push 40
mov ecx,00012101
sub ecx,00011101
push ecx
push ecx
push 00
call dword ptr [0049F094] ;kernel32. VirtualAlloc
mov ebx,eax
nop nop nop nop
mov [ebx],90909090
add ebx,04
mov [ebx],087A8190
add ebx,04
mov [ebx],6C616552
add ebx,04
mov [ebx],7A810B75
add ebx,04
mov [ebx],7974690C
add ebx,04
mov [ebx],EB027553
add ebx,04
mov [ebx],0000E907
add ebx,04
mov [ebx],90900000
add ebx,04
mov [ebx],000000E8
add ebx,04
mov [ebx],90F2EB00
add ebx,04
nop nop
mov ebx,eax
mov [004B4464],74726956 ;Virt
mov [004B4468],506C6175 ;ualP
mov [004B446C],65746F72 ;rote
mov [004B4470],00007463 ;ct
push 0049F604 ;KERNEL32
call dword ptr [0049F0B8] ;kernel32. GetModuleHandleA
push 004B4464 ;VirtualProtect
push eax
call dword ptr [0049F130] ;apphelp. SE_ProcessDying+39
push eax
push 004B4474
push 40
push 00090F00
push 00410000
call eax
pop eax
nop nop nop nop
mov ecx,ebx
sub ecx,004713A9
sub ecx,05
mov [004713A9],909090E9
mov [004713AA],90909090
mov [004713AA],ecx
nop nop
mov ecx,ebx
add ecx,20
mov edx,0049314F
sub edx,ecx
sub edx,05
mov [ecx],000000E8
inc ecx
mov [ecx],edx
nop nop
mov ecx,ebx
add ecx,19
mov edx,004713AE
sub edx,ecx
sub edx,05
mov [ecx],000000E9
inc ecx
mov [ecx],edx
nop nop
push 004B4474
push 20
push 00090F00
push 00410000
call eax