 8
mov ecx, dword [esi + 0x58]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esi + 0x3c8]
mov dword [esi + 0x5c], ecx
call fcn.10006000
sub esp, 4
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x5b8], 0
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x3e0]
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.bat
call fcn.1000c510
jmp 0x1009ae90
mov eax, dword [0x1028a600]
xor edx, edx
div dword [0x1028a604]
mov ecx, eax
xor ecx, 0x1a8a7d1a
and eax, 0xe57582e5
shl eax, 1
sub eax, ecx
and eax, 0x5c2f0416
mov ecx, eax
xor ecx, 0xc24d86c0
xor ecx, 0xffffffff
or eax, 0xc24d86c0
and eax, ecx
cmp eax, 0x3698119c
jb 0x1009c01b
mov dword [esi + 0x5b8], 1
mov eax, esp
lea ecx, [esi + 0x3e0]
mov dword [eax], ecx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 0x40
mov dword [eax + 4], 2
lea ecx, [esi + 0x3f8]
call fcn.10068630
sub esp, 0x10
jmp 0x1009af0c
lea ecx, [esi + 0x3e0]
call fcn.10006100
lea ecx, [esi + 0x3c8]
call fcn.10006100
lea ecx, [esi + 0x3f8]
call fcn.1009c1f0
test al, 1
jne 0x1009af3a
jmp 0x1009b624
mov eax, dword [0x1028a620]
xor edx, edx
div dword [0x1028a624]
imul eax, eax, 0xbf80c5ce
add eax, 0x72386add
add eax, 0x298877cf
cmp eax, 0xdf7cb3e2
jae 0x1009c020
mov eax, dword [0x1028a628]
mov edi, dword [0x1028a62c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, edi
and edx, ecx
mov ebx, edi
xor ebx, 0xffffffff
mov ecx, eax
and ecx, ebx
imul ecx, edx
mov edx, eax
and edx, edi
or eax, edi
imul eax, edx
add eax, ecx
sub eax, 0xd51f1a5a
sub eax, 0xcdd59d90
add eax, 0xd51f1a5a
mov ecx, 0x6ba34e1
xor edx, edx
div ecx
xor eax, 0xffffffff
or eax, 0xde2ff0c8
xor eax, 0xffffffff
cmp eax, 0xeb99bf22
jae 0x1009c020
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str._echo_off_n
call fcn.100672e0
jmp 0x1009afe0
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.:CheckProcess_n
call fcn.100672e0
jmp 0x1009affb
mov eax, dword [0x1028a638]
mov ecx, dword [0x1028a63c]
and eax, ecx
add eax, 0xa5bb8671
mov edx, eax
xor edx, 0xffffffff
and edx, 0xda2215fa
mov ecx, eax
and ecx, 0x25ddea05
imul ecx, edx
mov edx, eax
and edx, 0xda2215fa
or eax, 0xda2215fa
imul eax, edx
add eax, ecx
imul eax, eax, 0xda2a3f14
cmp eax, 0xd0d8f04c
jae 0x1009c025
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.set__ProcessName
call fcn.100672e0
mov dword [esi + 0x54], eax
jmp 0x1009b06e
mov eax, dword [0x1028a640]
mov edx, dword [str.KEq50]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
add eax, 1
add eax, ecx
mov edx, eax
and edx, 0xb5e52e6a
mov ecx, eax
or ecx, 0xb5e52e6a
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x4a1ad195
or eax, 0x4a1ad195
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4139de18
mov ecx, eax
and ecx, 0xbec621e7
imul ecx, edx
mov edx, eax
and edx, 0x4139de18
or eax, 0x4139de18
imul eax, edx
add eax, ecx
mov edx, eax
and edx, 0x35e25471
mov ecx, eax
or ecx, 0x35e25471
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xca1dab8e
or eax, 0xca1dab8e
imul eax, edx
add eax, ecx
cmp eax, 0x83f062fc
jbe 0x1009c02a
mov eax, dword [0x1028a648]
xor edx, edx
div dword [0x1028a64c]
imul eax, eax, 0x7dd0d864
imul edx, eax, 0xff6b172f
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0x4783287d
and edx, 0xb87cd782
or eax, edx
xor eax, 0xf6542f79
or ecx, 0x4e28f8fb
xor ecx, 0xffffffff
or eax, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x50], ecx
cmp eax, 0xd702cafb
jae 0x1009b10a
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x50]
mov dword [esi + 0x5b8], 2
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1009c370
mov dword [esi + 0x4c], eax
jmp 0x1009b17c
mov eax, dword [0x1028a658]
mov ecx, dword [0x1028a65c]
or eax, ecx
sub eax, 0x17f2b43e
add eax, 0x45b31473
add eax, 0x17f2b43e
xor ecx, ecx
sub ecx, eax
add ecx, 0xe0f3cf16
xor eax, eax
sub eax, ecx
add eax, 0x56e5879
cmp eax, 0x503725f5
jbe 0x1009c02f
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x5b8], 2
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1025dea9
call fcn.100672e0
jmp 0x1009b1d8
mov eax, dword [0x1028a660]
mov ecx, dword [0x1028a664]
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
and eax, 0x66b793c
mov edx, eax
and edx, 0xefb98b0b
mov ecx, eax
or ecx, 0xefb98b0b
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x104674f4
or eax, 0x104674f4
imul eax, edx
add eax, ecx
add eax, 0xbb913ce
cmp eax, 0x49d56693
jb 0x1009c034
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.set__ProcessPath
call fcn.100672e0
mov dword [esi + 0x48], eax
jmp 0x1009b249
mov ecx, dword [esi + 0x48]
mov edx, dword [ebp + 0xc]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1009c370
mov dword [esi + 0x44], eax
jmp 0x1009b263
mov ecx, dword [esi + 0x44]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1025dea9
call fcn.100672e0
jmp 0x1009b27b
mov edx, dword [0x1028a678]
mov edi, dword [0x1028a67c]
mov ebx, edi
xor ebx, 0xffffffff
mov ecx, edx
and ecx, ebx
mov eax, edx
or eax, ebx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, edx
and ecx, edi
or edx, edi
imul edx, ecx
add edx, eax
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0x2fb40d3a
and edx, 0xd04bf2c5
or eax, edx
xor eax, 0x636295b5
or ecx, 0xb3296770
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x198bf974
xor edx, edx
div ecx
imul eax, eax, 0x40ce75d1
cmp eax, 0x6d613ae8
jae 0x1009b27b
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.tasklist__FI__IMAGENAME_eq__ProcessName____findstr__I___ProcessName____nul_n
call fcn.100672e0
jmp 0x1009b308
mov ecx, dword [0x1028a680]
mov edx, dword [0x1028a684]
mov eax, ecx
xor eax, 0xffffffff
mov edi, edx
xor edi, 0xffffffff
or eax, edi
xor eax, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
imul eax, eax, 0xfd927111
and eax, 0x1f999ae2
add eax, 0xc8866596
cmp eax, 0x7f739b2
jb 0x1009c039
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.if__ERRORLEVEL__neq_0___n
call fcn.100672e0
jmp 0x1009b363
mov edx, dword [0x1028a690]
mov ecx, dword [0x1028a694]
mov eax, edx
xor eax, 0xffffffff
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or eax, ecx
sub eax, 0xd435aba2
sub eax, 0xade1dc85
mov edx, eax
and edx, 0xeaa1e027
mov ecx, eax
or ecx, 0xeaa1e027
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x155e1fd8
or eax, 0x155e1fd8
imul eax, edx
add eax, ecx
cmp eax, 0x2cc06cc
jae 0x1009c03e
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.____start______ProcessPath___n
call fcn.100672e0
jmp 0x1009b3d6
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], 0x1025de72
call fcn.100672e0
jmp 0x1009b3f1
mov edx, dword [0x1028a6a0]
mov edi, dword [0x1028a6a4]
mov eax, edx
xor eax, 0xffffffff
mov ecx, edi
and ecx, eax
mov ebx, edi
xor ebx, 0xffffffff
mov eax, edx
and eax, ebx
imul eax, ecx
mov ecx, edx
and ecx, edi
or edx, edi
imul edx, ecx
add edx, eax
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0x48be84fd
and edx, 0xb7417b02
or eax, edx
xor eax, 0x98d371d8
or ecx, 0x2f920ada
xor ecx, 0xffffffff
or eax, ecx
mov edx, eax
xor edx, 0xffffffff
mov ecx, eax
xor ecx, 0xffffffff
or edx, ecx
and edx, 0x3e79ae7
xor edx, 0xffffffff
xor eax, 0xffffffff
or eax, 0x3e79ae7
and edx, eax
mov eax, edx
xor eax, 0xffffffff
and edx, 0x9872fb2
mov ecx, eax
and ecx, 0xf678d04d
imul ecx, edx
mov edx, eax
and edx, 0x9872fb2
or eax, 0x9872fb2
imul eax, edx
add eax, ecx
cmp eax, 0xb677a994
ja 0x1009c043
mov edi, dword [0x1028a6a8]
mov edx, dword [0x1028a6ac]
mov eax, edi
xor eax, 0xffffffff
and eax, 0xc51d30a5
and edi, 0x3ae2cf5a
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xc51d30a5
and edx, 0x3ae2cf5a
or eax, edi
or ecx, edx
xor eax, ecx
add eax, 0x51b0cebc
add eax, 0xa29bd059
xor eax, 0x18e0bfb8
cmp eax, 0x734fa167
jbe 0x1009b493
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.timeout__t_30__nobreak__nul_n
call fcn.100672e0
jmp 0x1009b505
mov ecx, dword [0x1028a6b8]
xor ecx, dword [0x1028a6bc]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xc7e6d953
xor ecx, 0xffffffff
and ecx, 0xc7e6d953
or eax, ecx
xor eax, 0xffffffff
and eax, 0xdf605bc7
add eax, 0x696f302e
cmp eax, 0x33aa52d0
jbe 0x1009c048
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x3f8]
mov dword [eax], ecx
mov dword [eax + 4], str.goto_CheckProcess_n
call fcn.100672e0
jmp 0x1009b563
lea ecx, [esi + 0x3f8]
call fcn.10068c60
jmp 0x1009b573
mov ecx, dword [0x1028a6c0]
mov edx, dword [0x1028a6c4]
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x8513d3c3
and ecx, 0x7aec2c3c
or eax, ecx
sub eax, 0x96dd0c88
xor ecx, ecx
sub ecx, eax
add ecx, 0x6b9dede3
xor eax, eax
sub eax, ecx
cmp eax, 0xa0fcdba1
ja 0x1009c04d
mov ecx, dword [0x1028a6c8]
mov edi, dword [0x1028a6cc]
mov eax, ecx
xor eax, 0xffffffff
mov edx, edi
and edx, eax
mov ebx, edi
xor ebx, 0xffffffff
mov eax, ecx
and eax, ebx
imul eax, edx
mov edx, ecx
and edx, edi
or ecx, edi
imul ecx, edx
add ecx, eax
mov eax, ecx
or eax, 0xe352f23
xor ecx, 0xffffffff
or ecx, 0xf1cad0dc
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x2eb7a065
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x5baa566a
shl ecx, 1
add eax, 0x5baa566a
sub eax, ecx
cmp eax, 0x5e8dae93
jae 0x1009c04d
jmp 0x1009b624
mov eax, dword [0x1028a6d0]
xor edx, edx
div dword [0x1028a6d4]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x686a17dc
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x166a6c1c
add eax, ecx
sub eax, 0x61dc552f
cmp eax, 0xc611588
jb 0x1009c052
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x4a8]
mov dword [eax], ecx
lea ecx, [esi + 0x298]
call fcn.10006000
sub esp, 4
jmp 0x1009b686
mov eax, dword [0x1028a6e0]
add eax, dword [0x1028a6e4]
mov edx, eax
and edx, 0x5c81e1fa
mov ecx, eax
or ecx, 0x5c81e1fa
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xa37e1e05
or eax, 0xa37e1e05
imul eax, edx
add eax, ecx
or eax, 0x87136b4f
add eax, 0xd2b05d95
add eax, 1
cmp eax, 0xf1335dcb
ja 0x1009c061
mov eax, dword [0x1028a6e8]
xor edx, edx
div dword [0x1028a6ec]
mov ecx, eax
mov eax, ecx
and eax, 0x975af9c
or ecx, 0x975af9c
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
sub eax, 0x659af9ed
sub eax, 0x85002821
add eax, 0x659af9ed
mov edx, eax
xor edx, 0xffffffff
and edx, 0xd18ec2c8
mov ecx, eax
and ecx, 0x2e713d37
imul ecx, edx
mov edx, eax
and edx, 0xd18ec2c8
or eax, 0xd18ec2c8
imul eax, edx
add eax, ecx
cmp eax, 0x8c5dde99
jae 0x1009b6d1
mov dword [esi + 0x5b8], 9
mov eax, esp
lea ecx, [esi + 0x298]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x2b0]
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.bat
call fcn.1000c510
jmp 0x1009b765
lea ecx, [esi + 0x2b0]
mov dword [esi + 0x40], ecx
call fcn.10008160
mov ecx, eax
mov eax, esp
mov dword [eax + 8], ecx
lea ecx, [esi + 0x2c8]
mov dword [eax], ecx
mov dword [eax + 4], str.cmd.exe__B__c___s_
call fcn.1009c560
mov ecx, dword [esi + 0x40]
call fcn.10006100
lea ecx, [esi + 0x298]
call fcn.10006100
xorps xmm0, xmm0
movaps xmmword [esi + 0x260], xmm0
movaps xmmword [esi + 0x250], xmm0
movaps xmmword [esi + 0x240], xmm0
movaps xmmword [esi + 0x230], xmm0
mov dword [esi + 0x270], 0
mov dword [esi + 0x230], 0x44
mov dword [esi + 0x25c], 1
mov word [esi + 0x260], 0
movaps xmmword [esi + 0x280], xmm0
mov dword [esi + 0x5b8], 2
mov eax, esp
lea ecx, [esi + 0x4a8]
mov dword [eax], ecx
lea ecx, [esi + 0x148]
call fcn.10006000
sub esp, 4
jmp 0x1009b815
mov eax, dword [0x1028a6f0]
mov edi, dword [0x1028a6f4]
mov edx, edi
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, edi
add eax, edx
sub eax, ecx
mov ecx, 0xace0bdaf
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xb38084b5
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x76beaa5c
and ecx, 0x894155a3
or eax, ecx
xor eax, 0xbf9047af
cmp eax, 0xce5770d2
ja 0x1009c066
mov ecx, dword [0x1028a6f8]
or ecx, dword [0x1028a6fc]
mov eax, ecx
and eax, 0xa7a9f92d
xor eax, 0xffffffff
add ecx, 0xa7a9f92d
add ecx, 1
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
or eax, 0x726716bb
xor ecx, 0xffffffff
and ecx, 0x726716bb
xor ecx, 0xffffffff
and eax, ecx
sub eax, 0x56d0a313
cmp eax, 0x888dac84
ja 0x1009c066
mov dword [esi + 0x5b8], 7
mov eax, esp
lea ecx, [esi + 0x148]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x160]
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.pid
call fcn.1000c510
jmp 0x1009b8dd
mov dword [esi + 0x5b8], 8
mov eax, esp
lea ecx, [esi + 0x160]
mov dword [eax], ecx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 0x40
mov dword [eax + 4], 1
lea ecx, [esi + 0x178]
call fcn.1009c770
sub esp, 0x10
jmp 0x1009b919
lea ecx, [esi + 0x160]
call fcn.10006100
lea ecx, [esi + 0x148]
call fcn.10006100
mov dword [esi + 0x144], 0
lea ecx, [esi + 0x178]
call fcn.1009c990
test al, 1
jne 0x1009b951
jmp 0x1009ba75
mov eax, dword [0x1028a700]
mov edx, dword [0x1028a704]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
and eax, 0x2a607c52
and eax, 0xd3a257b4
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x13ece39c
add eax, ecx
cmp eax, 0xae66ffc5
ja 0x1009c06b
mov dword [esi + 0x5b8], 3
mov eax, esp
lea ecx, [esi + 0x144]
mov dword [eax], ecx
lea ecx, [esi + 0x178]
call fcn.1009cb40
sub esp, 4
jmp 0x1009b9b5
mov edx, dword [0x1028a710]
mov ecx, dword [0x1028a714]
mov eax, edx
xor eax, ecx
xor eax, 0xffffffff
or edx, ecx
and edx, eax
sub edx, 0xe355e8ff
add edx, 0x1443f80
add edx, 0xe355e8ff
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0xe90adc24
and edx, 0x16f523db
or eax, edx
xor eax, 0x11fd93c6
or ecx, 0x708b01d
xor ecx, 0xffffffff
or eax, ecx
imul eax, eax, 0x6132308a
cmp eax, 0x889bc7bf
ja 0x1009c070
mov ecx, dword [0x1028a718]
mov edx, dword [0x1028a71c]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
xor eax, 0xf5552cc0
and eax, ecx
add eax, 0x342aa808
mov ecx, eax
and ecx, 0x30f24d69
shl ecx, 1
xor eax, 0x30f24d69
add eax, ecx
cmp eax, 0x9d76f729
je 0x1009ba13
mov dword [esi + 0x5b8], 3
lea ecx, [esi + 0x178]
call fcn.1009ccf0
jmp 0x1009ba70
jmp 0x1009ba75
mov eax, dword [0x1028a720]
and eax, dword [0x1028a724]
add eax, 0x228b4e71
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa51910a7
mov ecx, eax
and ecx, 0x5ae6ef58
imul ecx, edx
mov edx, eax
and edx, 0xa51910a7
or eax, 0xa51910a7
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xbabd40b7
and eax, 0x4542bf48
sub eax, ecx
cmp eax, 0xc3b7f45e
jb 0x1009c075
mov eax, dword [0x1028a728]
and eax, dword [0x1028a72c]
sub eax, 0x45e75eff
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xe6d13580
and eax, 0x192eca7f
sub eax, ecx
mov ecx, eax
and ecx, 0xb572b557
shl ecx, 1
xor eax, 0xb572b557
add eax, ecx
cmp dword [esi + 0x144], 0
setne cl
mov byte [esi + 0x3f], cl
cmp eax, 0xe110e117
je 0x1009c075
mov al, byte [esi + 0x3f]
test al, 1
jne 0x1009bb25
jmp 0x1009bbcd
mov ecx, dword [0x1028a730]
xor ecx, dword [0x1028a734]
mov eax, ecx
and eax, 0x4c21d65f
xor ecx, 0x4c21d65f
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x3947cdcd
and eax, 0xc6b83232
sub eax, ecx
sub eax, 0xe75b819a
cmp eax, 0xbb4123
je 0x1009c07a
mov eax, dword [0x1028a738]
mov edx, dword [0x1028a73c]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
add eax, 1
add eax, ecx
xor eax, 0xc42e9b0b
xor eax, 0x368e257
sub eax, 0xbf18c263
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x144]
mov dword [esp], eax
call fcn.1009a980
mov cl, al
mov eax, dword [esi + 0x38]
mov byte [esi + 0x3e], cl
cmp eax, 0x4f6b80c5
jb 0x1009c07a
mov al, byte [esi + 0x3e]
test al, 1
jne 0x1009bbbe
jmp 0x1009bbcd
mov dword [esi + 0x140], 1
jmp 0x1009bfa5
xor eax, eax
lea edx, [esi + 0x2c8]
lea ecx, [esi + 0x230]
lea eax, [esi + 0x280]
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
cmp eax, 0
jne 0x1009bc45
mov dword [esi + 0x140], 1
jmp 0x1009bfa5
mov eax, dword [0x1028a750]
mov ecx, dword [0x1028a754]
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
imul eax, eax, 0xdd9a1fb7
add eax, 0xdca947a2
add eax, 0xa3d9cbde
sub eax, 0xdca947a2
xor eax, 0x7bb690b9
cmp eax, 0xb3a4e88b
je 0x1009c08d
mov eax, dword [0x1028a758]
xor edx, edx
div dword [0x1028a75c]
imul ecx, eax, 0x109e1f32
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x9e703241
and ecx, 0x618fcdbe
or eax, ecx
add eax, 0x17dc43b7
cmp eax, 0x82c31af0
jb 0x1009c08d
mov dword [esi + 0x5b8], 3
mov eax, esp
lea ecx, [esi + 0x4a8]
mov dword [eax], ecx
lea ecx, [esi + 0x60]
call fcn.10006000
sub esp, 4
jmp 0x1009bcd9
mov eax, dword [0x1028a760]
or eax, dword [0x1028a764]
sub eax, 0x7eefd242
add eax, 0xbf6d5779
add eax, 0x7eefd242
and eax, 0x47168420
xor eax, 0xbc3d233b
cmp eax, 0x19ec071b
jb 0x1009c092
mov eax, dword [0x1028a768]
mov edx, dword [0x1028a76c]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
xor eax, 0x99123478
mov edx, eax
xor edx, 0xffffffff
and edx, 0x483e0b15
mov ecx, eax
and ecx, 0xb7c1f4ea
imul ecx, edx
mov edx, eax
and edx, 0x483e0b15
or eax, 0x483e0b15
imul eax, edx
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x378b50f4
add eax, ecx
cmp eax, 0x948def43
jae 0x1009bd08
mov dword [esi + 0x5b8], 5
mov eax, esp
lea ecx, [esi + 0x60]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x78]
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.pid
call fcn.1000c510
jmp 0x1009bd8c
mov ecx, dword [0x1028a770]
or ecx, dword [0x1028a774]
add ecx, 0x22c99216
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or eax, 0xaa952379
and ecx, 0xaa952379
xor eax, 0xffffffff
or eax, ecx
xor eax, 0x68a26e16
cmp eax, 0xddcbb015
ja 0x1009c097
mov dword [esi + 0x5b8], 6
mov eax, esp
lea ecx, [esi + 0x78]
mov dword [eax], ecx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 0x40
mov dword [eax + 4], 2
lea ecx, [esi + 0x90]
call fcn.10068630
sub esp, 0x10
jmp 0x1009be06
lea ecx, [esi + 0x78]
call fcn.10006100
lea ecx, [esi + 0x60]
call fcn.10006100
lea ecx, [esi + 0x90]
call fcn.1009c1f0
test al, 1
jne 0x1009be2e
jmp 0x1009bf6c
mov eax, dword [0x1028a780]
mov edx, dword [0x1028a784]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
xor eax, 0xc8497f6b
or eax, 0x9cb4b22a
xor ecx, ecx
sub ecx, eax
add ecx, 0xe0eba8b7
xor eax, eax
sub eax, ecx
cmp eax, 0xbab25143
jb 0x1009c09c
mov eax, dword [0x1028a788]
mov edx, dword [0x1028a78c]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
and eax, 0xd442d558
imul ecx, eax, 0x7f75192f
mov eax, ecx
and eax, 0x303179a
xor ecx, 0x303179a
or eax, ecx
mov ecx, dword [esi + 0x288]
mov dword [esi + 0x34], ecx
cmp eax, 0x39e23b11
jb 0x1009c09c
mov ecx, dword [esi + 0x34]
mov dword [esi + 0x5b8], 4
mov eax, esp
mov dword [eax], ecx
lea ecx, [esi + 0x90]
call fcn.1009d180
sub esp, 4
jmp 0x1009bece
lea ecx, [esi + 0x90]
call fcn.10068c60
jmp 0x1009bede
mov ecx, dword [0x1028a790]
mov edx, dword [0x1028a794]
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, edx
add ecx, eax
xor ecx, 0xffffffff
or ecx, 0x1c3095dc
xor ecx, 0xffffffff
xor ecx, 0x5dce2e39
mov eax, ecx
xor eax, 0xffffffff
or eax, 0x8b6bb07c
xor eax, 0xffffffff
xor ecx, 0xffffffff
and ecx, 0x8b6bb07c
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x756f2e3b
jae 0x1009c0a1
mov eax, dword [0x1028a798]
add eax, dword [0x1028a79c]
mov ecx, eax
xor ecx, 0xffffffff
or ecx, 0xeffa061b
and eax, 0x1005f9e4
xor ecx, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0x8c00795a
and eax, ecx
add eax, 0x5d11e9a6
cmp eax, 0xcb45a167
jae 0x1009bf2e
jmp 0x1009bf6c
mov eax, dword [esi + 0x280]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esi + 0x284]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea ecx, [esi + 0x90]
call fcn.10068f60
mov dword [esi + 0x140], 0
lea ecx, [esi + 0x178]
call fcn.1009d6c0
lea ecx, [esi + 0x3f8]
call fcn.10068f60
cmp dword [esi + 0x140], 1
ja 0x1009bfdc
mov eax, dword [esi + 0x5b0]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1028a7c8]
mov edx, dword [0x1028a7cc]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xefb9aa7e
xor ecx, 0xffffffff
or eax, 0xefb9aa7e
and eax, ecx
imul eax, eax, 0x12a6c7d7
sub eax, 0x1f1827ec
cmp eax, 0x91bbd370
jae 0x1009c0a6
jmp 0x1009aed0
jmp 0x1009af62
jmp 0x1009affb
jmp 0x1009b10a
jmp 0x1009b17c
jmp 0x1009b22b
jmp 0x1009b348
jmp 0x1009b3bb
jmp 0x1009b493
jmp 0x1009b505
jmp 0x1009b5b9
mov dword [esi + 0x5b8], 2
jmp 0x1009b65f
jmp 0x1009b6d1
jmp 0x1009b866
jmp 0x1009b98e
jmp 0x1009ba13
jmp 0x1009baca
mov eax, dword [esi + 0x144]
mov dword [esp], eax
call fcn.1009a980
jmp 0x1009bb62
jmp 0x1009bc80
jmp 0x1009bd08
jmp 0x1009bdcd
jmp 0x1009be66
jmp 0x1009bf2e
jmp 0x1009bfdc