Function at 0x4ad0b297
Capabilities:
Create process on windows
Get system information on windows
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4ad0b6e8
push 0x4ad21a2c
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x1c5c0
call fcn.4ad0367b
mov eax, dword [0x4ad2406c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c454], eax
mov dword [ebp - 0x1c464], eax
mov esi, 0x4ad0b6d8
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebp - 0x1c44c], 0xffffffff
mov dword [ebp - 0x1c460], eax
mov dword [ebp - 0x1c45c], eax
mov dword [ebp - 0x1c444], 0x80010
push 0x48
pop esi
push esi
push eax
lea eax, [ebp - 0x1c4c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c528]
mov dword [ebp - 0x1c484], eax
mov dword [ebp - 0x1c4c8], esi
xor edi, edi
mov dword [ebp - 0x1c4c4], edi
mov dword [ebp - 0x1c4c0], edi
mov dword [ebp - 0x1c4bc], edi
mov dword [ebp - 0x1c4b8], edi
mov dword [ebp - 0x1c4b4], edi
mov dword [ebp - 0x1c4b0], edi
mov dword [ebp - 0x1c4ac], edi
mov dword [ebp - 0x1c49c], edi
mov word [ebp - 0x1c498], 1
mov word [ebp - 0x1c496], di
mov dword [ebp - 0x1c494], edi
push 0xfffffffffffffff6
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call esi
mov dword [ebp - 0x1c490], eax
push 0xfffffffffffffff5
call esi
mov dword [ebp - 0x1c48c], eax
push 0xfffffffffffffff4
call esi
mov dword [ebp - 0x1c488], eax
mov word [ebp - 0x443c], di
mov word [ebp - 0x1043c], di
mov dword [ebp - 0x1c458], edi
mov eax, ebx
mov dword [ebp - 0x1c448], eax
cmp ebx, edi
je 0x4ad1a7e9
mov esi, 0x2000
cmp word [eax], di
je 0x4ad0b447
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
xor ebx, ebx
inc ebx
push 0
push eax
call fcn.4ad0219c
mov dword [ebp - 0x1c448], eax
movzx ecx, word [eax]
cmp cx, 0x22
je 0x4ad10a6e
push esi
cmp cx, word [0x4ad405f0]
je 0x4ad1050b
lea eax, [ebp - 0x443c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push 0
call fcn.4ad0b709
cmp eax, ebx
je 0x4ad13a1f
mov eax, dword [ebp - 0x1c448]
cmp word [eax], 0
je 0x4ad0b447
push eax
push esi
lea eax, [ebp - 0x1043c]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x1043c]
mov dword [ebp - 0x1c454], eax
cmp word [ebp - 0x443c], 0
je 0x4ad1aafc
cmp word [ebp - 0x443c], 0x22
je 0x4ad0b478
push 0x20
lea eax, [ebp - 0x443c]
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x4ad1ab12
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad0156d
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad01416
xor bl, bl
mov byte [ebp - 0x1c43d], bl
lea eax, [ebp - 0x1c468]
push eax
lea eax, [ebp - 0x443c]
push eax
push 0x2d
call fcn.4ad023b1
cmp eax, 0xffffffff
jne 0x4ad1ab39
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1843c]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x443c]
mov dword [ebp - 0x1c5a0], eax
push esi
push eax
lea eax, [ebp - 0x1c5d8]
push eax
call fcn.4ad037a6
cmp eax, 3
je 0x4ad118ad
xor edi, edi
cmp eax, edi
je 0x4ad118c1
cmp eax, 2
je 0x4ad13a18
cmp eax, 5
je 0x4ad1ab42
cmp byte [ebp - 0x1c43d], 0
jne 0x4ad0b57a
test bl, bl
jne 0x4ad13a26
mov ebx, dword [ebp - 0x1c454]
lea eax, [ebp - 0x1443c]
push eax
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.4ad01416
push 0x4ad023a8
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.4ad014d2
cmp ebx, edi
je 0x4ad0b56e
push ebx
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.4ad014d2
lea eax, [ebp - 0x1c43c]
mov dword [ebp - 0x1c454], eax
cmp dword [ebp - 0x1c460], edi
jne 0x4ad1060f
mov dword [ebp - 0x1c590], 0x44
lea eax, [ebp - 0x1c590]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x1c588]
mov dword [ebp - 0x1c4c0], eax
cmp byte [ebp - 0x1c43d], 0
jne 0x4ad118e1
mov dword [ebp - 0x1c46c], 0x20
lea eax, [ebp - 0x1c46c]
push eax
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
cmp eax, edi
je 0x4ad1abe5
mov dword [ebp - 0x1c480], esi
push edi
push edi
push 4
lea eax, [ebp - 0x1c480]
push eax
push 0x60001
push edi
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
cmp eax, edi
je 0x4ad1ac03
lea eax, [ebp - 0x1c47c]
push eax
lea eax, [ebp - 0x1c4c8]
push eax
push dword [ebp - 0x1c458]
push dword [ebp - 0x1c464]
mov eax, dword [ebp - 0x1c444]
or eax, 0x400
push eax
push esi
push edi
push edi
push dword [ebp - 0x1c454]
lea eax, [ebp - 0x443c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c450], eax
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
cmp dword [ebp - 0x1c460], edi
jne 0x4ad1061d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad240e0], eax
cmp dword [ebp - 0x1c450], edi
je 0x4ad117ef
cmp dword [ebp - 0x1c44c], 0xffffffff
jne 0x4ad1ac1d
push dword [ebp - 0x1c478]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c47c], edi
je 0x4ad0b6b8
push dword [ebp - 0x1c47c]
cmp dword [ebp - 0x1c45c], edi
jne 0x4ad10811
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.4ad013fa
leave
ret 4
inc eax
inc eax
mov dword [ebp - 0x1c448], eax
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad0b709
cmp eax, ebx
je 0x4ad13a1f
push 0x4ad105e8
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1a7f7
push 0x4ad105d0
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1a8f4
push 0x4ad105b8
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1a903
push 0x4ad105b4
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad108bd
and dword [ebp - 0x1c45c], eax
mov dword [ebp - 0x1c460], ebx
mov eax, dword [ebp - 0x1c444]
and eax, 0xffffffef
or eax, 0x200
mov dword [ebp - 0x1c444], eax
jmp 0x4ad105fa
mov eax, dword [ebp - 0x1c448]
cmp word [eax], 0
jne 0x4ad0b3db
jmp 0x4ad0b447
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x4ad0b586
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x4ad0b668
or dword [ebp - 0x1c49c], ebx
and word [ebp - 0x1c498], 0xfffe
or word [ebp - 0x1c498], 7
jmp 0x4ad105fa
call fcn.4ad03ffd
mov dword [0x4ad24130], eax
jmp 0x4ad0b6b8
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x44
je 0x4ad1a912
push 0x4ad10a54
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1a9b4
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x4ad1a9c3
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x4ad1aa90
push 0x4ad10a4c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1a9e1
push 0x4ad10a44
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad107f6
push 0x4ad10a3c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1a9ed
push 0x4ad10a2c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1aa08
push 0x4ad10a18
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1aa14
push 0x4ad10a04
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1aa23
push 0x4ad109f4
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1aa32
push 0x4ad109e8
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad1aa41
mov dword [ebp - 0x1c45c], ebx
jmp 0x4ad105fa
cmp dword [ebp - 0x1c4bc], 0
jne 0x4ad0b3f6
push 0x104
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad0b709
cmp eax, ebx
je 0x4ad13a1f
lea eax, [ebp - 0x43c]
push eax
call fcn.4ad0156d
push eax
push 0x104
lea eax, [ebp - 0x43c]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x1c4bc], eax
jmp 0x4ad105fa
cmp byte [0x4ad24041], 0
je 0x4ad1170a
cmp eax, 0xc1
je 0x4ad117fc
cmp eax, 0x2e4
je 0x4ad117fc
jmp 0x4ad118a1
mov eax, dword [ebp - 0x1c4e8]
cmp eax, edi
je 0x4ad1ac54
cmp eax, 0x20
je 0x4ad1ac63
mov dword [0x4ad240e0], eax
jmp 0x4ad1189a
cmp byte [ebp - 0x1c43d], 0
je 0x4ad116f6
push 0x3c
pop esi
push esi
push edi
lea eax, [ebp - 0x1c508]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c508], esi
mov dword [ebp - 0x1c504], 0x8140
test byte [ebp - 0x1c444], 0x10
je 0x4ad11833
mov dword [ebp - 0x1c504], 0x140
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x1c500], eax
lea eax, [ebp - 0x443c]
mov dword [ebp - 0x1c4f8], eax
lea eax, [ebp - 0x1043c]
mov dword [ebp - 0x1c4f4], eax
mov eax, dword [ebp - 0x1c458]
mov dword [ebp - 0x1c4f0], eax
movzx eax, word [ebp - 0x1c498]
mov dword [ebp - 0x1c4ec], eax
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c508]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x1c450], eax
cmp eax, edi
je 0x4ad117ce
mov eax, dword [ebp - 0x1c4d0]
mov dword [ebp - 0x1c47c], eax
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c450], edi
jne 0x4ad0b698
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad11767
xor eax, eax
inc eax
jmp 0x4ad0b6ba
mov byte [ebp - 0x1c43d], 1
lea eax, [ebp - 0x1843c]
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad01416
jmp 0x4ad0b51f
mov dword [ebp - 0x1c450], edi
jmp 0x4ad0b65c
mov bl, 1
jmp 0x4ad0b51f
mov eax, ebx
jmp 0x4ad0b6ba
push str.COMSPEC
call fcn.4ad02163
mov edi, eax
test edi, edi
je 0x4ad1ab57
lea eax, [ebp - 0x1443c]
push eax
push 0x4ad13ab8
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad01710
add esp, 0x10
push edi
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.4ad01416
push 0x4ad13aac
lea eax, [ebp - 0xc43c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4ad13a9e
cmp word [ebp - 0x1043c], 0
jne 0x4ad1ab69
lea ebx, [ebp - 0xc43c]
xor edi, edi
jmp 0x4ad0b536
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c448], eax
jmp 0x4ad0b3c8
push eax
push dword [ebp - 0x1c448]
call fcn.4ad0219c
mov dword [ebp - 0x1c448], eax
push esi
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad0b709
cmp eax, ebx
je 0x4ad1aac4
lea edi, [ebp - 0x843c]
cmp word [ebp - 0x843c], 0x30
jne 0x4ad1a850
cmp word [ebp - 0x843a], 0x78
je 0x4ad1a84a
cmp word [ebp - 0x843a], 0x58
jne 0x4ad1a850
lea edi, [ebp - 0x8438]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1a855
sub eax, edx
sar eax, 1
cmp eax, 8
ja 0x4ad1aa5b
and dword [ebp - 0x1c44c], 0
jmp 0x4ad1a8af
test bx, bx
je 0x4ad1a8cb
mov eax, dword [ebp - 0x1c44c]
shl eax, 4
lea ecx, [ebx - 0x30]
cmp cx, 9
ja 0x4ad1a895
movzx ecx, bx
lea eax, [eax + ecx - 0x30]
jmp 0x4ad1a8a9
lea ecx, [ebx - 0x61]
cmp cx, 5
ja 0x4ad1aa75
movzx ecx, bx
lea eax, [eax + ecx - 0x57]
mov dword [ebp - 0x1c44c], eax
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
inc edi
movzx ebx, ax
inc edi
push ebx
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
pop ecx
je 0x4ad1a875
mov eax, dword [ebp - 0x1c44c]
test eax, eax
je 0x4ad1aa75
mov dword [ebp - 0x1c44c], eax
or dword [ebp - 0x1c444], 4
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x8000
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x4000
jmp 0x4ad105fa
lea eax, [ebp - 0x843a]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1a91b
sub eax, edx
sar eax, 1
je 0x4ad1a933
lea eax, [ebp - 0x843a]
jmp 0x4ad1a969
push 0
push dword [ebp - 0x1c448]
call fcn.4ad0219c
mov dword [ebp - 0x1c448], eax
push esi
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad0b709
cmp eax, ebx
je 0x4ad13a1f
lea eax, [ebp - 0x843c]
push eax
call fcn.4ad0156d
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x234]
mov dword [ebp - 0x1c458], eax
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1a990
sub eax, edx
sar eax, 1
cmp eax, 0x104
jbe 0x4ad105fa
lea eax, [ebp - 0x234]
jmp 0x4ad1aa61
or dword [ebp - 0x1c444], 0x80
jmp 0x4ad105fa
mov eax, dword [0x4ad24168]
test eax, eax
je 0x4ad105fa
push eax
call fcn.4ad1c15a
mov dword [ebp - 0x1c464], eax
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x40
jmp 0x4ad105fa
or dword [ebp - 0x1c49c], ebx
and word [ebp - 0x1c498], 0xfffe
or word [ebp - 0x1c498], 3
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x20
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x100
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x800
jmp 0x4ad105fa
or dword [ebp - 0x1c444], 0x1000
jmp 0x4ad105fa
push 0x4ad1acb8
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad109da
jmp 0x4ad1aac4
lea eax, [ebp - 0x843c]
push eax
push ebx
push 0x2362
call fcn.4ad080e2
add esp, 0xc
jmp 0x4ad13a1f
lea eax, [ebp - 0x843c]
push eax
push 1
push 0x2362
call fcn.4ad080e2
add esp, 0xc
jmp 0x4ad118b9
call fcn.4ad1f4e2
push 0
push 0x40002397
call fcn.4ad0594f
pop ecx
pop ecx
cmp byte [0x4ad24041], 0
je 0x4ad1aaba
push 0
push 0x400023bf
call fcn.4ad0594f
pop ecx
pop ecx
call fcn.4ad1f36e
jmp 0x4ad13a1f
push 0x4ad1b26c
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad01416
lea eax, [ebp - 0x843c]
push eax
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad014d2
lea eax, [ebp - 0xc43c]
push eax
push ebx
push 0x2375
jmp 0x4ad1aa68
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad01416
jmp 0x4ad0b455
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad0156d
push eax
push 0x4ad1acac
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.4ad01710
add esp, 0x10
jmp 0x4ad0b4a6
inc bl
xor edi, edi
jmp 0x4ad0b51f
cmp eax, 2
je 0x4ad13a18
mov byte [ebp - 0x1c43d], 1
jmp 0x4ad0b51f
push eax
push 0x400023d2
call fcn.4ad080e2
pop ecx
pop ecx
jmp 0x4ad118b9
lea eax, [ebp - 0x1043c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1ab72
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0xc43c]
lea edi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1ab8b
sub eax, edi
sar eax, 1
add eax, edx
cmp eax, esi
jae 0x4ad1abca
push 0x4ad023a8
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad014d2
lea eax, [ebp - 0x1043c]
push eax
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad014d2
jmp 0x4ad13a9e
lea eax, [ebp - 0x1043c]
push eax
push 1
push 0x2363
call fcn.4ad080e2
add esp, 0xc
jmp 0x4ad13a9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad240e0], eax
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad11767
mov eax, esi
jmp 0x4ad0b6ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad240e0], eax
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
jmp 0x4ad1abf0
lea eax, [ebp - 0x1c54c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c53c]
and eax, dword [ebp - 0x1c44c]
push eax
push dword [ebp - 0x1c47c]
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push dword [ebp - 0x1c478]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4ad0b68c
mov dword [0x4ad240e0], 8
jmp 0x4ad1189a
mov dword [0x4ad240e0], 2
jmp 0x4ad1189a