Function at 0x4018a0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa53c
call fcn.00407960
mov eax, dword [0x416d64]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], al
lea ecx, [ebp - 0x78]
call fcn.004031f0
mov ecx, eax
call fcn.00403a70
push eax
call fcn.00405030
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x416e00], eax
cmp dword [0x416e00], 0
jne 0x4018fb
jmp 0x402da9
xor ecx, ecx
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], ecx
mov word [ebp - 0x1a0], cx
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov word [ebp - 0x64], dx
mov byte [ebp - 0x62], dl
lea ecx, [ebp - 0x1c0]
call fcn.00403370
mov ecx, eax
call fcn.00403e60
mov dword [ebp - 0xa4fc], eax
lea ecx, [ebp - 0x6c]
call fcn.00403230
mov ecx, eax
call fcn.00403b50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa4f8], eax
mov eax, dword [ebp - 0xa4fc]
push eax
mov ecx, dword [ebp - 0xa4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x416e48], eax
xor edx, edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d0], edx
mov dword [ebp - 0x1cc], edx
mov dword [ebp - 0x1c8], edx
mov dword [ebp - 0x1c4], edx
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x58], ax
mov byte [ebp - 0x56], al
lea ecx, [ebp - 0x1dc]
call fcn.00403340
mov ecx, eax
call fcn.00403df0
mov dword [ebp - 0xa4f4], eax
lea ecx, [ebp - 0x60]
call fcn.00403230
mov ecx, eax
call fcn.00403b50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa53c], eax
mov ecx, dword [ebp - 0xa4f4]
push ecx
mov edx, dword [ebp - 0xa53c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x416e40], eax
xor eax, eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0xa538]
push ecx
lea ecx, [ebp - 0x140]
call fcn.004034d0
mov ecx, eax
call fcn.004042c0
push eax
call fcn.00404b70
add esp, 8
mov dword [ebp - 0xa4f0], eax
mov dword [ebp - 0xa4ec], edx
mov edx, dword [ebp - 0xa538]
push edx
mov eax, dword [ebp - 0xa4ec]
push eax
mov ecx, dword [ebp - 0xa4f0]
push ecx
call fcn.00401610
add esp, 0xc
mov edx, dword [0x416e00]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov word [ebp - 0xe8], ax
mov byte [ebp - 0xe6], al
lea ecx, [ebp - 0xf8]
call fcn.00403310
mov ecx, eax
call fcn.00403d80
push eax
call fcn.00405030
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x416e00], eax
cmp dword [0x416e00], 0
jne 0x401ae7
jmp 0x402da9
push 0x40
push 0x3000
push 0x20000
push 0
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa4c0], eax
cmp dword [ebp - 0xa4c0], 0
jne 0x401b16
jmp 0x402da9
push 0xb0
push 0
lea edx, [ebp - 0x31c]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x27c], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x278], ecx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], edx
mov word [ebp - 0xfc], dx
mov byte [ebp - 0xfa], dl
push 0x11
lea ecx, [ebp - 0x10c]
call fcn.004032e0
mov ecx, eax
call fcn.00403d10
push eax
lea eax, [ebp - 0x31c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], ecx
mov byte [ebp - 0xc8], cl
push 0xb
lea ecx, [ebp - 0xd4]
call fcn.00403510
mov ecx, eax
call fcn.004043a0
push eax
lea edx, [ebp - 0x2fc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x110], al
push 0xf
lea ecx, [ebp - 0x120]
call fcn.00403280
mov ecx, eax
call fcn.00403c30
push eax
lea ecx, [ebp - 0x2dc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor edx, edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], edx
mov word [ebp - 0xac], dx
mov byte [ebp - 0xaa], dl
push 0xd
lea ecx, [ebp - 0xb8]
call fcn.00403570
mov ecx, eax
call fcn.004044f0
push eax
lea eax, [ebp - 0x2bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov byte [ebp - 0x124], cl
push 0xf
lea ecx, [ebp - 0x134]
call fcn.00403250
mov ecx, eax
call fcn.00403bc0
push eax
lea edx, [ebp - 0x29c]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0
push 0xb0
lea eax, [ebp - 0x31c]
push eax
mov ecx, dword [ebp - 0xa4c0]
push ecx
mov edx, dword [0x416e00]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x99
push 0x411400
mov eax, dword [ebp - 0xa4c0]
add eax, 0xb0
push eax
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov edx, dword [ebp - 0xa4c0]
push edx
mov eax, dword [ebp - 0xa4c0]
add eax, 0xb0
push eax
push 0
push 0
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa4dc], eax
push 0xb0
call fcn.004076f3
add esp, 4
mov dword [ebp - reloc.WS2_32.dll_getaddrinfo], eax
cmp dword [ebp - reloc.WS2_32.dll_getaddrinfo], 0
je 0x401d4e
push 0xb0
push 0
mov edx, dword [ebp - reloc.WS2_32.dll_getaddrinfo]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - reloc.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xa4e0], eax
jmp 0x401d58
mov dword [ebp - 0xa4e0], 0
mov ecx, dword [ebp - 0xa4e0]
mov dword [ebp - 0xa4c8], ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa4dc]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xa4dc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xb0
mov ecx, dword [ebp - 0xa4c8]
push ecx
mov edx, dword [ebp - 0xa4c0]
push edx
mov eax, dword [0x416e00]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40
push 0x3000
push 0x4000
push 0
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa4d8], eax
cmp dword [ebp - 0xa4d8], 0
jne 0x401dd0
jmp 0x402da9
mov dword [ebp - 0xa4e4], 0
push 0
push 4
lea edx, [ebp - 0xa4e4]
push edx
mov eax, dword [ebp - 0xa4c8]
mov ecx, dword [eax + 0xa8]
push ecx
mov edx, dword [0x416e00]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x400
call fcn.00407723
add esp, 4
mov dword [ebp - 0xa534], eax
mov eax, dword [ebp - 0xa534]
mov dword [ebp - 0xa4d0], eax
push 0
push 0x400
mov ecx, dword [ebp - 0xa4d0]
push ecx
mov edx, dword [ebp - 0xa4e4]
push edx
mov eax, dword [0x416e00]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa1a0
push 0
lea ecx, [ebp - 0xa4bc]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0xd8], edx
push 6
lea ecx, [ebp - 0xdc]
call fcn.004031d0
mov ecx, eax
call fcn.00403a00
push eax
lea eax, [ebp - 0x8b00]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x8b00]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x8b00]
push edx
call fcn.00403070
add esp, 8
xor eax, eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
push 4
lea ecx, [ebp - 0xe4]
call fcn.004035a0
mov ecx, eax
call fcn.00404560
push eax
lea ecx, [ebp - 0xa37c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0xa37c]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea eax, [ebp - 0xa37c]
push eax
call fcn.004030b0
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov word [ebp - 0xa0], cx
push 6
lea ecx, [ebp - 0xa8]
call fcn.004035e0
mov ecx, eax
call fcn.00404640
push eax
lea edx, [ebp - 0xa376]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0xa376]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea ecx, [ebp - 0xa376]
push ecx
call fcn.004030b0
add esp, 8
mov edx, 0x28
imul eax, edx, 0
mov dword [ebp + eax - 0xa498], 0
mov ecx, 0x28
imul edx, ecx, 0
mov dword [ebp + edx - 0xa49c], 1
xor eax, eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
push 0xc
lea ecx, [ebp - 0x178]
call fcn.00403640
mov ecx, eax
call fcn.00404790
push eax
mov ecx, 0x28
imul edx, ecx, 0
lea eax, [ebp + edx - 0xa4bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
imul edx, ecx, 0
lea eax, [ebp + edx - 0xa4bc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
imul edx, ecx, 0
lea eax, [ebp + edx - 0xa4bc]
push eax
call fcn.004030b0
add esp, 8
mov ecx, 0x28
shl ecx, 0
mov dword [ebp + ecx - 0xa498], 2
mov edx, 0x28
shl edx, 0
mov dword [ebp + edx - 0xa49c], 5
xor eax, eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov word [ebp - 0x94], ax
push 6
lea ecx, [ebp - 0x9c]
call fcn.00403600
mov ecx, eax
call fcn.004046b0
push eax
mov ecx, 0x28
shl ecx, 0
lea edx, [ebp + ecx - 0xa4bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
shl eax, 0
lea ecx, [ebp + eax - 0xa4bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
shl edx, 0
lea eax, [ebp + edx - 0xa4bc]
push eax
call fcn.004030b0
add esp, 8
mov ecx, 0x28
shl ecx, 1
mov dword [ebp + ecx - 0xa498], 1
mov edx, 0x28
shl edx, 1
mov dword [ebp + edx - 0xa49c], 0x1e
xor eax, eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
push 0xc
lea ecx, [ebp - 0x188]
call fcn.00403620
mov ecx, eax
call fcn.00404720
push eax
mov ecx, 0x28
shl ecx, 1
lea edx, [ebp + ecx - 0xa4bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
shl eax, 1
lea ecx, [ebp + eax - 0xa4bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
shl edx, 1
lea eax, [ebp + edx - 0xa4bc]
push eax
call fcn.004030b0
add esp, 8
mov ecx, 0x28
imul edx, ecx, 3
mov dword [ebp + edx - 0xa498], 0
mov eax, 0x28
imul ecx, eax, 3
mov dword [ebp + ecx - 0xa49c], 1
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov word [ebp - 0x144], dx
push 0xe
lea ecx, [ebp - 0x154]
call fcn.00403660
mov ecx, eax
call fcn.00404800
push eax
mov eax, 0x28
imul ecx, eax, 3
lea edx, [ebp + ecx - 0xa4bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 3
lea edx, [ebp + ecx - 0xa4bc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 3
lea edx, [ebp + ecx - 0xa4bc]
push edx
call fcn.004030b0
add esp, 8
mov eax, 0x28
shl eax, 2
mov dword [ebp + eax - 0xa498], 2
mov ecx, 0x28
shl ecx, 2
mov dword [ebp + ecx - 0xa49c], 6
xor edx, edx
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xc0], edx
mov word [ebp - 0xbc], dx
push 6
lea ecx, [ebp - 0xc4]
call fcn.00403600
mov ecx, eax
call fcn.004046b0
push eax
mov eax, 0x28
shl eax, 2
lea ecx, [ebp + eax - 0xa4bc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
shl edx, 2
lea eax, [ebp + edx - 0xa4bc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
shl ecx, 2
lea edx, [ebp + ecx - 0xa4bc]
push edx
call fcn.004030b0
add esp, 8
mov eax, 0x28
imul ecx, eax, 5
mov dword [ebp + ecx - 0xa498], 0
mov edx, 0x28
imul eax, edx, 5
mov dword [ebp + eax - 0xa49c], 0
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov word [ebp - 0x158], cx
push 0xe
lea ecx, [ebp - 0x168]
call fcn.00403690
mov ecx, eax
call fcn.00404870
push eax
mov edx, 0x28
imul eax, edx, 5
lea ecx, [ebp + eax - 0xa4bc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
imul eax, edx, 5
lea ecx, [ebp + eax - 0xa4bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
imul eax, edx, 5
lea ecx, [ebp + eax - 0xa4bc]
push ecx
call fcn.004030b0
add esp, 8
mov edx, 0x28
imul eax, edx, 6
mov dword [ebp + eax - 0xa498], 0
mov ecx, 0x28
imul edx, ecx, 6
mov dword [ebp + edx - 0xa49c], 1
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov word [ebp - 0x88], ax
push 6
lea ecx, [ebp - 0x90]
call fcn.004035c0
mov ecx, eax
call fcn.004045d0
push eax
mov ecx, 0x28
imul edx, ecx, 6
lea eax, [ebp + edx - 0xa4bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
imul edx, ecx, 6
lea eax, [ebp + edx - 0xa4bc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
imul edx, ecx, 6
lea eax, [ebp + edx - 0xa4bc]
push eax
call fcn.004030b0
add esp, 8
mov ecx, 0x28
imul edx, ecx, 7
mov dword [ebp + edx - 0xa498], 0
mov eax, 0x28
imul ecx, eax, 7
mov dword [ebp + ecx - 0xa49c], 0
xor edx, edx
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov dword [ebp - 0x190], edx
mov dword [ebp - 0x18c], edx
push 0x10
lea ecx, [ebp - 0x19c]
call fcn.004036c0
mov ecx, eax
call fcn.004048e0
push eax
mov eax, 0x28
imul ecx, eax, 7
lea edx, [ebp + ecx - 0xa4bc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 7
lea edx, [ebp + ecx - 0xa4bc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 7
lea edx, [ebp + ecx - 0xa4bc]
push edx
call fcn.004030b0
add esp, 8
movss xmm0, dword [0x409724]
movss dword [ebp - 0xa254], xmm0
movss xmm0, dword [0x409730]
movss dword [ebp - 0xa274], xmm0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ad8], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ad8], 0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ad8], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ad8], 0x32
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ad4], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ad4], 0xff
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ad4], 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ad4], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ad0], 0xe1
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ad0], 0xe1
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ad0], 0xe1
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ad0], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8acc], 0x66
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8acc], 0xb2
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8acc], 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8acc], 0xc8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ac8], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ac8], 0x99
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ac8], 0x33
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ac8], 0xc8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ac0], 0x12
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ac0], 0x12
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ac0], 0x12
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ac0], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8abc], 0x2d
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8abc], 0x2d
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8abc], 0x2d
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8abc], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ac4], 0x3c
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ac4], 0x3c
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ac4], 0x3c
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ac4], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ab8], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ab8], 0x80
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ab8], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ab8], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ab4], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ab4], 0x99
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ab4], 0x33
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ab4], 0xc8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8ab0], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8ab0], 0xff
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8ab0], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8ab0], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8aac], 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8aac], 0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8aac], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8aac], 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x8aa8], 0x66
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x8aa8], 0xb2
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x8aa8], 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x8aa8], 0xff
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], al
lea ecx, [ebp - 0x84]
call fcn.004031f0
mov ecx, eax
call fcn.00403a70
push eax
call fcn.00405030
add esp, 4
mov dword [ebp - 0x8a60], eax
mov ecx, dword [ebp - 0xa4f0]
mov edx, dword [ebp - 0xa4ec]
mov dword [ebp - 0x8a5c], ecx
mov dword [ebp - 0x8a58], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x8a78], eax
mov ecx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x8a84], ecx
mov edx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x8a80], edx
mov eax, dword [0x416e40]
mov dword [ebp - 0x8a74], eax
mov ecx, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x8a7c], ecx
xor edx, edx
mov dword [ebp - 0x14], edx
mov word [ebp - 0x10], dx
mov byte [ebp - 0xe], dl
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov word [ebp - 0x4c], ax
mov byte [ebp - 0x4a], al
lea ecx, [ebp - 0x14]
call fcn.00403190
mov ecx, eax
call fcn.00403920
mov dword [ebp - reloc.VCRUNTIME140.dll___std_exception_copy], eax
lea ecx, [ebp - 0x54]
call fcn.00403230
mov ecx, eax
call fcn.00403b50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa52c], eax
mov ecx, dword [ebp - reloc.VCRUNTIME140.dll___std_exception_copy]
push ecx
mov edx, dword [ebp - 0xa52c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a70], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x18], ax
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov word [ebp - 0x40], cx
mov byte [ebp - 0x3e], cl
lea ecx, [ebp - 0x1c]
call fcn.00403150
mov ecx, eax
call fcn.00403840
mov dword [ebp - 0xa528], eax
lea ecx, [ebp - 0x48]
call fcn.00403230
mov ecx, eax
call fcn.00403b50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - reloc.VCRUNTIME140.dll_strstr], eax
mov edx, dword [ebp - 0xa528]
push edx
mov eax, dword [ebp - reloc.VCRUNTIME140.dll_strstr]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a6c], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], cl
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov word [ebp - 0x34], dx
mov byte [ebp - 0x32], dl
lea ecx, [ebp - 0xc]
call fcn.00403130
mov ecx, eax
call fcn.004037d0
mov dword [ebp - 0xa514], eax
lea ecx, [ebp - 0x3c]
call fcn.00403230
mov ecx, eax
call fcn.00403b50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa510], eax
mov eax, dword [ebp - 0xa514]
push eax
mov ecx, dword [ebp - 0xa510]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a68], eax
xor edx, edx
mov dword [ebp - 0x24], edx
mov word [ebp - 0x20], dx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov byte [ebp - 0x26], al
lea ecx, [ebp - 0x24]
call fcn.00403170
mov ecx, eax
call fcn.004038b0
mov dword [ebp - 0xa50c], eax
lea ecx, [ebp - 0x30]
call fcn.00403230
mov ecx, eax
call fcn.00403b50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - reloc.VCRUNTIME140.dll_memset], eax
mov ecx, dword [ebp - 0xa50c]
push ecx
mov edx, dword [ebp - reloc.VCRUNTIME140.dll_memset]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a64], eax
mov eax, dword [0x416e10]
mov ecx, dword [0x416e14]
mov dword [ebp - 0x8a44], eax
mov dword [ebp - 0x8a40], ecx
mov edx, dword [0x416e18]
mov eax, dword [0x416e1c]
mov dword [ebp - 0x8a34], edx
mov dword [ebp - 0x8a30], eax
mov ecx, dword [0x416e08]
mov edx, dword [0x416e0c]
mov dword [ebp - 0x8a4c], ecx
mov dword [ebp - 0x8a48], edx
mov eax, dword [0x416e20]
mov ecx, dword [0x416e24]
mov dword [ebp - 0x8a3c], eax
mov dword [ebp - 0x8a38], ecx
movss xmm0, dword [0x409734]
movss dword [ebp - 0xa2c0], xmm0
movss xmm0, dword [0x409700]
movss dword [ebp - 0xa2a0], xmm0
movss xmm0, dword [0x4096f0]
movss dword [ebp - 0xa2a4], xmm0
movss xmm0, dword [0x409708]
movss dword [ebp - 0xa29c], xmm0
movss xmm0, dword [0x409710]
movss dword [ebp - 0xa2b8], xmm0
movss xmm0, dword [0x409714]
movss dword [ebp - 0xa2b4], xmm0
movss xmm0, dword [0x409718]
movss dword [ebp - 0xa2b0], xmm0
movss xmm0, dword [0x409720]
movss dword [ebp - 0xa2ac], xmm0
movss xmm0, dword [0x40972c]
movss dword [ebp - 0xa2a8], xmm0
movss xmm0, dword [0x40970c]
movss dword [ebp - 0x89e0], xmm0
mov dword [ebp - 0x89b0], 0x64
mov dword [ebp - 0x89ac], 0x86
mov dword [ebp - 0x89a8], 0x64
mov dword [ebp - 0x89a4], 0x79
movss xmm0, dword [0x40971c]
movss dword [ebp - 0x8a8c], xmm0
movss xmm0, dword [0x4096fc]
movss dword [ebp - 0x89c4], xmm0
movss xmm0, dword [0x4096f8]
movss dword [ebp - 0x89c0], xmm0
movss xmm0, dword [0x409704]
movss dword [ebp - 0x89bc], xmm0
movss xmm0, dword [0x409728]
movss dword [ebp - 0x89b8], xmm0
movss xmm0, dword [0x4096f4]
movss dword [ebp - 0x89b4], xmm0
push 0x2fa8
push 0x40e458
lea edx, [ebp - 0x8984]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x3458
push section..data
lea eax, [ebp - 0x59db]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x1a90
push 0x4152c8
lea ecx, [ebp - 0x2582]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x388
push 0x414f40
lea edx, [ebp - 0xaf2]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 4
imul ecx, eax, 0x8d
mov edx, dword [ebp - 0xa4d0]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x8a88], eax
mov ecx, dword [ebp - 0xa4c0]
add ecx, 0xa1a0
mov edx, 4
imul eax, edx, 0x8d
mov edx, dword [ebp - 0xa4d0]
mov dword [edx + eax], ecx
push 0
push 0x400
mov eax, dword [ebp - 0xa4d0]
push eax
mov ecx, dword [ebp - 0xa4d8]
push ecx
mov edx, dword [0x416e00]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xa4c8]
mov ecx, dword [eax + 0xa8]
mov dword [ebp - 0x8b18], ecx
push 0
push 0xa1a0
lea edx, [ebp - 0xa4bc]
push edx
mov eax, dword [ebp - 0xa4c0]
push eax
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0xa4c0]
add edx, 0xa1a0
mov dword [ebp - 0xa504], edx
push 0x11
push 0x4114a0
call fcn.00405100
add esp, 8
mov dword [ebp - 0xa518], eax
mov eax, dword [ebp - 0xa518]
mov ecx, dword [ebp - 0xa4c0]
mov dword [eax], ecx
push 0
push 0x3a99
push 0x4114a0
mov edx, dword [ebp - 0xa504]
push edx
mov eax, dword [0x416e00]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
lea ecx, [ebp - 0xa4d8]
push ecx
mov edx, dword [ebp - 0xa4c8]
mov eax, dword [edx + 0xa8]
push eax
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x2a
push 0
lea edx, [ebp - 0x208]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x208]
call fcn.004033f0
mov ecx, eax
call fcn.00403fb0
push eax
call fcn.00404a90
add esp, 4
push 0x61
push 0
lea eax, [ebp - 0x26c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x26c]
call fcn.004034b0
mov ecx, eax
call fcn.00404250
mov dword [ebp - 0xa500], eax
mov ecx, dword [ebp - 0xa4c8]
mov eax, dword [ecx + 0xac]
cdq
mov dword [ebp - 0xa524], eax
mov dword [ebp - 0xa520], edx
mov edx, dword [ebp - 0xa500]
push edx
push 0x5f000
mov eax, dword [ebp - 0xa520]
push eax
mov ecx, dword [ebp - 0xa524]
push ecx
call fcn.00404e30
add esp, 0x10
add eax, 1
mov dword [ebp - 0xa4cc], eax
je 0x402da9
lea edx, [ebp - 0xa4e8]
push edx
push 0x40
push 1
mov eax, dword [ebp - 0xa4cc]
push eax
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402da9
mov byte [ebp - 0xa4c1], 0
push 0
push 1
lea edx, [ebp - 0xa4c1]
push edx
mov eax, dword [ebp - 0xa4cc]
push eax
mov ecx, dword [0x416e00]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea edx, [ebp - 0xa4e8]
push edx
mov eax, dword [ebp - 0xa4e8]
push eax
push 1
mov ecx, dword [ebp - 0xa4cc]
push ecx
mov edx, dword [0x416e00]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407731
mov esp, ebp
pop ebp
ret