Function at 0x100106aa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
mov ecx, 0xeaa25dde
cmp ecx, 0xe9fd9f1d
jle 0x10010789
cmp ecx, 0x2dfb0242
jg 0x100107f0
cmp ecx, 0x13af77a0
jg 0x1001088b
cmp ecx, 0xefc12f83
jle 0x10010a79
cmp ecx, 0xf6a5eaf7
jg 0x10010db3
cmp ecx, 0xf53165a7
jg 0x10011377
cmp ecx, 0xefc12f84
je 0x1001139f
cmp ecx, 0xf10c82eb
jne 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x998abfb5
mov edx, eax
and edx, 0x6675404a
or edx, ecx
xor edx, 0x6675404b
and eax, 0xfffffffe
or eax, edx
xor eax, 0xf91dc0e6
xor eax, 0x6e23f19
sete al
setne cl
cmp dword [0x10098e08], 0xa
setge dl
setl ah
mov dh, ah
xor dh, cl
and dh, ah
and dl, al
and ah, cl
or ah, dl
mov al, dh
xor al, ah
test ah, ah
mov ecx, 0xc4677321
mov esi, 0x95f781ef
cmovne ecx, esi
test dh, dh
mov edx, 0xc4677321
jmp 0x10011150
cmp ecx, 0xb517535c
jg 0x10010839
cmp ecx, 0x9f1c16a3
jg 0x1001094a
cmp ecx, 0x969c5ac3
jg 0x10010b09
cmp ecx, 0x8b5dc478
jg 0x10010e38
cmp ecx, 0x822a048b
je 0x10011422
cmp ecx, 0x8798cd79
je 0x1001142c
cmp ecx, 0x88dbedbe
jne 0x100106bb
mov eax, dword [ebp - 0x20]
mov dword [eax], 2
mov ecx, 0xb517535d
jmp 0x100106bb
cmp ecx, 0x59bd2770
jg 0x10010998
cmp ecx, 0x4adb4f5d
jg 0x10010b99
cmp ecx, 0x423104ec
jg 0x10010eb4
cmp ecx, 0x2dfb0243
je 0x10011436
cmp ecx, 0x39ccb7c3
je 0x1001148c
cmp ecx, 0x3c5d4ff5
je 0x10010881
jmp 0x100106bb
cmp ecx, 0xc90e9f41
jg 0x10010a33
cmp ecx, 0xbc676dcd
jg 0x10010bd3
cmp ecx, 0xba3ff50b
jg 0x10010f2f
cmp ecx, 0xb517535d
je 0x100114f9
cmp ecx, 0xb53947ee
je 0x10011560
cmp ecx, 0xb9f790a8
jne 0x100106bb
mov ecx, 0x9f1c16a4
jmp 0x100106bb
cmp ecx, 0x2318f006
jg 0x10010c10
cmp ecx, 0x1f79aa4e
jg 0x10010fb6
cmp ecx, 0x13af77a1
je 0x10011572
cmp ecx, 0x1a502b56
je 0x1001157c
cmp ecx, 0x1f54fb70
jne 0x100106bb
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x10], eax
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push dword [ebp + 0xc]
call fcn.1000cc5f
add esp, 4
mov edx, dword [0x10098e04]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov ebx, edx
and ebx, 0xfffffffe
and ecx, 1
or ecx, ebx
xor edx, ecx
test edx, ecx
setne cl
sete dl
cmp dword [0x10098e08], 0xa
setl dh
setge ch
and dl, ch
and dh, cl
or dh, dl
or ch, cl
mov dl, ch
xor dl, dh
test ch, ch
mov ecx, 0x588c31b5
mov esi, 0xd7544f96
cmovne ecx, esi
test dh, dh
cmove ecx, esi
mov dword [ebp - 0x28], eax
test dl, dl
mov eax, 0x588c31b5
cmove ecx, eax
jmp 0x100106bb
cmp ecx, 0xaaaf3b8d
jg 0x10010c9c
cmp ecx, 0xa4464ed8
jg 0x1001103b
cmp ecx, 0x9f1c16a4
je 0x100115db
cmp ecx, 0xa2041e42
je 0x100115e8
cmp ecx, 0xa28286a0
jne 0x100106bb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov ecx, 0xf10c82eb
jmp 0x100106bb
cmp ecx, 0x70f4e09c
jg 0x10010cdc
cmp ecx, 0x6819e7c2
jg 0x100110ca
cmp ecx, 0x59bd2771
je 0x10011642
cmp ecx, 0x5d2b6721
je 0x1001164c
cmp ecx, 0x602a2067
jne 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xd97436a6
mov edx, eax
and edx, 0x268bc959
or edx, ecx
xor edx, 0x268bc958
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e08], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0xde3fb3e9
mov esi, 0x207e40bd
jmp 0x10011faa
cmp ecx, 0xd7544f95
jg 0x10010d20
cmp ecx, 0xcada72a2
jg 0x10011158
cmp ecx, 0xc90e9f42
je 0x10011656
cmp ecx, 0xc9beb014
je 0x100116a7
cmp ecx, 0xc9ff88e3
jne 0x100106bb
mov ecx, 0x4ca65808
jmp 0x100106bb
cmp ecx, 0xee70ad1e
jg 0x10011186
cmp ecx, 0xe9fd9f1e
je 0x100116bd
cmp ecx, 0xeaa25dde
je 0x1001170b
cmp ecx, 0xec3110b5
jne 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xb564c06
mov edx, eax
and edx, 0xf4a9b3f9
or edx, ecx
xor edx, 0xf4a9b3f8
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
and dl, ah
xor ah, dl
test al, al
mov ecx, 0xdb0d7db8
mov esi, 0xd9ff8c01
cmovne ecx, esi
test dl, dl
mov edx, 0xdb0d7db8
jmp 0x10011a39
cmp ecx, 0x9b5c83f5
jg 0x10011215
cmp ecx, 0x969c5ac4
je 0x1001176c
cmp ecx, 0x9b3ca945
je 0x10011776
cmp ecx, 0x9b46ecd1
jne 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x5818c190
mov edx, eax
and edx, 0xa7e73e6f
or edx, ecx
xor edx, 0xa7e73e6e
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
and dl, ah
xor ah, dl
test al, al
mov ecx, 0x4f48b647
mov esi, 0x1a502b56
cmovne ecx, esi
test dl, dl
mov edx, 0x4f48b647
jmp 0x10011a39
cmp ecx, 0x510540a9
jg 0x1001124e
cmp ecx, 0x4adb4f5e
je 0x10011780
cmp ecx, 0x4ca65808
je 0x1001178a
cmp ecx, 0x4f48b647
jne 0x100106bb
mov ecx, 0x1a502b56
jmp 0x100106bb
cmp ecx, 0xc5c2e7fb
jg 0x1001127c
cmp ecx, 0xbc676dce
je 0x100117d0
cmp ecx, 0xc45a2de7
je 0x10011833
cmp ecx, 0xc4677321
jne 0x100106bb
mov eax, dword [ebp - 0x14]
mov ecx, 0x95f781ef
jmp 0x100106bb
cmp ecx, 0x265d6e04
jg 0x100112aa
cmp ecx, 0x2318f007
je 0x10011885
cmp ecx, 0x234047d8
je 0x100118f2
cmp ecx, 0x2561ced3
jne 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne cl
sete dl
cmp dword [0x10098e08], 0xa
setl al
setge ah
and dl, ah
and al, cl
or al, dl
or ah, cl
mov cl, ah
xor cl, al
mov edx, 0x1f79aa4f
mov ecx, 0x6819e7c3
cmovne edx, ecx
test ah, ah
mov ecx, 0x1f79aa4f
cmovne ecx, edx
jmp 0x10011fb4
cmp ecx, 0xaff2a87b
jg 0x100112e1
cmp ecx, 0xaaaf3b8e
je 0x10011940
cmp ecx, 0xae00e0df
je 0x1001194a
cmp ecx, 0xaebd1107
jne 0x100106bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov ecx, 0xcb056c02
jmp 0x100106bb
cmp ecx, 0x77264e33
jg 0x1001130f
cmp ecx, 0x70f4e09d
je 0x10011960
cmp ecx, 0x72d9a09a
je 0x100119b5
cmp ecx, 0x74b39da0
jne 0x100106bb
mov eax, dword [ebp - 0x3c]
cmp eax, 0x78
setl byte [ebp - 0x17]
mov ecx, 0x7e8d848b
jmp 0x100106bb
cmp ecx, 0xdb0d7db7
jg 0x10011349
cmp ecx, 0xd7544f96
je 0x100119bf
cmp ecx, 0xd9ff8c01
je 0x100119d4
cmp ecx, 0xda24d8fd
jne 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0xaa57813f
mov esi, 0xf5590be7
cmovne ecx, esi
test dl, dl
cmove ecx, esi
test al, al
mov eax, 0xaa57813f
cmove ecx, eax
jmp 0x100106bb
cmp ecx, 0xf6a5eaf8
je 0x100119ea
cmp ecx, 0x76a0425
je 0x10011a46
cmp ecx, 0xf070a8d
jne 0x100106bb
mov dword [ebp - 0x34], edi
mov edi, dword [ebp - 0x24]
mov ecx, edi
not ecx
mov eax, edi
xor eax, 0x400
mov edx, edi
and edx, 0x2278a78c
mov ebx, ecx
and ebx, 0xdd875873
or ebx, edx
xor ebx, 0xdd875c73
mov esi, 0xfffffbff
and ecx, esi
or ecx, ebx
mov edx, edi
mov edi, dword [ebp - 0x34]
xor edx, esi
mov ebx, edx
and ebx, 0xbbedc08c
mov esi, 0x44123f73
and eax, esi
or eax, ebx
xor eax, esi
xor eax, ecx
or edx, ecx
not edx
or edx, eax
mov dword [ebp - 0x38], edx
mov ecx, 0x43166518
jmp 0x100106bb
cmp ecx, 0x8b5dc479
je 0x10011a50
cmp ecx, 0x94fa1933
je 0x10011ac4
cmp ecx, 0x95f781ef
jne 0x100106bb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [0x10098e04]
lea ecx, [edx - 1]
imul ecx, edx
test cl, 1
sete dh
cmp dword [0x10098e08], 0xa
setl dl
setge bl
and dh, bl
and dl, cl
or dl, dh
or bl, cl
mov ecx, ebx
xor cl, dl
test cl, 1
mov esi, 0xa5ca6171
mov ecx, 0xc4677321
cmovne esi, ecx
test bl, 1
mov ecx, 0xa5ca6171
cmovne ecx, esi
mov dword [ebp - 0x3c], eax
test dl, dl
cmove ecx, esi
jmp 0x100106bb
cmp ecx, 0x423104ed
je 0x10011b14
cmp ecx, 0x43166518
je 0x10011b77
cmp ecx, 0x43eb6195
jne 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
mov ebx, 0x5d2b6721
mov esi, 0x6c8916a8
cmovne ebx, esi
not ah
test ah, dl
cmovne ebx, esi
test al, al
mov ecx, ebx
cmovne ecx, esi
test ah, dl
cmove ecx, ebx
jmp 0x100106bb
cmp ecx, 0xba3ff50c
je 0x10011b87
cmp ecx, 0xbb65341d
je 0x10011b9f
cmp ecx, 0xbbd2ab4f
jne 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0x39ccb7c3
mov esi, 0xb413878d
cmovne ecx, esi
test dl, dl
cmove ecx, esi
test al, al
mov eax, 0x39ccb7c3
cmove ecx, eax
jmp 0x100106bb
cmp ecx, 0x1f79aa4f
je 0x10011bac
cmp ecx, 0x207e40bd
je 0x10011c21
cmp ecx, 0x22fb785d
jne 0x100106bb
mov edi, dword [ebp - 0x28]
test edi, edi
setne byte [ebp - 0x15]
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
test dl, dl
mov ecx, 0xbb65341d
mov edx, 0xc9beb014
cmovne ecx, edx
test ah, ah
mov esi, 0xbb65341d
jmp 0x10011fb1
cmp ecx, 0xa4464ed9
je 0x10011c2b
cmp ecx, 0xa5ca6171
je 0x10011c35
cmp ecx, 0xaa57813f
jne 0x100106bb
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [eax], 2
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x8d3ae7a9
mov edx, eax
and edx, 0x72c51856
or edx, ecx
xor edx, 0x72c51857
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
not ah
mov ecx, 0xf5590be7
mov esi, 0xb9f790a8
cmovne ecx, esi
test ah, dl
mov edx, 0xf5590be7
jmp 0x100119a5
cmp ecx, 0x6819e7c3
je 0x10011c3f
cmp ecx, 0x68eaf318
je 0x10011c53
cmp ecx, 0x6c8916a8
jne 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x64f86eb7
and eax, 0x9b079148
or eax, edx
xor eax, 0x64f86eb6
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setge dl
setl ah
mov dh, ah
xor dh, cl
and dh, ah
and dl, al
and ah, cl
or ah, dl
mov al, dh
xor al, ah
test ah, ah
mov ecx, 0xc9ff88e3
mov esi, 0x4ca65808
cmovne ecx, esi
test dh, dh
mov edx, 0xc9ff88e3
cmove ecx, edx
jmp 0x100119ab
cmp ecx, 0xcada72a3
je 0x10011c8a
cmp ecx, 0xcb056c02
je 0x10011ce2
cmp ecx, 0xd153631e
jne 0x100106bb
mov ecx, 0xae00e0df
jmp 0x100106bb
cmp ecx, 0xee70ad1f
je 0x10011d4d
cmp ecx, 0xee7a2a9f
je 0x10011d5e
cmp ecx, 0xef207b80
jne 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne cl
sete ah
cmp dword [0x10098e08], 0xa
setl al
setge ch
mov edx, eax
or al, ah
and ah, ch
and dl, cl
or dl, ah
xor ch, cl
xor al, 1
or al, ch
mov ah, al
xor ah, dl
test al, al
mov ecx, 0xf6a5eaf8
mov esi, 0x4adb4f5e
cmovne ecx, esi
test dl, dl
cmove ecx, esi
test ah, ah
mov eax, 0xf6a5eaf8
cmove ecx, eax
jmp 0x100106bb
cmp ecx, 0x9b5c83f6
je 0x10011d68
cmp ecx, 0x9b8dcecc
je 0x10011dcb
cmp ecx, 0x9d1e25bd
jne 0x100106bb
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x423104ed
jmp 0x100106bb
cmp ecx, 0x510540aa
je 0x10011dde
cmp ecx, 0x525d960c
je 0x10011e38
cmp ecx, 0x588c31b5
jne 0x100106bb
mov ecx, 0x510540aa
jmp 0x100106bb
cmp ecx, 0xc5c2e7fc
je 0x10011eab
cmp ecx, 0xc5cb3b1b
je 0x10011f07
cmp ecx, 0xc843124a
jne 0x100106bb
mov ecx, 0xc90e9f42
jmp 0x100106bb
cmp ecx, 0x265d6e05
je 0x10011f37
cmp ecx, 0x26cdacaf
je 0x10011f55
cmp ecx, 0x2d75f482
jne 0x100106bb
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
mov ecx, 0xf53165a8
jmp 0x100106bb
cmp ecx, 0xaff2a87c
je 0x10011f5f
cmp ecx, 0xb413878d
je 0x10011fbe
cmp ecx, 0xb487818f
jne 0x100106bb
mov ecx, 0x2d75f482
jmp 0x100106bb
cmp ecx, 0x77264e34
je 0x10011fd8
cmp ecx, 0x78cfa309
je 0x10011fe2
cmp ecx, 0x7e8d848b
jne 0x100106bb
cmp byte [ebp - 0x17], 0
mov ecx, 0x88dbedbe
mov eax, 0x2318f007
cmovne ecx, eax
jmp 0x100106bb
cmp ecx, 0xdb0d7db8
je 0x10011ff5
cmp ecx, 0xdb6d84ad
je 0x10011fff
cmp ecx, 0xde3fb3e9
jne 0x100106bb
mov ecx, 0x602a2067
jmp 0x100106bb
cmp ecx, 0xf5590be7
jne 0x1001204c
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [eax], 2
mov ecx, 0xaa57813f
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x29aa49a
mov edx, eax
and edx, 0xfd655b65
or edx, ecx
xor edx, 0xfd655b64
and eax, 0xfffffffe
or eax, edx
mov ecx, dword [ebp - 0x1c]
xor eax, 0x1efb46d1
cmp eax, 0xe104b92e
setne al
cmp dword [0x10098e08], 0xa
mov dword [ebp - 0x40], ecx
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0xee7a2a9f
mov esi, 0xaff2a87c
cmovne ecx, esi
test dl, dl
mov edx, 0xee7a2a9f
cmovne ecx, edx
test al, al
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edi
cmove ecx, esi
jmp 0x100106bb
mov ecx, 0x9b8dcecc
jmp 0x100106bb
mov ecx, 0x2dfb0243
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea edx, [eax + 1]
imul edx, eax
test dl, 1
sete ah
cmp dword [0x10098e08], 0xa
setge al
setl cl
and dl, cl
and al, ah
or al, dl
mov edx, ecx
xor dl, ah
or cl, ah
xor cl, 1
or cl, dl
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0xaaaf3b8e
mov esi, 0x8798cd79
cmovne ecx, esi
test al, al
cmove ecx, esi
test dl, dl
mov eax, 0xaaaf3b8e
cmove ecx, eax
jmp 0x100106bb
xor eax, eax
mov dword [ebp - 0x1c], eax
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
setne byte [ebp - 0x16]
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete ch
cmp dword [0x10098e08], 0xa
setl cl
setge dh
mov dl, cl
or cl, ch
and ch, dh
and dl, al
or dl, ch
xor dh, al
xor cl, 1
or cl, dh
mov eax, ecx
xor al, dl
test al, 1
mov eax, 0x969c5ac4
mov esi, 0xb413878d
cmovne eax, esi
test cl, 1
mov ecx, 0x969c5ac4
cmovne ecx, eax
test dl, dl
cmove ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x6f74e4a2
and eax, 0x908b1b5d
or eax, edx
xor eax, 0x6f74e4a3
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e08], 0xa
setge dl
setl ah
xor ah, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0xc90e9f42
mov edx, 0xc843124a
cmovne ecx, edx
test ah, ah
cmove ecx, edx
test al, al
mov eax, 0xc90e9f42
cmove ecx, eax
jmp 0x100106bb
push dword [ebp - 0x30]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov ecx, 0x8b5dc479
jmp 0x100106bb
mov ecx, 0x2561ced3
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x7e4e0b6a
and eax, 0x81b1f495
or eax, edx
xor eax, 0x7e4e0b6b
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
or ah, cl
xor dl, al
mov al, ah
xor al, dl
mov esi, 0x234047d8
mov ecx, 0x4f48b647
cmovne esi, ecx
test dl, dl
mov ecx, esi
mov edx, 0x234047d8
jmp 0x10011826
mov eax, dword [ebp - 0x14]
mov ecx, 0x76a0425
jmp 0x100106bb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x10098e04]
lea edx, [ecx + 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x10098e08], 0xa
setl ch
xor dl, ch
mov bl, ch
xor bl, cl
or ch, cl
xor ch, 1
or ch, bl
mov ebx, edx
xor bl, ch
test ch, ch
mov ecx, 0xd153631e
mov esi, 0xa4464ed9
cmovne ecx, esi
mov dword [ebp - 0x54], eax
test dl, 1
cmovne ecx, esi
not bl
test bl, 1
mov eax, 0xd153631e
cmove ecx, eax
jmp 0x100106bb
mov ecx, 0x68eaf318
jmp 0x100106bb
mov ecx, 0x6c8916a8
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x10098e08], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, 1
mov ecx, 0x3c5d4ff5
mov edx, 0xc843124a
cmovne ecx, edx
test al, al
cmove ecx, edx
not ah
test ah, 1
mov eax, 0x3c5d4ff5
cmovne ecx, eax
jmp 0x100106bb
cmp byte [ebp - 0x15], 0
mov ecx, 0x2d75f482
mov eax, 0xee70ad1f
cmovne ecx, eax
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
setne al
cmp dword [0x10098e08], 0xa
setge cl
setl dl
xor dl, al
or cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x602a2067
mov esi, 0xde3fb3e9
cmovne ecx, esi
test dl, dl
cmovne ecx, esi
test al, al
mov eax, 0x602a2067
cmovne ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x42a5095b
and eax, 0xbd5af6a4
or eax, edx
xor eax, 0xbd5af6a5
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
mov ecx, 0xd7544f96
mov esi, 0x1f54fb70
cmovne ecx, esi
not ah
test ah, dl
mov ebx, 0xd7544f96
cmove ecx, ebx
test al, al
cmovne ecx, esi
test ah, dl
cmovne ecx, esi
jmp 0x100106bb
mov ecx, 0x43eb6195
jmp 0x100106bb
mov ecx, 0xdb6d84ad
jmp 0x100106bb
mov ecx, 0xf6a5eaf8
jmp 0x100106bb
mov ecx, dword [0x10098e04]
mov eax, ecx
not eax
imul eax, ecx
and al, 1
cmp dword [0x10098e08], 0xa
setge cl
mov edx, ecx
or dl, al
xor al, cl
mov ecx, edx
xor cl, al
mov ebx, 0x94fa1933
mov ecx, 0xc9ff88e3
cmovne ebx, ecx
test al, al
mov ecx, ebx
mov eax, 0x94fa1933
cmovne ecx, eax
test dl, dl
cmovne ecx, ebx
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
mov esi, 0x822a048b
mov ecx, 0x77264e34
cmovne esi, ecx
test dl, dl
mov ecx, esi
mov edx, 0x822a048b
cmovne ecx, edx
test ah, ah
cmovne ecx, esi
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0xec3110b5
mov esi, 0xdb0d7db8
cmovne ecx, esi
test dl, dl
cmove ecx, esi
test al, al
mov eax, 0xec3110b5
cmove ecx, eax
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x734caa04
mov edx, eax
and edx, 0x8cb355fb
or edx, ecx
xor edx, 0x8cb355fa
and eax, 0xfffffffe
or eax, edx
xor eax, 0x21d94b69
cmp eax, 0xde26b496
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
mov ecx, 0x72d9a09a
mov ebx, 0xcada72a3
cmovne ecx, ebx
not ah
test ah, dl
mov esi, 0x72d9a09a
cmove ecx, esi
test al, al
cmovne ecx, ebx
test ah, dl
cmovne ecx, ebx
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e08], 0xa
setl dl
setge ch
and cl, ch
and dl, al
or dl, cl
or ch, al
mov al, ch
xor al, dl
test ch, 1
mov ecx, 0xa2041e42
mov esi, 0xa4464ed9
cmovne ecx, esi
test dl, dl
cmove ecx, esi
test al, 1
mov eax, 0xa2041e42
cmove ecx, eax
jmp 0x100106bb
mov ecx, 0xef207b80
jmp 0x100106bb
cmp dword [ebp - 0x54], 0
mov ecx, 0xaebd1107
mov eax, 0x2561ced3
cmove ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
not ah
mov ecx, 0x8798cd79
mov esi, 0x2dfb0243
cmovne ecx, esi
test ah, dl
mov edx, 0x8798cd79
cmove ecx, edx
cmovne ecx, esi
test al, al
cmovne ecx, esi
jmp 0x100106bb
mov ecx, 0xcada72a3
jmp 0x100106bb
push dword [ebp + 0xc]
call fcn.1000cc5f
add esp, 4
mov ecx, 0x1f54fb70
jmp 0x100106bb
cmp byte [ebp - 0x16], 0
mov ecx, 0xc5cb3b1b
mov eax, 0xf070a8d
cmovne ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
and dl, ah
xor ah, dl
test al, al
mov ecx, 0x4adb4f5e
mov esi, 0xb487818f
cmovne ecx, esi
test dl, dl
mov edx, 0x4adb4f5e
cmove ecx, edx
test ah, ah
cmove ecx, esi
jmp 0x100106bb
mov ecx, 0x9b46ecd1
jmp 0x100106bb
push dword [ebp - 0x30]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x66172549
mov edx, eax
and edx, 0x99e8dab6
or edx, ecx
xor edx, 0x99e8dab7
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e08], 0xa
setl cl
mov edx, eax
xor dl, cl
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0x13af77a1
mov esi, 0xb53947ee
cmovne ecx, esi
test dl, dl
cmove ecx, esi
test al, al
mov eax, 0x13af77a1
cmove ecx, eax
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete dl
cmp dword [0x10098e08], 0xa
setl ah
setge al
and dl, al
or al, cl
and ah, cl
or ah, dl
mov ecx, eax
xor cl, ah
test cl, 1
mov edx, 0xc45a2de7
mov ecx, 0x5d2b6721
cmovne edx, ecx
test ah, ah
mov ecx, edx
mov esi, 0xc45a2de7
cmovne ecx, esi
test al, 1
cmovne ecx, edx
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x5154fead
and eax, 0xaeab0152
or eax, edx
xor eax, 0x5154feac
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0x77264e34
mov esi, 0xbc676dce
cmovne ecx, esi
test ah, ah
mov edx, 0x77264e34
jmp 0x1001203f
mov ecx, 0xe9fd9f1e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
jmp 0x100106bb
push 0x10
push dword [ebp - 0x10]
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov eax, dword [ebp - 0x14]
mov ecx, 0x78cfa309
jmp 0x100106bb
mov ecx, 0x22fb785d
mov edi, dword [ebp - 0x28]
jmp 0x100106bb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xb7588a4e
and eax, 0x48a775b1
or eax, edx
xor eax, 0xb7588a4f
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, dl
mov ecx, 0x70f4e09d
mov edx, 0x6819e7c3
cmovne ecx, edx
test al, al
cmove ecx, edx
test ah, ah
mov eax, 0x70f4e09d
cmove ecx, eax
jmp 0x100106bb
mov ecx, 0xc5cb3b1b
jmp 0x100106bb
mov ecx, 0xa2041e42
jmp 0x100106bb
mov ecx, 0x74b39da0
jmp 0x100106bb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, 0x1f79aa4f
jmp 0x100106bb
push dword [ebp - 0x10]
lea eax, [ebp - 0x98]
push eax
xor eax, eax
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push eax
push eax
push eax
push dword [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
mov ecx, 0x265d6e05
mov eax, 0x9d1e25bd
cmove ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e08], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
mov eax, 0x9b5c83f6
mov esi, 0x72d9a09a
cmovne eax, esi
test cl, cl
mov ecx, eax
mov esi, 0x9b5c83f6
cmovne ecx, esi
test dl, dl
cmovne ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xc217bbc1
and eax, 0x3de8443e
or eax, edx
xor eax, 0x3de8443f
xor ecx, eax
test ecx, eax
sete cl
setne al
cmp dword [0x10098e08], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
or cl, dl
xor cl, 1
or cl, ah
xor ah, cl
test cl, cl
mov ecx, 0x8b5dc479
mov edx, 0xb53947ee
cmovne ecx, edx
test al, al
cmovne ecx, edx
test ah, ah
mov eax, 0x8b5dc479
cmove ecx, eax
jmp 0x100106bb
mov ecx, 0x525d960c
mov dword [ebp - 0x24], 0x20
jmp 0x100106bb
mov ecx, 0xefc12f84
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xe644a68d
and eax, 0x19bb5972
or eax, edx
xor eax, 0xe644a68c
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
test dl, dl
mov ecx, 0x26cdacaf
mov edx, 0xc5c2e7fc
cmovne ecx, edx
test ah, ah
mov esi, 0x26cdacaf
jmp 0x10011fb1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x50], eax
mov ecx, 0xa28286a0
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea edx, [eax + 1]
imul edx, eax
test dl, 1
sete ah
cmp dword [0x10098e08], 0xa
setge ch
setl cl
mov al, ch
xor ch, dl
and dl, cl
and al, ah
or al, dl
or cl, ah
xor cl, 1
or cl, ch
mov edx, ecx
xor dl, al
test cl, 1
mov ecx, 0x22fb785d
mov esi, 0xbb65341d
cmovne ecx, esi
test al, al
cmove ecx, esi
not dl
test dl, 1
mov eax, 0x22fb785d
cmovne ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x1f74fde4
and eax, 0xe08b021b
or eax, edx
xor eax, 0xe08b021a
xor ecx, eax
test ecx, eax
sete dl
setne ah
cmp dword [0x10098e08], 0xa
setge al
setl cl
and ah, cl
and al, dl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0xdb6d84ad
mov esi, 0x9b3ca945
cmovne ecx, esi
test al, al
cmove ecx, esi
test dl, dl
mov eax, 0xdb6d84ad
cmove ecx, eax
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e08], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov esi, 0xefc12f84
mov ecx, 0xee7a2a9f
cmovne esi, ecx
test dl, dl
mov ecx, 0xefc12f84
cmovne ecx, esi
jmp 0x10012042
mov esi, 0x44
push esi
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x90], str.Winsta0Default
mov eax, dword [ebp - 0x10]
mov ecx, 0xba3ff50c
jmp 0x100106bb
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, 0xda24d8fd
jmp 0x100106bb
mov ecx, 0xc5c2e7fc
jmp 0x100106bb
mov ecx, dword [0x10098e04]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete cl
setne dl
cmp dword [0x10098e08], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0x26cdacaf
mov esi, 0x59bd2771
cmovne edx, esi
test ch, ch
mov ecx, edx
cmovne ecx, esi
test al, al
cmove ecx, edx
jmp 0x100106bb
xor eax, eax
mov dword [ebp - 0x1c], eax
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
mov ecx, 0x39ccb7c3
jmp 0x100106bb
mov ecx, 0xbc676dce
jmp 0x100106bb
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
mov ecx, 0xf10c82eb
jmp 0x100106bb
mov ecx, 0xec3110b5
jmp 0x100106bb
mov eax, dword [0x10098e04]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
setne al
cmp dword [0x10098e08], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x9b3ca945
mov esi, 0xbbd2ab4f
cmovne ecx, esi
test dl, dl
mov edx, 0x9b3ca945
cmovne ecx, edx
test al, al
cmove ecx, esi
jmp 0x100106bb
cmp ecx, 0xf53165a8
jne 0x100106bb
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret