Function at 0x419878
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x419881
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x41989b
add esp, 0xfffffff0
call fcn.00404420
mov esi, ecx
mov byte [ebp - 0x51], dl
mov dword [ebp - 0x50], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
call fcn.004058a4
lea eax, [ebp - 0x4c]
mov edx, dword [0x40e80c]
call fcn.00406430
xor eax, eax
push ebp
push 0x41abed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [eax + 0x2c], edx
call fcn.004170f4
push ebp
push 0x41ab84
push dword fs:[0]
mov dword fs:[0], esp
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x419916
mov edx, 0x4249bc
mov eax, 0x4249b8
call fcn.00412750
mov dword [edi], ebx
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x3c], esi
test byte [ebp + 8], 0x20
setne al
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x40], al
test byte [ebp + 8], 0x40
setne al
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x41], al
test byte [ebp + 9], 1
setne al
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x42], al
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [eax + 0x34], edx
lea edx, [ebp - 0xf4]
mov eax, 0x418e18
call fcn.00411198
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x7c], eax
xor edx, edx
mov eax, 0x4000
call fcn.0041674c
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
add eax, 0x3000
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
mov byte [eax], 0xff
mov byte [eax + 1], 0x25
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x2c]
mov dword [eax + 2], edx
mov edx, dword [ebp - 0x50]
mov eax, ebx
mov dword [edx + 8], eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x18], edi
mov byte [ebp - 0x7d], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax + 8]
xor ecx, ecx
mov eax, dword [0x4248c8]
call fcn.0041631c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax + 8]
mov cl, 1
mov eax, dword [0x4248c8]
call fcn.0041631c
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x419a1e
mov eax, dword [ebp - 0x50]
cmp dword [eax + 8], 0x80000000
jb 0x419a26
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040525c
lea eax, [ebp - 8]
call fcn.004051ac
jmp 0x419a26
lea eax, [ebp - 8]
call fcn.004051ac
lea edx, [ebp - 0xfc]
mov eax, dword [0x4248a8]
call fcn.0040ccb0
push dword [ebp - 0xfc]
push 0x41ac24
push dword [ebp - 4]
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0xf8]
call fcn.004058b4
push eax
call fcn.00415c40
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 8], 0
je 0x419ab2
lea edx, [ebp - 0x104]
mov eax, dword [0x4248a8]
call fcn.0040ccb0
push dword [ebp - 0x104]
push 0x41ac24
push dword [ebp - 8]
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x100]
call fcn.004058b4
push eax
call fcn.00415c40
mov dword [ebp - 0x60], eax
jmp 0x419ab7
xor eax, eax
mov dword [ebp - 0x60], eax
push ebp
push 0x41ab5e
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [ebp - 0x5c], 0
je 0x419adc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp dword [ebp - 0x60], 0
je 0x419aed
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
push ebp
push 0x41aac4
push dword fs:[0]
mov dword fs:[0], esp
push 0xffffffffffffffff
lea edx, [ebp - 0x10c]
mov eax, dword [0x4248c0]
call fcn.0040ccb0
push dword [ebp - 0x10c]
push 0x41ac24
push dword [ebp - 4]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x108]
call fcn.004058b4
push eax
call fcn.00416138
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
call fcn.00419828
xor al, 1
mov edx, dword [ebp - 0x50]
mov byte [edx + 5], al
mov eax, dword [ebp - 0x50]
cmp byte [eax + 5], 0
je 0x419bcc
cmp dword [ebp - 8], 0
je 0x419bcc
push 0xffffffffffffffff
lea edx, [ebp - 0x114]
mov eax, dword [0x4248c0]
call fcn.0040ccb0
push dword [ebp - 0x114]
push 0x41ac24
push dword [ebp - 8]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x110]
call fcn.004058b4
push eax
call fcn.00416138
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
call fcn.00419828
xor al, 1
mov edx, dword [ebp - 0x50]
mov byte [edx + 5], al
mov eax, dword [ebp - 0x50]
cmp byte [eax + 5], 0
jne 0x419bcc
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040525c
push ebp
push 0x41aa91
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [ebp - 0x50]
cmp byte [eax + 5], 0
je 0x41a171
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0x18]
mov eax, esi
call fcn.00419328
test al, al
je 0x419c21
mov dword [ebp - 0x78], 0x770001
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
jmp 0x41ab8b
test byte [ebp + 8], 2
jne 0x419d5e
mov eax, dword [ebp - 0x50]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.00419268
test al, al
je 0x419c45
or dword [ebp + 8], 2
jmp 0x419d5e
test byte [ebp + 0xb], 0x80
jne 0x419d5e
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
call fcn.00411198
cmp byte [ebp - 0x4c], 0
je 0x419c91
cmp byte [ebp - 0x24], 0
je 0x419c91
cmp byte [0x424724], 0
jne 0x419d5e
lea ecx, [ebp - 0x88]
mov eax, dword [ebp - 0x50]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.004196a4
test al, al
je 0x419d5e
or dword [ebp + 8], 2
cmp byte [ebp - 0x4c], 0
je 0x419ca8
cmp byte [ebp - 0x24], 0
je 0x419ca8
mov dword [ebp - 0x78], 0x770004
test byte [ebp + 9], 2
je 0x419d5e
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
call fcn.0040fe5c
cmp byte [ebp - 0xae], 0
je 0x419d5e
cmp dword [ebp - 0xac], 0
je 0x419d5e
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xac]
call fcn.00411198
mov ebx, 0xa
cmp byte [ebp - 0x4c], 0
je 0x419d45
cmp byte [ebp - 0x24], 0
jne 0x419d45
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0xac]
call fcn.0040fe5c
push esi
lea esi, [ebp - 0x138]
lea edi, [ebp - 0xb4]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop esi
cmp byte [ebp - 0xae], 0
je 0x419d45
cmp dword [ebp - 0xac], 0
je 0x419d45
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xac]
call fcn.00411198
dec ebx
jne 0x419cf0
cmp byte [ebp - 0x4c], 0
je 0x419d5e
cmp byte [ebp - 0x24], 0
je 0x419d5e
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x74], eax
and dword [ebp + 8], 0xfffffffd
test byte [ebp + 8], 2
jne 0x419d9e
mov eax, dword [ebp - 0x50]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.004194c0
mov edx, dword [ebp - 0x50]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a181
cmp dword [ebp - 8], 0
je 0x41a181
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040525c
jmp 0x41a181
test byte [ebp + 8], 0x10
jne 0x41a151
test esi, esi
je 0x419e1b
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x419df4
lea edx, [ebp - 0x140]
mov eax, dword [0x424888]
call fcn.0040ccb0
mov eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x13c]
mov dl, 1
call fcn.0040cce4
mov eax, dword [ebp - 0x13c]
push eax
call sub.kernel32.dll_GetModuleHandleW
cmp esi, eax
sete al
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x43], al
jmp 0x419e1b
lea edx, [ebp - 0x144]
mov eax, dword [0x424888]
call fcn.0040ccb0
mov eax, dword [ebp - 0x144]
push eax
call sub.kernel32.dll_GetModuleHandleA
cmp esi, eax
sete al
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x43], al
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0x43], 0
je 0x419e35
test byte [ebp + 8], 0x80
je 0x419e35
mov eax, esi
call fcn.00416778
mov ebx, eax
jmp 0x419e37
xor ebx, ebx
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0x43], 0
je 0x419e48
test ebx, ebx
je 0x41a131
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x419e78
mov eax, dword [ebp - 0x50]
cmp dword [eax + 8], 0x80000000
jae 0x419e7c
test esi, esi
je 0x419e78
mov eax, esi
call fcn.0040d478
mov edx, eax
mov eax, esi
call fcn.004194c0
test al, al
jne 0x419e7c
xor eax, eax
jmp 0x419e7e
mov al, 1
mov edx, dword [ebp - 0x50]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x419eaf
cmp dword [ebp - 8], 0
je 0x419e9e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040525c
push 0
push 0x1000
call fcn.004127f8
mov dword [ebp - 0x70], eax
jmp 0x419ebe
xor edx, edx
mov eax, 0x1000
call fcn.0041674c
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov byte [eax], 0xff
mov eax, dword [ebp - 0x70]
mov byte [eax + 1], 0x25
mov eax, dword [ebp - 0x70]
add eax, 6
mov edx, dword [ebp - 0x70]
mov dword [edx + 2], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x70]
mov dword [edx + 6], eax
lea eax, [ebp - 0x8c]
push eax
push 0x20
push 0x1000
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0x424cac]
mov dword [eax], fcn.00416514
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x50]
movzx ecx, byte [eax + 0xc]
mov edx, dword [ebp - 0x70]
mov eax, dword [0x4248c4]
call fcn.0041631c
push 4
lea edx, [ebp - 0x14c]
mov eax, dword [0x4248c0]
call fcn.0040ccb0
push dword [ebp - 0x14c]
push 0x41ac24
push dword [ebp - 0xc]
lea eax, [ebp - 0x148]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x148]
call fcn.004058b4
push eax
call fcn.00415d54
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x419fa8
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x419f9a
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x68]
mov dword [edx], eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x419fa8
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x41a0d6
push ebx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x70]
mov eax, esi
call fcn.00416904
test al, al
jne 0x419fe8
call fcn.00416c60
mov edx, dword [ebp - 0x50]
cmp eax, dword [edx + 8]
jne 0x41a0d6
mov eax, dword [ebp - 0x70]
call fcn.00416c84
test al, al
je 0x41a0d6
mov eax, dword [ebp - 0x50]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a030
mov eax, dword [ebp - 0x64]
call fcn.00412700
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.00416c60
mov edx, dword [ebp - 0x50]
cmp eax, dword [edx + 8]
je 0x41a030
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x70]
call fcn.00416cd0
test byte [ebp + 8], 4
setne al
call fcn.00417140
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0x43], 0
je 0x41a092
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x41a076
lea edx, [ebp - 0x154]
mov eax, dword [0x424888]
call fcn.0040ccb0
mov eax, dword [ebp - 0x154]
lea ecx, [ebp - 0x150]
mov dl, 1
call fcn.0040cce4
mov eax, dword [ebp - 0x150]
push eax
call sub.kernel32.dll_LoadLibraryW
jmp 0x41a092
lea edx, [ebp - 0x158]
mov eax, dword [0x424888]
call fcn.0040ccb0
mov eax, dword [ebp - 0x158]
push eax
call sub.kernel32.dll_LoadLibraryA
xor eax, eax
push ebp
push 0x41a0b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x70]
call fcn.00416bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a0c2
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x7d], 1
xor eax, eax
mov dword [ebp - 0x78], eax
jmp 0x41a181
cmp dword [ebp - 0x64], 0
je 0x41a0e5
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a0fb
push 0
mov eax, dword [ebp - 0x70]
push eax
call fcn.0041290c
jmp 0x41a10b
push 0x8000
push 0
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_VirtualFree
cmp dword [ebp - 0x78], 0
jne 0x41a118
mov dword [ebp - 0x78], 0x770002
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
jmp 0x41ab8b
mov dword [ebp - 0x78], 0x770002
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
jmp 0x41ab8b
mov dword [ebp - 0x78], 0x770002
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
jmp 0x41ab8b
mov eax, dword [ebp - 4]
cmp byte [eax + 5], 0x53
sete al
mov edx, dword [ebp - 0x50]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a190
test byte [ebp + 8], 4
jne 0x41a194
xor eax, eax
jmp 0x41a196
mov al, 1
mov edx, dword [ebp - 0x50]
mov byte [edx + 0x24], al
test al, al
je 0x41a379
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x14], 0x80000000
jae 0x41a2d5
mov eax, dword [ebp - 0x50]
add eax, 0x1c
push eax
lea eax, [ebp - 0x4c]
push eax
test byte [ebp + 8], 8
setne cl
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.00412a94
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x14], 0
jne 0x41a202
mov dword [ebp - 0x78], 0x770003
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
jmp 0x41ab8b
mov eax, dword [ebp - 0x2c]
call fcn.00406a2c
mov esi, eax
test esi, esi
jl 0x41a2be
inc esi
xor ebx, ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
sub eax, ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [edx + eax*4]
cmp byte [ecx + 0x10], 0
jne 0x41a2b6
cmp dword [ecx + 0x18], 0
je 0x41a2b6
mov eax, dword [ecx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
cmp eax, dword [edx + 0x18]
jne 0x41a2b6
mov eax, dword [ecx + 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x44]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x1c]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov edi, eax
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0x24], 0
jne 0x41a28c
lea eax, [ebp - 0x8c]
push eax
push 0x40
push 4
push edi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41a2b6
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x40]
mov dword [edi], eax
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0x24], 0
jne 0x41a2b6
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x8c]
push eax
push 4
push edi
call sub.kernel32.dll_VirtualProtect
inc ebx
dec esi
jne 0x41a217
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x28]
mov dword [edx + 2], eax
jmp 0x41a379
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x14]
call fcn.00411198
cmp byte [ebp - 0x4c], 0
jne 0x41a309
mov dword [ebp - 0x78], 0x770003
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
call fcn.00404b0c
jmp 0x41ab8b
mov eax, dword [ebp - 0x2c]
call fcn.00406a2c
mov esi, eax
test esi, esi
jl 0x41a379
inc esi
xor ebx, ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
sub eax, ebx
mov edx, dword [ebp - 0x2c]
lea edi, [edx + eax*4]
cmp byte [edi + 0x10], 0
jne 0x41a375
cmp dword [edi + 0x18], 0
je 0x41a375
mov eax, dword [edi + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
cmp eax, dword [edx + 0x18]
jne 0x41a375
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x1c], 0
jne 0x41a36a
push 0
push 4
call fcn.004127f8
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x28]
mov dword [edx + 2], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x1c]
mov edx, dword [edi + 0x18]
mov dword [edx], eax
inc ebx
dec esi
jne 0x41a31a
xor eax, eax
mov dword [ebp - 0x68], eax
xor ecx, ecx
push ebp
push 0x41aa5b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0x50]
cmp byte [eax + 5], 0
je 0x41a66b
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a3b6
push 0
push 0x2000
call fcn.004127f8
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x48], eax
jmp 0x41a3e9
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x41a3d6
push 0x2000
push 0x40
call sub.kernel32.dll_LocalAlloc
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x48], eax
jmp 0x41a3e9
mov edx, dword [ebp - 0x74]
mov eax, 0x2000
call fcn.0041674c
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x48], eax
mov ebx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x50]
mov esi, dword [eax + 0x48]
lea edx, [ebp - 0xb4]
mov eax, ebx
call fcn.0040fe5c
cmp byte [ebp - 0xad], 0
je 0x41a499
cmp dword [ebp - 0xa0], 1
jne 0x41a43e
cmp word [ebp - 0xb2], 0xeb
je 0x41a436
mov byte [esi], 0xf
movzx eax, byte [ebp - 0xb2]
and al, 0xf
add al, 0x80
mov byte [esi + 1], al
add esi, 6
jmp 0x41a488
mov byte [esi], 0xe9
add esi, 5
jmp 0x41a488
cmp dword [ebp - 0xa0], 2
jne 0x41a46c
mov eax, dword [ebp - 0x94]
sub eax, ebx
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
sub ecx, 3
mov edx, esi
mov eax, ebx
inc eax
call fcn.00403ab0
mov eax, esi
add eax, dword [ebp - 0x58]
inc eax
mov esi, eax
jmp 0x41a488
mov eax, dword [ebp - 0x94]
sub eax, ebx
mov dword [ebp - 0x58], eax
mov edx, esi
mov eax, ebx
mov ecx, dword [ebp - 0x58]
call fcn.00403ab0
mov eax, dword [ebp - 0x58]
add esi, eax
mov edx, dword [ebp - 0xac]
mov eax, esi
sub edx, eax
sub eax, 4
mov dword [eax], edx
jmp 0x41a4b5
mov eax, dword [ebp - 0x94]
sub eax, ebx
mov dword [ebp - 0x58], eax
mov edx, esi
mov eax, ebx
mov ecx, dword [ebp - 0x58]
call fcn.00403ab0
mov eax, dword [ebp - 0x58]
add esi, eax
mov ebx, dword [ebp - 0x94]
mov eax, ebx
sub eax, dword [ebp - 0x74]
cmp eax, 6
jb 0x41a3f2
mov byte [esi], 0xe9
add esi, 5
sub ebx, esi
sub esi, 4
mov dword [esi], ebx
lea eax, [ebp - 0x8c]
push eax
push 0x20
push 0x1000
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x48]
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [ebp - 0x8c]
push eax
push 4
push 0x1000
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x48]
add eax, 0x1000
push eax
call sub.kernel32.dll_VirtualProtect
push 4
lea edx, [ebp - 0x160]
mov eax, dword [0x4248c0]
call fcn.0040ccb0
push dword [ebp - 0x160]
push 0x41ac24
push dword [ebp - 4]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x15c]
call fcn.004058b4
push eax
call fcn.00415d54
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x41a752
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a56e
mov eax, dword [ebp - 0x64]
call fcn.00412700
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x41a752
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a5a8
push 0
push 0x5c
call fcn.004127f8
mov edx, dword [ebp - 0x68]
mov dword [edx], eax
jmp 0x41a5b9
xor edx, edx
mov eax, 0x5c
call fcn.0041674c
mov edx, dword [ebp - 0x68]
mov dword [edx], eax
lea eax, [ebp - 0x58]
push eax
push 4
push 0x5c
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [eax], 2
mov dword [eax + 4], 8
mov edx, dword [ebp - 0x74]
mov dword [eax + 0xc], edx
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dword [eax + 0x10], ecx
mov cx, word [edx + 4]
mov word [eax + 0x14], cx
mov byte [eax + 0x16], 0xff
mov byte [eax + 0x17], 0x25
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x48]
add edx, 0x1000
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x48]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx + 0x48]
add ecx, 0x1000
mov dword [ecx], edx
mov edx, dword [ebp - 0x50]
cmp byte [edx + 0xc], 0
jne 0x41a636
cmp byte [ebp - 0x7d], 0
jne 0x41a636
mov edx, dword [ebp - 0x64]
mov dword [eax + 8], edx
jmp 0x41a63b
xor edx, edx
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x64]
mov dword [edx + 0x10], ecx
xor edx, edx
mov dword [eax + 0x1c], edx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x48]
add edx, 0x1000
mov dword [eax + 0x20], edx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x48]
mov dword [eax + 0x24], edx
xor edx, edx
mov dword [eax + 0x28], edx
jmp 0x41a752
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov esi, dword [eax]
mov eax, dword [esi]
mov eax, dword [esi + eax*8 + 0x14]
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x48], eax
mov eax, dword [esi + 4]
cmp eax, dword [esi]
jne 0x41a749
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a6c1
push 0
mov eax, dword [esi + 4]
add eax, eax
add eax, eax
add eax, eax
add eax, eax
add eax, 0x1c
push eax
call fcn.004127f8
mov ebx, eax
jmp 0x41a6d8
mov eax, dword [esi + 4]
add eax, eax
add eax, eax
add eax, eax
add eax, eax
add eax, 0x1c
xor edx, edx
call fcn.0041674c
mov ebx, eax
lea eax, [ebp - 0x8c]
push eax
push 4
mov eax, dword [esi + 4]
add eax, eax
add eax, eax
add eax, eax
add eax, eax
add eax, 0x1c
push eax
push ebx
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [esi + 4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
add ecx, 0x1c
mov edx, ebx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
call fcn.00403ab0
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ebx
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a739
push 0
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041290c
jmp 0x41a749
push 0x8000
push 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_VirtualFree
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0x24], 0
jne 0x41a936
test byte [ebp + 8], 1
jne 0x41a894
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
add eax, 0x1000
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
add eax, 0x3000
add eax, 4
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x34]
mov edx, 0x888
call fcn.00408f88
xor ebx, ebx
mov eax, ebx
shl eax, 4
sub eax, ebx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x30]
lea eax, [edx + eax]
mov word [eax], 0x35ff
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x34]
lea edx, [edx + ebx*4]
mov dword [eax + 2], edx
mov byte [eax + 6], 0xf0
mov word [eax + 7], 0x2583
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x34]
lea edx, [edx + ebx*4]
mov dword [eax + 9], edx
mov byte [eax + 0xd], 0
mov byte [eax + 0xe], 0xc3
inc ebx
cmp ebx, 0x222
jne 0x41a7a0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
add eax, 0xa
mov ebx, eax
mov edx, ebx
mov eax, 0x418e18
mov ecx, dword [ebp - 0x7c]
call fcn.00403ab0
mov eax, dword [ebp - 0x7c]
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x424bc0]
mov esi, dword [esi]
mov eax, 0x41ac28
mov ecx, 4
mov edx, ebx
call esi
add eax, ebx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x30]
mov dword [eax], edx
mov eax, dword [ebp - 0x7c]
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x424bc0]
mov esi, dword [esi]
mov eax, 0x41ac30
mov ecx, 4
mov edx, ebx
call esi
add eax, ebx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x34]
mov dword [eax], edx
mov eax, dword [ebp - 0x7c]
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x424bc0]
mov esi, dword [esi]
mov eax, 0x41ac38
mov ecx, 4
mov edx, ebx
call esi
add eax, ebx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x14]
sub edx, ebx
sub edx, dword [ebp - 0x7c]
mov dword [eax], edx
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x14], ebx
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xc], 0
je 0x41a936
push 0
push 0x22
call fcn.004127f8
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x20]
mov edi, eax
mov esi, 0x424a8c
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x424c2c]
mov eax, dword [eax]
mov dl, 1
call fcn.004112e4
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x20]
inc edx
add edx, 5
sub eax, edx
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x20]
mov dword [edx + 2], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [ebp - 0x50]
mov ebx, dword [edx + 0x20]
mov dword [ebx + 7], eax
lea eax, [ebx + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x14]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x1e]
mov dword [ebx + 0x1a], eax
lea eax, [ebx + 0x1e]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x28]
mov dword [edx + 2], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x20]
push eax
call sub.kernel32.dll_GetCurrentProcessId
push eax
call sub.kernel32.dll_GetCurrentProcess
mov edx, dword [ebp - 0x50]
mov ecx, dword [edx + 8]
pop edx
call fcn.0041861c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x4c], edx
mov edx, dword [ebp - 0x50]
mov ecx, dword [eax + 0x16]
mov dword [edx + 0x50], ecx
mov cx, word [eax + 0x1a]
mov word [edx + 0x54], cx
mov edx, dword [ebp - 0x50]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x56], ecx
mov cx, word [eax + 0x14]
mov word [edx + 0x5a], cx
mov edx, dword [eax]
mov ecx, dword [eax + edx*8 + 0x14]
mov dword [eax + edx*8 + 0x1c], ecx
mov ecx, dword [eax + edx*8 + 0x18]
mov dword [eax + edx*8 + 0x20], ecx
mov edx, dword [ebp - 0x50]
cmp byte [edx + 0xc], 0
je 0x41a9a6
mov edx, dword [ebp - 0x50]
cmp byte [edx + 0x24], 0
jne 0x41a9a6
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx + 0x20]
mov dword [eax + edx*8 + 0x14], ecx
jmp 0x41a9b2
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx + 0x14]
mov dword [eax + edx*8 + 0x14], ecx
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx + 0x28]
mov ecx, dword [ecx + 2]
mov dword [eax + edx*8 + 0x18], ecx
mov edx, dword [eax]
mov ecx, dword [eax + edx*8 + 0x1c]
mov edx, dword [eax + edx*8 + 0x18]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + edx*8 + 0x14]
mov edx, dword [eax + edx*8 + 0x10]
mov dword [edx], ecx
inc dword [eax]
mov eax, dword [ebp - 0x50]
mov byte [eax + 4], 1
mov eax, dword [ebp - 0x50]
cmp byte [eax + 5], 0
jne 0x41aa36
cmp byte [0x424730], 0
jne 0x41aa36
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4c]
xor ecx, ecx
mov edx, 6
call fcn.00411740
test al, al
jne 0x41aa3e
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
add edx, 0x56
cmp eax, dword [edx]
jne 0x41aa3e
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4c]
add eax, 4
movzx eax, word [eax]
mov edx, dword [ebp - 0x50]
add edx, 0x56
add edx, 4
cmp ax, word [edx]
jne 0x41aa3e
mov eax, dword [ebp - 0x50]
call fcn.0041b1dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41aa62
cmp dword [ebp - 0x68], 0
je 0x41aa5a
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41abf4
lea eax, [ebp - 0x160]
mov edx, 0xa
call fcn.004051d0
lea eax, [ebp - 0x114]
mov edx, 8
call fcn.004051d0
lea eax, [ebp - 0xf4]
mov edx, dword [0x40e80c]
call fcn.004064fc
lea eax, [ebp - 0x4c]
mov edx, dword [0x40e80c]
call fcn.004064fc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051d0
lea eax, [ebp + 0x18]
call fcn.004051ac
ret