Function at 0x100b61ba
Capabilities:
Create thread
Encode data using xor

Disassembly:
jae 0x100b61d1
stc
inc dword [ebx - 0x3fccf33c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1011e48a
leave
ret 4
push ebp
pushfd
test byte [0x100b6255], 0x18
jne 0x100b6256
shr dword [0x98772a7], 0x89
cmpsb byte [esi], byte es:[edi]
xor ebx, ebp
xlatb
sub dword [esi + 0x7d46af94], 0x5aa09a5d
push esp
cmp dl, byte [esi - 0x68]
scasd eax, dword es:[edi]
mov al, byte [0x64385cfa]
movsd dword es:[edi], dword [esi]
dec ecx
or eax, 0x4c327ce5
sti
mov eax, 0xe62167fc
and bh, byte [edx + 0x1d]
add al, bl
pop esp
loopne 0x100b6195
nop
sti
loopne 0x100b6201
mov ebx, 0x8de76304
add al, 0x63
out 0x8d, eax
jnp 0x100b6271
add bl, ah
nop
add eax, edx
or al, byte [edx - 0x1dd3613f]
jb 0x100b6263
into
in al, 0xb8
jnp 0x100b6263
push ebx
dec eax
dec esp
push ds
dec ecx
sub dword [ecx + 0x65], esp
mov dword [0xc4787d29], eax
aas
dec ebx
and al, 0xfd
pop edi
sbb dword [eax], 0x5c515d48
test eax, eax
cmc
in al, dx
xchg esp, eax
mov bl, 4
mov word [ebx], fs
int 0x6c
popal
cwde
out 0x53, eax
salc
sbb eax, 0x1bab09b8
jns 0x100b6202
outsd dx, dword [esi]
mov cl, 0x8a
dec ebx
xlatb
and cl, byte [esi + 0xd]
cwde
pop ebp
popfd
mov ebp, esp
push ebx
pushfd
test byte [0x100b6316], 0x9b
jne 0x100b6317
test dword [edi - 0x2e000000], ebp
in eax, dx
shr ch, cl
sub dword [edx - 0x42], ebp
adc dl, byte [edx - 0x651cc301]
jecxz 0x100b620d
xchg esp, eax
cmp byte [edx + eax*8 + 0x31], ch
mov esp, 0x37b7155f
mov dword [0x2a97ec2b], eax
repne scasb al, byte es:[edi]
lds ebx, [edi + 0x3d94166f]
mov dword [eax + 0x75], esi
cmp bl, dh
test byte [0xd7c74ca1], bl
dec esi
push 0xffffffffffffff84
push es
int 0x26
xor al, 0xc4
xor dh, byte [edx + 0x55]
mov eax, dword [0xe2eb113]
scasb al, byte es:[edi]
cmp bl, byte [edi]
test eax, 0xc82cbe07
push ecx
das
int 0xd2
mov al, byte [0xb7144e52]
stc
cmp byte [eax], ah
sbb dword [ecx - 0x54], 0x14
test eax, 0xab67877
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
push ebx
xor al, 0xdf
pop edx
xchg ebp, eax
pop eax
lahf
sbb ecx, edx
or al, 0xb5
outsd dx, dword [esi]
mov edx, 0xf865d348
mov ch, 0x19
pushal
push ebp
mov ebx, 0x4ee367bd
inc ebx
push edx
xor byte [esi - 0x34], 0xf7
in al, 0x63
adc bl, bl
sal dword [esi], 0x33
mov dl, 0x41
push 0x1ca83dc9
and byte [0x5c9186f7], dh
idiv dword [edi + edx*4 + 0x7e]
add al, 0xf0
add edx, dword [0xfa13589]
push edi
cmpsd dword [esi], dword es:[edi]
or eax, 0x523d4b4a
sub byte [edx - 0x79], ch
ficom word [esi]
inc ebx
push edx
push ss
sbb al, 0x51
popfd
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x100b6b31
pushfd
test byte [0x100b6362], 0x87
jne 0x100b6463
arpl word [ebx], cx
adc byte [edi + 0x12c850f], al
add byte [eax], al
sub eax, 0xcea899c7
pop ebx
in eax, dx
push ds
dec ecx
inc esi
rol dword [edi + 0x4e25c84], 1
clc
inc edi
ja 0x100b639c
pop edi
mov dword [0x2be5815], eax
sub al, 4
clc
mov dl, 2
int 0x18
and bh, byte [ecx]
jle 0x100b6384
cmpsd dword [esi], dword es:[edi]
ja 0x100b632d
int3
shl byte [edx], cl
retf 0x2631
xor dword [0x307c4c41], edx
push esp
xor eax, 0x935e3026
sub dword [ebp - 0x5a], 0x217ee2e0
xor dword [eax + 4], edi
test dword [edx], ebx
add dword [ebx], ecx
inc esi
xor esp, edx
or ebx, dword [esp + edi*8 + 0x12]
mov dword [0x805369c2], eax
in eax, 0xaf
imul edx, dword [edx - 1], 0xffffffaa
out 0xeb, eax
idiv ch
inc ebp
clc
mov dl, bh
cld
adc eax, 0xe637a242
dec ebp
cmpsd dword [esi], dword es:[edi]
mov dl, 0x6d
cmp eax, 0x355896bd
push ss
fld dword [edx - 0x38d7941d]
cmp byte [ebx], al
rcr byte [ecx + ebp*2 - 0x32], 1
adc ebp, dword [edi - 0x79ef406b]
pop edx
test al, 0x99
imul dword [eax]
pop edi
fadd dword [esi - 3]
mov al, 0x87
mov al, 0x8e
sbb byte [eax - 0x13], dh
pop edi
adc byte [0xe2bab645], ch
ljmp es:[0x28accc6b]
popfd
cmp dword [ebp + 0xc], ebx
je 0x100b6b31
cmp byte [esi + 0x61], bl
jne 0x100b6b31
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi]
lea ecx, [esi + 0x62]
push ecx
pushfd
test byte [0x100b656e], 0xad
jne 0x100b656f
mov ecx, 0x1a52f308
and dword [edx], edi
push 0xffffffffffffffc3
inc ecx
aam 0x2e
test dword [ebp - 0x12], ebx
and ecx, esp
adc ecx, dword [edi]
push esp
mov cl, 0x8e
jbe 0x100b64b8
imul edx, dword [edx + 0x37d8ab96], 0x5b
xchg esi, eax
mov esp, 0x31262915
xor al, 0xf1
xor dword es:[ecx + esi*8], esi
jnp 0x100b652b
dec ebp
mov byte [eax + 0x63], bh
lodsb al, byte [esi]
dec eax
sub al, 0xf8
mov esp, 0xdd1acec
arpl word [edi - 0x293742fd], si
mov dword [ecx + 0x3944dfad], esp
stosb byte es:[edi], al
enter 0xffffffffffff89d6, 0xffffffffffffffa1
lodsd eax, dword [esi]
fild word [ecx + edi - 0x56]
mov edi, es
push cs
aam 0x3a
div byte [edx - 0x12144af0]
mov cl, 0xa
mov al, byte [0xd19d6974]
in al, 2
add ch, byte [edi - 0x17]
inc ecx
dec edi
int 0x50
movsd dword es:[edi], dword [esi]
cwde
mov ebx, 0x94ff2ea8
and eax, 0x2b52dc7f
mov bh, 0xa9
xchg esp, eax
lodsd eax, dword [esi]
dec edx
xor dword [esi], ecx
adc dword [ecx], ebp
movsb byte es:[edi], byte [esi]
jg 0x100b64cf
mov dword [0x5bc7f416], eax
sbb cl, ch
xor al, byte gs:[edi]
push ss
cmp al, 0x50
loop 0x100b6580
mov bl, 0x62
cmpsb byte [esi], byte es:[edi]
cdq
adc ah, byte [edi*4 - 0x42437694]
fbld tbyte [eax + edi - 0x4c919aa1]
xchg esp, eax
mov bl, 0x94
lahf
jle 0x100b6540
ror byte [ebx + 0x6088f229], cl
or al, 0x60
push esp
or bl, bh
push ebp
and dword [edx + 9], edx
sal byte [ebp - 0x77], 0xc1
ja 0x100b6566
movsd dword es:[edi], dword [esi]
cli
fbld tbyte [edx + 0x2cbf1550]
sub byte [ecx + 0x22e85d89], 0x13
rol dword [ebx - 0x126d0585], cl
pop es
adc eax, 0xc64fe3bd
cli
inc esp
adc al, 0xb7
or eax, ebx
and eax, 0xbfd4ec8a
fsub dword [0xbfd4ec8a]
push ecx
push ebp
dec eax
popfd
push dword [ebp + 0x10]
pushfd
test byte [0x100b65ae], 0xe0
jne 0x100b66af
add cl, bl
xchg esp, eax
or ebp, esi
add eax, 0x37a1e553
mov al, byte [0xb63f56a7]
pop ss
fst dword [ebx + ecx - 0x1aacfa12]
mov eax, dword [0x56a7a037]
aas
mov dh, 0x17
adc al, 0x20
bound ebp, qword [ebx + 0x27]
xchg edx, eax
mov dword [0xdcff15ac], eax
insd dword es:[edi], dx
out dx, eax
div dword [edx]
mov dword [0x26eb2404], eax
push esp
and byte [esi], cl
rcr dword [esi - 0x347f8a58], 1
les ebx, [ebp - 0x39359bb0]
xchg byte [ecx], bh
inc ebx
insd dword es:[edi], dx
mov dword [eax], eax
mov ebx, 0x1e98b718
test ch, 0xff
enter 0x46e4, 0xffffffffffffffa3
or eax, 0x9e616188
pop ds
mov dword [eax], ecx
add ebp, dword [edx]
les ecx, [edi - 0x3695443d]
sub byte [edi + 0x753bbc48], dh
sbb al, 0xf2
aas
adc byte [ebx + 0x63], bl
mov dl, 0x69
popfd
mov ebx, dword [esp + edi*2 + 0x32]
push 0xc6381767
add edx, dword [edx]
sbb al, 0x62
outsd dx, dword [esi]
int3
popfd
mov ecx, esi
push dword [ebp + 0xc]
mov word [esi + 0x60], bx
mov dword [esi + 0x10], edi
call dword [eax + 4]
cmp eax, ebx
pushfd
test byte [0x100b679c], 0xbe
jne 0x100b679d
cdq
paddb mm2, qword [eax]
or dl, byte [edi - 0x62]
cld
adc byte [edx], cl
push edi
sahf
pop edi
pop esi
pushal
xchg edi, eax
sbb byte [0x5900da27], bh
adc dword [edi + 0x7d31f27e], eax
sbb esp, edi
aam 0
inc eax
xlatb
mov word [ebx], ds
sub dl, byte [esi + 0x73bc2c71]
xchg ecx, eax
lahf
sub dword [esp + ebx*2], edi
xor al, 0xbb
clc
inc ebp
std
ja 0x100b66d1
adc dword [eax + 0x15], esi
out dx, eax
add dword [eax], ecx
lodsd eax, dword [esi]
fld dword [ebp + 0x799ba85]
out 0x36, eax
mov edx, 0x36e70799
pop es
push 0x4c
mov dl, 0xeb
fbld tbyte [0x332b0aa2]
fld qword [esi]
call 0x981441bd
cmp ebx, esp
mov ecx, 0xfbbc6c61
or al, 0xf6
sar dword [esi], cl
test eax, 0xa7d1d552
mov dl, 0x16
not byte [eax - 0x39]
mov ecx, ss
stc
and al, 0x22
and edx, ecx
jecxz 0x100b672d
pushal
xor ebp, dword [ecx - 0x21]
jne 0x100b6764
ror byte [ebx + 0x4dc0bb36], cl
ja 0x100b670a
mov ebx, 0xbc774dc0
in eax, 0x7d
outsd dx, dword [esi]
sar bl, cl
sub eax, 0xe1c8282c
shr dword [ecx + 0x4cc99f50], cl
inc esp
out dx, al
mov edi, dword [esi - 0x48051a3b]
stosb byte es:[edi], al
cli
mov bh, 0xaa
sub esi, dword [eax + edi*8 - 0x204f8013]
int 0x65
aad 0xb4
stc
mov fs, eax
clc
and ebx, dword [ebx + 7]
mov dword [0x3389212e], eax
add eax, 0x3389212e
loop 0x100b6749
pop esi
push ds
xchg ebp, eax
out 0x4f, eax
call 0xe7d1907a
pop ebp
sbb dh, 0xee
xchg ecx, eax
in al, 0xcb
mov eax, dword [0x2249cfed]
in al, 0x87
or dh, byte [edx - 0x22]
dec ecx
and ah, ah
xchg dword [edx], ecx
jb 0x100b677a
in eax, dx
popfd
jne 0x100b6b31
lea eax, [ebp + 0xc]
push eax
push ebx
pushfd
test byte [0x100b68a4], 0xa9
jne 0x100b68a5
je 0x100b6831
push dword [ecx + eax*4]
scasd eax, dword es:[di]
sub al, 0xdc
inc eax
dec edx
aam 0x7c
xchg esp, eax
pop ebp
outsd dx, dword [esi]
adc al, 0xa7
scasd eax, dword es:[edi]
mov dword [esi - 0x34], edi
and byte [ebx + 0x535deabe], ah
movsd dword es:[edi], dword [esi]
sti
shr dword [0x1a81914f], 0x21
mov ebp, ebp
in eax, dx
add eax, 0x16e2d77c
xor eax, 0x933480e0
and ebp, dword [ebx - 0x5bf34de6]
dec dword [ebx - 0x51]
inc ebx
xchg dword [ecx + 0x27a3a3b2], eax
loopne 0x100b67dd
popfd
test al, 0x6c
cmp esi, dword [ebx + 0x7b]
cmc
inc esp
lahf
fistp qword [ebp + 0x114bea33]
jge 0x100b6795
int1
test dword [ecx + 0x55], edx
xchg ebp, eax
mov ch, 0x77
sub ch, al
dec ecx
add al, 0x2f
and byte [ebx], al
imul ebp, dword [esi], 0x66c564b6
mov al, 0x4c
ja 0x100b67aa
push es
cmpsd dword [esi], dword es:[edi]
lea ecx, [ebx - 0x45bf3dc4]
and eax, 0xd60682ee
add edx, esp
adc dword [edx + 0x5dd7f0cc], edx
and dword [ebx + 0x4ca887bd], esi
xchg edi, eax
xchg ecx, eax
clc
or al, byte [edi + 0x24]
rcl byte [edx], 0x2f
fst qword [ebp + 0x6d]
sal byte [ebx + 0x29], 0xbc
jg 0x100b685f
popfd
sub dword [ecx - 0x79], esp
movsb byte es:[edi], byte [esi]
les edi, [edx - 0x2d]
mov al, 0x8d
inc ecx
jae 0x100b684b
add dword [ebp - 0x2d9818cc], 0xffffff9f
or byte [ebx + 4], dh
stosb byte es:[edi], al
test dword [edi], esi
rcr byte [bx + 0x7308], cl
add al, 0xaa
lodsd eax, dword [esi]
push esi
pop edi
and eax, 0xa4418633
mov bh, 0x20
mov edx, 0x6bb72e3e
lahf
push edi
or dword [ecx + 0x51], esp
mov ah, 0x84
jge 0x100b688e
xchg esi, eax
push es
adc al, 0x86
fsubr qword [ebx + 0x6bff1348]
push es
sbb eax, 0xb5b936c7
pushal
int 0xf4
test eax, 0x35db4715
cdq
nop
je 0x100b686b
invalid
int1
cmpsb byte [esi], byte es:[edi]
xchg edi, eax
jae 0x100b68e3
outsb dx, byte [esi]
popfd
push esi
push 0x100b1500
push ebx
push ebx
pushfd
test byte [0x100b6913], 0xc3
jne 0x100b6914
aaa
mul byte [eax - 0x33639326]
and dword [ebx + ebp*8], eax
mov dl, byte [edi - 0x48]
mov esi, 0x341296f9
mov bl, 0xa2
pop dword [eax + eax*4 + 0x522eec22]
lahf
mov dword [0xb2e211bc], eax
cmp eax, 0xc0f8f046
inc ebp
adc dword [ecx + 0x76], ebx
xchg esp, eax
or al, 0xff
rcr byte [ebx - 0x20b89d56], cl
xchg ebp, ebx
scasd eax, dword es:[edi]
loopne 0x100b68a4
mov ecx, dword [ebp - 0x46]
push eax
xor byte [esi], bl
sub edi, dword [ecx + ebx*2]
scasd eax, dword es:[edi]
xor dword [edi - 0x23], ebp
movsb byte es:[edi], byte [esi]
sar ebp, 0xe2
sub al, 0x5b
aas
mov byte [ebp - 0x3a], bh
add byte [esi + edi*8 + 0x47299484], dh
div dh
mov ah, 0xdd
push cs
popfd
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x74], eax
cmp eax, ebx
jne 0x100b6d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pushfd
test byte [0x100b6959], 0x43
je 0x100b6a5a
fucomp st(4)
fiadd dword [edi]
xor dword [esi - 0x78], eax
std
shl byte [ebp - 0x48], 0x3a
push eax
add edi, eax
stc
sub cl, ah
nop
enter 0xffffffffffffaa2a, 0xffffffffffffffcc
inc ecx
aad 0x47
xchg dword [esp + edx], eax
inc edx
rcr dword [esi + 0xd], cl
and dword [edi + 0xc54be25], ebp
add byte [ebx], cl
xor byte gs:[ecx - 0x71d552b3], bl
aad 0xe4
aam 0x22
add byte [ecx], dl
jnp 0x100b6938
arpl word [eax], cx
sub eax, 0xaeaa374c
mov dh, 0x70
add eax, edi
mov edi, 0x73248a5
adc eax, 0x322773c3
cli
jae 0x100b69b1
xor bh, dl
and bl, dh
daa
mov ecx, 0x6a939abf
mov ch, 0xf0
and al, 0xa0
cmp ebp, dword [eax + 0x58]
xor esi, eax
or ebx, dword [ebx + 0x6980c846]
xchg ebx, eax
push 0xffffffffffffffb5
invalid
dec eax
shr byte [0xf7c98425], 0xf3
inc eax
pop ds
xchg dword [edi - 0x61], esi
into
leave
xor dl, byte [esi]
or esp, ebx
xchg edx, eax
jno 0x100b6988
lodsb al, byte [esi]
mov dl, 0x67
xor eax, 0xd8291502
adc byte [edx + 0x77], dl
fisub dword [edx + 4]
adc edi, edi
fmul st(6), st(0)
in eax, 0xc2
xor byte [edi], bh
xchg edi, eax
loopne 0x100b69c5
add byte [eax + eax*8 + 0x59], ah
sub ch, byte [esi - 0x76]
pop ds
sar dword [ecx + 0x9962b7b], cl
enter 0xffffffffffffec3e, 0xffffffffffffffec
or ebp, dword [eax + ebp*8 - 0x18bd2b0d]
push esp
sub ebp, dword [edx]
cli
dec ecx
jno 0x100b6a5c
int1
pop eax
fistp qword [edi - 0x7ca4c67c]
xlatb
jecxz 0x100b6992
psllw mm6, qword [ecx - 0x1e4c5dd8]
lea ebp, [ecx]
xchg esi, eax
rcr ah, cl
popal
je 0x100b69a4
dec eax
salc
cld
emms
rol esp, 1
mov eax, dword [0xca81d5d5]
pop ss
mov ebp, 0x3ea38117
xchg ebx, eax
aas
rcl byte [ebx - 0x42fade5a]
mov ebp, 0xfbaca03f
pop ss
and dword [ebx + 0x3f3e933e], 0x21a693d0
add eax, 0xa03fbdbd
lodsb al, byte [esi]
sti
sub dword [ebx - 0x52], 0xa6158edf
push ds
cwde
insd dword es:[edi], dx
push esi
xchg ebx, eax
sub eax, 0x125139ce
mov ch, dl
adc dl, byte [esi + 0x79]
outsb dx, byte [esi]
jne 0x100b6a09
pop ebp
sbb dword [ecx - 0x695ea2e], ebx
stc
push ss
int1
in eax, 0x15
add ax, 0x3e3a
cmpsd dword [esi], dword es:[edi]
nop
popfd
push str.Create_WorkThread_Faild_With_Error__d
cld
test byte [eax + edx], dl
push ebx
push ebx
call fcn.10049c0c
add esp, 0x10
pushfd
test byte [0x100b6b2f], 0xd3
je 0x100b6b30
mov ebp, 0xf01ca012
sub eax, 0x1774776b
adc ah, byte [eax + 0x6b2df01c]
ja 0x100b6af5
pop ss
or al, 0xec
xor byte [eax - 0x7a], ch
mov edx, 0x8946c9a5
pop esi
loop 0x100b6afb
jge 0x100b6b03
ja 0x100b6a1c
test dword [ecx - 1], edx
jo 0x100b6a27
jb 0x100b6a79
mov ch, dh
sbb bh, byte [ebp + ebp*4 + 0x585fce25]
popfd
push ds
mov cl, 0x5e
pop ebx
dec ebx
sar byte [ecx + esi*2], cl
jge 0x100b6b01
push ebx
add eax, 0x1eefe68e
in al, dx
ffree st(4)
pop esi
int 0xb6
push edi
xchg esp, eax
cmp bh, byte [eax + 0x4256bbbf]
sbb al, 0xc6
mov cl, 0x54
popal
xor bh, bh
cli
adc al, 0x57
cmp dword [eax + 0x3a0f1fdf], 0x80b0a318
cmp al, 0x52
stosb byte es:[edi], al
in eax, 0x77
fst dword [edi]
scasb al, byte es:[edi]
rcr dword [ecx + 0x3bac0e78], 1
mov dl, ah
out dx, al
test al, 0xa7
fnstcw word [eax + 0x15447774]
shl dword [esi + 0x24], cl
and edi, dword [edi + 0x42]
out dx, eax
push esi
mov ecx, 0xc19736b0
sar dword [edi], 0xde
jg 0x100b6b3f
mov al, 0x36
xchg edi, eax
rol ecx, 0x3f
fidivr word [edi + 0x3b]
cmp esp, dword [ecx - 0x4426f36f]
mov eax, dword [0xbbd90c91]
adc dword [ebp - 0x72d6fea0], ebx
pop ss
in al, 0xea
mov ch, 0xa5
enter 0xffffffffffff9c22, 0xffffffffffffff88
mov cl, 0x7e
fild dword [esi - 0x60]
push ss
push ebx
int1
mov ch, byte [eax + 0x134f4d09]
in al, 0xaa
outsb dx, byte [esi]
mov dword [0xd909acd4], eax
les ecx, [eax]
popfd
xor al, al
rcr byte [edi - 0x64], 0xf6
add eax, 0x100b6b55
xchg byte [edi], cl
test dword [ecx + eax], edx
add byte [eax], al
pop edi
pushfd
test byte [0x100b6b55], 0x86
jne 0x100b6c56
add dword [eax], eax
add byte [esi], al
push es
pop eax
mov ecx, 0xad5fc4db
in eax, dx
mov ch, 0x6e
xlatb
loop 0x100b6bb1
out 0x91, al
xlatb
push esp
pop eax
ja 0x100b6ba1
enter 0x2030, 0x4c
fcmovnb st(0), st(0)
cmpsb byte [esi], byte es:[edi]
pop esp
loopne 0x100b6bde
cmp cl, byte [esp + edx*4]
cdq
fmul dword [ebp + 0x64]
cmp eax, 0x971aa292
cld
sbb eax, 0xcc0f14a5
sbb byte [edi + 0x70], 0x54
loopne 0x100b6b32
adc ah, byte [ebx]
leave
stc
xor byte [edx - 0x43], 0xa4
pop esp
xlatb
sti
mov eax, dword [0xb5f2add3]
pop ds
and dword [ebx - 0x705b787a], ebp
les ebp, [ecx + 0x13]
insb byte es:[edi], dx
rcl dword [edx], 0x1f
movsd dword es:[edi], dword [esi]
add dword [ebp - 0x6e], eax
lahf
adc dh, byte [eax + esi*8 - 0x4e]
xchg esp, eax
xchg dword [eax + 3], ebx
pop ebp
inc ebp
invalid
xor dword [edx + 0x764f245f], 0xffffffbc
dec eax
mov ah, 0x33
adc eax, 0x4443de3d
xchg esi, esp
in al, 0xfe
jns 0x100b6be5
test dword [ecx - 0x2c], esp
mov eax, dword [0x5bffc4f9]
test al, 0x3a
in eax, dx
jns 0x100b6c19
xor al, 0xbd
and dword [esi + ebp*2], ebp
mov ebx, 0x40d7a0ec
xchg ebp, eax
inc ebx
inc edi
inc ebp
add eax, 0x873ef697
popfd
xchg dword [edx], edi
xchg esp, eax
test eax, 0x2731a020
mov cl, 0x4c
idiv byte [esi]
xchg dword [ebp - 0x566bc579], ebx
and byte [eax + 0x4cb12731], ah
cwde
inc edx
xchg edx, eax
adc dword [edx - 0x3581d912], edi
push esi
mov edx, 0xc5d338d5
or byte [eax + ebp + 0x5d], bl
mov eax, 0x638edf01
scasb al, byte es:[edi]
idiv bl
add eax, 0x4cef0794
add dword [ebx + 0x4cb03b95], esp
dec esp
push 0xffffffffffffffbf
salc
and ah, byte [0x330dbe3]
salc
nop
lea eax, [ebx + 0x2e8583ac]
aam 0x2f
into
push ecx
pop edi
pop edi
insd dword es:[edi], dx
pop esp
sub dword [ebp + 0x66], eax
pop ecx
in al, dx
int 0xa6
mov edi, 0x4aabd7e2
xor eax, 0x64e8ec29
pop ebp
imul edx, dword [edi], 0xcf09850b
adc eax, 0x9e3e3a7e
push ebx
das
jb 0x100b6caa
pop es
popfd
pop esi
pushfd
test byte [0x100b6ca8], 0xca
jne 0x100b6ca9
pushfd
push ds
mov ch, 0xa4
push 0xfffffffffffffffa
adc eax, esp
rcr dword [ebp + 0x61e3f2c1], 0xed
pop ss
cmp al, 0x7f
inc ebp
loopne 0x100b6ca5
in al, dx
out 0xfa, eax
pop ebp
clc
dec ebp
pushfd
cmp dword [edi - 0x47], 0xffffffd2
add al, 0xf3
ror dl, 1
adc esi, dword [edx - 0x5e]
mov edi, 0x710d1446
and bh, dh
cld
loop 0x100b6cea
jg 0x100b6cb9
cwde
pop edx
pop ebp
test eax, 0x61ef3997
xchg edi, eax
mov al, 0xf8
jne 0x100b6d1f
pop eax
pop edx
mov cl, 0xf
outsb dx, byte [esi]
dec esp
out dx, eax
movd mm1, dword [edi + ebp*8 - 0x63]
popfd
pop ebx
pushfd
test byte [0x100b6d1e], 0xe8
jne 0x100b6d1f
pushfd
inc esp
sub bh, byte [ebp - 0x61d3999a]
sub al, 0x9e
ror dl, 0xc7
mov ebx, 0xc4ec3346
xlatb
and eax, 0x6818762e
xchg dword [ebp + 0x72], ebx
int3
retf 0xbbc7
xchg edx, eax
push ebx
dec esp
mov eax, dword [0xbfcd31a3]
inc ebp
int 0xaa
mov bl, 0xc0
sub ah, dl
fdiv st(3), st(0)
pop es
cmp byte [edx + 0x70], al
and dword [esi + 0x39d76d06], 0x6fe3001b
mov esi, 0x7b041c1e
mov ch, 0xb2
cmpsd dword [esi], dword es:[edi]
sub ecx, esp
jb 0x100b6d8f
jge 0x100b6d57
je 0x100b6cbe
insb byte es:[edi], dx
jne 0x100b6d79
out 0x16, eax
dec ebp
popfd
pop ebp
ret 0xc
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x100b548c
push ebx
push ebx
pushfd
test byte [0x100b6d68], 0x44
je 0x100b6e69
dec ecx
xchg ebx, eax
mov edx, 0x429219db
sub dword [ecx - 0x2429cb28], eax
or dword [ebx + 0x306b82d7], edx
test eax, 0x22e070c7
xor byte [ecx + 0x22e070c7], ch
mov eax, 0x98d8a39a
pop ds
into
test al, 0xdd
sahf
jbe 0x100b6d1c
sbb byte ss:[ebp + 0x1d41a47b], dl
aad 4
test eax, 0x342c8364
mov dh, 0x45
movsb byte es:[edi], byte [esi]
inc ecx
sbb eax, 0x64a904d5
sub dword [esp + esi], 0xffffffb6
inc ebp
pop esi
push ebx
shr bl, 1
shr ebp, 0x4e
sbb al, 0x30
cmp al, 0x80
mov ah, 0x58
jns 0x100b6d9f
sal byte [ebp + 0x74], 0xc2
aas
dec eax
dec edi
cmp eax, 0xecfb4c98
insd dword es:[edi], dx
in eax, dx
js 0x100b17fb
sub eax, 0x9192b441
mov al, byte [0x41d7580f]
pop edi
xchg esp, eax
dec ebx
je 0x100b6e28
pop eax
or eax, dword gs:[eax - 0xa]
movsd dword es:[edi], dword [esi]
add ch, byte [eax - 0x75a41765]
lahf
in al, dx
push es
cmp eax, dword [ebx]
stc
movsd dword es:[edi], dword [esi]
mov ecx, 0xa8293c74
cmp cl, byte [0xaf722692]
pop esp
mov dword [0x4d01a92a], eax
not byte [edi + 0x4c7fee7f]
dec esp
inc eax
inc ebp
xor al, 5
test dword [ecx], eax
or ah, dh
mov esp, 0x8abfd1e8
and eax, 0x692186e6
mov al, byte [0x8fe1e23e]
sbb eax, 0xcd1f9219
xchg esi, eax
or al, 0xcf
pop bx
push 0xce4590bd
in al, 0x4b
pop ebp
jle 0x100b6e3d
add eax, 0xc981b0d2
mov al, 0x81
leave
inc ecx
inc ebx
xchg ebp, eax
out 0x2f, al
xchg ebp, eax
dec ebx
inc ebp
insb byte es:[edi], dx
cli
test dword [esi - 0x73], ebx
mov eax, dword [0xe5d6c3e4]
sal dword [ebp - 0x4d4db836], cl
inc ebx
dec ecx
sub edx, edi
inc eax
cmp bh, byte [esi]
out dx, al
cmpsb byte [esi], byte es:[edi]
js 0x100b6e70
aaa
cmp eax, 0x999ae84c
les esp, [ebx + eax*2 + 0x30847669]
bswap edi
jecxz 0x100b6e7e
imul esi, dword [esi - 0x7c], 0xe3cf0f30
pop ds
int3
popfd
mov dword [esi + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
popal
adc al, 0x10
cmp eax, ebx
jne 0x100b6fd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
bound edx, qword [eax + edx]
push eax
push str.Create_RecvThread_Faild_With_Error__d
pushfd
test byte [0x100b6e96], 0xe0
jne 0x100b6f97
dec ecx
das
mov word [edi], gs
movsb byte es:[edi], byte [esi]
pop eax
sets byte [eax]
std
test dword [eax], 0x2268d767
push ss
nop
test al, 0xd8
dec esp
mov dl, 0x3e
add eax, 0x8fd5aeca
and al, 0xad
xchg ecx, eax
jle 0x100b6f03
cdq
xchg esp, eax
xor dh, byte [ecx - 0x17]
xchg ecx, eax
xor eax, 0xbb29a690
jle 0x100b6ecd
push ebp
stosb byte es:[edi], al
push ss
pop eax
pop ebp
cmp bl, byte [ebp + 0x729350c7]
mov byte [ecx], dl
movsb byte es:[edi], byte [esi]
rol bl, cl
adc al, 0xae
aad 0x2e
clc
jb 0x100b6e57
adc dword [edx + edx*8 - 0x2a51eb3d], esp
clc
pop ecx
dec esp
mov esi, 0xd005e67f
fdivr st(2)
sti
push 0x1b
inc esp
test dword [esi - 0x38], ecx
sbb byte [edx], al
and al, 0xf7
popal
xchg ebx, eax
aas
in al, dx
adc ebx, ebx
xchg edi, eax
sub eax, 0x2bf12421
int3
ficomp dword [eax + 0x4b]
out 0x17, eax
pop ss
js 0x100b6f7c
dec ecx
adc edi, dword [ecx + 4]
mov dword [0x31fb7903], eax
and edx, edi
loopne 0x100b6f7a
mov ecx, 0x1153d7ca
pop ebp
push ds
push esp
pop esp
or dword [ecx], ebp
jno 0x100b6ecd
mov dl, 0x81
test al, 0xc
stosd dword es:[edi], eax
mov al, 0xf7
cwde
mov edx, 0xd455bc79
stosd dword es:[edi], eax
in al, 0xd5
and al, 0x5e
xor eax, 0xdcf33fc2
fdiv st(1), st(0)
xchg edx, eax
jne 0x100b6eff
ficomp dword [eax - 0x75]
mov ebx, 0x9b3ef155
ffreep st(1)
jo 0x100b6f1a
scasb al, byte es:[di]
or ecx, dword [esi]
aam 0x7a
sbb ebx, eax
dec esp
jo 0x100b6f6e
mov dword [eax - 0x32393245], ebx
sub byte [edx - 7], 0xc2
adc ebp, dword [eax - 0x74]
jne 0x100b6f91
ret 0x6813
xor esi, edx
cmp bh, byte [edi + 0x5307d501]
loopne 0x100b6f5d
dec esp
adc ax, 0xa948
push esp
bound edi, qword [edi - 0x5ae12eb1]
test ah, bh
cld
cwde
push 0xffffffffffffffb0
dec edx
adc al, byte [edi - 0x32c901e9]
outsb dx, byte [esi]
pushal
cmc
add byte [0x5abcbd90], 0x52
mov ebp, 0x636bb7e
insd dword es:[edi], dx
xor al, 0xce
mov ebx, 0x346d0636
into
popfd
push ebx
push ebx
call fcn.10049c0c
add esp, 0x10
push dword [esi + 0x5c]
pushfd
test byte [0x100b6fc5], 0x9f
jne 0x100b6fc6
out dx, al
fistp dword [eax + ebx*4 + 0x3bdf588d]
aad 0x30
cmp al, 0x14
lea ebp, [eax]
or ecx, esi
out dx, eax
and eax, 0x3e2d2a4
popfd
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x100b6b31
push eax
call edi
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x100b3c9c
push ebx
pushfd
test byte [0x100b6ff6], 0xf8
or edx, dword [eax]
clc
jne 0x100b6ff7
push ebp
pop eax
mul dword [ecx - 0x462fdd6]
cmp dword [ebx - 0x63], edi
in al, dx
popfd
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x100b7011
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Create_SEND_Thred_Faild_With_Error__d
jmp 0x100b6f98
push eax
pushfd
test byte [0x100b704d], 0x5e
jne 0x100b714e
add dword [eax], eax
add byte [edi - 0x62], al
inc edi
sahf
dec edx
test al, 0x2c
jns 0x100b701d
pushfd
pop dword [ecx]
inc esp
xor esi, ecx
stc
inc esi
aas
in al, dx
enter 0x64a3, 0xffffffffffffff8e
pop eax
out 0x77, eax
out 0xd5, al
and eax, 0xcae0755e
enter 0x31cd, 0xffffffffffffffae
dec esi
sbb edi, dword [ebp - 0x37f929cd]
jae 0x100b7072
sbb ebp, dword [ecx]
js 0x100b6fe6
pop ebx
stc
loop 0x100b70ad
fnstenv [0xd6d00051]
cmp edx, esp
ficom dword [ecx]
aaa
dec edx
sbb byte [edi + 0x59], al
adc dword [edi - 0x270c2243], ebx
int3
fmul st(4)
lds ebx, [esi + 0x4e]
test byte [eax + 0x5502fe95], bh
inc byte [edx]
push ebp
add al, bl
xchg ebp, eax
test byte [esi - 0x58], ah
popfd
dec esp
inc ecx
xor byte [edx + 0x43ff9190], dl
popal
xchg ecx, eax
inc dword [ebx + 0x61]
mov ecx, 0xf02e560c
push esp
dec ebp
call 0x1defa5c3
mov dword [0xe29afdf3], eax
mov edx, 0xb0ee899e
std
lcall 0xb0ee, 0x899ebae2
dec eax
push 0xef8de9a8
push es
cmp edi, dword [edx + edx*2]
pushfd
insb byte es:[edi], dx
lea edx, [esi*4 + 0x5fa5bebd]
movsd dword es:[edi], dword [esi]
pop edi
dec esi
stosb byte es:[edi], al
cmc
pop ecx
lea ebx, [eax + ecx]
jns 0x100b70bb
xchg ecx, eax
cmp bh, 0xb9
loopne 0x100b70ba
invalid
mov ecx, 0xa97cfce0
jl 0x100b7069
fucomp st(1)
popal
pop edx
aad 0x38
mov edi, 0x8eff1b75
jl 0x100b70ac
popal
outsb dx, byte [esi]
or bh, 0x34
jecxz 0x100b7092
or esi, dword [edx + ebp*4 - 0x42]
rcr edi, 0x8b
mul byte [ecx + 8]
test ebp, ebx
push cs
mov ecx, 0x871ba605
jnp 0x100b70f8
je 0x100b7081
mov esi, 0xf68bdfc1
popal
or byte [ebp + 0x5b90edd], al
cmpsb byte [esi], byte es:[edi]
sbb eax, dword [edi - 0x14faef85]
mov byte [0xe3fa3390], al
invalid
add eax, 0x3390a2eb
cli
jecxz 0x100b70ee
pushfd
leave
in al, dx
cmpsd dword [esi], dword es:[edi]
in al, dx
xchg edi, eax
inc ebp
outsb dx, byte [esi]
out 0x23, eax
mov cl, 0x2d
mov al, byte [0xa877a044]
cmp dword [edx - 0x33282816], edi
push ebx
pop edx
stosb byte es:[edi], al
jo 0x100b70d5
test eax, 0x340b78a4
in al, dx
inc esi
sub eax, edx
sub ecx, dword [0xb49ad03]
dec ebx
cdq
les edx, [eax + 0x346950b0]
test dword [esi + 0x4ef67588], eax
mov esi, esi
mov al, byte [0x162d7596]
mov edi, 0xd93d5ecf
sbb eax, 0x726a84f6
out dx, eax
xchg dword [esi + 0x76], edx
adc dword [ecx], ebp
push es
push esp
out 0xa1, eax
mov word [esi + 0x4c24c138], ds
push esp
inc edi
lahf
popfd
call edi
mov byte [esi + 0x61], 1
mov al, 1
jmp 0x100b6b33