Function at 0x100f7fc0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x101bdbec]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x101bc8f8]
imul eax, dword [0x101bc8fc]
and eax, 0x21335156
xor eax, 0x1e652420
imul eax, eax, 0xd6d7ac30
imul eax, eax, 0xa7cc1224
imul eax, eax, 0x1060f533
xor eax, 0x812c3b3b
and eax, 0x446c658a
and eax, 0xce2b82fd
add eax, 0xf6c9cebd
add eax, 0x41bd6b54
or eax, 0x4ca51148
mov ecx, 0xce9c288b
xor edx, edx
div ecx
add eax, 0xcb6cbb27
sub eax, 0x64387d2f
mov ecx, 0xabfad38c
xor edx, edx
div ecx
xor eax, 0x6ac13aba
or eax, 0x10e4b321
add eax, 0xfd814ca
or eax, 0xe0e08327
imul eax, eax, 0x6cbd10f6
or eax, 0x5aa5cc30
add eax, 0xf42688b3
add eax, 0x77c11485
imul eax, eax, 0xeafe5cb2
sub eax, 0x927b07fd
add eax, 0xcbb5f06d
mov ecx, 0xa06d0cb6
xor edx, edx
div ecx
add eax, 0x22d2c119
add eax, 0x532efd58
imul eax, eax, 0x5e523b07
add eax, 0x22baf930
xor eax, 0xe4d88d6a
sub eax, 0xf13f3153
add eax, 0x36ae39c8
imul eax, eax, 0x8bc741ef
or eax, 0x31b382e
add eax, 0x3b4c9755
add eax, 0xcecb548c
cmp eax, 0x3cdbb4dd
jae 0x100f92a1
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0x7650c8ff
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.101650c0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10087750
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0xfe2b26a4
je 0x100f80c7
mov al, byte [ebp - 0x16]
test al, 1
jne 0x100f81cc
jmp 0x100f8965
mov eax, dword [0x101bc908]
and eax, dword [0x101bc90c]
or eax, 0xb618caa8
and eax, 0x5538e58b
or eax, 0x31e0b909
imul eax, eax, 0x49b1af2c
and eax, 0x75081b67
or eax, 0xb308612c
and eax, 0x68994dba
add eax, 0x9886f306
or eax, 0xb2d104b1
sub eax, 0x24e3fce0
sub eax, 0x763d18a3
imul eax, eax, 0x265433f3
xor eax, 0x5d10aba
add eax, 0xe09c6fcc
add eax, 0xd282cba5
mov ecx, 0x9816e7ce
xor edx, edx
div ecx
and eax, 0x10070b7d
imul eax, eax, 0xe06dc779
imul eax, eax, 0xb939a15
mov ecx, 0xb78cc405
xor edx, edx
div ecx
xor eax, 0x68b6e392
add eax, 0x1517a05a
mov ecx, 0x90623cc7
xor edx, edx
div ecx
add eax, 0xcaeffd38
xor eax, 0xf04cf684
or eax, 0x8ebcf5e0
or eax, 0x24ff5b53
or eax, 0x22b75a26
mov ecx, 0x6ee8cd95
xor edx, edx
div ecx
or eax, 0xefd9bf73
add eax, 0x6e544a4d
add eax, 0x28734b83
or eax, 0x65002d4c
mov ecx, 0x6cfd177f
xor edx, edx
div ecx
mov ecx, 0x15fefb86
xor edx, edx
div ecx
sub eax, 0x2efb669d
mov ecx, 0xd19b83dd
xor edx, edx
div ecx
xor eax, 0x923c9039
cmp eax, 0x67e3b1e6
je 0x100f941e
mov eax, dword [0x101bc910]
xor edx, edx
div dword [0x101bc914]
xor eax, 0x1086461b
or eax, 0xdc1f6dab
or eax, 0x43f30ce4
imul eax, eax, 0xa2c7b7e1
imul eax, eax, 0x4d08ad29
mov ecx, 0x36a33cd1
xor edx, edx
div ecx
add eax, 0x5ac66ef6
and eax, 0xebe4f301
xor eax, 0xd3cdaa65
xor eax, 0x85e173d9
and eax, 0x39e17246
mov ecx, 0xab7bad2d
xor edx, edx
div ecx
mov ecx, 0xf899fe71
xor edx, edx
div ecx
imul eax, eax, 0x15c075f6
add eax, 0x8b8198bf
add eax, 0xcaafa8d2
and eax, 0x38847b1
and eax, 0x2a21c137
imul eax, eax, 0x554f4254
sub eax, 0x6b2b31d0
xor eax, 0xf4a7da83
add eax, 0xd8c198fa
sub eax, 0xa5b90f6d
imul eax, eax, 0x2f42059
mov ecx, 0x33abac75
xor edx, edx
div ecx
imul eax, eax, 0x7de4da13
sub eax, 0xd33dac6a
add eax, 0x1796786a
and eax, 0x39c42bd7
imul eax, eax, 0x6ea851d6
and eax, 0xee326cc4
and eax, 0x63b63626
add eax, 0xfa1335d2
and eax, 0x68fa4eb6
add eax, 0xaff9caea
and eax, 0x9eca89c2
or eax, 0xd5689072
mov ecx, 0xf2d943d9
xor edx, edx
div ecx
cmp eax, 0x83a6ad57
ja 0x100f941e
mov eax, dword [0x101bc918]
or eax, dword [0x101bc91c]
or eax, 0x8a982cd3
imul eax, eax, 0xb10f85a
and eax, 0xaf95ce4
imul eax, eax, 0x92a5bff8
or eax, 0xa19e850c
and eax, 0xd1a5fa9c
sub eax, 0x57e05ae0
mov ecx, 0x8052783a
xor edx, edx
div ecx
and eax, 0x23bcb4e4
and eax, 0x36942ffc
sub eax, 0x67f99cd1
or eax, 0x5ea43f58
or eax, 0x55cf1a23
xor eax, 0x62742c3
add eax, 0x8a5c1445
sub eax, 0xec3c5a21
add eax, 0x28c96719
and eax, 0xe7b0b570
add eax, 0x1547574
or eax, 0x646baeea
add eax, 0x4dd4c5f9
xor eax, 0x638325ae
and eax, 0xdde5a2d5
add eax, 0x2ddc0ec8
mov ecx, 0xbeaab93d
xor edx, edx
div ecx
and eax, 0x3f12df5c
add eax, 0x95c119b3
imul eax, eax, 0x75e4010f
xor eax, 0x76880fcc
xor eax, 0x59b3c344
and eax, 0xe004ca20
imul eax, eax, 0xeb9366f3
sub eax, 0x78094cc5
mov ecx, 0xd42cba4
xor edx, edx
div ecx
and eax, 0x5cca9c38
imul eax, eax, 0x79ac598e
and eax, 0x26625134
sub eax, 0x62d88688
cmp eax, 0x4b0ca830
jb 0x100f8f53
mov eax, dword [0x101bc920]
sub eax, dword [0x101bc924]
sub eax, 0x2c357cf7
or eax, 0x771fe8c9
sub eax, 0x2cae21e8
xor eax, 0x22ac390
or eax, 0x5b2d0da6
add eax, 0xcd0e8d4f
xor eax, 0x32922be5
or eax, 0xc0e7a45b
xor eax, 0xba02ca8c
or eax, 0x2fd420a1
xor eax, 0xca07e641
imul eax, eax, 0x85020002
or eax, 0x5f255d4b
or eax, 0xa4c1ee08
or eax, 0x59ba19e
mov ecx, 0xd54c57
xor edx, edx
div ecx
add eax, 0xd12d2d90
and eax, 0x6164e835
add eax, 0x20cff02
imul eax, eax, 0xd8a7d888
add eax, 0x623b634c
add eax, 0xbd6b1c5c
and eax, 0x22f3d55f
or eax, 0x598ebbdb
and eax, 0x3436d794
or eax, 0x88e82193
imul eax, eax, 0xe4db5a9
add eax, 0x80d0c26f
and eax, 0x7cf864d
add eax, 0xf79e4ddf
mov ecx, 0x186cb6bf
xor edx, edx
div ecx
sub eax, 0x4f15d342
add eax, 0x57ff619e
or eax, 0x8f81af9a
sub eax, 0x5fdcb8f2
or eax, 0x2228216d
and eax, 0xbf5846e6
add eax, 0xa623a4d8
cmp eax, 0x7608d43e
je 0x100f94cb
mov eax, dword [0x101bc928]
add eax, dword [0x101bc92c]
mov ecx, 0x9756ae68
xor edx, edx
div ecx
add eax, 0x4cd10751
sub eax, 0x3e98c021
sub eax, 0xa19d6edb
and eax, 0xda8d173b
xor eax, 0x147b75b6
mov ecx, 0x959d2139
xor edx, edx
div ecx
add eax, 0xd3bbfd56
mov ecx, 0x31959e35
xor edx, edx
div ecx
add eax, 0xcb2f3d2c
xor eax, 0x945a9320
imul eax, eax, 0xfd29fd6d
add eax, 0x3b286332
or eax, 0x27d7c797
mov ecx, 0x88cdb23a
xor edx, edx
div ecx
xor eax, 0xf041f627
or eax, 0x8ce0acad
imul eax, eax, 0x7c36b7cc
mov ecx, 0x87e6a6f2
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
imul ecx, ecx, 0xd50a91da
or ecx, 0x46c64450
sub ecx, 0x11f62c26
imul ecx, ecx, 0x324977f2
or ecx, 0x3d1c6be8
or ecx, 0x5df621c0
xor ecx, 0x5615b5a1
or ecx, 0x5b6ea9bd
imul ecx, ecx, 0xd6a2090c
or ecx, 0x300d33c6
xor ecx, 0xb8dbf22d
sub ecx, 0x7e71f296
and ecx, 0xa376cd51
imul ecx, ecx, 0x56e36c44
add ecx, 0x3c771d60
and ecx, 0xfc31ae9a
imul ecx, ecx, 0x3076fdac
imul ecx, ecx, 0xbfa7466
and ecx, 0x7e24b3dd
mov dword [ebp - 0x30], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x30]
cmp eax, 0xf74982ab
jae 0x100f8575
mov eax, dword [0x101bc930]
imul eax, dword [0x101bc934]
sub eax, 0x4c8ef90c
add eax, 0x2e06a7de
xor eax, 0xc25fa5e3
xor eax, 0x4dfe1aa0
mov ecx, 0xa14789b7
xor edx, edx
div ecx
xor eax, 0x4103a996
xor eax, 0xa143b415
imul eax, eax, 0x6a6f7327
imul eax, eax, 0x47ea0388
imul eax, eax, 0x5acfc3a1
xor eax, 0x5ad6b132
add eax, 0x499229b1
or eax, 0x242ce508
and eax, 0xd2aa3a40
imul eax, eax, 0x5b9bdf7a
or eax, 0x5dae0c0b
and eax, 0x97c9e93c
mov ecx, 0xf455ccf9
xor edx, edx
div ecx
add eax, 0xfab6b8a3
imul eax, eax, 0x498dc307
add eax, 0xba251b5
and eax, 0xa8ced5d8
or eax, 0xae01124f
sub eax, 0x83116107
or eax, 0xd7a72a79
and eax, 0xd7def184
xor eax, 0x5a167af7
and eax, 0xbe17c9c3
mov ecx, 0x135d3d15
xor edx, edx
div ecx
mov ecx, 0x788088c8
xor edx, edx
div ecx
add eax, 0xe57e3953
mov ecx, 0xd2d2a21f
xor edx, edx
div ecx
sub eax, 0xb5ee594f
or eax, 0x1bb92e66
sub eax, 0xc2f8665f
add eax, 0x5a3e67b5
xor eax, 0x94630f70
sub eax, 0xaf448a0
cmp eax, 0x51529347
jbe 0x100f8496
mov eax, dword [0x101bc938]
sub eax, dword [0x101bc93c]
and eax, 0x47135084
imul eax, eax, 0x76835822
sub eax, 0xfbb65133
imul eax, eax, 0x9c4c9848
xor eax, 0xa8b7b692
add eax, 0x342bc60c
or eax, 0x7c1e3132
and eax, 0xae730871
xor eax, 0xab204bf1
xor eax, 0x1fb8e74
add eax, 0x774b6d91
and eax, 0x7411da98
imul eax, eax, 0xd8ba7a47
imul eax, eax, 0x6c7f031b
sub eax, 0xd78d2aed
add eax, 0x639dc45a
and eax, 0x8e3650f9
imul eax, eax, 0x791454e3
or eax, 0x1cd669f9
and eax, 0xf632f096
mov ecx, 0x8cae5c3d
xor edx, edx
div ecx
or eax, 0xc92d8859
xor eax, 0x107770e1
imul eax, eax, 0x76ac2b9c
imul eax, eax, 0x38994ccd
imul eax, eax, 0x82e6fe29
xor eax, 0x4192440
mov ecx, 0xb7ba45f8
xor edx, edx
div ecx
and eax, 0xbb561c8f
mov ecx, 0xf0960baf
xor edx, edx
div ecx
mov ecx, 0xfcebfb0f
xor edx, edx
div ecx
imul eax, eax, 0x38424f38
sub eax, 0xf5b90cef
add eax, 0x78591eb5
sub eax, 0xbd6e7f61
and eax, 0xdc25c68c
and eax, 0x696adcfd
or eax, 0x7c372694
cmp eax, 0xf18f238b
jae 0x100f958d
mov eax, dword [0x101bc940]
imul eax, dword [0x101bc944]
mov ecx, 0xeb447855
xor edx, edx
div ecx
add eax, 0x3a80f638
or eax, 0x5797639e
and eax, 0x7a927b7e
imul eax, eax, 0xa1221649
sub eax, 0x2ba3764d
mov ecx, 0x90c044be
xor edx, edx
div ecx
or eax, 0xa76aaeb7
sub eax, 0x4aee2eb8
xor eax, 0xcdd8818c
imul eax, eax, 0x167040df
imul eax, eax, 0x43c4c8c
xor eax, 0xfa691fe
xor eax, 0xdd8d3556
sub eax, 0x3cc4444a
or eax, 0x21278900
and eax, 0xff51d271
sub eax, 0x26875fe7
add eax, 0xc00f2b9e
sub eax, 0x7fa642a0
xor eax, 0x72f24b15
mov ecx, 0x42f6aa38
xor edx, edx
div ecx
and eax, 0x9efd6357
and eax, 0xcc18f1ad
sub eax, 0x620a770a
imul eax, eax, 0xa6e4f55e
mov ecx, 0x6e49ec57
xor edx, edx
div ecx
imul eax, eax, 0x9eb2134c
sub eax, 0xf8ebfb74
mov ecx, 0x436f20d0
xor edx, edx
div ecx
and eax, 0xbae0a3e2
or eax, 0x2ec957d
mov ecx, 0xcd31ccfe
xor edx, edx
div ecx
or eax, 0xe1797f16
add eax, 0x9c2cb60
add eax, 0xb272a351
or eax, 0x3a5c18c1
and eax, 0x6095069e
cmp eax, 0xbf747361
jae 0x100f958d
jmp 0x100f8965
mov eax, dword [0x101bc948]
or eax, dword [0x101bc94c]
xor eax, 0x5b64d4c0
add eax, 0xd39cf76
or eax, 0x66a770bc
mov ecx, 0xabad1f89
xor edx, edx
div ecx
and eax, 0x5c4c04af
xor eax, 0xb519a753
xor eax, 0x22b43d17
imul eax, eax, 0xd9926c6c
mov ecx, 0x4b67aecf
xor edx, edx
div ecx
xor eax, 0x1a813a81
imul eax, eax, 0x43040b5c
or eax, 0x8eade87d
sub eax, 0xe091755f
or eax, 0xb9ece16c
imul eax, eax, 0x755a82f4
add eax, 0x2a3e9d52
imul eax, eax, 0x710c9022
imul eax, eax, 0xafab4618
and eax, 0x6691059a
imul eax, eax, 0x79ccc26f
and eax, 0x29876d32
xor eax, 0xd4c1dd43
and eax, 0xd300089f
imul eax, eax, 0x7a43ad59
sub eax, 0x1d114ea0
or eax, 0xeee73d4f
xor eax, 0x88fdec8e
or eax, 0xde0baafb
sub eax, 0xd76f425d
mov ecx, 0xe93984eb
xor edx, edx
div ecx
sub eax, 0x85c53685
imul eax, eax, 0x2b7e4969
imul eax, eax, 0x2e86ba91
and eax, 0xe6214d84
sub eax, 0x88901a17
sub eax, 0x749824aa
and eax, 0x8ed651b5
and eax, 0x327f0b82
cmp eax, 0xaba2820d
ja 0x100f9656
mov eax, dword [0x101bc950]
and eax, dword [0x101bc954]
mov ecx, 0x920674a5
xor edx, edx
div ecx
xor eax, 0xf6a0d6b2
and eax, 0x23f2b581
and eax, 0xaaa438c8
sub eax, 0xa4709b12
and eax, 0x2a5fd9ab
and eax, 0xc667e4bc
and eax, 0x9a1dde4d
and eax, 0xd6be6e79
add eax, 0x33263b76
mov ecx, 0xb824653a
xor edx, edx
div ecx
mov ecx, 0x4b11881c
xor edx, edx
div ecx
xor eax, 0xb19a9944
xor eax, 0x4bfec48c
mov ecx, 0x16ef9e0d
xor edx, edx
div ecx
mov ecx, 0x7c130f69
xor edx, edx
div ecx
and eax, 0xdde0549e
mov ecx, 0xd6619aa
xor edx, edx
div ecx
add eax, 0x1a64b030
xor eax, 0x33e87e19
xor eax, 0xfe781fd3
imul eax, eax, 0xf94d2cd3
sub eax, 0xf1354a91
and eax, 0x5eaedbe0
xor eax, 0x8ca9ae
sub eax, 0x68c012c9
mov ecx, 0x85e94a3e
xor edx, edx
div ecx
mov ecx, 0xb2f7821a
xor edx, edx
div ecx
add eax, 0x5af9ee0
add eax, 0xbe51b638
imul eax, eax, 0xef1fd2bb
or eax, 0xbeb7bc94
or eax, 0x6bbbb2bc
mov ecx, 0x3f07d662
xor edx, edx
div ecx
and eax, 0x94c6fdca
sub eax, 0xdbb3fdf0
add eax, 0x2f7bafe9
imul eax, eax, 0xc4092888
cmp eax, 0xbaa76763
je 0x100f9656
mov eax, dword [0x101bc958]
imul eax, dword [0x101bc95c]
and eax, 0x5fea2b3d
sub eax, 0x3258dd31
xor eax, 0xda474489
and eax, 0xa58f4648
and eax, 0x5e0cc92d
sub eax, 0xaaf6fb56
imul eax, eax, 0x5eda8ac5
xor eax, 0xf652f62a
mov ecx, 0xe9896d25
xor edx, edx
div ecx
imul eax, eax, 0xa2304ed2
xor eax, 0x9f85e729
or eax, 0x91c928bf
imul eax, eax, 0x78b05cec
or eax, 0xe7102954
mov ecx, 0x7911ac05
xor edx, edx
div ecx
or eax, 0x8ee6763f
add eax, 0x3131fba8
mov ecx, 0x41281388
xor edx, edx
div ecx
xor eax, 0x4f91d1d7
add eax, 0x764d239f
sub eax, 0xe6c7f52f
sub eax, 0x99898693
xor eax, 0x7b29193c
and eax, 0xc2a8e49c
or eax, 0xf9dd7c76
sub eax, 0x139e8097
or eax, 0x920273ab
imul eax, eax, 0x53b76cd9
imul eax, eax, 0xe73b9109
xor eax, 0xc89f1b64
or eax, 0x83772ee
sub eax, 0xf7f41c2a
and eax, 0xa758389c
and eax, 0xd103e56e
imul eax, eax, 0xeeef4919
xor eax, 0xcbe75e6c
mov ecx, 0xff573656
xor edx, edx
div ecx
imul eax, eax, 0xffaf751
cmp eax, 0xd5c14895
ja 0x100f8ff9
mov eax, dword [0x101bc960]
or eax, dword [0x101bc964]
add eax, 0xafd9e1d1
mov ecx, 0xd4587720
xor edx, edx
div ecx
xor eax, 0x7df610df
imul eax, eax, 0x3b90a497
xor eax, 0x53a6da96
or eax, 0xeea78b2
add eax, 0x1f349256
xor eax, 0x45ea2a43
imul eax, eax, 0xa405e50e
xor eax, 0xf7a53ce6
add eax, 0xad73943a
add eax, 0x8578758f
xor eax, 0xaa4ea821
xor eax, 0x6e07df64
imul eax, eax, 0x9afcfcad
and eax, 0x9ebba964
mov ecx, 0x1b331fc7
xor edx, edx
div ecx
imul eax, eax, 0x155264ae
and eax, 0xd6736ef6
sub eax, 0xf525210e
mov ecx, 0xdc754522
xor edx, edx
div ecx
imul eax, eax, 0x5a2a317b
sub eax, 0x441b1a8e
imul eax, eax, 0x22c9e8bc
add eax, 0xc8ac2708
and eax, 0x8b8609e3
sub eax, 0xccdfa6a0
add eax, 0x1d32066a
xor eax, 0x65313819
or eax, 0x7158fe2f
mov ecx, 0x9334a98f
xor edx, edx
div ecx
or eax, 0x38044927
or eax, 0x68be630b
and eax, 0x4dca4615
and eax, 0xceaad590
mov ecx, 0x44712ed5
xor edx, edx
div ecx
mov ecx, 0x61ef6403
xor edx, edx
div ecx
or eax, 0xb467722d
cmp eax, 0x128c099f
je 0x100f96df
mov eax, dword [0x101bc968]
and eax, dword [0x101bc96c]
and eax, 0xb4f18772
add eax, 0x665339b9
xor eax, 0x2fa31a01
imul eax, eax, 0xc6ed1482
or eax, 0xdaf2335
add eax, 0x2f768a84
or eax, 0x8a80184
sub eax, 0xd748d769
xor eax, 0x8de158f3
mov ecx, 0x7af8ba0e
xor edx, edx
div ecx
sub eax, 0xdcba443c
mov ecx, 0xa8071e64
xor edx, edx
div ecx
or eax, 0xa68d43dd
imul eax, eax, 0xd07719d9
and eax, 0xda9dd15b
and eax, 0xbe788ba8
add eax, 0x4ea96f1f
xor eax, 0xcc80a445
or eax, 0x98414120
sub eax, 0x931e525
xor eax, 0x3733bc06
mov ecx, 0x506476
xor edx, edx
div ecx
or eax, 0xf967510c
or eax, 0x77cbc7e2
mov ecx, 0x6668b199
xor edx, edx
div ecx
xor eax, 0x1cdaa8f7
mov ecx, 0xf0f6c7ed
xor edx, edx
div ecx
xor eax, 0x7313212a
xor eax, 0x58d6a8ca
mov ecx, 0x3d7f3cc
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, 0x4fe50881
imul ecx, ecx, 0x4e57c21f
or ecx, 0xc34e482f
add ecx, 0x92012405
and ecx, 0xf541e873
xor ecx, 0xe527b68c
and ecx, 0xf7b8fa31
and ecx, 0x74be66d2
mov dword [ebp - 0x38], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x34], ecx
cmp eax, 0x1fa37cb0
jb 0x100f8d27
mov eax, dword [0x101bc970]
xor eax, dword [0x101bc974]
add eax, 0x90575da4
xor eax, 0x7f401765
imul eax, eax, 0x467bde5c
sub eax, 0x7140e382
add eax, 0xe97fedbd
or eax, 0x7a370bea
add eax, 0xd05b99f9
mov ecx, 0x96d1c685
xor edx, edx
div ecx
mov ecx, 0x231099a7
xor edx, edx
div ecx
or eax, 0x223f0d55
add eax, 0xff4988d1
xor eax, 0x25f1a11f
mov ecx, 0x7667ad25
xor edx, edx
div ecx
add eax, 0xb4e9ab41
add eax, 0xd5e1187b
add eax, 0x186d7b3d
xor eax, 0x19f9f98b
imul eax, eax, 0x9363df2f
imul eax, eax, 0x7f6291c6
and eax, 0x5ce05bce
sub eax, 0x87f80543
add eax, 0xbe406b6a
mov ecx, 0x4d3cf8db
xor edx, edx
div ecx
add eax, 0x6eb462f3
or eax, 0xae4f971d
imul eax, eax, 0x9fb16039
mov ecx, 0x94f18499
xor edx, edx
div ecx
xor eax, 0xdb583634
xor eax, 0x989259c7
imul eax, eax, 0xd373b25e
xor eax, 0xb5f2e7ce
xor eax, 0x7653f905
or eax, 0xcf15831d
and eax, 0x5522c00c
add eax, 0x4e25ec06
sub eax, 0x4a4b09e0
sub eax, 0x674f60f3
sub eax, 0xc7da95e9
cmp eax, 0x68b70eb4
ja 0x100f8ff9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101626c6
mov eax, dword [ebp - 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x24]
lcall 0xbf01, 0xdae6a09c
int3
mov eax, dword [0x101bc978]
xor edx, edx
div dword [0x101bc97c]
mov ecx, 0x6cc603aa
xor edx, edx
div ecx
add eax, 0xd8ba413b
and eax, 0x34939c67
imul eax, eax, 0xd6a79166
or eax, 0xbc8b3d0c
mov ecx, 0x1974b387
xor edx, edx
div ecx
xor eax, 0xcde17b4e
sub eax, 0x72925606
add eax, 0xa1bf6f6e
and eax, 0x985e0bda
or eax, 0x210c6ee4
and eax, 0x7219e345
and eax, 0x299f3463
xor eax, 0x56376713
xor eax, 0xda3b7f9f
add eax, 0xd415f2a8
or eax, 0xe33746ef
and eax, 0x7942a040
add eax, 0x307966c2
sub eax, 0x1616f7de
add eax, 0x8e5f2ec5
xor eax, 0xe6690dc1
add eax, 0xa8a9f970
sub eax, 0x63f17fdc
or eax, 0xe921691a
and eax, 0x8e6b6f82
and eax, 0xb8410396
or eax, 0x8ad273a3
mov ecx, 0x95850adf
xor edx, edx
div ecx
xor eax, 0xebdcc11d
imul eax, eax, 0x4fb4320
and eax, 0x9a48b1ee
and eax, 0x53e6044e
or eax, 0xd4830247
mov ecx, 0x32bebaac
xor edx, edx
div ecx
add eax, 0x1ad18c25
xor eax, 0x1133642a
or eax, 0xd6286af5
cmp eax, 0x4edef41e
jbe 0x100f97b3
mov eax, dword [0x101bc980]
sub eax, dword [0x101bc984]
xor eax, 0x1e8cce57
imul eax, eax, 0xd9c513ef
imul eax, eax, 0x30660929
add eax, 0x874bb4cf
and eax, 0x8d01c1ef
xor eax, 0x97d95ad8
imul eax, eax, 0x1df601ac
add eax, 0xb9271891
imul eax, eax, 0x8d4be950
imul eax, eax, 0x67f532ad
xor eax, 0xd7373fe4
add eax, 0x5defe237
or eax, 0xe436b38b
imul eax, eax, 0xeaf9dd01
add eax, 0xd4e9e26f
imul eax, eax, 0x7702bc2f
and eax, 0xdf1948a6
or eax, 0xf063636
and eax, 0x332844ed
mov ecx, 0xf71ff036
xor edx, edx
div ecx
mov ecx, 0xa13d7607
xor edx, edx
div ecx
imul eax, eax, 0x21a3d5f5
sub eax, 0xde816e27
or eax, 0x5b88f012
mov ecx, 0x78a76ad8
xor edx, edx
div ecx
add eax, 0xb900cbc8
or eax, 0xed08b399
add eax, 0xaa677a7c
sub eax, 0x6303bdb8
xor eax, 0xea739a92
imul eax, eax, 0x71aad1a4
xor eax, 0x9f07214a
lahf
xor eax, 0x2ca36c22
and eax, 0xa08cc318
imul eax, eax, 0x4b352fb4
imul eax, eax, 0x4632959c
mov ecx, 0xd4d6b456
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor ecx, 0x37575f2e
mov dword [ebp - 0x3c], ecx
mov ah, 0xb1
add edx, dword [esi + 0x1f]
test eax, 0xeb92f24b
mov ah, 0x48
add eax, 0x4bf2ea5e
cmp al, 0x22
test eax, 0xb4d1186a
xor byte [ebp + 0x4f], cl
xchg ebp, eax
loope 0x100f91a0
or byte [ecx + 0x99208a6], dh
invalid
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
sbb dword [ebp + 0x1c29ac30], esp
hlt
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10087750
add esp, 0xc
jmp 0x100f80c7
xor ch, byte [0x541d6004]
arpl word [ebp - 0x52fe38c8], di
test byte [ebx + 0x74], dh
fsubr qword [edi - 0xda1b094]
pushal
mov bh, 0x56
clc
sub eax, dword [edi - 0x5a6b433]
xchg edx, eax
jl 0x100f9484
scasb al, byte es:[edi]
call 0x37b7e040
les ebp, [eax + 0x43]
jae 0x100f93e9
pop edx
or eax, 0x7d2fd006
push es
das
xlatb
int3
int 0xb2
test byte [ebx + 0x4a], 0x64
mov ch, 0x2c
mov edi, 0xdf2448b
lcall 0xb8e4, 0xf88c1168
pop es
adc eax, 0xb508f35f
xchg ecx, eax
jne 0x100f94c9
cmp al, 0x81
add edx, dword [ecx - 4]
ljmp 0x175a
invalid
mov eax, dword [ebp - 0x24]
in al, 0x79
sbb al, 0xe6
xor ebp, dword [esi + edx*4 + 0x25]
sub byte [edi - 0x3955cbff], dh
lea ebp, [ecx]
xchg esi, eax
mov dh, 0xfa
cdq
adc byte [ecx + 0x2d957c23], al
daa
sal dword [esi - 0x12236705], cl
xchg edx, eax
xor dword [ebp + 0x2eb8a721], edx
invalid
in eax, dx
fsub st(0), st(0)
cmp byte [edi - 0x195b6c08], dl
pop edx
sahf
mov eax, dword [0x9a8fe365]
aas
adc ebx, dword [ebx + 0x14]
movsd dword es:[edi], dword [esi]
loope 0x100f95c2
enter 0xffffffffffffb268, 0x51
movsd dword es:[edi], dword [esi]
aad 0x64
fistp dword [ebx - 0x369c2385]
in eax, 0xd6
cmp al, 0x70
lcall 0xbf0, 0x888b6b67
or eax, 0x490d630a
push edx
scasd eax, dword es:[edi]
jge 0x100f9600
fcomi st(5)
rol dword [ebx - 0x5f], 1
or al, 0xfa
inc ebx
add al, 0x6b
cdq
mov byte [0xce091770], al
mov dword [0x3a7f9c6d], eax
and byte [esi], 0x5b
and bh, 0x28
mov dl, 0xab
or dword [eax + 0x61], esi
invalid
inc ax
loop 0x100f9616
push esp
jecxz 0x100f95ab
mov ch, 0x21
xor edx, esi
inc edx
add byte [esi + 0x7ef33b22], 0x84
imul ebp, dword [edx + 0x14], 0x31d40155
xchg dword [eax + eax - 0x6c8b67f], ebp
push ebp
add esp, edx
xor dword [edi + 0x498100ac], eax
aaa
stc
and al, bl
invalid
xor dword [edx], edx
invalid
xor dword [0xf73a993c], eax
add eax, 0xfd94b3e0
insd dword es:[edi], dx
rol ch, cl
adc dword es:[ecx - 0x1a], ecx
add al, 0x4e
popal
shl byte [edx + edi*2], 1
and byte [esi - 0x42b60eb], al
wait
inc ecx
push edx
push edx
sbb dl, dh
pop esp
mov cl, 0xd5
mov eax, dword [0x59ca1b58]
xchg edi, eax
xor cl, ch
outsd dx, dword [esi]
invalid
mov eax, dword [ebp - 0x24]
cmp bl, byte [0x601811bf]
stc
sbb byte [eax + 0x67], ah
stc
insd dword es:[edi], dx
into
rcr byte [ebx], 1
pop ds
add dh, dh
xchg byte [esi + 0x1d], bl
les esi, [ebx + 0x5b]
add ax, 0x4850
xchg ebp, eax
or al, 0x15
je 0x100f96cd
add eax, 0xc954850
adc eax, 0x5edecc74
jle 0x100f96ac
ficomp word [esi + 0x7e]
cmpsd dword [esi], dword es:[edi]
jnp 0x100f9701
stosb byte es:[edi], al
jae 0x100f970d
pop es
add dl, bl
cli
test al, 0x95
dec edi
xor byte [edx], ch
mov ebx, 0xc95c1c0d
jg 0x100f9748
rol dh, 1
stosd dword es:[edi], eax
out 0xbe, al
outsd dx, dword [esi]
inc ebp
out 0x8d, al
jl 0x100f9789
int1
fsubr st(5), st(0)
pop esp
jmp 0x100f96f9
add ebp, 0xffffffcc
sub al, byte [ecx]
jne 0x100f97ca
inc esi
sub bh, cl
insd dword es:[edi], dx
in al, dx
fbld tbyte [ebp + 0x36]
in al, dx
inc edi
mov edx, fs
salc
not byte [eax]
sbb eax, 0x7c14be98
je 0x100f96e6
invalid
ljmp 0x9868:0x161c7912
adc bh, byte [ecx + 0x1c]
push ss
push 0xfeccb98
enter 0x56da, 0xffffffffffffffb7
pop esi
fbstp tbyte [ebx + 0x3540d98d]
rcr dword [edx - 0x2d], 1
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc eax
xor eax, 0x8bd35ad1
add byte [ebx + 0x48904ec], al
and al, 0xff
adc eax, sym.imp.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100f8d27
mov eax, dword [ebp - 0x24]
cmp eax, 0x85baa2bf
sbb ecx, dword [ebx - 0x5f9e706d]
je 0x100f9776
pop es
js 0x100f9834
cdq
dec edi
mov edx, 0xe46861ca
pop esp
pop ss
popal
push 0x66c48fe4
pop ss
test ecx, esp
or eax, 0x871b4fcd
out 0x31, al
mov al, byte [0xb23f6e48]
sahf
mov dword [eax - 0x1e], esi
outsb dx, byte [esi]
sal byte [ebp + ebp*4 + 0x31d8ab58], cl
jl 0x100f9777
mov bl, 0xe6
push ss
sub eax, 0x929b3cb2
mov dh, byte [edi + 0x3f]
ja 0x100f9838
add eax, 0xf9932ba0
call 0x19b751bf
push 0xf176aaa2
test eax, 0x8c1d8267
or dl, cl
xor byte [ebx - 0x44], bl
sub al, 0x69
add eax, 0x434e2cd4
add byte [ecx + ebp*8 - 0x50], ch
inc ecx
cwde
test byte [ebx], dh
xchg ebx, eax
push ds
cmp byte [esi + 0x66], al
outsd dx, dword [esi]
inc esi
outsw dx, word [esi]
jp 0x100f97f7
pop eax
dec ecx
push 0xffffffffffffff9c
movsd dword es:[edi], dword [esi]
bound edi, qword gs:[ecx - 0x118163ea]
jle 0x100f9824
xchg ebx, eax
lodsb al, byte [esi]
invalid