Function at 0x401ba0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4228
call fcn.00409050
mov eax, dword [0x4126a4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401840
mov dword [ebp - 0x41f0], eax
mov dword [ebp - 0x41ec], edx
xor eax, eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov word [ebp - 0xc4], ax
mov byte [ebp - 0xc2], al
lea ecx, [ebp - 0xd4]
call fcn.00404cf0
mov ecx, eax
call fcn.004057a0
push eax
call fcn.00406c80
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x412740], eax
cmp dword [0x412740], 0
jne 0x401c2b
jmp 0x4047b2
push 0x40
push 0x3000
push 0x20000
push 0
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x41c0], eax
cmp dword [ebp - 0x41c0], 0
jne 0x401c5a
jmp 0x4047b2
push 0xb0
push 0
lea edx, [ebp - 0x28c]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1ec], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1e8], ecx
xor edx, edx
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xdc], edx
mov word [ebp - 0xd8], dx
mov byte [ebp - 0xd6], dl
push 0x11
lea ecx, [ebp - 0xe8]
call fcn.00404cc0
mov ecx, eax
call fcn.00405730
push eax
lea eax, [ebp - 0x28c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov byte [ebp - 0xa4], cl
push 0xb
lea ecx, [ebp - 0xb0]
call fcn.00404f80
mov ecx, eax
call fcn.00405f80
push eax
lea edx, [ebp - 0x26c]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov byte [ebp - 0xfc], al
push 0xf
lea ecx, [ebp - 0x10c]
call fcn.00404c90
mov ecx, eax
call fcn.004056c0
push eax
lea ecx, [ebp - 0x24c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
mov word [ebp - 0x70], dx
mov byte [ebp - 0x6e], dl
push 0xd
lea ecx, [ebp - 0x7c]
call fcn.00404fe0
mov ecx, eax
call fcn.004060d0
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x110], cl
push 0xf
lea ecx, [ebp - 0x120]
call fcn.00404c60
mov ecx, eax
call fcn.00405650
push eax
lea edx, [ebp - 0x20c]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0
push 0xb0
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x41c0]
push ecx
mov edx, dword [0x412740]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x99
push section..data
mov eax, dword [ebp - 0x41c0]
add eax, 0xb0
push eax
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov edx, dword [ebp - 0x41c0]
push edx
mov eax, dword [ebp - 0x41c0]
add eax, 0xb0
push eax
push 0
push 0
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x41e8], eax
push 0xb0
call fcn.00408dd9
add esp, 4
mov dword [ebp - 0x41d8], eax
cmp dword [ebp - 0x41d8], 0
je 0x401e80
push 0xb0
push 0
mov edx, dword [ebp - 0x41d8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x41d8]
mov dword [ebp - 0x41e4], eax
jmp 0x401e8a
mov dword [ebp - 0x41e4], 0
mov ecx, dword [ebp - 0x41e4]
mov dword [ebp - 0x41cc], ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x41e8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x41e8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xb0
mov ecx, dword [ebp - 0x41cc]
push ecx
mov edx, dword [ebp - 0x41c0]
push edx
mov eax, dword [0x412740]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40
push 0x3000
push 0x4000
push 0
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x41d4], eax
cmp dword [ebp - 0x41d4], 0
jne 0x401f02
jmp 0x4047b2
mov dword [ebp - 0x41dc], 0
push 0
push 4
lea edx, [ebp - 0x41dc]
push edx
mov eax, dword [ebp - 0x41cc]
mov ecx, dword [eax + 0xa8]
push ecx
mov edx, dword [0x412740]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x400
call fcn.00408e09
add esp, 4
mov dword [ebp - 0x4228], eax
mov eax, dword [ebp - 0x4228]
mov dword [ebp - 0x41d0], eax
push 0
push 0x400
mov ecx, dword [ebp - 0x41d0]
push ecx
mov edx, dword [ebp - 0x41dc]
push edx
mov eax, dword [0x412740]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x3f30
push 0
lea ecx, [ebp - 0x41bc]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xbc], edx
push 6
lea ecx, [ebp - 0xc0]
call fcn.00404be0
mov ecx, eax
call fcn.00405490
push eax
lea eax, [ebp - 0x2728]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x2728]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x2728]
push edx
call fcn.00404a80
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
push 4
lea ecx, [ebp - 0xb8]
call fcn.00405010
mov ecx, eax
call fcn.00406140
push eax
lea ecx, [ebp - 0x4030]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x4030]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea eax, [ebp - 0x4030]
push eax
call fcn.00404ac0
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov word [ebp - 0x64], cx
push 6
lea ecx, [ebp - 0x6c]
call fcn.00405050
mov ecx, eax
call fcn.00406220
push eax
lea edx, [ebp - 0x402a]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x402a]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea ecx, [ebp - 0x402a]
push ecx
call fcn.00404ac0
add esp, 8
mov edx, 0x2c
imul eax, edx, 0
mov dword [ebp + eax - 0x4194], 0
mov ecx, 0x2c
imul edx, ecx, 0
mov dword [ebp + edx - 0x419c], 1
xor eax, eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
push 0xc
lea ecx, [ebp - 0x158]
call fcn.004050d0
mov ecx, eax
call fcn.004063e0
push eax
mov ecx, 0x2c
imul edx, ecx, 0
lea eax, [ebp + edx - 0x41bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x2c
imul edx, ecx, 0
lea eax, [ebp + edx - 0x41bc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x2c
imul edx, ecx, 0
lea eax, [ebp + edx - 0x41bc]
push eax
call fcn.00404ac0
add esp, 8
mov ecx, 0x2c
shl ecx, 0
mov dword [ebp + ecx - 0x4194], 2
mov edx, 0x2c
shl edx, 0
mov dword [ebp + edx - 0x419c], 5
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov word [ebp - 0x98], ax
push 6
lea ecx, [ebp - 0xa0]
call fcn.00405070
mov ecx, eax
call fcn.00406290
push eax
mov ecx, 0x2c
shl ecx, 0
lea edx, [ebp + ecx - 0x41bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x2c
shl eax, 0
lea ecx, [ebp + eax - 0x41bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x2c
shl edx, 0
lea eax, [ebp + edx - 0x41bc]
push eax
call fcn.00404ac0
add esp, 8
mov ecx, 0x2c
shl ecx, 1
mov dword [ebp + ecx - 0x4194], 1
mov edx, 0x2c
shl edx, 1
mov dword [ebp + edx - 0x419c], 0x1e
mov eax, 0x2c
shl eax, 1
mov dword [ebp + eax - 0x4198], 0x64
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
push 0xc
lea ecx, [ebp - 0x168]
call fcn.004050b0
mov ecx, eax
call fcn.00406370
push eax
mov edx, 0x2c
shl edx, 1
lea eax, [ebp + edx - 0x41bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x2c
shl ecx, 1
lea edx, [ebp + ecx - 0x41bc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x2c
shl eax, 1
lea ecx, [ebp + eax - 0x41bc]
push ecx
call fcn.00404ac0
add esp, 8
mov edx, 0x2c
imul eax, edx, 3
mov dword [ebp + eax - 0x4194], 0
mov ecx, 0x2c
imul edx, ecx, 3
mov dword [ebp + edx - 0x419c], 1
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov word [ebp - 0x138], ax
push 0xe
lea ecx, [ebp - 0x148]
call fcn.004050f0
mov ecx, eax
call fcn.00406450
push eax
mov ecx, 0x2c
imul edx, ecx, 3
lea eax, [ebp + edx - 0x41bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x2c
imul edx, ecx, 3
lea eax, [ebp + edx - 0x41bc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x2c
imul edx, ecx, 3
lea eax, [ebp + edx - 0x41bc]
push eax
call fcn.00404ac0
add esp, 8
mov ecx, 0x2c
shl ecx, 2
mov dword [ebp + ecx - 0x4194], 2
mov edx, 0x2c
shl edx, 2
mov dword [ebp + edx - 0x419c], 6
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov word [ebp - 0x8c], ax
push 6
lea ecx, [ebp - 0x94]
call fcn.00405070
mov ecx, eax
call fcn.00406290
push eax
mov ecx, 0x2c
shl ecx, 2
lea edx, [ebp + ecx - 0x41bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x2c
shl eax, 2
lea ecx, [ebp + eax - 0x41bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x2c
shl edx, 2
lea eax, [ebp + edx - 0x41bc]
push eax
call fcn.00404ac0
add esp, 8
mov ecx, 0x2c
imul edx, ecx, 5
mov dword [ebp + edx - 0x4194], 0
mov eax, 0x2c
imul ecx, eax, 5
mov dword [ebp + ecx - 0x419c], 0
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], edx
mov word [ebp - 0x124], dx
push 0xe
lea ecx, [ebp - 0x134]
call fcn.00405120
mov ecx, eax
call fcn.004064c0
push eax
mov eax, 0x2c
imul ecx, eax, 5
lea edx, [ebp + ecx - 0x41bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x2c
imul ecx, eax, 5
lea edx, [ebp + ecx - 0x41bc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x2c
imul ecx, eax, 5
lea edx, [ebp + ecx - 0x41bc]
push edx
call fcn.00404ac0
add esp, 8
mov eax, 0x2c
imul ecx, eax, 6
mov dword [ebp + ecx - 0x4194], 0
mov edx, 0x2c
imul eax, edx, 6
mov dword [ebp + eax - 0x419c], 1
xor ecx, ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov word [ebp - 0x80], cx
push 6
lea ecx, [ebp - 0x88]
call fcn.00405030
mov ecx, eax
call fcn.004061b0
push eax
mov edx, 0x2c
imul eax, edx, 6
lea ecx, [ebp + eax - 0x41bc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x2c
imul eax, edx, 6
lea ecx, [ebp + eax - 0x41bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x2c
imul eax, edx, 6
lea ecx, [ebp + eax - 0x41bc]
push ecx
call fcn.00404ac0
add esp, 8
mov edx, 0x2c
imul eax, edx, 7
mov dword [ebp + eax - 0x4194], 0
mov ecx, 0x2c
imul edx, ecx, 7
mov dword [ebp + edx - 0x419c], 0
xor eax, eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
push 0x10
lea ecx, [ebp - 0x17c]
call fcn.00405150
mov ecx, eax
call fcn.00406530
push eax
mov ecx, 0x2c
imul edx, ecx, 7
lea eax, [ebp + edx - 0x41bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x2c
imul edx, ecx, 7
lea eax, [ebp + edx - 0x41bc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x2c
imul edx, ecx, 7
lea eax, [ebp + edx - 0x41bc]
push eax
call fcn.00404ac0
add esp, 8
mov ecx, 0x2c
shl ecx, 3
mov dword [ebp + ecx - 0x4194], 1
mov edx, 0x2c
shl edx, 3
mov dword [ebp + edx - 0x419c], 1
mov eax, 0x2c
shl eax, 3
mov dword [ebp + eax - 0x4198], 0x1e
xor ecx, ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], ecx
mov word [ebp - 0xec], cx
push 0xa
lea ecx, [ebp - 0xf8]
call fcn.00405090
mov ecx, eax
call fcn.00406300
push eax
mov edx, 0x2c
shl edx, 3
lea eax, [ebp + edx - 0x41bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x2c
shl ecx, 3
lea edx, [ebp + ecx - 0x41bc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x2c
shl eax, 3
lea ecx, [ebp + eax - 0x41bc]
push ecx
call fcn.00404ac0
add esp, 8
movss xmm0, dword [0x40b954]
movss dword [ebp - 0x3f04], xmm0
movss xmm0, dword [0x40b960]
movss dword [ebp - 0x3f24], xmm0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x2700], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x2700], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x2700], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x2700], 0x96
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26fc], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26fc], 0xff
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26fc], 0xff
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26fc], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26f8], 0xe1
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26f8], 0xe1
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26f8], 0xe1
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26f8], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26f0], 0x12
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26f0], 0x12
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26f0], 0x12
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26f0], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26ec], 0x2d
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26ec], 0x2d
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26ec], 0x2d
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26ec], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26f4], 0x3c
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26f4], 0x3c
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26f4], 0x3c
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26f4], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26e8], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26e8], 0x80
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26e8], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26e8], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26e4], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26e4], 0x99
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26e4], 0x33
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26e4], 0xc8
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26e0], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26e0], 0xff
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26e0], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26e0], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26dc], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26dc], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26dc], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26dc], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x26d8], 0x66
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x26d8], 0xb2
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x26d8], 0xff
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x26d8], 0xff
mov edx, 4
imul eax, edx, 0
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0x8c
mov edx, 4
imul eax, edx, 0
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0
mov eax, 4
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xa5
mov edx, 4
imul eax, edx, 0
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0
mov eax, 4
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
shl edx, 0
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
shl eax, 0
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0
mov eax, 4
shl eax, 0
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0x8b
mov eax, 4
shl eax, 0
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
shl ecx, 0
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0x87
mov edx, 4
shl edx, 0
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xce
mov edx, 4
shl edx, 0
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xfa
mov edx, 4
shl edx, 0
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
shl eax, 1
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0x80
mov ecx, 4
shl ecx, 1
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
shl ecx, 1
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0x80
mov ecx, 4
shl ecx, 1
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
shl edx, 1
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
shl eax, 1
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xb6
mov eax, 4
shl eax, 1
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0xc1
mov eax, 4
shl eax, 1
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 3
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x8b
mov eax, 4
imul ecx, eax, 3
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 3
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 3
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 3
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 3
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x63
mov ecx, 4
imul edx, ecx, 3
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x47
mov edx, 4
imul eax, edx, 3
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
shl ecx, 2
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
shl edx, 2
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xc0
mov edx, 4
shl edx, 2
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xcb
mov edx, 4
shl edx, 2
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
shl eax, 2
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
shl ecx, 2
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xf5
mov ecx, 4
shl ecx, 2
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0xee
mov ecx, 4
shl ecx, 2
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 5
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 5
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xa5
mov edx, 4
imul eax, edx, 5
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0
mov eax, 4
imul ecx, eax, 5
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 5
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 5
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xf5
mov edx, 4
imul eax, edx, 5
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0xee
mov eax, 4
imul ecx, eax, 5
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 6
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 6
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xf5
mov edx, 4
imul eax, edx, 6
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0xee
mov eax, 4
imul ecx, eax, 6
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 6
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0
mov ecx, 4
imul edx, ecx, 6
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0x80
mov edx, 4
imul eax, edx, 6
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0
mov eax, 4
imul ecx, eax, 6
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 7
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0
mov ecx, 4
imul edx, ecx, 7
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 7
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0xff
mov eax, 4
imul ecx, eax, 7
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 7
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 7
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xf5
mov edx, 4
imul eax, edx, 7
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0xee
mov eax, 4
imul ecx, eax, 7
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
shl edx, 3
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
shl eax, 3
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xff
mov eax, 4
shl eax, 3
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0
mov eax, 4
shl eax, 3
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
shl ecx, 3
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
shl edx, 3
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 0
mov byte [eax + ecx], 0xf5
mov edx, 4
shl edx, 3
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xee
mov edx, 4
shl edx, 3
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 9
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0
mov edx, 4
imul eax, edx, 9
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x64
mov eax, 4
imul ecx, eax, 9
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 9
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 9
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0x39
mov edx, 4
imul eax, edx, 9
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xff
mov eax, 4
imul ecx, eax, 9
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0x14
mov ecx, 4
imul edx, ecx, 9
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xa
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0
mov edx, 4
imul eax, edx, 0xa
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xbf
mov eax, 4
imul ecx, eax, 0xa
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0xa
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xa
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0xa
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x69
mov eax, 4
imul ecx, eax, 0xa
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0xb4
mov ecx, 4
imul edx, ecx, 0xa
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xb
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0x30
mov edx, 4
imul eax, edx, 0xb
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x19
mov eax, 4
imul ecx, eax, 0xb
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0x34
mov ecx, 4
imul edx, ecx, 0xb
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xb
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0xb
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xff
mov eax, 4
imul ecx, eax, 0xb
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0xb
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xc
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0
mov edx, 4
imul eax, edx, 0xc
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xff
mov eax, 4
imul ecx, eax, 0xc
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0xef
mov ecx, 4
imul edx, ecx, 0xc
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xc
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0xc
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0
mov eax, 4
imul ecx, eax, 0xc
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0xc
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xd
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0xd
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x45
mov eax, 4
imul ecx, eax, 0xd
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0xd
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xd
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0x36
mov edx, 4
imul eax, edx, 0xd
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x45
mov eax, 4
imul ecx, eax, 0xd
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0x4f
mov ecx, 4
imul edx, ecx, 0xd
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xe
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0
mov edx, 4
imul eax, edx, 0xe
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0
mov eax, 4
imul ecx, eax, 0xe
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0x8b
mov ecx, 4
imul edx, ecx, 0xe
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xe
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0xe
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xa5
mov eax, 4
imul ecx, eax, 0xe
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0xe
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xf
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xff
mov edx, 4
imul eax, edx, 0xf
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0xdf
mov eax, 4
imul ecx, eax, 0xf
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0xf
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0xf
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
imul ecx, eax, 0
mov byte [edx + ecx], 0xdc
mov edx, 4
imul eax, edx, 0xf
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x14
mov eax, 4
imul ecx, eax, 0xf
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0x3c
mov ecx, 4
imul edx, ecx, 0xf
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 3
mov byte [eax + edx], 0xff
mov eax, 4
shl eax, 4
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 0
mov byte [ecx + eax], 0
mov ecx, 4
shl ecx, 4
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xff
mov ecx, 4
shl ecx, 4
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 1
mov byte [edx + eax], 0xff
mov ecx, 4
shl ecx, 4
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
imul ecx, eax, 3
mov byte [edx + ecx], 0xff
mov edx, 4
shl edx, 4
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x30
mov eax, 4
shl eax, 4
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 0
mov byte [ecx + edx], 0x19
mov eax, 4
shl eax, 4
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
shl edx, 1
mov byte [ecx + edx], 0x34
mov eax, 4
shl eax, 4
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x11
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x11
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x11
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x8b
mov edx, 4
imul eax, edx, 0x11
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x11
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x11
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x69
mov ecx, 4
imul edx, ecx, 0x11
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xb4
mov edx, 4
imul eax, edx, 0x11
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x12
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x12
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x69
mov ecx, 4
imul edx, ecx, 0x12
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xb4
mov edx, 4
imul eax, edx, 0x12
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x12
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x12
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xbf
mov ecx, 4
imul edx, ecx, 0x12
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xff
mov edx, 4
imul eax, edx, 0x12
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x13
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x13
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x44
mov ecx, 4
imul edx, ecx, 0x13
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xcc
mov edx, 4
imul eax, edx, 0x13
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x13
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x32
mov eax, 4
imul ecx, eax, 0x13
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xcd
mov ecx, 4
imul edx, ecx, 0x13
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x32
mov edx, 4
imul eax, edx, 0x13
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x14
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x14
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x14
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x14
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x14
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x14
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x14
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x14
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x15
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x15
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x99
mov ecx, 4
imul edx, ecx, 0x15
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xff
mov edx, 4
imul eax, edx, 0x15
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x15
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x15
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x99
mov ecx, 4
imul edx, ecx, 0x15
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xff
mov edx, 4
imul eax, edx, 0x15
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x16
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x39
mov eax, 4
imul ecx, eax, 0x16
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x16
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x14
mov edx, 4
imul eax, edx, 0x16
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x16
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x39
mov eax, 4
imul ecx, eax, 0x16
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x16
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x14
mov edx, 4
imul eax, edx, 0x16
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x17
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x17
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x8c
mov ecx, 4
imul edx, ecx, 0x17
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x17
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x17
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x17
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x8c
mov ecx, 4
imul edx, ecx, 0x17
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x17
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x18
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x18
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xdf
mov ecx, 4
imul edx, ecx, 0x18
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x18
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x18
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x18
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xdf
mov ecx, 4
imul edx, ecx, 0x18
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x18
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x19
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x80
mov eax, 4
imul ecx, eax, 0x19
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x19
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x80
mov edx, 4
imul eax, edx, 0x19
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x19
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0x80
mov eax, 4
imul ecx, eax, 0x19
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x19
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0x80
mov edx, 4
imul eax, edx, 0x19
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1a
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x1a
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1a
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xff
mov edx, 4
imul eax, edx, 0x1a
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1a
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x1a
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1a
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xff
mov edx, 4
imul eax, edx, 0x1a
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1b
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xc0
mov eax, 4
imul ecx, eax, 0x1b
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xc0
mov ecx, 4
imul edx, ecx, 0x1b
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xc0
mov edx, 4
imul eax, edx, 0x1b
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1b
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xc0
mov eax, 4
imul ecx, eax, 0x1b
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0xc0
mov ecx, 4
imul edx, ecx, 0x1b
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xc0
mov edx, 4
imul eax, edx, 0x1b
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1c
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x1c
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x69
mov ecx, 4
imul edx, ecx, 0x1c
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xb4
mov edx, 4
imul eax, edx, 0x1c
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1c
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0xff
mov eax, 4
imul ecx, eax, 0x1c
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0x69
mov ecx, 4
imul edx, ecx, 0x1c
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0xb4
mov edx, 4
imul eax, edx, 0x1c
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1d
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x1d
lea edx, [ebp + ecx - 0x26d0]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x1d
lea eax, [ebp + edx - 0x26d0]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x1d
lea ecx, [ebp + eax - 0x26d0]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
mov ecx, 4
imul edx, ecx, 0x1d
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
mov eax, 4
imul ecx, eax, 0x1d
lea edx, [ebp + ecx - 0x2658]
mov eax, 1
shl eax, 0
mov byte [edx + eax], 0
mov ecx, 4
imul edx, ecx, 0x1d
lea eax, [ebp + edx - 0x2658]
mov ecx, 1
shl ecx, 1
mov byte [eax + ecx], 0
mov edx, 4
imul eax, edx, 0x1d
lea ecx, [ebp + eax - 0x2658]
mov edx, 1
imul eax, edx, 3
mov byte [ecx + eax], 0xff
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 0x58], cl
lea ecx, [ebp - 0x60]
call fcn.00404c00
mov ecx, eax
call fcn.00405500
push eax
call fcn.00406c80
add esp, 4
mov dword [ebp - 0x25a0], eax
mov edx, dword [ebp - 0x41f0]
mov eax, dword [ebp - 0x41ec]
mov dword [ebp - 0x259c], edx
mov dword [ebp - 0x2598], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x25b8], ecx
mov edx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x25c4], edx
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x25c0], eax
mov ecx, dword [0x412780]
mov dword [ebp - 0x25b4], ecx
mov edx, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x25bc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x10], ax
mov byte [ebp - 0xe], al
lea ecx, [ebp - 0x14]
call fcn.00404ba0
mov ecx, eax
call fcn.004053b0
mov dword [ebp - 0x4224], eax
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov word [ebp - 0x4c], cx
mov byte [ebp - 0x4a], cl
lea ecx, [ebp - 0x54]
call fcn.00404c40
mov ecx, eax
call fcn.004055e0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4220], eax
mov edx, dword [ebp - 0x4224]
push edx
mov eax, dword [ebp - 0x4220]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x25b0], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x1c]
call fcn.00404b60
mov ecx, eax
call fcn.004052d0
mov dword [ebp - 0x421c], eax
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov word [ebp - 0x40], dx
mov byte [ebp - 0x3e], dl
lea ecx, [ebp - 0x48]
call fcn.00404c40
mov ecx, eax
call fcn.004055e0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4218], eax
mov eax, dword [ebp - 0x421c]
push eax
mov ecx, dword [ebp - 0x4218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x25ac], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov byte [ebp - 8], dl
lea ecx, [ebp - 0xc]
call fcn.00404b40
mov ecx, eax
call fcn.00405260
mov dword [ebp - 0x4214], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], ax
mov byte [ebp - 0x32], al
lea ecx, [ebp - 0x3c]
call fcn.00404c40
mov ecx, eax
call fcn.004055e0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4204], eax
mov ecx, dword [ebp - 0x4214]
push ecx
mov edx, dword [ebp - 0x4204]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x25a8], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
lea ecx, [ebp - 0x24]
call fcn.00404b80
mov ecx, eax
call fcn.00405340
mov dword [ebp - 0x4200], eax
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 0x26], cl
lea ecx, [ebp - 0x30]
call fcn.00404c40
mov ecx, eax
call fcn.004055e0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x41fc], eax
mov edx, dword [ebp - 0x4200]
push edx
mov eax, dword [ebp - 0x41fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x25a4], eax
mov ecx, dword [0x412750]
mov edx, dword [0x412754]
mov dword [ebp - 0x2584], ecx
mov dword [ebp - 0x2580], edx
mov eax, dword [0x412758]
mov ecx, dword [0x41275c]
mov dword [ebp - 0x2574], eax
mov dword [ebp - 0x2570], ecx
mov edx, dword [0x412748]
mov eax, dword [0x41274c]
mov dword [ebp - 0x258c], edx
mov dword [ebp - 0x2588], eax
mov ecx, dword [0x412760]
mov edx, dword [0x412764]
mov dword [ebp - 0x257c], ecx
mov dword [ebp - 0x2578], edx
movss xmm0, dword [0x40b964]
movss dword [ebp - 0x3f74], xmm0
movss xmm0, dword [0x40b934]
movss dword [ebp - 0x3f54], xmm0
movss xmm0, dword [0x40b928]
movss dword [ebp - 0x3f58], xmm0
movss xmm0, dword [0x40b938]
movss dword [ebp - 0x3f50], xmm0
movss xmm0, dword [0x40b940]
movss dword [ebp - 0x3f6c], xmm0
movss xmm0, dword [0x40b944]
movss dword [ebp - 0x3f68], xmm0
movss xmm0, dword [0x40b948]
movss dword [ebp - 0x3f64], xmm0
movss xmm0, dword [0x40b950]
movss dword [ebp - 0x3f60], xmm0
movss xmm0, dword [0x40b95c]
movss dword [ebp - 0x3f5c], xmm0
movss xmm0, dword [0x40b93c]
movss dword [ebp - 0x2520], xmm0
movss xmm0, dword [0x40b94c]
movss dword [ebp - 0x25cc], xmm0
movss xmm0, dword [0x40b930]
movss dword [ebp - 0x2504], xmm0
movss xmm0, dword [0x40b958]
movss dword [ebp - 0x2500], xmm0
movss xmm0, dword [0x40b92c]
movss dword [ebp - 0x24fc], xmm0
push 0x1a90
push 0x410c08
lea eax, [ebp - 0x24f0]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x388
push 0x410880
lea ecx, [ebp - 0xa60]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 4
imul eax, edx, 0x8d
mov ecx, dword [ebp - 0x41d0]
mov edx, dword [ecx + eax]
mov dword [ebp - 0x25c8], edx
mov eax, dword [ebp - 0x41c0]
add eax, 0x3f30
mov ecx, 4
imul edx, ecx, 0x8d
mov ecx, dword [ebp - 0x41d0]
mov dword [ecx + edx], eax
push 0
push 0x400
mov edx, dword [ebp - 0x41d0]
push edx
mov eax, dword [ebp - 0x41d4]
push eax
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0x41cc]
mov eax, dword [edx + 0xa8]
mov dword [ebp - 0x2738], eax
push 0
push 0x3f30
lea ecx, [ebp - 0x41bc]
push ecx
mov edx, dword [ebp - 0x41c0]
push edx
mov eax, dword [0x412740]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x41c0]
add ecx, 0x3f30
mov dword [ebp - 0x4208], ecx
push 0x11
push 0x40d0a0
call fcn.00406d50
add esp, 8
mov dword [ebp - 0x41f8], eax
mov edx, dword [ebp - 0x41f8]
mov eax, dword [ebp - 0x41c0]
mov dword [edx], eax
push 0
push 0x37e0
push 0x40d0a0
mov ecx, dword [ebp - 0x4208]
push ecx
mov edx, dword [0x412740]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
lea eax, [ebp - 0x41d4]
push eax
mov ecx, dword [ebp - 0x41cc]
mov edx, dword [ecx + 0xa8]
push edx
mov eax, dword [0x412740]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x2a
push 0
lea ecx, [ebp - 0x1a8]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1a8]
call fcn.00404db0
mov ecx, eax
call fcn.00405960
push eax
call fcn.004066e0
add esp, 4
push 0x31
push 0
lea edx, [ebp - 0x1dc]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1dc]
call fcn.00404dd0
mov ecx, eax
call fcn.004059d0
mov dword [ebp - 0x41f4], eax
mov eax, dword [ebp - 0x41cc]
mov eax, dword [eax + 0xac]
cdq
mov dword [ebp - 0x4210], eax
mov dword [ebp - 0x420c], edx
mov ecx, dword [ebp - 0x41f4]
push ecx
push 0x5f000
mov edx, dword [ebp - 0x420c]
push edx
mov eax, dword [ebp - 0x4210]
push eax
call fcn.00406a80
add esp, 0x10
mov dword [ebp - 0x41c8], eax
cmp dword [ebp - 0x41c8], 0
je 0x4047b2
mov ecx, dword [ebp - 0x41c8]
add ecx, 1
mov dword [ebp - 0x41c8], ecx
lea edx, [ebp - 0x41e0]
push edx
push 0x40
push 1
mov eax, dword [ebp - 0x41c8]
push eax
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x4047b2
mov byte [ebp - 0x41c1], 0
push 0
push 1
lea edx, [ebp - 0x41c1]
push edx
mov eax, dword [ebp - 0x41c8]
push eax
mov ecx, dword [0x412740]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea edx, [ebp - 0x41e0]
push edx
mov eax, dword [ebp - 0x41e0]
push eax
push 1
mov ecx, dword [ebp - 0x41c8]
push ecx
mov edx, dword [0x412740]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408e17
mov esp, ebp
pop ebp
ret