Function at 0x401872
Capabilities:
Check os version
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x574
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x37c], 0
mov byte [ebp - 0x37e], 0
mov byte [ebp - 0x37d], 0x68
mov byte [ebp - 0x37f], 0xcc
mov dword [ebp - 0x388], 0x8d006af9
mov dword [ebp - 0x384], 0x8b575653
mov dword [ebp - 0x39c], 0x900008c2
mov dword [ebp - 0x398], 0x90000cc2
mov dword [ebp - 0x394], 0x900004c2
mov dword [ebp - 0x390], 0x90000cc2
mov dword [ebp - 0x38c], 0x900008c2
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x3a8], 0x74617453
mov dword [ebp - 0x3a4], 0x64616f4c
mov dword [ebp - 0x3ac], 0x909090c3
mov dword [ebp - 0x3b0], 0
mov byte [ebp - 0x3b1], 0
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x28], 0x3e8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x528]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x528]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecA]
call eax
sub esp, 4
mov dword [esp + 4], str.Pusu.exe
lea eax, [ebp - 0x528]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathAppendA]
call eax
sub esp, 8
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x90]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x90], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0xa0]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0xa0]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x90]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x528]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
je 0x401ae5
mov dword [esp + 4], str._loaded
mov dword [esp], str.Pusu.exe
call sym._Concat
mov dword [esp + 4], eax
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x401b22
mov dword [esp + 4], str._cant_loaded
mov dword [esp], str.Pusu.exe
call sym._Concat
mov dword [esp + 4], eax
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x402c34
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x424]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
call eax
sub esp, 8
test eax, eax
je 0x402baf
cmp dword [ebp - 0x18], 0
je 0x401bd7
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
call eax
cmp al, 4
jbe 0x401bc2
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
je 0x401bc2
cmp dword [ebp - 0x1c], 0
je 0x401baf
lea edx, [ebp - 0x37e]
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x424]
cmp eax, 9
ja case.0x401bed.0
mov eax, dword [eax*4 + 0x405170]
jmp eax
mov eax, dword [ebp - 0x418]
cmp eax, 0x80000004
je 0x40283f
cmp eax, 0xc0000005
je 0x401c13
cmp eax, 0x80000003
je 0x401c3c
jmp 0x4028c2
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x401c30
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x80010001
jmp 0x4028d1
mov dword [ebp - 0xc], 0
jmp 0x4028d1
add dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x402833
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x30], 1
jbe 0x402603
mov eax, dword [ebp - 0x40c]
mov edx, eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
cmp edx, eax
jne 0x4025f7
mov dword [ebp - 0x36c], 0x10007
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x36c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadContext]
call eax
sub esp, 8
lea edx, [ebp - 0x37e]
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x2b4]
sub eax, 1
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x36c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadContext]
call eax
sub esp, 8
cmp dword [ebp - 0x2c], 0
jne 0x401e7d
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x401d69
mov dword [esp + 4], str._Kernel32.dll__GetModuleHandle_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov dword [esp + 4], str.GetVersion
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x401dbe
mov dword [esp + 4], str._Kernel32.dll__GetVersion_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov eax, dword [ebp - 0x44]
lea edx, [eax + 6]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x374], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
lea edx, [ebp - 0x3b1]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
lea edx, [ebp - 0x3b1]
mov eax, dword [ebp - 0x3c]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x37e]
mov edx, dword [ebp - 0x3c]
add edx, ecx
mov byte [edx], al
lea edx, [ebp - 0x37f]
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
add dword [ebp - 0x2c], 1
mov dword [ebp - 0x24], 0x10002
jmp 0x4028d1
cmp dword [ebp - 0x2c], 1
jne 0x4024e0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2a8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x370], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x370]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x2d0]
cmp edx, eax
jne 0x4024c6
mov eax, dword [ebp - 0x2a8]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x370]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x370]
test eax, eax
je 0x4024b6
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x370]
lea edx, [eax - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x370], edx
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x370]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x37c]
sub edx, eax
mov eax, edx
add eax, 0x1000
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0
jmp 0x402143
mov dword [ebp - 0x34], 0
jmp 0x402133
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jb 0x401fbc
mov dword [ebp - 0x38], 5
jmp 0x40213f
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x388]
cmp edx, eax
jne 0x40212f
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 4]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x384]
cmp edx, eax
jne 0x40212f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 0x10]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
lea eax, [ebp - 0x39c]
mov edx, dword [ebp - 0x38]
shl edx, 2
lea ecx, [eax + edx]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 0x32]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x3a0], edx
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jb 0x401fa8
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 4
jbe 0x401f9c
cmp dword [ebp - 0x10], 0
je 0x40229b
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3a0]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x37c]
sub edx, eax
mov eax, edx
add eax, 0x1000
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0
jmp 0x40228d
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x3a8]
cmp edx, eax
jne 0x402289
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 4]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x3a4]
cmp edx, eax
jne 0x402289
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x3b0], edx
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jb 0x402197
jmp 0x4022cf
mov dword [esp + 4], str.Dialog_functions_not_found
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x3b0]
test eax, eax
je 0x402482
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x370]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0
jmp 0x402474
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x3b8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x3b0]
cmp edx, eax
jne 0x402470
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x378], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x378]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
lea edx, [ebp - 0x3b1]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
lea edx, [ebp - 0x3b1]
mov eax, dword [ebp - 0x3c]
add eax, edx
movzx edx, byte [eax]
movzx eax, byte [ebp - 0x37d]
cmp dl, al
jne 0x402470
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x374], edx
lea edx, [ebp - 0x3b1]
mov eax, dword [ebp - 0x3c]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x37e]
mov edx, dword [ebp - 0x3c]
add edx, ecx
mov byte [edx], al
lea edx, [ebp - 0x37f]
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
add dword [ebp - 0x2c], 1
jmp 0x4025eb
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jb 0x402308
jmp 0x4024d4
mov dword [esp + 4], str.Loader_failed__Pool_
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._SetSingleStep
jmp 0x4024d4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._SetSingleStep
mov dword [ebp - 0x24], 0x10002
jmp 0x4028d1
cmp dword [ebp - 0x2c], 2
jne 0x4025eb
mov eax, dword [ebp - 0x2a8]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x3b8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x3b8]
test eax, eax
je 0x4025b7
lea eax, [ebp - 0x3ac]
mov edx, dword [ebp - 0x3c]
shl edx, 2
lea ecx, [eax + edx]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x3b8]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 1
mov dword [esp + 4], str.Successfully_initialized
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x4025eb
mov dword [esp + 4], str.Loader_failed__Pool_
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov dword [ebp - 0x24], 0x10002
jmp 0x4028d1
mov dword [ebp - 0x24], 0x80010001
jmp 0x4028d1
mov dword [ebp - 0x36c], 0x10004
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x36c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadContext]
call eax
sub esp, 8
mov edx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x530]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
call eax
sub esp, 0xc
test eax, eax
jne 0x402682
mov dword [esp + 4], str.GetThreadSelectorEntry_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x4028d1
movzx eax, byte [ebp - 0x529]
movzx eax, al
shl eax, 8
mov edx, eax
movzx eax, byte [ebp - 0x52c]
movzx eax, al
or eax, edx
shl eax, 0x10
mov edx, eax
movzx eax, word [ebp - 0x52e]
movzx eax, ax
or eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0x30
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x538]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x534]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x4026fb
mov eax, dword [ebp - 0x538]
cmp eax, 4
je 0x402728
mov dword [esp + 4], str.ReadProcessMemory_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x40282e
mov eax, dword [ebp - 0x534]
add eax, 2
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x538]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 2
lea edx, [ebp - 0x53a]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x402775
mov eax, dword [ebp - 0x538]
cmp eax, 2
je 0x4027a2
mov dword [esp + 4], str.ReadProcessMemory_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x40282e
mov word [ebp - 0x53a], 0
mov eax, dword [ebp - 0x534]
add eax, 2
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x538]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 2
lea edx, [ebp - 0x53a]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x4027f8
mov eax, dword [ebp - 0x538]
cmp eax, 2
je 0x402822
mov dword [esp + 4], str.WriteProcessMemory_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x40282e
mov dword [ebp - 0x24], 0x10002
jmp 0x4028d1
jmp 0x402b52
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x4028b9
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._ClearSingleStep
cmp dword [ebp - 0x1c], 0
jne 0x4028a9
lea edx, [ebp - 0x37f]
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
jmp 0x4028d1
mov dword [ebp - 0xc], 0
jmp 0x4028d1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x80010001
nop
jmp 0x402b52
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0x1100
mov eax, dword [sym.imp.KERNEL32.dll_FormatMessageA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40c]
mov edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x37c], edx
mov eax, dword [ebp - 0x3fc]
mov edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x374], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
lea edx, [ebp - 0x3b1]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
lea edx, [ebp - 0x3b1]
mov eax, dword [ebp - 0x3c]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x37e]
mov edx, dword [ebp - 0x3c]
add edx, ecx
mov byte [edx], al
lea edx, [ebp - 0x37f]
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x374]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x3c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
mov eax, dword [ebp - 0x418]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x10002
jmp 0x402b52
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0x1100
mov eax, dword [sym.imp.KERNEL32.dll_FormatMessageA]
call eax
sub esp, 0x1c
mov dword [esp + 4], str.RIP_EVENT
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0x80010001
jmp 0x402b52
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x80010001
nop
cmp dword [ebp - 0xc], 0
jne 0x402b8b
nop
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x402c26
jmp 0x402bb4
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
call eax
sub esp, 0xc
jmp 0x401b22
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
call eax
cmp al, 4
jbe 0x402c26
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
je 0x402c26
mov dword [esp + 4], str.DebugActiveProcessStop
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x402c15
mov dword [esp + 4], str._Kernel32.dll__DebugActiveProcessStop_failed
mov dword [esp], str.Loader:
call sym._Concat
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
jmp 0x402c26
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov ebx, dword [ebp - 4]
leave
ret