Function at 0x401ba0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa510
call fcn.00407c60
mov eax, dword [0x417bd4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401840
mov dword [ebp - 0xa504], eax
mov dword [ebp - 0xa500], edx
xor eax, eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov word [ebp - 0xc4], ax
mov byte [ebp - 0xc2], al
lea ecx, [ebp - 0xd4]
call fcn.00403420
mov ecx, eax
call fcn.00403eb0
push eax
call fcn.00405320
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x417c70], eax
cmp dword [0x417c70], 0
jne 0x401c2b
jmp 0x402edb
push 0x40
push 0x3000
push 0x20000
push 0
mov ecx, dword [0x417c70]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa4a8], eax
cmp dword [ebp - 0xa4a8], 0
jne 0x401c5a
jmp 0x402edb
push 0xb0
push 0
lea edx, [ebp - 0x27c]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1dc], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1d8], ecx
xor edx, edx
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xdc], edx
mov word [ebp - 0xd8], dx
mov byte [ebp - 0xd6], dl
push 0x11
lea ecx, [ebp - 0xe8]
call fcn.004033f0
mov ecx, eax
call fcn.00403e40
push eax
lea eax, [ebp - 0x27c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov byte [ebp - 0xa4], cl
push 0xb
lea ecx, [ebp - 0xb0]
call fcn.004036b0
mov ecx, eax
call fcn.00404690
push eax
lea edx, [ebp - 0x25c]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], al
push 0xf
lea ecx, [ebp - 0xfc]
call fcn.004033c0
mov ecx, eax
call fcn.00403dd0
push eax
lea ecx, [ebp - 0x23c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov word [ebp - 0x88], dx
mov byte [ebp - 0x86], dl
push 0xd
lea ecx, [ebp - 0x94]
call fcn.00403710
mov ecx, eax
call fcn.004047e0
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov byte [ebp - 0x100], cl
push 0xf
lea ecx, [ebp - 0x110]
call fcn.00403390
mov ecx, eax
call fcn.00403d60
push eax
lea edx, [ebp - 0x1fc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0
push 0xb0
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0xa4a8]
push ecx
mov edx, dword [0x417c70]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x99
push 0x412400
mov eax, dword [ebp - 0xa4a8]
add eax, 0xb0
push eax
mov ecx, dword [0x417c70]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov edx, dword [ebp - 0xa4a8]
push edx
mov eax, dword [ebp - 0xa4a8]
add eax, 0xb0
push eax
push 0
push 0
mov ecx, dword [0x417c70]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa4cc], eax
push 0xb0
call fcn.004079e9
add esp, 4
mov dword [ebp - 0xa4c0], eax
cmp dword [ebp - 0xa4c0], 0
je 0x401e92
push 0xb0
push 0
mov edx, dword [ebp - 0xa4c0]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0xa4c0]
mov dword [ebp - 0xa4d0], eax
jmp 0x401e9c
mov dword [ebp - 0xa4d0], 0
mov ecx, dword [ebp - 0xa4d0]
mov dword [ebp - 0xa4b4], ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa4cc]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xa4cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xb0
mov ecx, dword [ebp - 0xa4b4]
push ecx
mov edx, dword [ebp - 0xa4a8]
push edx
mov eax, dword [0x417c70]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40
push 0x3000
push 0x4000
push 0
mov ecx, dword [0x417c70]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa4bc], eax
cmp dword [ebp - 0xa4bc], 0
jne 0x401f14
jmp 0x402edb
mov dword [ebp - 0xa4c8], 0
push 0
push 4
lea edx, [ebp - 0xa4c8]
push edx
mov eax, dword [ebp - 0xa4b4]
mov ecx, dword [eax + 0xa8]
push ecx
mov edx, dword [0x417c70]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x400
call fcn.00407a19
add esp, 4
mov dword [ebp - 0xa4e0], eax
mov eax, dword [ebp - 0xa4e0]
mov dword [ebp - 0xa4b8], eax
push 0
push 0x400
mov ecx, dword [ebp - 0xa4b8]
push ecx
mov edx, dword [ebp - 0xa4c8]
push edx
mov eax, dword [0x417c70]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa228
push 0
lea ecx, [ebp - 0xa4a4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xbc], edx
push 6
lea ecx, [ebp - 0xc0]
call fcn.00403310
mov ecx, eax
call fcn.00403ba0
push eax
lea eax, [ebp - 0x8a60]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x8a60]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x8a60]
push edx
call fcn.004031b0
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
push 4
lea ecx, [ebp - 0xb8]
call fcn.00403740
mov ecx, eax
call fcn.00404850
push eax
lea ecx, [ebp - 0xa364]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0xa364]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea eax, [ebp - 0xa364]
push eax
call fcn.004031f0
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov word [ebp - 0x7c], cx
push 6
lea ecx, [ebp - 0x84]
call fcn.00403780
mov ecx, eax
call fcn.00404930
push eax
lea edx, [ebp - 0xa35e]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0xa35e]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea ecx, [ebp - 0xa35e]
push ecx
call fcn.004031f0
add esp, 8
mov edx, 0x28
imul eax, edx, 0
mov dword [ebp + eax - 0xa480], 0
mov ecx, 0x28
imul edx, ecx, 0
mov dword [ebp + edx - 0xa484], 1
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
push 0xc
lea ecx, [ebp - 0x148]
call fcn.004037e0
mov ecx, eax
call fcn.00404a80
push eax
mov ecx, 0x28
imul edx, ecx, 0
lea eax, [ebp + edx - 0xa4a4]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
imul edx, ecx, 0
lea eax, [ebp + edx - 0xa4a4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
imul edx, ecx, 0
lea eax, [ebp + edx - 0xa4a4]
push eax
call fcn.004031f0
add esp, 8
mov ecx, 0x28
shl ecx, 0
mov dword [ebp + ecx - 0xa480], 2
mov edx, 0x28
shl edx, 0
mov dword [ebp + edx - 0xa484], 5
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov word [ebp - 0x70], ax
push 6
lea ecx, [ebp - 0x78]
call fcn.004037a0
mov ecx, eax
call fcn.004049a0
push eax
mov ecx, 0x28
shl ecx, 0
lea edx, [ebp + ecx - 0xa4a4]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
shl eax, 0
lea ecx, [ebp + eax - 0xa4a4]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
shl edx, 0
lea eax, [ebp + edx - 0xa4a4]
push eax
call fcn.004031f0
add esp, 8
mov ecx, 0x28
shl ecx, 1
mov dword [ebp + ecx - 0xa480], 1
mov edx, 0x28
shl edx, 1
mov dword [ebp + edx - 0xa484], 0x1e
xor eax, eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
push 0xc
lea ecx, [ebp - 0x158]
call fcn.004037c0
mov ecx, eax
call fcn.00404a10
push eax
mov ecx, 0x28
shl ecx, 1
lea edx, [ebp + ecx - 0xa4a4]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
shl eax, 1
lea ecx, [ebp + eax - 0xa4a4]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
shl edx, 1
lea eax, [ebp + edx - 0xa4a4]
push eax
call fcn.004031f0
add esp, 8
mov ecx, 0x28
imul edx, ecx, 3
mov dword [ebp + edx - 0xa480], 0
mov eax, 0x28
imul ecx, eax, 3
mov dword [ebp + ecx - 0xa484], 1
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov word [ebp - 0x114], dx
push 0xe
lea ecx, [ebp - 0x124]
call fcn.00403800
mov ecx, eax
call fcn.00404af0
push eax
mov eax, 0x28
imul ecx, eax, 3
lea edx, [ebp + ecx - 0xa4a4]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 3
lea edx, [ebp + ecx - 0xa4a4]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 3
lea edx, [ebp + ecx - 0xa4a4]
push edx
call fcn.004031f0
add esp, 8
mov eax, 0x28
shl eax, 2
mov dword [ebp + eax - 0xa480], 2
mov ecx, 0x28
shl ecx, 2
mov dword [ebp + ecx - 0xa484], 6
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov word [ebp - 0x64], dx
push 6
lea ecx, [ebp - 0x6c]
call fcn.004037a0
mov ecx, eax
call fcn.004049a0
push eax
mov eax, 0x28
shl eax, 2
lea ecx, [ebp + eax - 0xa4a4]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
shl edx, 2
lea eax, [ebp + edx - 0xa4a4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
shl ecx, 2
lea edx, [ebp + ecx - 0xa4a4]
push edx
call fcn.004031f0
add esp, 8
mov eax, 0x28
imul ecx, eax, 5
mov dword [ebp + ecx - 0xa480], 0
mov edx, 0x28
imul eax, edx, 5
mov dword [ebp + eax - 0xa484], 0
xor ecx, ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov word [ebp - 0x128], cx
push 0xe
lea ecx, [ebp - 0x138]
call fcn.00403830
mov ecx, eax
call fcn.00404b60
push eax
mov edx, 0x28
imul eax, edx, 5
lea ecx, [ebp + eax - 0xa4a4]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
imul eax, edx, 5
lea ecx, [ebp + eax - 0xa4a4]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
imul eax, edx, 5
lea ecx, [ebp + eax - 0xa4a4]
push ecx
call fcn.004031f0
add esp, 8
mov edx, 0x28
imul eax, edx, 6
mov dword [ebp + eax - 0xa480], 0
mov ecx, 0x28
imul edx, ecx, 6
mov dword [ebp + edx - 0xa484], 1
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov word [ebp - 0x98], ax
push 6
lea ecx, [ebp - 0xa0]
call fcn.00403760
mov ecx, eax
call fcn.004048c0
push eax
mov ecx, 0x28
imul edx, ecx, 6
lea eax, [ebp + edx - 0xa4a4]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
imul edx, ecx, 6
lea eax, [ebp + edx - 0xa4a4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
imul edx, ecx, 6
lea eax, [ebp + edx - 0xa4a4]
push eax
call fcn.004031f0
add esp, 8
mov ecx, 0x28
imul edx, ecx, 7
mov dword [ebp + edx - 0xa480], 0
mov eax, 0x28
imul ecx, eax, 7
mov dword [ebp + ecx - 0xa484], 0
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
push 0x10
lea ecx, [ebp - 0x16c]
call fcn.00403860
mov ecx, eax
call fcn.00404bd0
push eax
mov eax, 0x28
imul ecx, eax, 7
lea edx, [ebp + ecx - 0xa4a4]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 7
lea edx, [ebp + ecx - 0xa4a4]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 7
lea edx, [ebp + ecx - 0xa4a4]
push edx
call fcn.004031f0
add esp, 8
movss xmm0, dword [0x40a944]
movss dword [ebp - 0xa23c], xmm0
movss xmm0, dword [0x40a950]
movss dword [ebp - 0xa25c], xmm0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a38], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a38], 0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a38], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a38], 0x32
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a34], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a34], 0xff
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a34], 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a34], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a30], 0xe1
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a30], 0xe1
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a30], 0xe1
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a30], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a2c], 0x66
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a2c], 0xb2
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a2c], 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a2c], 0xc8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a28], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a28], 0x99
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a28], 0x33
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a28], 0xc8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a20], 0x12
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a20], 0x12
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a20], 0x12
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a20], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a1c], 0x2d
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a1c], 0x2d
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a1c], 0x2d
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a1c], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a24], 0x3c
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a24], 0x3c
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a24], 0x3c
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a24], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a18], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a18], 0x80
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a18], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a18], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a14], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a14], 0x99
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a14], 0x33
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a14], 0xc8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a10], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a10], 0xff
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a10], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a10], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a0c], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a0c], 0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a0c], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a0c], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8a08], 0x66
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8a08], 0xb2
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8a08], 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8a08], 0xff
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], al
lea ecx, [ebp - 0x60]
call fcn.00403330
mov ecx, eax
call fcn.00403c10
push eax
call fcn.00405320
add esp, 4
mov dword [ebp - 0x89c0], eax
mov ecx, dword [ebp - 0xa504]
mov edx, dword [ebp - 0xa500]
mov dword [ebp - 0x89bc], ecx
mov dword [ebp - 0x89b8], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x89d8], eax
mov ecx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x89e4], ecx
mov edx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x89e0], edx
mov eax, dword [0x417cb0]
mov dword [ebp - 0x89d4], eax
mov ecx, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x89dc], ecx
xor edx, edx
mov dword [ebp - 0x14], edx
mov word [ebp - 0x10], dx
mov byte [ebp - 0xe], dl
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov word [ebp - 0x4c], ax
mov byte [ebp - 0x4a], al
lea ecx, [ebp - 0x14]
call fcn.004032d0
mov ecx, eax
call fcn.00403ac0
mov dword [ebp - 0xa4dc], eax
lea ecx, [ebp - 0x54]
call fcn.00403370
mov ecx, eax
call fcn.00403cf0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa4d8], eax
mov ecx, dword [ebp - 0xa4dc]
push ecx
mov edx, dword [ebp - 0xa4d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x89d0], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x18], ax
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov word [ebp - 0x40], cx
mov byte [ebp - 0x3e], cl
lea ecx, [ebp - 0x1c]
call fcn.00403290
mov ecx, eax
call fcn.004039e0
mov dword [ebp - 0xa4d4], eax
lea ecx, [ebp - 0x48]
call fcn.00403370
mov ecx, eax
call fcn.00403cf0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa510], eax
mov edx, dword [ebp - 0xa4d4]
push edx
mov eax, dword [ebp - 0xa510]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x89cc], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], cl
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov word [ebp - 0x34], dx
mov byte [ebp - 0x32], dl
lea ecx, [ebp - 0xc]
call fcn.00403270
mov ecx, eax
call fcn.00403970
mov dword [ebp - 0xa50c], eax
lea ecx, [ebp - 0x3c]
call fcn.00403370
mov ecx, eax
call fcn.00403cf0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa508], eax
mov eax, dword [ebp - 0xa50c]
push eax
mov ecx, dword [ebp - 0xa508]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x89c8], eax
xor edx, edx
mov dword [ebp - 0x24], edx
mov word [ebp - 0x20], dx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov byte [ebp - 0x26], al
lea ecx, [ebp - 0x24]
call fcn.004032b0
mov ecx, eax
call fcn.00403a50
mov dword [ebp - 0xa4fc], eax
lea ecx, [ebp - 0x30]
call fcn.00403370
mov ecx, eax
call fcn.00403cf0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa4f8], eax
mov ecx, dword [ebp - 0xa4fc]
push ecx
mov edx, dword [ebp - 0xa4f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x89c4], eax
mov eax, dword [0x417c80]
mov ecx, dword [0x417c84]
mov dword [ebp - 0x89a4], eax
mov dword [ebp - 0x89a0], ecx
mov edx, dword [0x417c88]
mov eax, dword [0x417c8c]
mov dword [ebp - 0x8994], edx
mov dword [ebp - 0x8990], eax
mov ecx, dword [0x417c78]
mov edx, dword [0x417c7c]
mov dword [ebp - 0x89ac], ecx
mov dword [ebp - 0x89a8], edx
mov eax, dword [0x417c90]
mov ecx, dword [0x417c94]
mov dword [ebp - 0x899c], eax
mov dword [ebp - 0x8998], ecx
movss xmm0, dword [0x40a954]
movss dword [ebp - 0xa2a8], xmm0
movss xmm0, dword [0x40a920]
movss dword [ebp - 0xa288], xmm0
movss xmm0, dword [0x40a910]
movss dword [ebp - 0xa28c], xmm0
movss xmm0, dword [0x40a928]
movss dword [ebp - 0xa284], xmm0
movss xmm0, dword [0x40a930]
movss dword [ebp - 0xa2a0], xmm0
movss xmm0, dword [0x40a934]
movss dword [ebp - 0xa29c], xmm0
movss xmm0, dword [0x40a938]
movss dword [ebp - 0xa298], xmm0
movss xmm0, dword [0x40a940]
movss dword [ebp - 0xa294], xmm0
movss xmm0, dword [0x40a94c]
movss dword [ebp - 0xa290], xmm0
movss xmm0, dword [0x40a92c]
movss dword [ebp - 0x8940], xmm0
mov dword [ebp - 0x8910], 0x64
mov dword [ebp - 0x890c], 0x86
mov dword [ebp - 0x8908], 0x64
mov dword [ebp - 0x8904], 0x79
movss xmm0, dword [0x40a93c]
movss dword [ebp - 0x89ec], xmm0
movss xmm0, dword [0x40a91c]
movss dword [ebp - 0x8924], xmm0
movss xmm0, dword [0x40a918]
movss dword [ebp - 0x8920], xmm0
movss xmm0, dword [0x40a924]
movss dword [ebp - 0x891c], xmm0
movss xmm0, dword [0x40a948]
movss dword [ebp - 0x8918], xmm0
movss xmm0, dword [0x40a914]
movss dword [ebp - 0x8914], xmm0
push 0x2fa8
push 0x40f458
lea edx, [ebp - 0x88e4]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x3458
push section..data
lea eax, [ebp - 0x593b]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x1a90
push 0x416138
lea ecx, [ebp - 0x24e2]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x388
push 0x415db0
lea edx, [ebp - 0xa52]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 4
imul ecx, eax, 0x8d
mov edx, dword [ebp - 0xa4b8]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x89e8], eax
mov ecx, dword [ebp - 0xa4a8]
add ecx, 0xa228
mov edx, 4
imul eax, edx, 0x8d
mov edx, dword [ebp - 0xa4b8]
mov dword [edx + eax], ecx
push 0
push 0x400
mov eax, dword [ebp - 0xa4b8]
push eax
mov ecx, dword [ebp - 0xa4bc]
push ecx
mov edx, dword [0x417c70]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xa4b4]
mov ecx, dword [eax + 0xa8]
mov dword [ebp - 0x8a78], ecx
push 0
push 0xa228
lea edx, [ebp - 0xa4a4]
push edx
mov eax, dword [ebp - 0xa4a8]
push eax
mov ecx, dword [0x417c70]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0xa4a8]
add edx, 0xa228
mov dword [ebp - 0xa4f4], edx
push 0x11
push 0x4124a0
call fcn.004053f0
add esp, 8
mov dword [ebp - 0xa4f0], eax
mov eax, dword [ebp - 0xa4f0]
mov ecx, dword [ebp - 0xa4a8]
mov dword [eax], ecx
push 0
push 0x390a
push 0x4124a0
mov edx, dword [ebp - 0xa4f4]
push edx
mov eax, dword [0x417c70]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
lea ecx, [ebp - 0xa4bc]
push ecx
mov edx, dword [ebp - 0xa4b4]
mov eax, dword [edx + 0xa8]
push eax
mov ecx, dword [0x417c70]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x2a
push 0
lea edx, [ebp - 0x198]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x198]
call fcn.004034e0
mov ecx, eax
call fcn.00404070
push eax
call fcn.00404d80
add esp, 4
push 0x31
push 0
lea eax, [ebp - 0x1cc]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1cc]
call fcn.00403500
mov ecx, eax
call fcn.004040e0
mov dword [ebp - 0xa4ec], eax
mov ecx, dword [ebp - 0xa4b4]
mov eax, dword [ecx + 0xac]
cdq
mov dword [ebp - 0xa4e8], eax
mov dword [ebp - 0xa4e4], edx
mov edx, dword [ebp - 0xa4ec]
push edx
push 0x5f000
mov eax, dword [ebp - 0xa4e4]
push eax
mov ecx, dword [ebp - 0xa4e8]
push ecx
call fcn.00405120
add esp, 0x10
mov dword [ebp - 0xa4b0], eax
cmp dword [ebp - 0xa4b0], 0
je 0x402edb
mov edx, dword [ebp - 0xa4b0]
add edx, 1
mov dword [ebp - 0xa4b0], edx
lea eax, [ebp - 0xa4c4]
push eax
push 0x40
push 1
mov ecx, dword [ebp - 0xa4b0]
push ecx
mov edx, dword [0x417c70]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402edb
mov byte [ebp - 0xa4a9], 0
push 0
push 1
lea eax, [ebp - 0xa4a9]
push eax
mov ecx, dword [ebp - 0xa4b0]
push ecx
mov edx, dword [0x417c70]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0xa4c4]
push eax
mov ecx, dword [ebp - 0xa4c4]
push ecx
push 1
mov edx, dword [ebp - 0xa4b0]
push edx
mov eax, dword [0x417c70]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a27
mov esp, ebp
pop ebp
ret