Function at 0x59ec90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xac
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test eax, eax
je 0x59edc9
mov dword [esp], eax
mov dword [esp + 4], str.K32GetModuleInformation
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x59ee97
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov ecx, 0x3e9
mov dword [esp + 0x98], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x70], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x6c], eax
mov edi, dword [esp + 0xc0]
mov esi, 0xf
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [esp + 0xa0]
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 0xc], 0xc
call dword [esp + 0x1c]
sub esp, 0x10
mov dword [esp + 0x44], 0x3ec
test eax, eax
mov ecx, ebx
mov ebx, dword [esp + 0x88]
jne 0x59ef01
mov edx, 2
mov edi, eax
or edi, 2
xor eax, 2
add eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x4c]
jne 0x59f56f
jmp 0x59f8bb
mov eax, 0xf
mov edi, 0x3e9
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], edx
mov dword [esp + 0x90], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x6c], edx
cmp eax, 6
mov ecx, dword [esp + 0x94]
mov ebx, dword [esp + 0x90]
mov esi, dword [esp + 0x98]
je 0x59ef12
mov edx, eax
and edx, 1
inc edx
xor edx, eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x54], esi
mov ecx, ebp
mov dword [esp + 0x70], ebx
mov dword [esp + 0x14], edi
mov ebx, edi
mov edx, ebp
jne 0x59fa95
jmp 0x59f8f9
mov eax, 0xd
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x88], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x54], edx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x70], edx
mov dword [esp + 0x6c], edx
jmp 0x59ef2b
mov dword [esp + 0x24], ecx
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x4c]
jmp 0x59f8bb
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], ecx
mov dword [esp + 0x54], esi
mov ecx, ebp
mov dword [esp + 0x70], ebx
mov edx, ebp
jmp 0x59f8f9
mov dword [esp + 0x18], ebp
mov dword [esp + 0x64], ecx
mov dword [esp + 0x80], ebx
cmp eax, 0xd
je 0x59ef53
imul eax, eax
and eax, 3
mov ebx, 0x3ed
cmp eax, 3
jne 0x59fa75
mov dword [esp], str.PSAPI.DLL
call fcn.007c60a0
test eax, eax
mov ebx, 0x3ea
je 0x59fa95
mov dword [esp + 0x3c], esi
mov dword [esp + 0x24], eax
xor eax, eax
test al, al
jne 0x59fa95
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], str.GetModuleInformation
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
mov ebx, 0x3eb
je 0x59efd2
xor ecx, ecx
test cl, cl
mov ecx, dword [esp + 0x18]
jne 0x59efdb
mov dword [esp + 0x1c], eax
mov eax, 0x17
mov dword [esp + 0x14], 0x3ea
mov dword [esp + 0x44], 0x3ed
mov esi, ecx
mov edx, edi
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x4c]
jmp 0x59f23a
mov ecx, dword [esp + 0x24]
jmp 0x59fa8a
mov ecx, dword [esp + 0x24]
jmp 0x59fa8a
mov dword [esp + 0x88], ebx
mov edx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov eax, ebx
and eax, 1
inc eax
xor eax, ebx
sete al
movzx eax, al
cmp ebx, eax
jne 0x59f040
mov dword [esp + 0x64], edx
mov dword [esp + 0x80], ebx
mov eax, 0x12
mov dword [esp + 0x44], 0x3ed
mov edi, ebp
mov ebx, dword [esp + 0x98]
mov edx, dword [esp + 0x84]
mov dword [esp + 0x98], edx
mov ebp, dword [esp + 0x7c]
jmp 0x59f08e
mov eax, edx
add eax, ebx
mov dword [esp + 0x8c], eax
mov ecx, 0x3ed
mov dword [esp + 0x94], 0
mov dword [esp + 0x5c], ebp
mov eax, dword [esp + 0x98]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov esi, 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x90], 0
xor ebp, ebp
jmp 0x59f0d0
cmp eax, 0xd
je 0x59f0a7
imul eax, eax
and eax, 3
cmp eax, 3
je 0x59f0a7
mov ebx, dword [esp + 0x44]
jmp 0x59fa75
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], edi
movzx eax, byte [ebp + 0x15]
add eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x30], ebp
jmp 0x59f798
mov dword [esp + 0x80], ebx
mov ebx, ebp
add ebx, edx
jb 0x59f175
xor eax, eax
test al, al
jne 0x59f175
mov dword [esp + 0x44], ecx
mov dword [esp + 0x64], edx
mov eax, 0xd
lea edi, [ebx + 5]
mov edx, dword [esp + 0x8c]
cmp edi, edx
ja 0x59f1ad
mov edx, edi
imul edx, edx
and edx, 3
cmp edx, 2
je 0x59f1ad
mov eax, 0xe
movzx edx, byte [ebx]
cmp edx, 0x68
je 0x59f205
mov dword [esp + 0x88], ebx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x2c], edi
imul edx, edx
and edx, 3
cmp edx, 2
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x54], esi
mov ecx, dword [esp + 0x20]
mov edi, esi
mov esi, ecx
mov edx, dword [esp + 0x90]
mov dword [esp + 0x70], edx
mov edx, ecx
mov esi, edi
jne 0x59f8f9
jmp 0x59f23a
mov dword [esp + 0x44], ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x64], edx
mov eax, dword [esp + 0x94]
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], esi
mov edx, dword [esp + 0x20]
mov ecx, edx
mov eax, dword [esp + 0x90]
mov dword [esp + 0x70], eax
jmp 0x59f8f9
mov dword [esp + 0x88], ebx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x2c], edi
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x98], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x74], ecx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x68], esi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x58], ecx
mov edi, esi
mov ebx, ecx
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
mov dword [esp + 0x70], edx
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
jmp 0x59f74c
mov dword [esp + 0x88], ebx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x2c], edi
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x54], esi
mov ecx, dword [esp + 0x20]
mov edi, esi
mov esi, ecx
mov edx, dword [esp + 0x90]
mov dword [esp + 0x70], edx
mov edx, ecx
mov esi, edi
cmp eax, 0xe
je 0x59f285
xor eax, eax
test al, al
jne 0x59f285
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x74], eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x58], edx
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x70]
jmp 0x59ed44
mov ebp, ecx
mov eax, 6
mov ecx, dword [esp + 0x88]
mov edx, ecx
or edx, 2
mov esi, ecx
xor esi, 2
add esi, edx
setne dl
movzx edx, dl
movzx edx, byte [ecx + edx]
mov esi, edx
and esi, 1
inc esi
xor esi, edx
sete bl
movzx esi, bl
cmp edx, esi
jne 0x59f314
movzx eax, byte [ecx + 2]
mov edx, eax
imul edx, edx
and edx, 3
cmp edx, 3
sete dl
movzx edx, dl
cmp eax, edx
jne 0x59f34a
movzx edx, byte [ecx + 3]
cmp edx, 0x40
jne 0x59f34a
mov eax, 0xb
mov esi, edx
and esi, 1
xor esi, edx
not esi
test esi, esi
mov edx, dword [esp + 0x48]
mov dword [esp + 0x94], edx
mov esi, dword [esp + 0x54]
mov ecx, ebp
mov edi, ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x90], edx
mov edx, edi
jne 0x59f36d
jmp 0x59f8f9
mov edx, dword [esp + 0x48]
mov dword [esp + 0x94], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x6c]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
jmp 0x59ee3d
mov eax, dword [esp + 0x48]
mov dword [esp + 0x94], eax
mov esi, dword [esp + 0x54]
mov ecx, ebp
mov edx, ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
jmp 0x59f8f9
cmp eax, 0xb
je 0x59f394
xor eax, eax
test al, al
jne 0x59f394
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x74], eax
jmp 0x59f860
mov eax, 0xe
mov edi, dword [esp + 0x88]
movzx edx, byte [edi + 4]
mov esi, edx
and esi, 1
inc esi
xor esi, edx
sete bl
movzx esi, bl
cmp edx, esi
jne 0x59f3f1
mov dword [esp + 0x74], 0
mov ebp, dword [esp + 0x2c]
cmp ebp, dword [esp + 0x64]
mov edx, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x94], edi
mov esi, ecx
mov ecx, edx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
jb 0x59f8f9
jmp 0x59f4ed
mov edx, dword [esp + 0x84]
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x74], edx
mov ebp, dword [esp + 0x7c]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x94], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x68], edx
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x90], edx
mov esi, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
cmp eax, 0xe
jne 0x59f46c
mov edx, eax
not edx
and edx, 1
add edx, eax
je 0x59f46c
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], esi
mov eax, dword [esp + 0x98]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ebp
jmp 0x59f8f1
movzx eax, byte [ebp + 7]
cmp eax, 0x24
jne 0x59f684
mov edx, 3
sub edx, eax
xor edx, eax
je 0x59f684
movzx eax, byte [ebp + 8]
cmp eax, 0x9c
je 0x59f4d1
mov edi, 5
imul eax, eax
and eax, 3
cmp eax, 3
je 0x59f4d1
mov eax, dword [esp + 0x98]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ebp
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x98], eax
jmp 0x59f9ff
mov eax, 6
movzx edx, byte [ebp + 0x1b]
cmp edx, 0x9d
mov edi, esi
jne 0x59f684
jmp 0x59f6e7
lea eax, [ebp + 0x1d]
mov edx, dword [esp + 0x8c]
cmp eax, edx
mov ebx, dword [esp + 0x88]
mov esi, dword [esp + 0x70]
jbe 0x59f533
imul eax, eax
and eax, 3
cmp eax, 2
jae 0x59f533
mov dword [esp + 0x94], ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x90], esi
mov eax, dword [esp + 0x68]
mov dword [esp + 0x98], eax
jmp 0x59f684
movzx eax, byte [ebp]
cmp eax, 0xe8
je 0x59f5aa
mov edx, 6
imul eax, eax
and eax, 3
cmp eax, 2
je 0x59f5aa
mov dword [esp + 0x94], ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x90], esi
mov eax, dword [esp + 0x68]
mov dword [esp + 0x84], eax
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x88], ebx
cmp edx, 2
jne 0x59fb2c
mov eax, edx
or eax, 2
xor edx, 2
add edx, eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x98], eax
mov ebp, dword [esp + 0x7c]
mov ebx, dword [esp + 0x44]
jne 0x59fa75
jmp 0x59f684
mov dword [esp + 0x4c], ecx
mov ecx, ebx
mov eax, 4
lea edi, [ebp + 5]
movzx edx, byte [ebp + 5]
mov esi, 3
sub esi, edx
xor esi, edx
setne bl
add bl, dl
jne 0x59f61b
mov eax, 0x18
movzx edx, byte [ebp + 6]
cmp edx, 0x34
mov ebx, dword [esp + 0x68]
je 0x59f648
mov dword [esp + 0x28], edi
imul edx, edx
and edx, 3
cmp edx, 2
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x90], edx
mov dword [esp + 0x98], ebx
mov esi, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
jne 0x59f684
jmp 0x59f435
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0x60]
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x84], edx
mov dword [esp + 0x7c], ebp
mov ebx, ecx
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x5c]
jmp 0x59faff
mov dword [esp + 0x28], edi
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0x4c]
jmp 0x59f41e
movzx edx, byte [ebp + 0x1c]
cmp edx, 0xc3
jne 0x59f684
mov eax, 0xd
mov esi, edx
or esi, 2
xor edx, 2
add edx, esi
jne 0x59f08e
mov eax, 0x1b
lea esi, [ebp + 5]
mov edx, dword [esp + 0x8c]
cmp esi, edx
ja 0x59f826
mov edx, esi
and edx, 1
inc edx
xor edx, esi
je 0x59f826
movzx edx, byte [ebp]
cmp edx, 0xe9
mov ebx, dword [esp + 0x98]
jne 0x59f851
mov dword [esp + 0x40], esi
mov eax, 0xf
mov esi, edx
and esi, 1
xor esi, edx
not esi
test esi, esi
mov dword [esp + 0x84], ebx
mov dword [esp + 0x7c], ebp
mov edi, ebp
je 0x59f860
cmp eax, 6
jne 0x59f6fb
imul eax, eax
and eax, 3
cmp eax, 2
jb 0x59f663
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], edi
mov ebx, ecx
mov eax, 2
mov edx, 3
sub edx, ebp
xor edx, ebp
setne dl
movzx edx, dl
movzx edx, byte [ebp + edx]
movzx esi, byte [ebp + 2]
shl esi, 8
or esi, edx
movzx edx, byte [ebp + 3]
shl edx, 0x10
or edx, esi
movzx esi, byte [ebp + 4]
shl esi, 0x18
or esi, edx
add esi, dword [esp + 0x40]
mov edx, dword [esp + 0x98]
mov ecx, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
cmp eax, 2
jne 0x59fbe3
mov dword [esp + 0x54], edi
mov dword [esp + 0x48], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov edx, eax
not edx
and edx, 1
add edx, eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ebp
mov eax, dword [esp + 0x98]
mov dword [esp + 0x84], eax
mov esi, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov ecx, ebx
je 0x59f8f9
mov edx, dword [esp + 0x78]
mov eax, edx
imul eax, eax
and eax, 3
cmp eax, 2
mov ebp, edx
adc ebp, 0
cmp ebp, 5
seta ah
mov edx, ebp
and edx, 1
xor edx, ebp
cmp edx, 0xffffffff
setne dh
mov ebx, dword [esp + 0x34]
cmp ebx, dword [esp + 0x64]
sbb al, al
mov esi, ebx
or esi, 2
mov edi, ebx
xor edi, 2
add edi, esi
setne dl
test ah, dh
jne 0x59fc1c
mov dword [esp + 0x74], ebp
and al, dl
mov eax, dword [esp + 0x30]
mov dword [esp + 0x68], eax
mov ebp, ebx
mov edx, dword [esp + 0x98]
mov dword [esp + 0x84], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x94], edx
mov esi, eax
mov edx, ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
je 0x59f4ed
jmp 0x59f8f9
mov dword [esp + 0x40], esi
mov dword [esp + 0x5c], ebp
mov edx, dword [esp + 0x98]
mov dword [esp + 0x60], edx
mov dword [esp + 0x84], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], ebp
jmp 0x59f36d
mov dword [esp + 0x40], esi
mov dword [esp + 0x84], ebx
mov dword [esp + 0x7c], ebp
mov eax, 5
lea edx, [ebp + 2]
cmp edx, dword [esp + 0x8c]
jbe 0x59fae3
mov esi, 7
imul edx, edx
and edx, 3
cmp edx, 2
mov ebx, dword [esp + 0x88]
mov dword [esp + 0x94], ebx
mov edi, dword [esp + 0x98]
mov dword [esp + 0x68], edi
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x90], edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], edi
mov edx, ebp
jae 0x59faff
cmp esi, 7
jne 0x59efe4
mov eax, 3
sub eax, esi
xor eax, esi
je 0x59efe4
mov dword [esp + 0x88], ebx
mov dword [esp + 0x5c], ebp
mov eax, dword [esp + 0x98]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov esi, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x6c]
inc eax
mov ebx, dword [esp + 0x80]
cmp eax, ebx
jne 0x59faba
mov dword [esp + 0x20], edx
mov edx, eax
imul edx, edx
and edx, 3
cmp edx, 1
ja 0x59fabe
mov dword [esp + 0x4c], ecx
mov eax, 0x16
mov edx, dword [esp + 0x94]
mov ecx, edx
and ecx, 1
inc ecx
xor ecx, edx
sete cl
movzx ecx, cl
cmp edx, ecx
sete dl
test esi, esi
mov dword [esp + 0x98], esi
sete ch
mov esi, dword [esp + 0x20]
mov edi, esi
imul edi, edi
and edi, 3
cmp edi, 2
sete cl
movzx edi, cl
cmp esi, edi
sete cl
or cl, ch
or cl, dl
movzx edx, cl
imul edx, edx
cmp edx, 2
setb dl
mov ebp, dword [esp + 0x90]
mov edi, ebp
imul edi, edi
and edi, 3
cmp edi, 2
sbb edi, edi
and edi, 1
cmp ebp, edi
jne 0x59facd
xor cl, dl
je 0x59facd
mov edi, 0xa
lea eax, [esp + 0x9c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov dword [esp + 8], 0x40
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
sete cl
movzx ecx, cl
mov ebx, 0x3ee
cmp eax, ecx
mov eax, dword [esp + 0x98]
mov dword [esp + 0x68], eax
mov dword [esp + 0x58], esi
mov dword [esp + 0x44], 0x3ee
mov ecx, dword [esp + 0x4c]
je 0x59fa75
mov ebx, esi
cmp edi, 5
mov ebp, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x98]
je 0x59faa2
imul edi, edi
and edi, 3
cmp edi, 3
je 0x59faa2
mov eax, 0xfffffffb
sub eax, esi
add eax, ebx
mov byte [esi], 0xe9
mov ecx, esi
not ecx
and ecx, 1
add ecx, esi
setne cl
movzx ecx, cl
mov byte [esi + ecx], al
mov byte [esi + 2], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi + 4], al
mov byte [ebx], 0x31
mov eax, ebx
or eax, 2
mov ecx, ebx
xor ecx, 2
add ecx, eax
setne al
movzx eax, al
mov byte [ebx + eax], 0xf6
xor ebx, ebx
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x59fa95
mov eax, ecx
imul eax, eax
and eax, 3
cmp eax, 3
je 0x59fa95
mov dword [esp], ecx
call sub.KERNEL32.dll_FreeLibrary
sub esp, 4
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x98], eax
mov dword [esp + 0x74], edx
jmp 0x59f684
mov dword [esp + 0x20], edx
mov ebp, eax
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x44]
jmp 0x59f0d0
mov edi, esi
mov ebp, dword [esp + 0x98]
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x3c]
jmp 0x59ef2b
mov edx, ebp
mov dword [esp + 0x38], ebp
mov esi, dword [esp + 0x98]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x68], esi
mov ebx, dword [esp + 0x88]
cmp eax, 4
jne 0x59fb43
imul eax, eax
and eax, 3
cmp eax, 2
jae 0x59fb43
mov dword [esp + 0x94], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x98], eax
mov ebp, dword [esp + 0x7c]
jmp 0x59f684
mov dword [esp + 0x5c], edx
mov edi, dword [esp + 0x38]
movzx eax, byte [edi]
cmp eax, 0x8b
mov ebp, dword [esp + 0x74]
jne 0x59fbbd
mov eax, edi
imul eax, eax
and eax, 3
xor edx, edx
cmp eax, 2
adc edx, 0
movzx eax, byte [edi + edx]
cmp eax, 0xf0
sete dl
mov esi, eax
or esi, 2
xor eax, 2
add eax, esi
setne al
and al, dl
mov edx, ecx
cmovne edx, edi
movzx eax, al
add eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x60], eax
mov dword [esp + 0x78], ebp
mov dword [esp + 0x94], ebx
mov dword [esp + 0x88], ebx
mov esi, dword [esp + 0x3c]
jmp 0x59f8f9
mov eax, dword [esp + 0x98]
mov dword [esp + 0x60], eax
mov dword [esp + 0x78], ebp
mov dword [esp + 0x94], ebx
mov dword [esp + 0x88], ebx
mov esi, dword [esp + 0x3c]
jmp 0x59f35b
mov dword [esp + 0x54], edi
mov dword [esp + 0x48], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x98]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ebp
mov esi, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov ecx, ebx
jmp 0x59f8f9
mov eax, dword [esp + 0x98]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x94], eax
mov esi, dword [esp + 0x30]
jmp 0x59f35b