Function at 0x4029a0
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410e3f
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x419008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push 0
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test edi, edi
jne 0x402d9c
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x12c], 0x7994ebdc
mov edi, dword [eax]
mov dword [ebp - 0x124], edi
mov eax, dword [edi + 0x4b4]
test al, 1
jne 0x402a8f
or eax, 1
mov dword [edi + 0x4b4], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x6c8], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x12c]
mov byte [ecx + edi + 0x6c4], al
add ecx, 1
adc edx, 0
jne 0x402a7b
cmp ecx, 4
jb 0x402a60
push 0x412e70
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x6c8], 0
lea ebx, [edi + 0x6c4]
je 0x402ae6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x79e787bf
and ecx, 7
mov edx, 0xb5e3ff6f
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402adc
cmp esi, 4
jb 0x402ab5
mov edi, dword [ebp - 0x124]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0xa8]
add esp, 4
mov dword [ebp - 0x120], 0xe0d3f848
mov dword [ebp - 0x11c], 0x33d04bc9
test al, 1
jne 0x402b6f
or eax, 1
mov dword [edi + 0xa8], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x130], xmm0
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
mov byte [edi + 0x51c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x514], al
add ecx, 1
adc edx, 0
jne 0x402b5b
cmp ecx, 8
jb 0x402b40
push 0x412e30
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x51c], 0
lea ebx, [edi + 0x514]
je 0x402bc6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x8fbf972b
and ecx, 7
mov edx, 0x33936bbb
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402bbc
cmp esi, 8
jb 0x402b95
mov edi, dword [ebp - 0x124]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x414700]
add esp, 4
mov eax, dword [edi + 0x520]
mov byte [ebp - 0x134], 0xcd
movups xmmword [ebp - 0x144], xmm0
test al, 1
jne 0x402c4f
or eax, 1
mov dword [edi + 0x520], eax
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x3b9], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x144]
mov byte [ecx + edi + 0x3a8], al
add ecx, 1
adc edx, 0
jne 0x402c3b
cmp ecx, 0x11
jb 0x402c20
push 0x412df0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x3b9], 0
lea ebx, [edi + 0x3a8]
je 0x402ca6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x7c34bcd
and ecx, 7
mov edx, 0x1bb371b9
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402c9c
cmp esi, 0x11
jb 0x402c75
mov edi, dword [ebp - 0x124]
mov byte [ebx + 0x11], 0
push 0x40ddc0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040d970
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x7b4]
mov dword [ebp - 0x120], 0xdcce8275
mov word [ebp - 0x11c], 0xe7ea
test al, 1
jne 0x402d38
or eax, 1
mov dword [edi + 0x7b4], eax
mov dword [ebp - 4], 3
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x68e], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x688], al
add ecx, 1
adc edx, 0
jne 0x402d2b
cmp ecx, 6
jb 0x402d10
push 0x412db0
call fcn.0040fca6
add esp, 4
cmp byte [edi + 0x68e], 0
lea edi, [edi + 0x688]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
nop
mov ecx, esi
mov eax, 0xafbbe305
and ecx, 7
mov edx, 0xedc1e78f
shl ecx, 3
call fcn.004107b0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x402d60
mov byte [edi + 6], 0
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor al, al
jmp 0x40417e
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x11c], ebx
mov edi, dword [eax]
test ebx, ebx
jne 0x403142
mov eax, dword [edi + 0x3e0]
mov dword [ebp - 0x12c], 0xdf2a17ee
mov dword [ebp - 0x124], edi
test al, 1
jne 0x402e3f
or eax, 1
mov dword [edi + 0x3e0], eax
mov dword [ebp - 4], 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x2f8], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x12c]
mov byte [ecx + edi + 0x2f4], al
add ecx, 1
adc edx, 0
jne 0x402e2b
cmp ecx, 4
jb 0x402e10
push 0x412d70
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x2f8], 0
lea ebx, [edi + 0x2f4]
je 0x402e96
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xdf597b8d
and ecx, 7
mov edx, 0xbb55ff59
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402e8c
cmp esi, 4
jb 0x402e65
mov edi, dword [ebp - 0x124]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x620]
add esp, 4
mov dword [ebp - 0x120], 0x760d98e0
mov dword [ebp - 0x11c], 0xe1b631a7
test al, 1
jne 0x402f1f
or eax, 1
mov dword [edi + 0x620], eax
mov dword [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x130], xmm0
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
mov byte [edi + 0x7c8], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x7c0], al
add ecx, 1
adc edx, 0
jne 0x402f0b
cmp ecx, 8
jb 0x402ef0
push 0x412d30
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x7c8], 0
lea ebx, [edi + 0x7c0]
je 0x402f76
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x1961f783
and ecx, 7
mov edx, 0xe1f511d5
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402f6c
cmp esi, 8
jb 0x402f45
mov edi, dword [ebp - 0x124]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x414610]
add esp, 4
mov eax, dword [edi + 0xec]
mov word [ebp - 0x134], 0xe9e1
movups xmmword [ebp - 0x144], xmm0
test al, 1
jne 0x402fff
or eax, 1
mov dword [edi + 0xec], eax
mov dword [ebp - 4], 6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x72a], 1
nop
mov al, byte [ebp + ecx - 0x144]
mov byte [ecx + edi + 0x718], al
add ecx, 1
adc edx, 0
jne 0x402feb
cmp ecx, 0x12
jb 0x402fd0
push 0x412cf0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x72a], 0
lea ebx, [edi + 0x718]
je 0x403056
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x8b41e993
and ecx, 7
mov edx, 0x4727c973
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40304c
cmp esi, 0x12
jb 0x403025
mov edi, dword [ebp - 0x124]
mov byte [ebx + 0x12], 0
push 0x40ddc0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040d970
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x730]
mov dword [ebp - 0x120], 0xc230c469
mov word [ebp - 0x11c], 0x9d02
test al, 1
jne 0x4030e8
or eax, 1
mov dword [edi + 0x730], eax
mov dword [ebp - 4], 7
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x262], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x25c], al
add ecx, 1
adc edx, 0
jne 0x4030db
cmp ecx, 6
jb 0x4030c0
push 0x412cb0
call fcn.0040fca6
add esp, 4
cmp byte [edi + 0x262], 0
lea edi, [edi + 0x25c]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xb145a519
and ecx, 7
mov edx, 0xef379d67
shl ecx, 3
call fcn.004107b0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x403112
jmp 0x402d87
mov eax, dword [edi + 0x180]
mov dword [ebp - 0x140], 0x17547c0f
mov dword [ebp - 0x13c], 0x4f0108c7
mov dword [ebp - 0x138], 0x324c6122
mov byte [ebp - 0x134], 0x8b
mov dword [ebp - 0x12c], edi
test al, 1
jne 0x4031df
or eax, 1
mov dword [edi + 0x180], eax
mov dword [ebp - 4], 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x24d], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x140]
mov byte [ecx + edi + 0x240], al
add ecx, 1
adc edx, 0
jne 0x4031cb
cmp ecx, 0xd
jb 0x4031b0
push 0x412c30
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0x640]
mov dword [ebp - 0x140], 0x1d477628
mov dword [ebp - 0x13c], 0xf500dee
mov dword [ebp - 0x138], 0x1f59776d
mov byte [ebp - 0x134], 0x8b
test al, 1
jne 0x40326f
or eax, 1
mov dword [edi + 0x640], eax
mov dword [ebp - 4], 9
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0xd9], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x140]
mov byte [ecx + edi + 0xcc], al
add ecx, 1
adc edx, 0
jne 0x40325b
cmp ecx, 0xd
jb 0x403240
push 0x412c70
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x240]
call fcn.0040b210
push eax
push ecx
lea ecx, [edi + 0xcc]
call fcn.0040b210
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x403632
mov eax, dword [edi + 0x694]
mov dword [ebp - 0x124], 0x87522178
test al, 1
jne 0x40331f
or eax, 1
mov dword [edi + 0x694], eax
mov dword [ebp - 4], 0xa
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x4b0], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x124]
mov byte [ecx + edi + 0x4ac], al
add ecx, 1
adc edx, 0
jne 0x40330b
cmp ecx, 4
jb 0x4032f0
push 0x412bf0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x4b0], 0
lea ebx, [edi + 0x4ac]
je 0x403376
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x87214d1b
and ecx, 7
mov edx, 0x61a7ddf5
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40336c
cmp esi, 4
jb 0x403345
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x4ec]
add esp, 4
mov dword [ebp - 0x120], 0x66ab7afa
mov dword [ebp - 0x11c], 0x51101f67
test al, 1
jne 0x4033ff
or eax, 1
mov dword [edi + 0x4ec], eax
mov dword [ebp - 4], 0xb
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x354], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x34c], al
add ecx, 1
adc edx, 0
jne 0x4033eb
cmp ecx, 8
jb 0x4033d0
push 0x412bb0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x354], 0
lea ebx, [edi + 0x34c]
je 0x403456
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x9c71599
and ecx, 7
mov edx, 0x51533f15
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40344c
cmp esi, 8
jb 0x403425
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x414760]
add esp, 4
mov eax, dword [edi + 0x7bc]
mov dword [ebp - 0x13c], 0xc53a5d31
mov dword [ebp - 0x138], 0x971ac348
mov byte [ebp - 0x134], 0x55
movups xmmword [ebp - 0x14c], xmm0
test al, 1
jne 0x4034f0
or eax, 1
mov dword [edi + 0x7bc], eax
mov dword [ebp - 4], 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x65d], 1
mov al, byte [ebp + ecx - 0x14c]
mov byte [ecx + edi + 0x644], al
add ecx, 1
adc edx, 0
jne 0x4034dc
cmp ecx, 0x19
jb 0x4034c1
push 0x412b70
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x65d], 0
lea ebx, [edi + 0x644]
je 0x403547
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xe5433955
and ecx, 7
mov edx, 0xe575b10d
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40353d
cmp esi, 0x19
jb 0x403516
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x19], 0
push 0x40ddc0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040d970
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x14c]
mov dword [ebp - 0x120], 0xf6ec6a21
mov word [ebp - 0x11c], 0xb7c
test al, 1
jne 0x4035d8
or eax, 1
mov dword [edi + 0x14c], eax
mov dword [ebp - 4], 0xd
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x4ea], 1
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x4e4], al
add ecx, 1
adc edx, 0
jne 0x4035cb
cmp ecx, 6
jb 0x4035b0
push 0x412b30
call fcn.0040fca6
add esp, 4
cmp byte [edi + 0x4ea], 0
lea edi, [edi + 0x4e4]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x85990b51
and ecx, 7
mov edx, 0xebf50b19
shl ecx, 3
call fcn.004107b0
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x403602
jmp 0x402d87
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403640
push 0x40
push 0x3000
sub ecx, edx
push ecx
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x403a02
mov eax, dword [edi + 0x224]
mov dword [ebp - 0x124], 0xf8e3180
test al, 1
jne 0x4036df
or eax, 1
mov dword [edi + 0x224], eax
mov dword [ebp - 4], 0xe
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x668], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x124]
mov byte [edi + ecx + 0x664], al
add ecx, 1
adc edx, 0
jne 0x4036cb
cmp ecx, 4
jb 0x4036b0
push 0x412af0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x668], 0
lea ebx, [edi + 0x664]
je 0x403736
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xffd5de3
and ecx, 7
mov edx, 0x53115973
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x40372c
cmp esi, 4
jb 0x403705
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x6f8]
add esp, 4
mov dword [ebp - 0x120], 0xfc21ecdc
mov dword [ebp - 0x11c], 0xbf3247b5
test al, 1
jne 0x4037bf
or eax, 1
mov dword [edi + 0x6f8], eax
mov dword [ebp - 4], 0xf
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x394], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x38c], al
add ecx, 1
adc edx, 0
jne 0x4037ab
cmp ecx, 8
jb 0x403790
push 0x412ab0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x394], 0
lea ebx, [edi + 0x38c]
je 0x403816
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x934d83bf
and ecx, 7
mov edx, 0xbf7167c7
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x40380c
cmp esi, 8
jb 0x4037e5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x4145d0]
add esp, 4
mov eax, dword [edi + 0x388]
mov dword [ebp - 0x13c], 0x6eaf52c9
mov dword [ebp - 0x138], 0xadb4cad
mov word [ebp - 0x134], 0x3bc9
movups xmmword [ebp - 0x14c], xmm0
test al, 1
jne 0x4038bf
or eax, 1
mov dword [edi + 0x388], eax
mov dword [ebp - 4], 0x10
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x586], 1
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x14c]
mov byte [edi + ecx + 0x56c], al
add ecx, 1
adc edx, 0
jne 0x4038ab
cmp ecx, 0x1a
jb 0x403890
push 0x412a70
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x586], 0
lea ebx, [edi + 0x56c]
je 0x403916
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x9c13bbb
and ecx, 7
mov edx, 0x65a9098d
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x40390c
cmp esi, 0x1a
jb 0x4038e5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x1a], 0
push 0x40ddc0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040d970
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x7a4]
mov dword [ebp - 0x120], 0xa006fcc3
mov word [ebp - 0x11c], 0x81c6
test al, 1
jne 0x4039a8
or eax, 1
mov dword [edi + 0x7a4], eax
mov dword [ebp - 4], 0x11
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x312], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x30c], al
add ecx, 1
adc edx, 0
jne 0x40399b
cmp ecx, 6
jb 0x403980
push 0x412a30
call fcn.0040fca6
add esp, 4
cmp byte [edi + 0x312], 0
lea edi, [edi + 0x30c]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xd3739db3
and ecx, 7
mov edx, 0x3fa781a3
shl ecx, 3
call fcn.004107b0
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x4039d2
jmp 0x402d87
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403a10
push 0
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x403dc2
mov eax, dword [edi + 0x378]
mov dword [ebp - 0x124], 0x239a9518
test al, 1
jne 0x403aaf
or eax, 1
mov dword [edi + 0x378], eax
mov dword [ebp - 4], 0x12
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x39c], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x124]
mov byte [edi + ecx + 0x398], al
add ecx, 1
adc edx, 0
jne 0x403a9b
cmp ecx, 4
jb 0x403a80
push 0x4129f0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x39c], 0
lea ebx, [edi + 0x398]
je 0x403b06
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x23e9f97b
and ecx, 7
mov edx, 0x4971799d
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403afc
cmp esi, 4
jb 0x403ad5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x484]
add esp, 4
mov dword [ebp - 0x120], 0xb0f92e5c
mov dword [ebp - 0x11c], 0xab9e73a7
test al, 1
jne 0x403b8f
or eax, 1
mov dword [edi + 0x484], eax
mov dword [ebp - 4], 0x13
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x678], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x670], al
add ecx, 1
adc edx, 0
jne 0x403b7b
cmp ecx, 8
jb 0x403b60
push 0x4129b0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x678], 0
lea ebx, [edi + 0x670]
je 0x403be6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xdf95413f
and ecx, 7
mov edx, 0xabdd53d5
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403bdc
cmp esi, 8
jb 0x403bb5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x4146b0]
add esp, 4
mov eax, dword [edi + 0x7a8]
mov word [ebp - 0x138], 0xd148
mov byte [ebp - 0x136], 0xcd
movups xmmword [ebp - 0x148], xmm0
test al, 1
jne 0x403c7f
or eax, 1
mov dword [edi + 0x7a8], eax
mov dword [ebp - 4], 0x14
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x1cf], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x148]
mov byte [edi + ecx + 0x1bc], al
add ecx, 1
adc edx, 0
jne 0x403c6b
cmp ecx, 0x13
jb 0x403c50
push 0x412970
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x1cf], 0
lea ebx, [edi + 0x1bc]
je 0x403cd6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x65cda327
and ecx, 7
mov edx, 0x2b6d3519
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403ccc
cmp esi, 0x13
jb 0x403ca5
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x13], 0
push 0x40ddc0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040d970
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x258]
mov dword [ebp - 0x120], 0xfe9e809d
mov word [ebp - 0x11c], 0x8fea
test al, 1
jne 0x403d68
or eax, 1
mov dword [edi + 0x258], eax
mov dword [ebp - 4], 0x15
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x786], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [edi + ecx + 0x780], al
add ecx, 1
adc edx, 0
jne 0x403d5b
cmp ecx, 6
jb 0x403d40
push 0x412930
call fcn.0040fca6
add esp, 4
cmp byte [edi + 0x786], 0
lea edi, [edi + 0x780]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x8debe1ed
and ecx, 7
mov edx, 0xbfe78f8f
shl ecx, 3
call fcn.004107b0
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x403d92
jmp 0x402d87
mov edx, dword [ebp - 0x124]
mov ecx, ebx
push esi
call fcn.00402120
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x404162
mov eax, dword [edi + 0x308]
mov dword [ebp - 0x124], 0x593ab91c
test al, 1
jne 0x403e4f
or eax, 1
mov dword [edi + 0x308], eax
mov dword [ebp - 4], 0x16
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x3e8], 1
nop
mov al, byte [ebp + ecx - 0x124]
mov byte [edi + ecx + 0x3e4], al
add ecx, 1
adc edx, 0
jne 0x403e3b
cmp ecx, 4
jb 0x403e20
push 0x4128f0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x3e8], 0
lea ebx, [edi + 0x3e4]
je 0x403ea6
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x5949d57f
and ecx, 7
mov edx, 0x69bd2b5b
shl ecx, 3
call fcn.004107b0
xor byte [ebx + esi], al
add esi, 1
adc edi, 0
jne 0x403e9c
cmp esi, 4
jb 0x403e75
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 4], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [edi + 0x4c8]
add esp, 4
mov dword [ebp - 0x120], 0xa0091838
mov dword [ebp - 0x11c], 0x29c86de1
test al, 1
jne 0x403f2f
or eax, 1
mov dword [edi + 0x4c8], eax
mov dword [ebp - 4], 0x17
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x2dc], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x2d4], al
add ecx, 1
adc edx, 0
jne 0x403f1b
cmp ecx, 8
jb 0x403f00
push 0x4128b0
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x2dc], 0
lea ebx, [edi + 0x2d4]
je 0x403f86
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xcf65775b
and ecx, 7
mov edx, 0x298b4d93
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x403f7c
cmp esi, 8
jb 0x403f55
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 8], 0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x414770]
add esp, 4
mov eax, dword [edi + 0x660]
mov word [ebp - 0x138], 0x87e2
mov byte [ebp - 0x136], 0xbf
movups xmmword [ebp - 0x148], xmm0
test al, 1
jne 0x40401f
or eax, 1
mov dword [edi + 0x660], eax
mov dword [ebp - 4], 0x18
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov byte [edi + 0x56b], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x148]
mov byte [ecx + edi + 0x558], al
add ecx, 1
adc edx, 0
jne 0x40400b
cmp ecx, 0x13
jb 0x403ff0
push 0x412870
call fcn.0040fca6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0x56b], 0
lea ebx, [edi + 0x558]
je 0x404076
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0xefbff58d
and ecx, 7
mov edx, 0xdd3955d9
shl ecx, 3
call fcn.004107b0
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x40406c
cmp esi, 0x13
jb 0x404045
mov edi, dword [ebp - 0x12c]
mov byte [ebx + 0x13], 0
push 0x40ddc0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call fcn.0040d970
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [edi + 0x524]
mov dword [ebp - 0x120], 0x602efec3
mov word [ebp - 0x11c], 0x35f2
test al, 1
jne 0x404108
or eax, 1
mov dword [edi + 0x524], eax
mov dword [ebp - 4], 0x19
xorps xmm0, xmm0
movlpd qword [ebp - 0x128], xmm0
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov byte [edi + 0x6ae], 1
nop
mov al, byte [ebp + ecx - 0x120]
mov byte [ecx + edi + 0x6a8], al
add ecx, 1
adc edx, 0
jne 0x4040fb
cmp ecx, 6
jb 0x4040e0
push 0x412830
call fcn.0040fca6
add esp, 4
cmp byte [edi + 0x6ae], 0
lea edi, [edi + 0x6a8]
je 0x402d8b
xorps xmm0, xmm0
movlpd qword [ebp - 0x120], xmm0
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x120]
mov ecx, esi
mov eax, 0x135b9fb3
and ecx, 7
mov edx, 0xd9a53597
shl ecx, 3
call fcn.004107b0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402d87
cmp esi, 6
jb 0x404132
jmp 0x402d87
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x11c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f95d
mov esp, ebp
pop ebp
ret