Function at 0x421330
Capabilities:
Create thread
Encode data using xor
Get file size
Parse pe header
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4fe40e
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52e144]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
push 0x527e20
call fcn.004ae310
add esp, 4
call fcn.004111e0
xor ebp, ebp
cmp eax, ebp
jbe 0x42139f
push eax
push 0x5131c4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
push 0x4180f0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x537534], eax
call fcn.0040bfc0
test eax, eax
je 0x42146b
lea eax, [esp + 0x124]
push 1
mov ecx, eax
push ecx
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4213fe
push ebp
push ebp
push 1
lea edx, [esp + 0x130]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x4213fe
lea esi, [esp + 0x20]
push 0x5131b8
call fcn.00404690
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 4
push eax
push ebp
push 1
push esi
call edi
push 0x5131a4
call fcn.00404690
add esp, 4
push eax
push ebp
push 1
push esi
call edi
mov dword [0x537884], eax
cmp eax, ebp
jne 0x421472
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x51318c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x40000001
push 0x1cae14e0
push 0x2711
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
push eax
push 0x513170
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov eax, dword [0x537884]
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
add esp, 0xc
push eax
call ebx
cmp byte [0x537552], 0
je 0x421502
push 0x50e3a0
call fcn.00404690
add esp, 4
push eax
push ebp
push 1
push esi
call edi
mov dword [0x537888], eax
cmp eax, ebp
jne 0x4214ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x513154
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x40000001
push 0x1cae3bf0
push 0x2711
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
push eax
call ebx
cmp byte [0x54a134], 0
je 0x421510
call fcn.00411a90
jmp 0x421522
push 0x5cc
call fcn.004b7c73
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x290], ebp
cmp eax, ebp
je 0x421547
mov ecx, eax
call fcn.00409050
jmp 0x421549
xor eax, eax
mov ecx, dword [0x537894]
push ecx
mov ecx, eax
mov dword [esp + 0x294], 0xffffffff
mov dword [0x536dc0], eax
call fcn.00408fe0
push 0x51059c
mov dword [0x548ef8], eax
call fcn.004045b0
add esp, 4
push eax
push 0x51058c
call fcn.00404690
add esp, 4
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebp
je 0x4215d6
cmp dword [0x537c94], 1
push ebp
jne 0x4215b1
push 2
push 0x2b2d
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x51312c
jmp 0x4215c3
push ebp
push 0x2b2d
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x513114
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
mov eax, dword [0x40003c]
mov ecx, dword [eax + 0x400028]
add eax, 0x400000
cmp ecx, ebp
je 0x421600
cmp ecx, dword [eax + 0x1c]
ja 0x421600
cmp ecx, 0x1000
jne 0x421607
mov byte [0x537550], 1
jmp 0x421607
mov byte [0x53751f], 1
mov edx, dword [eax + 0x1c]
mov eax, dword [eax + 0x50]
mov dword [0x537558], edx
mov dword [0x537554], eax
call fcn.004105d0
mov esi, eax
push esi
push 0x513108
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp esi, ebp
je 0x42165d
push 0xc0000200
push 0x1cae6300
push 0x3a9a
call fcn.0040a3f0
add esp, 0xc
xor al, al
jmp 0x422ce9
cmp byte [0x54a134], 0
je 0x4216c4
push 0x510470
call fcn.00404690
add esp, 4
push eax
mov ecx, 0x538790
call fcn.004aae80
mov ecx, 0x538790
call fcn.004aad20
mov dword [0x538640], eax
cmp eax, ebp
jne 0x4216c4
push 0x5130fc
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0x80000409
push 0x1cae8a10
push 0x2ee0
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
push 0x50eadc
call fcn.00404690
add esp, 4
push eax
mov ecx, 0x5388b8
call fcn.004aae80
mov ecx, 0x5388b8
call fcn.004aad20
mov dword [0x538644], eax
cmp eax, ebp
jne 0x421722
push 0x5130f0
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0x80000409
push 0x1caeb120
push 0x2ee0
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
push str.IsImmersiveProcess
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0040fed0
push 0x5130bc
mov dword [0x537110], eax
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 4
push eax
push ecx
call fcn.0040fed0
push eax
push 0x5130a0
mov dword [0x5385f8], eax
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp dword [0x5385f8], ebp
je 0x421792
push 0x537f30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5385f8]
cmp dword [0x537f30], ebp
je 0x42183e
push 0x51308c
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0x513068
call fcn.00404690
mov edx, dword [0x538644]
add esp, 0x10
push eax
push edx
call fcn.0040fed0
push 0x513044
mov dword [0x538638], eax
call fcn.00404690
add esp, 4
push eax
mov eax, dword [0x538644]
push eax
call fcn.0040fed0
mov dword [0x53863c], eax
cmp dword [0x538638], ebp
je 0x4217ff
push 0x513018
jmp 0x421804
push 0x512fec
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp dword [0x53863c], ebp
je 0x421826
push 0x512fc0
jmp 0x42182b
push 0x512f94
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
push 0x512f84
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 4
push eax
push ecx
call fcn.0040fed0
mov dword [0x538604], eax
cmp eax, ebp
jne 0x42186b
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x538604], eax
push eax
push 0x512f70
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512f54
call fcn.00404690
mov edx, dword [0x538644]
add esp, 0x10
push eax
push edx
call fcn.0040fed0
mov dword [0x538608], eax
cmp eax, ebp
jne 0x4218b1
mov eax, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [0x538608], eax
push eax
push 0x512f40
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512f30
call fcn.00404690
add esp, 0x10
push eax
mov eax, dword [0x538644]
push eax
call fcn.0040fed0
mov dword [0x53860c], eax
cmp eax, ebp
jne 0x4218f6
mov eax, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [0x53860c], eax
push eax
push 0x512f1c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512f0c
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 0x10
push eax
push ecx
call fcn.0040fed0
mov dword [0x538610], eax
cmp eax, ebp
jne 0x42193c
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x538610], eax
push eax
push 0x512ef8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512eec
call fcn.00404690
mov edx, dword [0x538644]
add esp, 0x10
push eax
push edx
call fcn.0040fed0
mov dword [0x538614], eax
cmp eax, ebp
jne 0x421982
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x538614], eax
push eax
push 0x512ed8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512ec8
call fcn.00404690
add esp, 0x10
push eax
mov eax, dword [0x538644]
push eax
call fcn.0040fed0
mov dword [0x5385d8], eax
cmp eax, ebp
jne 0x4219c7
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x5385d8], eax
push eax
push 0x512eb4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512e9c
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 0x10
push eax
push ecx
call fcn.0040fed0
mov dword [0x5385dc], eax
cmp eax, ebp
jne 0x421a0d
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x5385dc], eax
push eax
push 0x512e88
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512e70
call fcn.00404690
mov edx, dword [0x538644]
add esp, 0x10
push eax
push edx
call fcn.0040fed0
mov dword [0x5385e0], eax
cmp eax, ebp
jne 0x421a53
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [0x5385e0], eax
push eax
push 0x512e5c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512e44
call fcn.00404690
add esp, 0x10
push eax
mov eax, dword [0x538644]
push eax
call fcn.0040fed0
mov dword [0x5385e4], eax
cmp eax, ebp
jne 0x421a98
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [0x5385e4], eax
push eax
push 0x512e30
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512e18
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 0x10
push eax
push ecx
call fcn.0040fed0
mov dword [0x5385e8], eax
cmp eax, ebp
jne 0x421ae0
mov edx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [0x5385e8], edx
push 0x512df8
call fcn.00404690
add esp, 4
push eax
mov eax, dword [0x538640]
push eax
call fcn.0040fed0
cmp byte [0x54a134], 0
mov dword [0x538600], eax
je 0x421b31
cmp dword [0x537f30], ebp
jne 0x421b31
push 0x512ddc
call fcn.00404690
push eax
call fcn.0048ad20
add esp, 8
mov dword [0x53836c], eax
mov dword [0x5385e8], 0x413550
mov ecx, dword [0x5385e8]
push ecx
push 0x512dc8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512db4
call fcn.00404690
mov edx, dword [0x538644]
add esp, 0x10
push eax
push edx
call fcn.0040fed0
mov dword [0x5385ec], eax
cmp eax, ebp
jne 0x421b7d
mov eax, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [0x5385ec], eax
cmp byte [0x54a134], 0
je 0x421bb0
cmp dword [0x537f30], ebp
jne 0x421bb0
push 0x512d98
call fcn.00404690
push eax
call fcn.0048ad20
mov dword [0x538368], eax
mov eax, 0x413500
add esp, 8
mov dword [0x5385ec], eax
push eax
push 0x512d84
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512d70
call fcn.00404690
add esp, 0x10
push eax
mov eax, dword [0x538644]
push eax
call fcn.0040fed0
mov dword [0x5385fc], eax
cmp eax, ebp
jne 0x421bf5
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5385fc], eax
push eax
push 0x512d5c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512d44
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 0x10
push eax
push ecx
call fcn.0040fed0
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [0x538618], eax
test eax, eax
jne 0x421c3e
mov eax, ebp
mov dword [0x538618], eax
push eax
push 0x512d30
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov eax, dword [0x5385e0]
mov edx, dword [0x5385fc]
mov ecx, dword [0x5385e8]
add edx, eax
mov eax, dword [0x5385e4]
add ecx, eax
xor edx, ecx
mov ecx, dword [0x5385ec]
imul ecx, ecx, 0xf7a12347
xor edx, ecx
xor edx, dword [0x5385d8]
add esp, 0xc
imul edx, edx, 0xab17f7fa
mov dword [0x538648], edx
mov dword [0x526b10], 0x6a1ce802
mov dword [0x526b14], 0xd750e803
mov dword [0x537c4c], 0x42
jmp 0x421cc6
cmp byte [0x54a134], 0
je 0x4220c9
push 0x512d20
call fcn.00404690
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [0x537c98], esi
test esi, esi
je 0x421d14
mov edx, 0x5a4d
cmp word [esi], dx
jne 0x421d14
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x421d14
mov eax, dword [eax + 0x50]
add eax, esi
mov dword [0x537c9c], eax
push 0x512d00
call fcn.00404690
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push eax
push esi
call ebx
push 0x512ce0
mov edi, eax
call fcn.00404690
add esp, 4
push eax
push esi
call fcn.0040fed0
cmp edi, esi
jae 0x421d67
cmp edi, eax
jne 0x421d67
push eax
push edi
push esi
push 0x512cbc
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x14
push 0x512ca8
call fcn.00404690
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 4
push eax
call esi
mov dword [0x537cb8], eax
test eax, eax
je 0x421da8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421da8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421da8
mov edx, dword [ecx + 0x50]
add edx, eax
mov dword [0x537cbc], edx
push 0x512c98
call fcn.00404690
add esp, 4
push eax
call esi
mov dword [0x537ca8], eax
test eax, eax
je 0x421de3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421de3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421de3
mov edx, dword [ecx + 0x50]
add edx, eax
mov dword [0x537cac], edx
push 0x512c84
call fcn.00404690
add esp, 4
push eax
call esi
mov dword [0x537cb0], eax
test eax, eax
je 0x421e1e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421e1e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421e1e
mov edx, dword [ecx + 0x50]
add edx, eax
mov dword [0x537cb4], edx
cmp dword [0x5385c0], 0
jne 0x421e40
push 0x512c74
call fcn.00404690
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5385c0], eax
push 0x512c60
call fcn.00404690
add esp, 4
push eax
mov eax, dword [0x5385c0]
push eax
call fcn.0040fed0
push 0x512c48
mov dword [0x53861c], eax
call fcn.00404690
mov ecx, dword [0x5385c0]
add esp, 4
push eax
push ecx
call fcn.0040fed0
push 0x512c30
mov dword [0x538620], eax
call fcn.00404690
mov edx, dword [0x5385c0]
add esp, 4
push eax
push edx
call fcn.0040fed0
push 0x512c18
mov dword [0x538624], eax
call fcn.00404690
add esp, 4
push eax
mov eax, dword [0x5385c0]
push eax
call fcn.0040fed0
push 0x512c00
mov dword [0x538628], eax
call fcn.00404690
mov ecx, dword [0x5385c0]
add esp, 4
push eax
push ecx
call fcn.0040fed0
push 0x512be0
mov dword [0x53862c], eax
call fcn.00404690
mov edx, dword [0x5385c0]
add esp, 4
push eax
push edx
call fcn.0040fed0
push 0x512bc8
mov dword [0x538630], eax
call fcn.00404690
add esp, 4
push eax
mov eax, dword [0x5385c0]
push eax
call fcn.0040fed0
cmp dword [0x53861c], 0
mov dword [0x538634], eax
je 0x42146b
cmp dword [0x538620], 0
je 0x42146b
cmp dword [0x538624], 0
je 0x42146b
cmp dword [0x538628], 0
je 0x42146b
cmp dword [0x53862c], 0
je 0x42146b
cmp dword [0x538630], 0
je 0x42146b
test eax, eax
je 0x42146b
cmp byte [0x54a134], 0
je 0x4220c9
push 1
call fcn.00418cf6
push 0
call fcn.00418cf6
call fcn.0048aa80
push 1
call fcn.00420540
add esp, 0xc
mov esi, eax
push esi
push 0x512bbc
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
test esi, esi
je 0x421fc2
push 0
call fcn.00420540
add esp, 4
call fcn.0041f930
cmp byte [0x54a134], 0
je 0x4220c9
push 0x512bac
call fcn.00404690
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x512b8c
mov edi, eax
call fcn.00404690
add esp, 4
push eax
push edi
call ebx
mov esi, eax
push esi
push 0x512b7c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 0xc
push 5
push esi
call ebx
test eax, eax
jne 0x42205b
movzx ecx, byte [esi + 4]
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
push ecx
movzx ecx, byte [esi + 1]
push edx
movzx edx, byte [esi]
push eax
push ecx
push edx
push 0x512b5c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x1c
push 0x512ce0
call fcn.00404690
add esp, 4
push eax
push edi
call fcn.0040fed0
mov esi, eax
push esi
push 0x512b4c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
push 5
push esi
call ebx
test eax, eax
jne 0x4220c9
movzx eax, byte [esi + 4]
movzx ecx, byte [esi + 3]
movzx edx, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push ecx
movzx ecx, byte [esi]
push edx
push eax
push ecx
push 0x512b5c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x1c
call fcn.00495fa0
push 0x512b34
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0
call fcn.004920d0
push 0x512b1c
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
mov edx, dword [0x537cc0]
push edx
call fcn.004920d0
push 0x512b10
call fcn.00404690
add esp, 0x24
push eax
mov eax, dword [0x538644]
push eax
call fcn.0040fed0
mov dword [0x5385f0], eax
test eax, eax
jne 0x422137
mov eax, dword [sym.imp.KERNEL32.dll__lopen]
mov dword [0x5385f0], eax
push eax
push 0x512b00
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x512af4
call fcn.00404690
mov ecx, dword [0x538644]
add esp, 0x10
push eax
push ecx
call fcn.0040fed0
mov dword [0x5385f4], eax
test eax, eax
jne 0x42217d
mov eax, dword [sym.imp.KERNEL32.dll__lclose]
mov dword [0x5385f4], eax
push eax
push 0x512ae4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
jmp 0x4221ab
push 0x104
lea edx, [esp + 0x184]
push edx
push 0
call ebp
push 0
push 0x80
push 3
push 0
push 3
push closesocket
lea eax, [esp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [esp + 0x2c], esi
cmp esi, 0xffffffff
je 0x4224af
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x4224a8
push 0
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov ebx, eax
test ebx, ebx
je 0x4224a1
mov edi, dword [0x40003c]
mov ebp, dword [0x400038]
add edi, 0x400000
test ebp, ebp
je 0x4223f6
mov ecx, dword [edi + 8]
push ecx
xor ebp, 0x3833faf4
call fcn.0040c5d0
mov edx, dword [ebx + ebp]
add esp, 4
mov dword [esp + 0x14], edx
call fcn.0040c5e0
mov esi, eax
xor esi, dword [esp + 0x14]
call fcn.0040c5e0
mov dword [esp + 0x18], eax
call fcn.0040c5e0
push ebp
push 0x512ad0
mov dword [esp + 0x38], eax
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp esi, 0x100000
jbe 0x4222b7
push 0xc0020100
push 0x1caf4d60
push 0x3a9b
call fcn.0040a3f0
add esp, 0xc
xor al, al
jmp 0x422ce9
push 0
push esi
mov ecx, 0x53b0d4
call fcn.00420490
lea eax, [esi*4]
push eax
lea eax, [ebx + ebp + 4]
push eax
push 0
mov ecx, 0x53b0d4
call fcn.004079c0
push eax
call fcn.004b6e40
mov ecx, dword [edi + 0x28]
xor ecx, dword [esp + 0x24]
xor ecx, dword [esp + 0x20]
xor ecx, dword [edi + 8]
push ecx
call fcn.0040c5d0
add esp, 0x10
xor ebp, ebp
lea esp, [esp]
call fcn.0040c5e0
mov dword [esp + 0x18], eax
call fcn.0040c5e0
xor al, byte [esp + 0x18]
inc ebp
mov byte [esp + ebp + 0x137], al
cmp ebp, 0x10
jb 0x422300
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x150], 0
call fcn.0040e240
add esp, 8
lea ecx, [esp + 0x34]
push ecx
lea eax, [esi*4]
push eax
push 0
mov ecx, 0x53b0d4
call fcn.004079c0
push eax
call fcn.0040e200
mov edx, dword [edi + 0x28]
xor edx, dword [esp + 0x3c]
mov dword [esp + 0x24], 0
xor edx, dword [esp + 0x20]
xor edx, dword [edi + 8]
push edx
call fcn.0040c5d0
add esp, 0x10
xor edi, edi
test esi, esi
jbe 0x422492
push edi
mov ecx, 0x53b0d4
call fcn.004079c0
mov ebp, eax
call fcn.0040c5e0
xor dword [ebp], eax
cmp dword [esp + 0x18], 0
jne 0x4223b4
push edi
mov ecx, 0x53b0d4
call fcn.004079c0
cmp dword [eax], 0
jne 0x4223b4
mov dword [esp + 0x18], edi
inc edi
cmp edi, esi
jb 0x422384
mov esi, dword [esp + 0x18]
test esi, esi
je 0x422492
lea eax, [esi + 1]
push eax
mov ecx, 0x53b0d4
call fcn.004079c0
mov ecx, dword [eax]
add esi, 2
mov dword [0x527d90], ecx
push esi
mov ecx, 0x53b0d4
call fcn.004079c0
mov edx, dword [eax]
mov dword [0x53753c], edx
jmp 0x422492
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [eax + ebx - 0x10]
mov ecx, dword [eax + ebx - 0xc]
mov esi, dword [eax + ebx - 8]
mov edi, dword [eax + ebx - 4]
cmp edx, 0x32812622
jne 0x422492
cmp edi, 0x32812621
jne 0x422492
lea esi, [esi + ecx + 0x10]
xor edx, edx
mov ecx, eax
sub ecx, esi
mov edi, edx
mov dword [esp + 0x140], edx
mov ebp, edx
cmp ecx, 0x10
jbe 0x422450
mov ebp, dword [ecx + ebx - 8]
mov edx, dword [ecx + ebx - 0x10]
mov edi, dword [ecx + ebx - 0xc]
mov dword [esp + 0x140], ebp
mov ebp, dword [ecx + ebx - 4]
cmp edx, 0x32812624
jne 0x42246d
cmp ebp, 0x32812623
jne 0x42246d
mov eax, ecx
mov ecx, dword [esp + 0x140]
lea esi, [ecx + edi + 0x10]
sub eax, esi
mov esi, dword [eax + ebx - 4]
test esi, esi
je 0x422492
cmp esi, 0xa77a65ed
je 0x422492
push esi
call fcn.0040c500
add esp, 4
test al, al
jne 0x422492
mov dword [0x527d90], esi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x53972c
call fcn.00419970
add esp, 4
test al, al
jne 0x4224df
push 0x512abc
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
xor al, al
jmp 0x422ce9
cmp dword [0x538358], 0
jne 0x422539
push 0x53972c
call fcn.0040bb20
add esp, 4
test al, al
je 0x422539
push 0x54a290
push 0x53972c
push 0x512aa8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0xc0000004
push 0x1caeff40
push 0x36b1
call fcn.0040a3f0
add esp, 0x1c
xor al, al
jmp 0x422ce9
test dword [0x5378cc], 0x40000000
je 0x4225a3
push 0x512a98
call fcn.00404690
add esp, 4
push eax
mov ecx, 0x538688
call fcn.004aae80
mov ecx, 0x538688
call fcn.004aad20
mov dword [0x538668], eax
test eax, eax
jne 0x4225a3
push 0x512a8c
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0x80000409
push 0x1caf2650
push 0x2ee0
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
cmp byte [0x54a134], 0
jne 0x4225c1
mov edx, dword [0x537c4c]
imul edx, edx, 0x18d
add edx, 0xc
mov dword [0x537c4c], edx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push eax
call edi
mov ebp, eax
mov eax, 1
cpuid
add dword [0x537890], eax
or dword [0x537890], 0xe1
push ebp
call esi
push eax
call edi
call fcn.004cdfa8
push 0x104
push 0x536948
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x536948
call fcn.004ba189
add esp, 4
push 0x77cfd895
push 1
push 0x512a78
mov dword [0x54c098], 0x536948
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
call fcn.004a8dc0
mov dword [0x537520], eax
test eax, eax
jne 0x422684
push 0x512a68
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0x40430
push 0x1caf2a38
push 0x2714
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, 1
je 0x422699
push 0x512a58
jmp 0x422656
mov ecx, dword [0x537520]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 0
push 0
call eax
test eax, eax
je 0x4226de
push 0x512a48
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
push 0
push 0x1caf2a39
push 0x2ee8
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
call dword [0x5385fc]
mov ebx, eax
push ebx
mov dword [0x537524], 0
xor edi, edi
call fcn.004b71f6
add esp, 4
xor esi, esi
lea ecx, [ecx]
call fcn.004b7208
and eax, 0xf
mov ecx, esi
shl eax, cl
add esi, 4
or edi, eax
cmp esi, 0x20
jl 0x422700
xor ecx, ecx
mov dword [0x537524], edi
xor edx, edx
movzx eax, cx
movzx cx, byte [edx + 0x537524]
shl cx, 8
movzx ecx, cx
mov esi, 8
mov ebp, ecx
xor ebp, eax
add eax, eax
test ebp, 0x8000
je 0x42274b
xor eax, 1
movzx eax, ax
add ecx, ecx
sub esi, 1
jne 0x422737
inc edx
movzx ecx, ax
cmp edx, 4
jb 0x422720
not eax
movzx edx, ax
shl edx, 0x10
movzx ecx, bx
or edx, ecx
mov ecx, dword [0x53789c]
mov al, cl
xor al, dl
mov byte [esp + 0x14], al
mov eax, ecx
imul eax, eax, 0xd6
add eax, 0x9d
mov bl, al
imul eax, eax, 0xd6
mov dword [esp + 0x18], edx
mov dl, byte [esp + 0x1a]
add eax, 0x9d
xor dl, al
mov byte [esp + 0x16], dl
mov dl, 0x2a
imul dl
xor bl, dh
mov dl, 0x9d
sub dl, al
xor dl, byte [esp + 0x1b]
mov byte [esp + 0x15], bl
mov byte [esp + 0x17], dl
mov eax, dword [esp + 0x14]
mov edx, eax
lea esi, [eax*4]
shr edx, 2
add eax, eax
add eax, eax
xor edx, esi
and edx, 0x33333333
xor edx, eax
mov dword [esp + 0x14], edx
mov dl, cl
imul ecx, ecx, 0x52
xor dl, byte [esp + 0x14]
add ecx, 0x35
mov al, cl
imul ecx, ecx, 0x52
xor al, byte [esp + 0x15]
add ecx, 0x35
mov byte [0x53c59d], al
mov eax, ecx
mov cl, byte [esp + 0x16]
xor cl, al
mov byte [0x53c59c], dl
mov dl, 0x52
imul dl
add al, 0x35
xor al, byte [esp + 0x17]
mov byte [0x53c59e], cl
mov byte [0x53c59f], al
mov eax, dword [0x53c59c]
push eax
push edi
push 0x512a34
call fcn.004045b0
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
call fcn.004123f0
mov ecx, dword [0x538664]
push 1
lea edx, [esp + 0x184]
mov dword [0x53c598], ecx
push edx
mov ecx, 0x538cb8
call fcn.00406500
test al, al
jne 0x42288b
push 1
lea eax, [esp + 0x184]
push eax
mov ecx, 0x538cb8
call fcn.00405fb0
movzx ecx, al
push ecx
push 0x512a1c
call fcn.00404690
add esp, 4
jmp 0x4224ca
jmp 0x42289d
cmp dword [0x537d10], 0
je 0x4228c7
cmp dword [0x537f34], 0
jne 0x4228b8
cmp dword [0x537f30], 0
jne 0x4228c7
mov edx, dword [0x539714]
push edx
call fcn.00419520
add esp, 4
cmp dword [0x54a138], 0x4e22
jne 0x4228e1
mov eax, dword [0x527da4]
lea ecx, [eax + eax]
mov dword [0x527da4], ecx
mov eax, 0x537d98
xor ebx, ebx
lea edx, [eax + 1]
jmp 0x4228f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4228f0
sub eax, edx
je 0x422900
mov ebx, 1
mov eax, 0x537dcc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422908
sub eax, edx
je 0x422914
inc ebx
mov eax, 0x537e00
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422920
sub eax, edx
je 0x42292c
inc ebx
mov eax, 0x537e34
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422934
sub eax, edx
je 0x422940
inc ebx
mov eax, 0x537e68
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422948
sub eax, edx
je 0x422954
inc ebx
mov eax, 0x537e9c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422960
sub eax, edx
je 0x42296c
inc ebx
mov eax, 0x537ed0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422974
sub eax, edx
je 0x422980
inc ebx
test ebx, ebx
jle 0x422bc0
push 0xec
xor esi, esi
lea edx, [esp + 0x3c]
push esi
push edx
xor edi, edi
mov byte [esp + 0x40], 0
call fcn.004b6dc0
add esp, 0xc
test ebx, ebx
jle 0x422b44
mov ebp, ebx
mov edi, edi
push 0x31
lea eax, [esp + 0x151]
push 0
push eax
mov byte [esp + 0x158], 0
call fcn.004b6dc0
add esp, 0xc
cmp byte [0x537d98], 0
je 0x4229f9
cmp esi, 1
jge 0x4229f9
push 0x32
lea ecx, [esp + 0x150]
push 0x537d98
push ecx
call fcn.004bac70
add esp, 0xc
mov bl, 1
inc esi
jmp 0x422af4
cmp byte [0x537dcc], 0
je 0x422a28
cmp esi, 2
jge 0x422a28
push 0x32
lea edx, [esp + 0x150]
push 0x537dcc
push edx
call fcn.004bac70
add esp, 0xc
mov bl, 2
add esi, 2
jmp 0x422af4
cmp byte [0x537e00], 0
je 0x422a57
cmp esi, 4
jge 0x422a57
push 0x32
lea eax, [esp + 0x150]
push 0x537e00
push eax
call fcn.004bac70
add esp, 0xc
mov bl, 3
add esi, 4
jmp 0x422af4
cmp byte [0x537e34], 0
je 0x422a83
cmp esi, 8
jge 0x422a83
push 0x32
lea ecx, [esp + 0x150]
push 0x537e34
push ecx
call fcn.004bac70
add esp, 0xc
mov bl, 4
add esi, 8
jmp 0x422af4
cmp byte [0x537e68], 0
je 0x422aaf
cmp esi, 0x10
jge 0x422aaf
push 0x32
lea edx, [esp + 0x150]
push 0x537e68
push edx
call fcn.004bac70
add esp, 0xc
mov bl, 5
add esi, 0x10
jmp 0x422af4
cmp byte [0x537e9c], 0
je 0x422adb
cmp esi, 0x20
jge 0x422adb
push 0x32
lea eax, [esp + 0x150]
push 0x537e9c
push eax
call fcn.004bac70
add esp, 0xc
mov bl, 6
add esi, 0x20
jmp 0x422af4
push 0x32
lea ecx, [esp + 0x150]
push 0x537ed0
push ecx
call fcn.004bac70
add esp, 0xc
mov bl, 7
lea edx, [esp + 0x14c]
push 0x512a18
push edx
call fcn.004babab
add esp, 8
test eax, eax
je 0x422b3b
lea ecx, [ecx]
cmp edi, 0x1e
jge 0x422b3b
push 0x10
push 0
push eax
mov byte [esp + edi*8 + 0x40], bl
call fcn.004b8fe2
push 0x512a18
mov dword [esp + edi*8 + 0x48], eax
push 0
inc edi
call fcn.004babab
add esp, 0x14
test eax, eax
jne 0x422b10
sub ebp, 1
jne 0x4229b0
push 0x512a04
call fcn.00404690
add esp, 4
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [0x5385cc], eax
test eax, eax
je 0x422b6f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x512a04
call fcn.00404690
add esp, 4
push eax
push 0xf0
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0xf0
push 0
push 0
push 0xf001f
push eax
mov dword [0x5385cc], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x5385d0], eax
test eax, eax
je 0x422bc0
mov ecx, 0x3c
lea esi, [esp + 0x34]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [0x537d78], 0
jne 0x422bd6
cmp byte [0x536ec8], 0
je 0x422cb8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5385bc], eax
test eax, eax
jne 0x422c06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5129dc
call fcn.00404690
add esp, 4
jmp 0x422caa
push 0x5385c8
push 0
push 0
push 0x419770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5385c4], eax
test eax, eax
jne 0x422c64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5129b4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x40000402
push 0x1caf7920
push 0x2712
call fcn.0040a3f0
add esp, 0x18
xor al, al
jmp 0x422ce9
mov ecx, dword [0x5385c8]
push ecx
push eax
push 0x512994
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov edx, dword [0x5385bc]
add esp, 0x10
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x422cb8
push 0x511020
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
call fcn.004a36e0
test al, al
jne 0x422ce2
push 0x512980
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
call fcn.00496aa0
xor al, al
jmp 0x422ce9
call fcn.00413580
mov al, 1
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004b6da3
add esp, 0x280
ret