Function at 0x401330
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa584
call fcn.004069e0
mov eax, dword [0x415a84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x18e
mov dword [ebp - 0xa548], 0x479b0bc0
mov dword [ebp - 0xa544], eax
mov ecx, dword [ebp - 0xa544]
push ecx
mov edx, dword [ebp - 0xa548]
push edx
call fcn.004012d0
add esp, 8
movzx eax, al
test eax, eax
je 0x4013b2
push 0x66
push 0
lea ecx, [ebp - 0x2d4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x2d4]
call fcn.00402e30
mov ecx, eax
call fcn.00403c50
push eax
call fcn.00403d80
add esp, 4
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x402860
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
mov byte [ebp - 0x70], dl
lea ecx, [ebp - 0x78]
call fcn.00402a30
mov ecx, eax
call fcn.00403080
push eax
call fcn.00404290
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x415b20], eax
cmp dword [0x415b20], 0
jne 0x4013f6
jmp 0x402860
xor eax, eax
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], eax
mov word [ebp - 0x1a0], ax
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov word [ebp - 0x64], cx
mov byte [ebp - 0x62], cl
lea ecx, [ebp - 0x1c0]
call fcn.00402b60
mov ecx, eax
call fcn.00403390
mov dword [ebp - 0xa540], eax
lea ecx, [ebp - 0x6c]
call fcn.00402a50
mov ecx, eax
call fcn.004030f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa53c], eax
mov edx, dword [ebp - 0xa540]
push edx
mov eax, dword [ebp - 0xa53c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x415b58], eax
xor ecx, ecx
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 0x1d4], ecx
mov dword [ebp - 0x1d0], ecx
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1c4], ecx
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov word [ebp - 0x58], dx
mov byte [ebp - 0x56], dl
lea ecx, [ebp - 0x1dc]
call fcn.00402b30
mov ecx, eax
call fcn.00403320
mov dword [ebp - 0xa538], eax
lea ecx, [ebp - 0x60]
call fcn.00402a50
mov ecx, eax
call fcn.004030f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa534], eax
mov eax, dword [ebp - 0xa538]
push eax
mov ecx, dword [ebp - 0xa534]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x415b50], eax
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], edx
lea eax, [ebp - 0xa584]
push eax
lea ecx, [ebp - 0x140]
call fcn.00402c70
mov ecx, eax
call fcn.00403710
push eax
call fcn.00403dd0
add esp, 8
mov dword [ebp - 0xa530], eax
mov dword [ebp - 0xa52c], edx
mov ecx, dword [ebp - 0xa584]
push ecx
mov edx, dword [ebp - 0xa52c]
push edx
mov eax, dword [ebp - 0xa530]
push eax
call fcn.004010a0
add esp, 0xc
mov ecx, dword [0x415b20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], edx
mov word [ebp - 0xfc], dx
mov byte [ebp - 0xfa], dl
lea ecx, [ebp - 0x10c]
call fcn.00402b00
mov ecx, eax
call fcn.004032b0
push eax
call fcn.00404290
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x415b20], eax
cmp dword [0x415b20], 0
jne 0x4015e2
jmp 0x402860
push 0x40
push 0x3000
push 0x20000
push 0
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa500], eax
cmp dword [ebp - 0xa500], 0
jne 0x401610
jmp 0x402860
push 0xb0
push 0
lea ecx, [ebp - 0x384]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x2e4], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2e0], eax
xor ecx, ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov word [ebp - 0xe8], cx
mov byte [ebp - 0xe6], cl
push 0x11
lea ecx, [ebp - 0xf8]
call fcn.00402ad0
mov ecx, eax
call fcn.00403240
push eax
lea edx, [ebp - 0x384]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], al
push 0xb
lea ecx, [ebp - 0xd4]
call fcn.00402c90
mov ecx, eax
call fcn.00403780
push eax
lea ecx, [ebp - 0x364]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov byte [ebp - 0x110], dl
push 0xf
lea ecx, [ebp - 0x120]
call fcn.00402aa0
mov ecx, eax
call fcn.004031d0
push eax
lea eax, [ebp - 0x344]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
mov word [ebp - 0xac], cx
mov byte [ebp - 0xaa], cl
push 0xd
lea ecx, [ebp - 0xb8]
call fcn.00402cb0
mov ecx, eax
call fcn.004037f0
push eax
lea edx, [ebp - 0x324]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], al
push 0xf
lea ecx, [ebp - 0x134]
call fcn.00402a70
mov ecx, eax
call fcn.00403160
push eax
lea ecx, [ebp - 0x304]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0
push 0xb0
lea edx, [ebp - 0x384]
push edx
mov eax, dword [ebp - 0xa500]
push eax
mov ecx, dword [0x415b20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x99
push 0x410400
mov edx, dword [ebp - 0xa500]
add edx, 0xb0
push edx
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov ecx, dword [ebp - 0xa500]
push ecx
mov edx, dword [ebp - 0xa500]
add edx, 0xb0
push edx
push 0
push 0
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa51c], eax
push 0xb0
call fcn.0040691d
add esp, 4
mov dword [ebp - 0xa514], eax
cmp dword [ebp - 0xa514], 0
je 0x401848
push 0xb0
push 0
mov ecx, dword [ebp - 0xa514]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0xa514]
mov dword [ebp - 0xa520], edx
jmp 0x401852
mov dword [ebp - 0xa520], 0
mov eax, dword [ebp - 0xa520]
mov dword [ebp - 0xa508], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa51c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xa51c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xb0
mov eax, dword [ebp - 0xa508]
push eax
mov ecx, dword [ebp - 0xa500]
push ecx
mov edx, dword [0x415b20]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40
push 0x3000
push 0x4000
push 0
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa518], eax
cmp dword [ebp - 0xa518], 0
jne 0x4018ca
jmp 0x402860
mov dword [ebp - 0xa524], 0
push 0
push 4
lea ecx, [ebp - 0xa524]
push ecx
mov edx, dword [ebp - 0xa508]
mov eax, dword [edx + 0xa8]
push eax
mov ecx, dword [0x415b20]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x400
call fcn.0040694d
add esp, 4
mov dword [ebp - 0xa580], eax
mov edx, dword [ebp - 0xa580]
mov dword [ebp - 0xa510], edx
push 0
push 0x400
mov eax, dword [ebp - 0xa510]
push eax
mov ecx, dword [ebp - 0xa524]
push ecx
mov edx, dword [0x415b20]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa178
push 0
lea eax, [ebp - 0xa4fc]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ecx
push 6
lea ecx, [ebp - 0xdc]
call fcn.00402a10
mov ecx, eax
call fcn.00403010
push eax
lea edx, [ebp - 0x8b48]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x8b48]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8b48]
push ecx
call fcn.00402910
add esp, 8
xor edx, edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe0], edx
push 4
lea ecx, [ebp - 0xe4]
call fcn.00402ce0
mov ecx, eax
call fcn.00403860
push eax
lea eax, [ebp - 0xa3bc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0xa3bc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea edx, [ebp - 0xa3bc]
push edx
call fcn.00402950
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov word [ebp - 0xa0], ax
push 6
lea ecx, [ebp - 0xa8]
call fcn.00402d20
mov ecx, eax
call fcn.00403940
push eax
lea ecx, [ebp - 0xa3b6]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0xa3b6]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea eax, [ebp - 0xa3b6]
push eax
call fcn.00402950
add esp, 8
mov ecx, 0x28
imul edx, ecx, 0
mov dword [ebp + edx - 0xa4d8], 0
mov eax, 0x28
imul ecx, eax, 0
mov dword [ebp + ecx - 0xa4dc], 1
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
push 0xc
lea ecx, [ebp - 0x178]
call fcn.00402d80
mov ecx, eax
call fcn.00403a90
push eax
mov eax, 0x28
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xa4fc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xa4fc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xa4fc]
push edx
call fcn.00402950
add esp, 8
mov eax, 0x28
shl eax, 0
mov dword [ebp + eax - 0xa4d8], 2
mov ecx, 0x28
shl ecx, 0
mov dword [ebp + ecx - 0xa4dc], 5
xor edx, edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], edx
mov word [ebp - 0x94], dx
push 6
lea ecx, [ebp - 0x9c]
call fcn.00402d40
mov ecx, eax
call fcn.004039b0
push eax
mov eax, 0x28
shl eax, 0
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
shl edx, 0
lea eax, [ebp + edx - 0xa4fc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
shl ecx, 0
lea edx, [ebp + ecx - 0xa4fc]
push edx
call fcn.00402950
add esp, 8
mov eax, 0x28
shl eax, 1
mov dword [ebp + eax - 0xa4d8], 1
mov ecx, 0x28
shl ecx, 1
mov dword [ebp + ecx - 0xa4dc], 0x1e
xor edx, edx
mov dword [ebp - 0x188], edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x17c], edx
push 0xc
lea ecx, [ebp - 0x188]
call fcn.00402d60
mov ecx, eax
call fcn.00403a20
push eax
mov eax, 0x28
shl eax, 1
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
shl edx, 1
lea eax, [ebp + edx - 0xa4fc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
shl ecx, 1
lea edx, [ebp + ecx - 0xa4fc]
push edx
call fcn.00402950
add esp, 8
mov eax, 0x28
imul ecx, eax, 3
mov dword [ebp + ecx - 0xa4d8], 0
mov edx, 0x28
imul eax, edx, 3
mov dword [ebp + eax - 0xa4dc], 1
xor ecx, ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov word [ebp - 0x144], cx
push 0xe
lea ecx, [ebp - 0x154]
call fcn.00402da0
mov ecx, eax
call fcn.00403b00
push eax
mov edx, 0x28
imul eax, edx, 3
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
imul eax, edx, 3
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
imul eax, edx, 3
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call fcn.00402950
add esp, 8
mov edx, 0x28
shl edx, 2
mov dword [ebp + edx - 0xa4d8], 2
mov eax, 0x28
shl eax, 2
mov dword [ebp + eax - 0xa4dc], 6
xor ecx, ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov word [ebp - 0xbc], cx
push 6
lea ecx, [ebp - 0xc4]
call fcn.00402d40
mov ecx, eax
call fcn.004039b0
push eax
mov edx, 0x28
shl edx, 2
lea eax, [ebp + edx - 0xa4fc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
shl ecx, 2
lea edx, [ebp + ecx - 0xa4fc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
shl eax, 2
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call fcn.00402950
add esp, 8
mov edx, 0x28
imul eax, edx, 5
mov dword [ebp + eax - 0xa4d8], 0
mov ecx, 0x28
imul edx, ecx, 5
mov dword [ebp + edx - 0xa4dc], 0
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov word [ebp - 0x158], ax
push 0xe
lea ecx, [ebp - 0x168]
call fcn.00402dd0
mov ecx, eax
call fcn.00403b70
push eax
mov ecx, 0x28
imul edx, ecx, 5
lea eax, [ebp + edx - 0xa4fc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
imul edx, ecx, 5
lea eax, [ebp + edx - 0xa4fc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
imul edx, ecx, 5
lea eax, [ebp + edx - 0xa4fc]
push eax
call fcn.00402950
add esp, 8
mov ecx, 0x28
imul edx, ecx, 6
mov dword [ebp + edx - 0xa4d8], 0
mov eax, 0x28
imul ecx, eax, 6
mov dword [ebp + ecx - 0xa4dc], 1
xor edx, edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov word [ebp - 0x88], dx
push 6
lea ecx, [ebp - 0x90]
call fcn.00402d00
mov ecx, eax
call fcn.004038d0
push eax
mov eax, 0x28
imul ecx, eax, 6
lea edx, [ebp + ecx - 0xa4fc]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 6
lea edx, [ebp + ecx - 0xa4fc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 6
lea edx, [ebp + ecx - 0xa4fc]
push edx
call fcn.00402950
add esp, 8
mov eax, 0x28
imul ecx, eax, 7
mov dword [ebp + ecx - 0xa4d8], 0
mov edx, 0x28
imul eax, edx, 7
mov dword [ebp + eax - 0xa4dc], 0
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18c], ecx
push 0x10
lea ecx, [ebp - 0x19c]
call fcn.00402e00
mov ecx, eax
call fcn.00403be0
push eax
mov edx, 0x28
imul eax, edx, 7
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
imul eax, edx, 7
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
imul eax, edx, 7
lea ecx, [ebp + eax - 0xa4fc]
push ecx
call fcn.00402950
add esp, 8
movss xmm0, dword [0x408608]
movss dword [ebp - 0xa294], xmm0
movss xmm0, dword [0x408610]
movss dword [ebp - 0xa2b4], xmm0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b20], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b20], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b20], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b20], 0x32
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b1c], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b1c], 0xff
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b1c], 0xff
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b1c], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b18], 0xe1
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b18], 0xe1
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b18], 0xe1
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b18], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b14], 0x66
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b14], 0xb2
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b14], 0xff
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b14], 0xc8
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b10], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b10], 0x99
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b10], 0x33
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b10], 0xc8
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b08], 0x12
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b08], 0x12
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b08], 0x12
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b08], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b04], 0x2d
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b04], 0x2d
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b04], 0x2d
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b04], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b0c], 0x3c
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b0c], 0x3c
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b0c], 0x3c
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b0c], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8b00], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8b00], 0x80
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8b00], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8b00], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8afc], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8afc], 0x99
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8afc], 0x33
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8afc], 0xc8
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8af8], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8af8], 0xff
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8af8], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8af8], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8af4], 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8af4], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8af4], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8af4], 0xff
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x8af0], 0x66
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x8af0], 0xb2
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x8af0], 0xff
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x8af0], 0xff
xor edx, edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov byte [ebp - 0x7c], dl
lea ecx, [ebp - 0x84]
call fcn.00402a30
mov ecx, eax
call fcn.00403080
push eax
call fcn.00404290
add esp, 4
mov dword [ebp - 0x8abc], eax
mov eax, dword [ebp - 0xa530]
mov ecx, dword [ebp - 0xa52c]
mov dword [ebp - 0x8ab4], eax
mov dword [ebp - 0x8ab0], ecx
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x8ad4], edx
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x8ae0], eax
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x8adc], ecx
mov edx, dword [0x415b50]
mov dword [ebp - 0x8ad0], edx
mov eax, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x8ad8], eax
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x10], cx
mov byte [ebp - 0xe], cl
xor edx, edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov word [ebp - 0x4c], dx
mov byte [ebp - 0x4a], dl
lea ecx, [ebp - 0x14]
call fcn.004029f0
mov ecx, eax
call fcn.00402fa0
mov dword [ebp - 0xa57c], eax
lea ecx, [ebp - 0x54]
call fcn.00402a50
mov ecx, eax
call fcn.004030f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa578], eax
mov eax, dword [ebp - 0xa57c]
push eax
mov ecx, dword [ebp - 0xa578]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8acc], eax
xor edx, edx
mov dword [ebp - 0x24], edx
mov word [ebp - 0x20], dx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], ax
mov byte [ebp - 0x3e], al
lea ecx, [ebp - 0x24]
call fcn.004029b0
mov ecx, eax
call fcn.00402ec0
mov dword [ebp - 0xa574], eax
lea ecx, [ebp - 0x48]
call fcn.00402a50
mov ecx, eax
call fcn.004030f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa570], eax
mov ecx, dword [ebp - 0xa574]
push ecx
mov edx, dword [ebp - 0xa570]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8ac8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x34], cx
mov byte [ebp - 0x32], cl
lea ecx, [ebp - 0xc]
call fcn.00402990
mov ecx, eax
call fcn.00402e50
mov dword [ebp - 0xa564], eax
lea ecx, [ebp - 0x3c]
call fcn.00402a50
mov ecx, eax
call fcn.004030f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa55c], eax
mov edx, dword [ebp - 0xa564]
push edx
mov eax, dword [ebp - 0xa55c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8ac4], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], cx
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov word [ebp - 0x28], dx
mov byte [ebp - 0x26], dl
lea ecx, [ebp - 0x1c]
call fcn.004029d0
mov ecx, eax
call fcn.00402f30
mov dword [ebp - 0xa558], eax
lea ecx, [ebp - 0x30]
call fcn.00402a50
mov ecx, eax
call fcn.004030f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa554], eax
mov eax, dword [ebp - 0xa558]
push eax
mov ecx, dword [ebp - 0xa554]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8ac0], eax
mov edx, dword [0x415b30]
mov eax, dword [0x415b34]
mov dword [ebp - 0x8a9c], edx
mov dword [ebp - 0x8a98], eax
mov ecx, dword [0x415b38]
mov edx, dword [0x415b3c]
mov dword [ebp - 0x8a8c], ecx
mov dword [ebp - 0x8a88], edx
mov eax, dword [0x415b28]
mov ecx, dword [0x415b2c]
mov dword [ebp - 0x8aa4], eax
mov dword [ebp - 0x8aa0], ecx
mov edx, dword [0x415b40]
mov eax, dword [0x415b44]
mov dword [ebp - 0x8a94], edx
mov dword [ebp - 0x8a90], eax
movss xmm0, dword [0x408614]
movss dword [ebp - 0xa300], xmm0
movss xmm0, dword [0x4085e8]
movss dword [ebp - 0xa2e0], xmm0
movss xmm0, dword [0x4085e0]
movss dword [ebp - 0xa2e4], xmm0
movss xmm0, dword [0x4085f0]
movss dword [ebp - 0xa2dc], xmm0
movss xmm0, dword [0x4085f8]
movss dword [ebp - 0xa2f8], xmm0
movss xmm0, dword [0x4085fc]
movss dword [ebp - 0xa2f4], xmm0
movss xmm0, dword [0x408600]
movss dword [ebp - 0xa2f0], xmm0
movss xmm0, dword [0x408604]
movss dword [ebp - 0xa2ec], xmm0
movss xmm0, dword [0x40860c]
movss dword [ebp - 0xa2e8], xmm0
movss xmm0, dword [0x4085f4]
movss dword [ebp - 0x8a38], xmm0
mov dword [ebp - 0x8a14], 0x64
mov dword [ebp - 0x8a10], 0x86
mov dword [ebp - 0x8a0c], 0x64
mov dword [ebp - 0x8a08], 0x79
movss xmm0, dword [0x4085e4]
movss dword [ebp - 0x8a1c], xmm0
movss xmm0, dword [0x4085ec]
movss dword [ebp - 0x8a18], xmm0
push 0x2fa8
push 0x40d458
lea ecx, [ebp - 0x89e8]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x3458
push section..data
lea edx, [ebp - 0x5a3f]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x1a90
push 0x413fe8
lea eax, [ebp - 0x25e6]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x388
push 0x413c60
lea ecx, [ebp - 0xb56]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 4
imul eax, edx, 0x8d
mov ecx, dword [ebp - 0xa510]
mov edx, dword [ecx + eax]
mov dword [ebp - 0x8ae4], edx
mov eax, dword [ebp - 0xa500]
add eax, 0xa178
mov ecx, 4
imul edx, ecx, 0x8d
mov ecx, dword [ebp - 0xa510]
mov dword [ecx + edx], eax
push 0
push 0x400
mov edx, dword [ebp - 0xa510]
push edx
mov eax, dword [ebp - 0xa518]
push eax
mov ecx, dword [0x415b20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0xa508]
mov eax, dword [edx + 0xa8]
mov dword [ebp - 0x8b60], eax
push 0
push 0xa178
lea ecx, [ebp - 0xa4fc]
push ecx
mov edx, dword [ebp - 0xa500]
push edx
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0xa500]
add ecx, 0xa178
mov dword [ebp - 0xa560], ecx
push 0x11
push 0x4104a0
call fcn.00404360
add esp, 8
mov dword [ebp - 0xa550], eax
mov edx, dword [ebp - 0xa550]
mov eax, dword [ebp - 0xa500]
mov dword [edx], eax
push 0
push 0x37b9
push 0x4104a0
mov ecx, dword [ebp - 0xa560]
push ecx
mov edx, dword [0x415b20]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
lea eax, [ebp - 0xa518]
push eax
mov ecx, dword [ebp - 0xa508]
mov edx, dword [ecx + 0xa8]
push edx
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x2a
push 0
lea ecx, [ebp - 0x208]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x208]
call fcn.00402bb0
mov ecx, eax
call fcn.00403470
push eax
call fcn.00403d30
add esp, 4
push 0x61
push 0
lea edx, [ebp - 0x26c]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x26c]
call fcn.00402c30
mov ecx, eax
call fcn.00403630
mov dword [ebp - 0xa54c], eax
mov eax, dword [ebp - 0xa508]
mov eax, dword [eax + 0xac]
cdq
mov dword [ebp - 0xa56c], eax
mov dword [ebp - 0xa568], edx
mov ecx, dword [ebp - 0xa54c]
push ecx
push 0x5f000
mov edx, dword [ebp - 0xa568]
push edx
mov eax, dword [ebp - 0xa56c]
push eax
call fcn.00404090
add esp, 0x10
add eax, 1
mov dword [ebp - 0xa50c], eax
je 0x402860
lea ecx, [ebp - 0xa528]
push ecx
push 0x40
push 1
mov edx, dword [ebp - 0xa50c]
push edx
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402860
mov byte [ebp - 0xa501], 0
push 0
push 1
lea ecx, [ebp - 0xa501]
push ecx
mov edx, dword [ebp - 0xa50c]
push edx
mov eax, dword [0x415b20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [ebp - 0xa528]
push ecx
mov edx, dword [ebp - 0xa528]
push edx
push 1
mov eax, dword [ebp - 0xa50c]
push eax
mov ecx, dword [0x415b20]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406956
mov esp, ebp
pop ebp
ret