Function at 0x401330
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa498
call fcn.004061c0
mov eax, dword [0x4157a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x18b
mov dword [ebp - 0xa464], 0x4ed6c13b
mov dword [ebp - 0xa460], eax
mov ecx, dword [ebp - 0xa460]
push ecx
mov edx, dword [ebp - 0xa464]
push edx
call fcn.004012d0
add esp, 8
movzx eax, al
test eax, eax
je 0x4013b2
push 0x66
push 0
lea ecx, [ebp - 0x288]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x288]
call fcn.00402c70
mov ecx, eax
call fcn.004039b0
push eax
call fcn.00403ae0
add esp, 4
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x4026e3
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
mov byte [ebp - 0x70], dl
lea ecx, [ebp - 0x78]
call fcn.004028c0
mov ecx, eax
call fcn.00402ec0
push eax
call fcn.00403ff0
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x415840], eax
cmp dword [0x415840], 0
jne 0x4013f6
jmp 0x4026e3
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov word [ebp - 0x180], ax
lea ecx, [ebp - 0x1a0]
call fcn.004029f0
mov ecx, eax
call fcn.004031d0
mov dword [ebp - 0xa45c], eax
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 0x26], cl
lea ecx, [ebp - 0x30]
call fcn.004028e0
mov ecx, eax
call fcn.00402f30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa458], eax
mov edx, dword [ebp - 0xa45c]
push edx
mov eax, dword [ebp - 0xa458]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x415878], eax
xor ecx, ecx
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], ecx
lea ecx, [ebp - 0x1bc]
call fcn.004029c0
mov ecx, eax
call fcn.00403160
mov dword [ebp - 0xa454], eax
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov word [ebp - 0x64], dx
mov byte [ebp - 0x62], dl
lea ecx, [ebp - 0x6c]
call fcn.004028e0
mov ecx, eax
call fcn.00402f30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa450], eax
mov eax, dword [ebp - 0xa454]
push eax
mov ecx, dword [ebp - 0xa450]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x415870], eax
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], edx
lea eax, [ebp - 0xa44c]
push eax
lea ecx, [ebp - 0x134]
call fcn.00402ac0
mov ecx, eax
call fcn.00403470
push eax
call fcn.00403b30
add esp, 8
mov dword [ebp - 0xa438], eax
mov dword [ebp - 0xa434], edx
mov ecx, dword [ebp - 0xa44c]
push ecx
mov edx, dword [ebp - 0xa434]
push edx
mov eax, dword [ebp - 0xa438]
push eax
call fcn.004010a0
add esp, 0xc
mov ecx, dword [0x415840]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [ebp - 0xec], edx
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe0], edx
mov word [ebp - 0xdc], dx
mov byte [ebp - 0xda], dl
lea ecx, [ebp - 0xec]
call fcn.00402990
mov ecx, eax
call fcn.004030f0
push eax
call fcn.00403ff0
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x415840], eax
cmp dword [0x415840], 0
jne 0x4015e2
jmp 0x4026e3
push 0x40
push 0x3000
push 0x20000
push 0
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa414], eax
cmp dword [ebp - 0xa414], 0
jne 0x401610
jmp 0x4026e3
push 0xb0
push 0
lea ecx, [ebp - 0x338]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x298], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x294], eax
xor ecx, ecx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
mov word [ebp - 0xf0], cx
mov byte [ebp - 0xee], cl
push 0x11
lea ecx, [ebp - 0x100]
call fcn.00402960
mov ecx, eax
call fcn.00403080
push eax
lea edx, [ebp - 0x338]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xbc], al
push 0xb
lea ecx, [ebp - 0xc8]
call fcn.00402ae0
mov ecx, eax
call fcn.004034e0
push eax
lea ecx, [ebp - 0x318]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov byte [ebp - 0x104], dl
push 0xf
lea ecx, [ebp - 0x114]
call fcn.00402930
mov ecx, eax
call fcn.00403010
push eax
lea eax, [ebp - 0x2f8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
mov word [ebp - 0xac], cx
mov byte [ebp - 0xaa], cl
push 0xd
lea ecx, [ebp - 0xb8]
call fcn.00402b20
mov ecx, eax
call fcn.004035c0
push eax
lea edx, [ebp - 0x2d8]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], al
push 0xf
lea ecx, [ebp - 0x128]
call fcn.00402900
mov ecx, eax
call fcn.00402fa0
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0
push 0xb0
lea edx, [ebp - 0x338]
push edx
mov eax, dword [ebp - 0xa414]
push eax
mov ecx, dword [0x415840]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x99
push 0x410400
mov edx, dword [ebp - 0xa414]
add edx, 0xb0
push edx
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov ecx, dword [ebp - 0xa414]
push ecx
mov edx, dword [ebp - 0xa414]
add edx, 0xb0
push edx
push 0
push 0
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa430], eax
push 0xb0
call fcn.00406107
add esp, 4
mov dword [ebp - 0xa428], eax
cmp dword [ebp - 0xa428], 0
je 0x401848
push 0xb0
push 0
mov ecx, dword [ebp - 0xa428]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0xa428]
mov dword [ebp - 0xa43c], edx
jmp 0x401852
mov dword [ebp - 0xa43c], 0
mov eax, dword [ebp - 0xa43c]
mov dword [ebp - 0xa41c], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa430]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xa430]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xb0
mov eax, dword [ebp - 0xa41c]
push eax
mov ecx, dword [ebp - 0xa414]
push ecx
mov edx, dword [0x415840]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40
push 0x3000
push 0x4000
push 0
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xa42c], eax
cmp dword [ebp - 0xa42c], 0
jne 0x4018ca
jmp 0x4026e3
mov dword [ebp - 0xa440], 0
push 0
push 4
lea ecx, [ebp - 0xa440]
push ecx
mov edx, dword [ebp - 0xa41c]
mov eax, dword [edx + 0xa8]
push eax
mov ecx, dword [0x415840]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x400
call fcn.00406137
add esp, 4
mov dword [ebp - 0xa448], eax
mov edx, dword [ebp - 0xa448]
mov dword [ebp - 0xa424], edx
push 0
push 0x400
mov eax, dword [ebp - 0xa424]
push eax
mov ecx, dword [ebp - 0xa440]
push ecx
mov edx, dword [0x415840]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa0d8
push 0
lea eax, [ebp - 0xa410]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], ecx
push 6
lea ecx, [ebp - 0xd8]
call fcn.004028a0
mov ecx, eax
call fcn.00402e50
push eax
lea edx, [ebp - 0x8af8]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x8af8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8af8]
push ecx
call fcn.004027a0
add esp, 8
xor edx, edx
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0xcc], edx
push 4
lea ecx, [ebp - 0xd0]
call fcn.00402b50
mov ecx, eax
call fcn.00403630
push eax
lea eax, [ebp - 0xa320]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0xa320]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea edx, [ebp - 0xa320]
push edx
call fcn.004027e0
add esp, 8
xor eax, eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov word [ebp - 0x94], ax
push 6
lea ecx, [ebp - 0x9c]
call fcn.00402b90
mov ecx, eax
call fcn.00403710
push eax
lea ecx, [ebp - 0xa31a]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0xa31a]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
lea eax, [ebp - 0xa31a]
push eax
call fcn.004027e0
add esp, 8
mov ecx, 0x28
imul edx, ecx, 0
mov dword [ebp + edx - 0xa3ec], 0
mov eax, 0x28
imul ecx, eax, 0
mov dword [ebp + ecx - 0xa3f0], 1
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
push 0xc
lea ecx, [ebp - 0x158]
call fcn.00402bf0
mov ecx, eax
call fcn.00403860
push eax
mov eax, 0x28
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xa410]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x28
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xa410]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xa410]
push edx
call fcn.004027e0
add esp, 8
mov eax, 0x28
shl eax, 0
mov dword [ebp + eax - 0xa3ec], 2
mov ecx, 0x28
shl ecx, 0
mov dword [ebp + ecx - 0xa3f0], 5
xor edx, edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov word [ebp - 0x88], dx
push 6
lea ecx, [ebp - 0x90]
call fcn.00402bb0
mov ecx, eax
call fcn.00403780
push eax
mov eax, 0x28
shl eax, 0
lea ecx, [ebp + eax - 0xa410]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
shl edx, 0
lea eax, [ebp + edx - 0xa410]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
shl ecx, 0
lea edx, [ebp + ecx - 0xa410]
push edx
call fcn.004027e0
add esp, 8
mov eax, 0x28
shl eax, 1
mov dword [ebp + eax - 0xa3ec], 1
mov ecx, 0x28
shl ecx, 1
mov dword [ebp + ecx - 0xa3f0], 0x1e
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
push 0xc
lea ecx, [ebp - 0x168]
call fcn.00402bd0
mov ecx, eax
call fcn.004037f0
push eax
mov eax, 0x28
shl eax, 1
lea ecx, [ebp + eax - 0xa410]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
shl edx, 1
lea eax, [ebp + edx - 0xa410]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
shl ecx, 1
lea edx, [ebp + ecx - 0xa410]
push edx
call fcn.004027e0
add esp, 8
mov eax, 0x28
imul ecx, eax, 3
mov dword [ebp + ecx - 0xa3ec], 0
mov edx, 0x28
imul eax, edx, 3
mov dword [ebp + eax - 0xa3f0], 0
xor ecx, ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], ecx
mov word [ebp - 0x138], cx
push 0xe
lea ecx, [ebp - 0x148]
call fcn.00402c10
mov ecx, eax
call fcn.004038d0
push eax
mov edx, 0x28
imul eax, edx, 3
lea ecx, [ebp + eax - 0xa410]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x28
imul eax, edx, 3
lea ecx, [ebp + eax - 0xa410]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov edx, 0x28
imul eax, edx, 3
lea ecx, [ebp + eax - 0xa410]
push ecx
call fcn.004027e0
add esp, 8
mov edx, 0x28
shl edx, 2
mov dword [ebp + edx - 0xa3ec], 0
mov eax, 0x28
shl eax, 2
mov dword [ebp + eax - 0xa3f0], 1
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov word [ebp - 0xa0], cx
push 6
lea ecx, [ebp - 0xa8]
call fcn.00402b70
mov ecx, eax
call fcn.004036a0
push eax
mov edx, 0x28
shl edx, 2
lea eax, [ebp + edx - 0xa410]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
shl ecx, 2
lea edx, [ebp + ecx - 0xa410]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov eax, 0x28
shl eax, 2
lea ecx, [ebp + eax - 0xa410]
push ecx
call fcn.004027e0
add esp, 8
mov edx, 0x28
imul eax, edx, 5
mov dword [ebp + eax - 0xa3ec], 0
mov ecx, 0x28
imul edx, ecx, 5
mov dword [ebp + edx - 0xa3f0], 0
xor eax, eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
push 0x10
lea ecx, [ebp - 0x17c]
call fcn.00402c40
mov ecx, eax
call fcn.00403940
push eax
mov ecx, 0x28
imul edx, ecx, 5
lea eax, [ebp + edx - 0xa410]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x28
imul edx, ecx, 5
lea eax, [ebp + edx - 0xa410]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push eax
mov ecx, 0x28
imul edx, ecx, 5
lea eax, [ebp + edx - 0xa410]
push eax
call fcn.004027e0
add esp, 8
movss xmm0, dword [0x40856c]
movss dword [ebp - 0xa1f8], xmm0
movss xmm0, dword [0x408574]
movss dword [ebp - 0xa218], xmm0
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ad0], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ad0], 0
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ad0], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ad0], 0x32
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8acc], 0xff
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8acc], 0xff
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8acc], 0xff
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8acc], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ac8], 0xe1
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ac8], 0xe1
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ac8], 0xe1
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ac8], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ac4], 0x66
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ac4], 0xb2
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ac4], 0xff
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ac4], 0xc8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ac0], 0xff
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ac0], 0x99
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ac0], 0x33
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ac0], 0xc8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ab8], 0x12
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ab8], 0x12
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ab8], 0x12
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ab8], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ab4], 0x2d
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ab4], 0x2d
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ab4], 0x2d
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ab4], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8abc], 0x3c
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8abc], 0x3c
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8abc], 0x3c
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8abc], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8ab0], 0xff
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8ab0], 0x80
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8ab0], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8ab0], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8aac], 0xff
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8aac], 0x99
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8aac], 0x33
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8aac], 0xc8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8aa8], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8aa8], 0xff
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8aa8], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8aa8], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8aa4], 0xff
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8aa4], 0
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8aa4], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8aa4], 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x8aa0], 0x66
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x8aa0], 0xb2
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x8aa0], 0xff
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x8aa0], 0xff
xor ecx, ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x7c], cl
lea ecx, [ebp - 0x84]
call fcn.004028c0
mov ecx, eax
call fcn.00402ec0
push eax
call fcn.00403ff0
add esp, 4
mov dword [ebp - 0x8a70], eax
mov edx, dword [ebp - 0xa438]
mov eax, dword [ebp - 0xa434]
mov dword [ebp - 0x8a68], edx
mov dword [ebp - 0x8a64], eax
mov ecx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x8a90], ecx
mov edx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x8a8c], edx
mov eax, dword [0x415870]
mov dword [ebp - 0x8a84], eax
mov ecx, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x8a88], ecx
xor edx, edx
mov dword [ebp - 0x14], edx
mov word [ebp - 0x10], dx
mov byte [ebp - 0xe], dl
lea ecx, [ebp - 0x14]
call fcn.00402880
mov ecx, eax
call fcn.00402de0
mov dword [ebp - 0xa498], eax
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x58], ax
mov byte [ebp - 0x56], al
lea ecx, [ebp - 0x60]
call fcn.004028e0
mov ecx, eax
call fcn.00402f30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa494], eax
mov ecx, dword [ebp - 0xa498]
push ecx
mov edx, dword [ebp - 0xa494]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a80], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
lea ecx, [ebp - 0x24]
call fcn.00402840
mov ecx, eax
call fcn.00402d00
mov dword [ebp - 0xa490], eax
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov word [ebp - 0x4c], cx
mov byte [ebp - 0x4a], cl
lea ecx, [ebp - 0x54]
call fcn.004028e0
mov ecx, eax
call fcn.00402f30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa48c], eax
mov edx, dword [ebp - 0xa490]
push edx
mov eax, dword [ebp - 0xa48c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a7c], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], cl
lea ecx, [ebp - 0xc]
call fcn.00402820
mov ecx, eax
call fcn.00402c90
mov dword [ebp - 0xa488], eax
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov word [ebp - 0x40], dx
mov byte [ebp - 0x3e], dl
lea ecx, [ebp - 0x48]
call fcn.004028e0
mov ecx, eax
call fcn.00402f30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa480], eax
mov eax, dword [ebp - 0xa488]
push eax
mov ecx, dword [ebp - 0xa480]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a78], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x18], dx
lea ecx, [ebp - 0x1c]
call fcn.00402860
mov ecx, eax
call fcn.00402d70
mov dword [ebp - 0xa47c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], ax
mov byte [ebp - 0x32], al
lea ecx, [ebp - 0x3c]
call fcn.004028e0
mov ecx, eax
call fcn.00402f30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa484], eax
mov ecx, dword [ebp - 0xa47c]
push ecx
mov edx, dword [ebp - 0xa484]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a74], eax
mov eax, dword [0x415850]
mov ecx, dword [0x415854]
mov dword [ebp - 0x8a50], eax
mov dword [ebp - 0x8a4c], ecx
mov edx, dword [0x415858]
mov eax, dword [0x41585c]
mov dword [ebp - 0x8a40], edx
mov dword [ebp - 0x8a3c], eax
mov ecx, dword [0x415848]
mov edx, dword [0x41584c]
mov dword [ebp - 0x8a58], ecx
mov dword [ebp - 0x8a54], edx
mov eax, dword [0x415860]
mov ecx, dword [0x415864]
mov dword [ebp - 0x8a48], eax
mov dword [ebp - 0x8a44], ecx
movss xmm0, dword [0x408578]
movss dword [ebp - 0xa264], xmm0
movss xmm0, dword [0x40854c]
movss dword [ebp - 0xa244], xmm0
movss xmm0, dword [0x408544]
movss dword [ebp - 0xa248], xmm0
movss xmm0, dword [0x408554]
movss dword [ebp - 0xa240], xmm0
movss xmm0, dword [0x40855c]
movss dword [ebp - 0xa25c], xmm0
movss xmm0, dword [0x408560]
movss dword [ebp - 0xa258], xmm0
movss xmm0, dword [0x408564]
movss dword [ebp - 0xa254], xmm0
movss xmm0, dword [0x408568]
movss dword [ebp - 0xa250], xmm0
movss xmm0, dword [0x408570]
movss dword [ebp - 0xa24c], xmm0
movss xmm0, dword [0x408558]
movss dword [ebp - 0x89ec], xmm0
mov dword [ebp - 0x89c8], 0x64
mov dword [ebp - 0x89c4], 0x86
mov dword [ebp - 0x89c0], 0x64
mov dword [ebp - 0x89bc], 0x79
movss xmm0, dword [0x408548]
movss dword [ebp - 0x89d0], xmm0
movss xmm0, dword [0x408550]
movss dword [ebp - 0x89cc], xmm0
push 0x2fa8
push 0x40d458
lea edx, [ebp - 0x899c]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x3458
push section..data
lea eax, [ebp - 0x59f3]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x1a90
push 0x413d08
lea ecx, [ebp - 0x259a]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x388
push 0x413980
lea edx, [ebp - 0xb0a]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 4
imul ecx, eax, 0x71
mov edx, dword [ebp - 0xa424]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x8a94], eax
mov ecx, dword [ebp - 0xa414]
add ecx, 0xa0d8
mov edx, 4
imul eax, edx, 0x71
mov edx, dword [ebp - 0xa424]
mov dword [edx + eax], ecx
push 0
push 0x400
mov eax, dword [ebp - 0xa424]
push eax
mov ecx, dword [ebp - 0xa42c]
push ecx
mov edx, dword [0x415840]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xa41c]
mov ecx, dword [eax + 0xa8]
mov dword [ebp - 0x8b0c], ecx
push 0
push 0xa0d8
lea edx, [ebp - 0xa410]
push edx
mov eax, dword [ebp - 0xa414]
push eax
mov ecx, dword [0x415840]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0xa414]
add edx, 0xa0d8
mov dword [ebp - 0xa474], edx
push 0x11
push 0x4104a0
call fcn.004040c0
add esp, 8
mov dword [ebp - 0xa478], eax
mov eax, dword [ebp - 0xa478]
mov ecx, dword [ebp - 0xa414]
mov dword [eax], ecx
push 0
push 0x34d9
push 0x4104a0
mov edx, dword [ebp - 0xa474]
push edx
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
lea ecx, [ebp - 0xa42c]
push ecx
mov edx, dword [ebp - 0xa41c]
mov eax, dword [edx + 0xa8]
push eax
mov ecx, dword [0x415840]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x61
push 0
lea edx, [ebp - 0x220]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.00402aa0
mov ecx, eax
call fcn.00403400
mov dword [ebp - 0xa470], eax
mov eax, dword [ebp - 0xa41c]
mov eax, dword [eax + 0xac]
cdq
mov dword [ebp - 0xa46c], eax
mov dword [ebp - 0xa468], edx
mov ecx, dword [ebp - 0xa470]
push ecx
push 0x5f000
mov edx, dword [ebp - 0xa468]
push edx
mov eax, dword [ebp - 0xa46c]
push eax
call fcn.00403df0
add esp, 0x10
add eax, 1
mov dword [ebp - 0xa420], eax
je 0x4026e3
lea ecx, [ebp - 0xa444]
push ecx
push 0x40
push 1
mov edx, dword [ebp - 0xa420]
push edx
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x4026e3
mov byte [ebp - 0xa415], 0
push 0
push 1
lea ecx, [ebp - 0xa415]
push ecx
mov edx, dword [ebp - 0xa420]
push edx
mov eax, dword [0x415840]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [ebp - 0xa444]
push ecx
mov edx, dword [ebp - 0xa444]
push edx
push 1
mov eax, dword [ebp - 0xa420]
push eax
mov ecx, dword [0x415840]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406140
mov esp, ebp
pop ebp
ret