Function at 0x40d250
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1000
mov edx, str.TEMPonefile_PID_TIME
mov eax, 0x43b0a0
push edi
push esi
push ebx
sub esp, 0x2dc
call fcn.00407710
test al, al
je 0x40dff6
mov dword [esp + 4], 1
mov dword [esp], 0x408270
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x40e0bb
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1b
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [0x43b090], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x43b08c], 0
mov dword [0x43b088], eax
mov edi, eax
mov eax, dword [0x43b090]
sub esp, 8
cmp byte [eax], 0x4b
lea ebp, [eax + 3]
movzx ecx, byte [eax + 2]
setne dl
cmp byte [eax + 1], 0x41
mov dword [0x43b090], ebp
setne al
or dl, al
jne 0x40e0b1
cmp cl, 0x59
jne 0x40e0b1
mov dword [esp], 0x20000
mov dword [0x43e0a8], 0
call sub.msvcrt.dll_malloc
mov dword [0x43e0b4], eax
test eax, eax
je 0x40dfd8
mov dword [esp], 0x27420
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x40dfce
mov dword [eax + 0x736c], 0
mov dword [eax + 0x7370], 0
mov dword [eax + 0x7374], 0
mov dword [eax + 0x7380], 0
mov dword [eax + 0x738c], 0
mov dword [eax + 0x7388], 0
mov dword [eax + 0x72b8], 0
mov dword [eax + 0x7394], 0
mov dword [eax + 0x7398], 0
mov dword [eax + 0x73a0], 0
mov dword [eax + 0x73a4], 0
mov dword [eax + 0x73b4], 0
mov dword [eax + 0x739c], 0
mov dword [eax + 0x73c4], 0
mov dword [eax + 0x73c8], 0
mov dword [eax + 0x73d4], 0
mov dword [eax + 0x2741c], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x40d7e4
mov dword [esi + 0x7384], ecx
mov dword [esi + 0x735c], 0
mov dword [esi + 0x73ac], 0x8000001
mov dword [esi + 0x73d8], 0
mov dword [esi + 0x7360], 0
mov dword [esi + 0x7364], 1
mov dword [0x43e0a4], esi
mov dword [0x43e0a8], ebp
mov dword [0x43e0b0], 0
mov dword [0x43e0ac], edi
mov byte [0x43b080], 1
mov ebp, 0x43a880
mov ebx, dword [0x43e0b8]
mov edi, dword [0x43e0bc]
mov dword [esp + 0x4c], ebp
lea esi, [esi]
lea eax, [esp + 0x1d0]
xor edx, edx
mov esi, 2
mov dword [esp + 0x3c], eax
lea esi, [esi]
mov eax, ebx
sub eax, edi
jne 0x40d51d
mov ebp, dword [0x43e0b0]
mov ecx, dword [0x43e0ac]
cmp ebp, ecx
setb al
or dl, al
je 0x40d580
mov eax, dword [0x43e0a4]
mov dword [0x43e0bc], 0
mov dword [0x43e0b8], 0x20000
call fcn.0040bef0
mov ebx, dword [0x43e0bc]
cmp dword [0x43e0b8], ebx
sete dl
cmp eax, 0xffffff88
ja 0x40d588
xor edi, edi
mov eax, ebx
mov dword [0x43e0b8], ebx
mov dword [0x43e0bc], 0
sub eax, edi
je 0x40d4b6
cmp eax, esi
mov byte [esp + 0x48], dl
cmova eax, esi
mov ebp, eax
mov eax, dword [0x43e0b4]
mov dword [esp + 8], ebp
add eax, edi
add edi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x3c], ebp
sub esi, ebp
movzx edx, byte [esp + 0x48]
mov dword [0x43e0bc], edi
jne 0x40d4b0
movzx eax, word [esp + 0x1d0]
mov esi, dword [esp + 0x4c]
mov word [esi], ax
test ax, ax
je 0x40d592
add esi, 2
mov dword [esp + 0x4c], esi
jmp 0x40d498
cmp ebp, ecx
je 0x40d4b0
mov eax, str.Error__couldnt_decode_attached_data.
call fcn.00407e40
movzx ecx, word [0x43a880]
test cx, cx
je 0x40d7f8
movzx edx, word [0x43b0a0]
xor esi, esi
mov eax, 2
mov word [0x438880], si
test dx, dx
jne 0x40d5d6
jmp 0x40d7da
add eax, 2
cmp eax, 0x2002
je 0x4154c4
mov word [eax + 0x43887e], dx
movzx edx, word [eax + 0x43b0a0]
test dx, dx
jne 0x40d5c8
add eax, 0x438880
xor ebx, ebx
mov word [eax], bx
cmp word [0x438880], 0
je 0x40d7d0
mov edx, 0x1000
mov eax, 0x438880
lea esi, [esi]
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d610
test edx, edx
je 0x40e149
mov dword [eax], 0x5c
mov edx, 0x1000
mov eax, 0x438880
cmp word [0x438880], 0
je 0x40d654
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d640
test edx, edx
je 0x40e135
mov ebx, 0x43a880
jmp 0x40d668
test edx, edx
je 0x40e130
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x40d660
xor ecx, ecx
cmp word [0x438080], 0
mov word [eax], cx
je 0x40d786
mov edx, 8
lea eax, [esp + 0x1d0]
call fcn.0040d160
mov esi, dword [esp + 0x1d0]
mov edi, dword [esp + 0x1d4]
call fcn.00408050
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x438880
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40d76f
jmp 0x40e080
xor eax, eax
mov edx, 0x8000
mov ecx, eax
cmp edx, esi
sbb ecx, edi
cmovae eax, edi
cmovae edx, esi
mov dword [esp + 0x44], eax
mov eax, 0x41c040
mov dword [esp + 0x40], edx
call fcn.0040d160
lea eax, [esp + 0x1d0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1d0], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41c040
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x40e0f8
sub esi, dword [esp + 0x40]
sbb edi, dword [esp + 0x44]
mov eax, esi
or eax, edi
jne 0x40d700
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40d47f
movzx edx, word [0x438880]
mov eax, 2
test dx, dx
jne 0x40d7ae
jmp 0x40dfc4
add eax, 2
cmp eax, 0x2002
je 0x4154c4
mov word [eax + 0x43807e], dx
movzx edx, word [eax + 0x438880]
test dx, dx
jne 0x40d7a0
add eax, 0x438080
xor edx, edx
mov word [eax], dx
jmp 0x40d68f
mov eax, 0x438880
jmp 0x40d624
mov eax, 0x438880
jmp 0x40d5ee
mov eax, 7
cpuid
mov ecx, ebx
shr ecx, 8
and ecx, 1
jmp 0x40d424
mov ebx, dword [0x43e0a4]
test ebx, ebx
je 0x40d8ba
mov eax, dword [ebx + 0x7380]
test eax, eax
jne 0x40d8ba
mov esi, dword [ebx + 0x7388]
mov edi, dword [ebx + 0x7370]
mov ebp, dword [ebx + 0x7374]
test esi, esi
je 0x40d86a
mov edx, dword [esi]
mov eax, dword [esi + 0x6ab4]
mov ecx, dword [esi + 0x6ab8]
test edx, edx
je 0x40e06b
test eax, eax
je 0x40e123
mov dword [esp], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 4], edx
call eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], esi
mov dword [esp], ecx
call eax
mov dword [ebx + 0x7388], 0
mov eax, dword [ebx + 0x73a0]
mov dword [ebx + 0x738c], 0
mov dword [ebx + 0x7398], 0
test eax, eax
je 0x40e056
test edi, edi
je 0x40e116
mov dword [esp + 4], eax
mov dword [esp], ebp
call edi
mov dword [ebx + 0x73a0], 0
mov dword [esp + 4], ebx
mov dword [esp], ebp
call edi
mov eax, dword [0x43e0b4]
mov esi, pe_nt_image_headers32
lea ebx, [esp + 0x1d0]
lea edi, [esp + 0x56]
mov dword [esp], eax
call sub.msvcrt.dll_free
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x4170ba
mov dword [esp + 0xc], eax
lea eax, [esp + 0x150]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call fcn.00401ad0
xor eax, eax
mov word [esp + 0x1d0], ax
movzx eax, byte [esp + 0x150]
test al, al
je 0x40d98a
mov byte [esp + 0x56], al
lea eax, [esp + 0x60]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x57], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x4154c4
cmp word [ebx], 0
movzx ecx, word [esp + 0x60]
mov edx, esi
mov eax, ebx
je 0x40d95c
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d950
test edx, edx
je 0x4154c4
xor ebp, ebp
mov word [eax], cx
add ebx, 2
lea edx, [esi - 1]
mov word [eax + 2], bp
mov eax, 1
sub eax, esi
movzx eax, byte [esp + eax + 0x1d0]
test al, al
je 0x40d98a
mov esi, edx
jmp 0x40d916
xor eax, eax
lea edi, [esp + 0x100]
mov esi, 0x28
mov word [esp + 0x100], ax
mov ebx, edi
mov eax, 0x4e
mov byte [esp + 0x58], al
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
lea eax, [esp + 0x64]
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x59], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x4154c4
cmp word [ebx], 0
movzx ecx, word [esp + 0x64]
mov edx, esi
mov eax, ebx
je 0x40d9f4
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d9e8
test edx, edx
je 0x4154c4
mov word [eax], cx
xor ecx, ecx
add ebx, 2
lea edx, [esi - 1]
mov word [eax + 2], cx
mov eax, 1
sub eax, esi
movzx eax, byte [eax + 0x4172dc]
test al, al
je 0x40da21
mov esi, edx
jmp 0x40d9a7
lea eax, [esp + 0x1d0]
mov dword [esp], edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp + 4], eax
call ebx
sub esp, 8
cmp word [0x424040], 0
je 0x40e000
xor eax, eax
mov edi, 0x28
lea esi, [esp + 0xb0]
mov word [esp + 0xb0], ax
mov eax, 0x4e
mov byte [esp + 0x5a], al
lea eax, [esp + 0x5a]
mov dword [esp + 4], eax
lea eax, [esp + 0x68]
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x5b], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x4154c4
cmp word [esi], 0
movzx ecx, word [esp + 0x68]
mov edx, edi
mov eax, esi
je 0x40daac
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40daa0
test edx, edx
je 0x4154c4
xor ebp, ebp
mov word [eax], cx
add esi, 2
lea edx, [edi - 1]
mov word [eax + 2], bp
mov eax, 1
sub eax, edi
movzx eax, byte [eax + 0x4172f2]
test al, al
je 0x40dad9
mov edi, edx
jmp 0x40da63
lea eax, [esp + 0xb0]
mov dword [esp + 4], 0x424040
mov dword [esp], eax
call ebx
xor eax, eax
mov ecx, 0x11
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 8
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov dword [esp], 0xfffffff6
xor edi, edi
mov dword [esp + 0x98], 0x100
call ebx
sub esp, 4
mov dword [esp + 0xa4], eax
mov dword [esp], 0xfffffff5
call ebx
sub esp, 4
mov dword [esp + 0xa8], eax
mov dword [esp], 0xfffffff4
call ebx
sub esp, 4
mov dword [esp + 0xac], eax
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov word [0x428060], di
sub esp, 8
mov esi, eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x426060
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
je 0x4154c4
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
movzx ecx, word [0x426060]
je 0x40e0c8
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40dbbb
test cx, cx
je 0x40dbf7
test edx, edx
je 0x40e13a
mov ebx, 0x426060
jmp 0x40dbe3
test edx, edx
je 0x40e13f
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x40dbdb
xor ebx, ebx
cmp dword [esp + 0x5c], 1
mov word [eax], bx
mov ebx, 1
jle 0x40de4e
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
je 0x40dc34
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40dc20
test edx, edx
je 0x4154c4
mov dword [eax], 0x20
mov edi, dword [esi + ebx*4]
mov ebp, str.__t_n_v_
mov eax, 0x20
jmp 0x40dc60
movzx eax, word [ebp + 2]
add ebp, 2
test ax, ax
je 0x40ddf1
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_wcschr
test eax, eax
je 0x40dc50
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
je 0x40dc98
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40dc84
test edx, edx
je 0x4154c4
mov edx, dword [esi + ebx*4]
mov dword [eax], 0x22
mov dword [esp + 0x3c], esi
movzx ebp, word [edx]
cmp bp, 0x5c
jne 0x40dd75
xor eax, eax
lea esi, [esi]
mov ecx, edx
movzx ebp, word [edx + 2]
add edx, 2
mov edi, eax
add eax, 1
cmp bp, 0x5c
je 0x40dcb8
test bp, bp
je 0x40df50
cmp bp, 0x22
je 0x40dde4
xor esi, esi
test eax, eax
jle 0x40dd29
lea esi, [esi]
cmp word [0x428060], 0
mov ebp, 0x8000
mov eax, 0x428060
je 0x40dd14
lea esi, [esi]
add eax, 2
sub ebp, 1
cmp word [eax], 0
jne 0x40dd00
test ebp, ebp
je 0x4154c4
mov dword [eax], 0x5c
lea eax, [esi + 1]
cmp esi, edi
je 0x40dd25
mov esi, eax
jmp 0x40dce8
movzx ebp, word [ecx + 2]
cmp word [0x428060], 0
je 0x40ddda
mov ecx, 0x8000
mov eax, 0x428060
lea esi, [esi]
add eax, 2
sub ecx, 1
cmp word [eax], 0
jne 0x40dd48
test ecx, ecx
je 0x40e144
xor ecx, ecx
add edx, 2
mov word [eax], bp
mov word [eax + 2], cx
movzx ebp, word [edx]
cmp bp, 0x5c
je 0x40dcb2
test bp, bp
je 0x40dfe2
cmp bp, 0x22
jne 0x40dd29
mov esi, 1
xor edi, edi
lea esi, [esi]
nop
cmp word [0x428060], 0
mov ecx, 0x8000
mov eax, 0x428060
je 0x40ddbc
lea esi, [esi]
add eax, 2
sub ecx, 1
cmp word [eax], 0
jne 0x40dda8
test ecx, ecx
je 0x4154c4
add edi, 1
mov dword [eax], 0x5c
cmp edi, esi
jne 0x40dd90
cmp word [0x428060], 0
movzx ebp, word [edx]
jne 0x40dd37
mov eax, 0x428060
jmp 0x40dd5c
lea esi, [eax + eax + 1]
test esi, esi
jg 0x40dd89
jmp 0x40dd29
mov edi, dword [esi + ebx*4]
mov edx, 0x8000
mov eax, 0x428060
cmp word [0x428060], 0
movzx ecx, word [edi]
je 0x40dfe8
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40de0f
test cx, cx
je 0x40de3c
test edx, edx
je 0x4154c4
add edi, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [edi]
test cx, cx
jne 0x40de20
xor edx, edx
mov word [eax], dx
add ebx, 1
cmp ebx, dword [esp + 0x5c]
jl 0x40dc0c
lea eax, [esp + 0x1d0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x428060
mov dword [esp], 0x438080
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x40e0d6
mov eax, dword [esp + 0x1d4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x1d0]
mov dword [esp + 0x150], 0
mov dword [0x438060], eax
test eax, eax
je 0x40df37
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x150]
mov dword [esp + 4], eax
mov eax, dword [0x438060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
jne 0x40df20
mov dword [esp + 0x150], 1
mov eax, dword [0x438060]
mov dword [esp], eax
call ebx
mov dword [0x438060], 0
sub esp, 4
call fcn.00408110
mov eax, dword [esp + 0x150]
add esp, 0x2dc
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
add eax, eax
mov esi, dword [esp + 0x3c]
test eax, eax
jle 0x40df91
xor edi, edi
cmp word [0x428060], 0
mov ecx, 0x8000
mov edx, 0x428060
je 0x40df84
add edx, 2
sub ecx, 1
cmp word [edx], 0
jne 0x40df70
test ecx, ecx
je 0x4154c4
add edi, 1
mov dword [edx], 0x5c
cmp edi, eax
jne 0x40df5c
cmp word [0x428060], 0
mov edx, 0x8000
mov eax, 0x428060
je 0x40dfb9
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40dfa5
test edx, edx
je 0x4154c4
mov dword [eax], 0x22
jmp 0x40de41
mov eax, 0x438080
jmp 0x40d7c6
mov dword [0x43e0a4], 0
mov eax, str.Error__couldnt_allocate_memory.
call fcn.00407e40
mov esi, dword [esp + 0x3c]
jmp 0x40df91
test cx, cx
jne 0x40de28
jmp 0x40de3c
mov eax, str.TEMPonefile_PID_TIME
call fcn.00407d90
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0x424040
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x424040
sub esp, 0xc
cmp word [0x424040], 0
jne 0x40e043
jmp 0x40e04c
cmp eax, 0x426042
je 0x4154c4
add eax, 2
cmp word [eax], 0
jne 0x40e038
xor edx, edx
mov word [eax], dx
jmp 0x40da48
test edi, edi
jne 0x40d8b1
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40d8ba
test eax, eax
jne 0x40d861
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x40d86a
mov dword [esp], 2
call dword [0x416054]
mov dword [esp + 8], 0x438880
mov dword [esp + 4], str.Error__failed_to_open__ls_for_writing._n
mov dword [esp], eax
call fcn.00401aa0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, str.Error__couldnt_find_attached_data_header.
call fcn.00407e40
mov eax, str.Error__failed_to_register_signal_handler.
call fcn.00407e40
lea esi, [esi]
test cx, cx
jne 0x40dbd4
jmp 0x40dbf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_launch_child
call fcn.00407dc0
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_unpack_file_to_target_path.
call fcn.00407dc0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40e05e
mov dword [esp], edx
call sub.msvcrt.dll_free
jmp 0x40e073
jmp 0x4154c4
jmp 0x4154c4
jmp 0x4154c4
jmp 0x4154c4
jmp 0x4154c4
jmp 0x4154c4
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014c0