Function at 0x4ad093bd
Capabilities:
Create process on windows
Get system information on windows
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4ad09818
push 0x4ad21f71
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x1c5c0
call fcn.4ad02bc6
mov eax, dword [0x4ad240ac]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c454], eax
mov dword [ebp - 0x1c464], eax
mov esi, 0x4ad09804
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebp - 0x1c44c], 0xffffffff
mov dword [ebp - 0x1c460], eax
mov dword [ebp - 0x1c45c], eax
mov dword [ebp - 0x1c444], 0x80010
push 0x48
pop esi
push esi
push eax
lea eax, [ebp - 0x1c4c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c528]
mov dword [ebp - 0x1c484], eax
mov dword [ebp - 0x1c4c8], esi
xor edi, edi
mov dword [ebp - 0x1c4c4], edi
mov dword [ebp - 0x1c4c0], edi
mov dword [ebp - 0x1c4bc], edi
mov dword [ebp - 0x1c4b8], edi
mov dword [ebp - 0x1c4b4], edi
mov dword [ebp - 0x1c4b0], edi
mov dword [ebp - 0x1c4ac], edi
mov dword [ebp - 0x1c49c], edi
xor eax, eax
inc eax
mov word [ebp - 0x1c498], ax
xor eax, eax
mov word [ebp - 0x1c496], ax
mov dword [ebp - 0x1c494], edi
push 0xfffffffffffffff6
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call esi
mov dword [ebp - 0x1c490], eax
push 0xfffffffffffffff5
call esi
mov dword [ebp - 0x1c48c], eax
push 0xfffffffffffffff4
call esi
mov dword [ebp - 0x1c488], eax
xor eax, eax
mov word [ebp - 0x443c], ax
mov word [ebp - 0x1043c], ax
mov dword [ebp - 0x1c458], edi
mov eax, ebx
mov dword [ebp - 0x1c448], eax
cmp ebx, edi
je 0x4ad1b1f1
mov esi, 0x2000
cmp word [eax], di
je 0x4ad09572
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
xor ebx, ebx
inc ebx
push 0
push eax
call fcn.4ad02b03
mov dword [ebp - 0x1c448], eax
movzx ecx, word [eax]
cmp cx, 0x22
je 0x4ad1b1ff
push esi
cmp cx, word [0x4ad4061c]
je 0x4ad0ba7b
lea eax, [ebp - 0x443c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push 0
call fcn.4ad09839
cmp eax, ebx
je 0x4ad132d3
mov eax, dword [ebp - 0x1c448]
cmp word [eax], 0
je 0x4ad09572
push eax
push esi
lea eax, [ebp - 0x1043c]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x1043c]
mov dword [ebp - 0x1c454], eax
cmp word [ebp - 0x443c], 0
je 0x4ad1b565
cmp word [ebp - 0x443c], 0x22
je 0x4ad095a3
push 0x20
lea eax, [ebp - 0x443c]
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x4ad1b57b
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad01b0c
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad017fb
xor bl, bl
mov byte [ebp - 0x1c43d], bl
lea eax, [ebp - 0x1c468]
push eax
lea eax, [ebp - 0x443c]
push eax
push 0x2d
call fcn.4ad046f3
cmp eax, 0xffffffff
jne 0x4ad132ca
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1843c]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x443c]
mov dword [ebp - 0x1c5a0], eax
push esi
push eax
lea eax, [ebp - 0x1c5d8]
push eax
call fcn.4ad032a0
cmp eax, 3
je 0x4ad0fe6f
xor edi, edi
cmp eax, edi
je 0x4ad0fe83
cmp eax, 2
je 0x4ad0c782
cmp eax, 5
je 0x4ad1b5a2
cmp byte [ebp - 0x1c43d], 0
jne 0x4ad096a5
test bl, bl
jne 0x4ad0c67e
mov ebx, dword [ebp - 0x1c454]
lea eax, [ebp - 0x1443c]
push eax
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.4ad017fb
push 0x4ad01b2c
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.4ad01a89
cmp ebx, edi
je 0x4ad09699
push ebx
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.4ad01a89
lea eax, [ebp - 0x1c43c]
mov dword [ebp - 0x1c454], eax
cmp dword [ebp - 0x1c460], edi
jne 0x4ad1044a
mov dword [ebp - 0x1c590], 0x44
lea eax, [ebp - 0x1c590]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x1c588]
mov dword [ebp - 0x1c4c0], eax
cmp byte [ebp - 0x1c43d], 0
jne 0x4ad0fea3
mov dword [ebp - 0x1c46c], 0x20
lea eax, [ebp - 0x1c46c]
push eax
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
cmp eax, edi
je 0x4ad1b5e4
mov dword [ebp - 0x1c480], esi
push edi
push edi
push 4
lea eax, [ebp - 0x1c480]
push eax
push 0x60001
push edi
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
cmp eax, edi
je 0x4ad1b602
lea eax, [ebp - 0x1c47c]
push eax
lea eax, [ebp - 0x1c4c8]
push eax
push dword [ebp - 0x1c458]
push dword [ebp - 0x1c464]
mov eax, dword [ebp - 0x1c444]
or eax, 0x400
push eax
push esi
push edi
push edi
push dword [ebp - 0x1c454]
lea eax, [ebp - 0x443c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c450], eax
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
cmp dword [ebp - 0x1c460], edi
jne 0x4ad10458
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad24120], eax
cmp dword [ebp - 0x1c450], edi
je 0x4ad0fdb1
cmp dword [ebp - 0x1c44c], 0xffffffff
jne 0x4ad1b61c
push dword [ebp - 0x1c478]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c47c], edi
je 0x4ad097e3
push dword [ebp - 0x1c47c]
cmp dword [ebp - 0x1c45c], edi
jne 0x4ad104b9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.4ad0139d
leave
ret 4
inc eax
inc eax
mov dword [ebp - 0x1c448], eax
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad09839
cmp eax, ebx
je 0x4ad132d3
push 0x4ad0bb64
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b25c
push 0x4ad0bb4c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b359
push 0x4ad0bb34
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b368
push 0x4ad0bb30
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad0bb76
and dword [ebp - 0x1c45c], eax
mov dword [ebp - 0x1c460], ebx
mov eax, dword [ebp - 0x1c444]
and eax, 0xffffffef
or eax, 0x200
mov dword [ebp - 0x1c444], eax
mov eax, dword [ebp - 0x1c448]
cmp word [eax], 0
jne 0x4ad09506
jmp 0x4ad09572
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x44
je 0x4ad1b377
push 0x4ad0bc34
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b419
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x4ad1b428
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x4ad1b4f9
push 0x4ad0bc2c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b446
push 0x4ad0bc24
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad137b3
or dword [ebp - 0x1c49c], ebx
mov eax, 0xfffe
and word [ebp - 0x1c498], ax
or word [ebp - 0x1c498], 7
jmp 0x4ad0bb1b
push str.COMSPEC
call fcn.4ad01931
mov edi, eax
test edi, edi
je 0x4ad1b5b7
lea eax, [ebp - 0x1443c]
push eax
push 0x4ad0c710
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad01799
add esp, 0x10
push edi
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.4ad017fb
push 0x4ad0c704
lea eax, [ebp - 0xc43c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4ad0c775
cmp word [ebp - 0x1043c], 0
je 0x4ad0c775
lea eax, [ebp - 0x1043c]
lea edx, [eax + 2]
jmp 0x4ad0c71e
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad0c71e
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0xc43c]
lea edi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad0c737
sub eax, edi
sar eax, 1
add eax, edx
cmp eax, esi
jae 0x4ad1b5c9
push 0x4ad01b2c
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad01a89
lea eax, [ebp - 0x1043c]
push eax
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad01a89
lea ebx, [ebp - 0xc43c]
xor edi, edi
jmp 0x4ad09661
mov bl, 1
jmp 0x4ad0964a
cmp byte [ebp - 0x1c43d], 0
je 0x4ad0feae
push 0x3c
pop esi
push esi
push edi
lea eax, [ebp - 0x1c508]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c508], esi
mov dword [ebp - 0x1c504], 0x8140
test byte [ebp - 0x1c444], 0x10
je 0x4ad0fdf5
mov dword [ebp - 0x1c504], 0x140
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x1c500], eax
lea eax, [ebp - 0x443c]
mov dword [ebp - 0x1c4f8], eax
lea eax, [ebp - 0x1043c]
mov dword [ebp - 0x1c4f4], eax
mov eax, dword [ebp - 0x1c458]
mov dword [ebp - 0x1c4f0], eax
movzx eax, word [ebp - 0x1c498]
mov dword [ebp - 0x1c4ec], eax
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c508]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x1c450], eax
cmp eax, edi
je 0x4ad13a82
mov eax, dword [ebp - 0x1c4d0]
mov dword [ebp - 0x1c47c], eax
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c450], edi
jne 0x4ad097c3
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad13a1b
xor eax, eax
inc eax
jmp 0x4ad097e5
mov byte [ebp - 0x1c43d], 1
lea eax, [ebp - 0x1843c]
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad017fb
jmp 0x4ad0964a
mov dword [ebp - 0x1c450], edi
jmp 0x4ad09787
cmp byte [0x4ad24081], 0
je 0x4ad0fec2
cmp eax, 0xc1
je 0x4ad0fdbe
cmp eax, 0x2e4
je 0x4ad0fdbe
jmp 0x4ad0fe63
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x4ad096b1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x4ad09793
call fcn.4ad03d1e
mov dword [0x4ad24180], eax
jmp 0x4ad097e3
inc bl
xor edi, edi
jmp 0x4ad0964a
mov eax, ebx
jmp 0x4ad097e5
push 0x4ad138a4
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b452
push 0x4ad13894
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b471
push 0x4ad13880
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b47d
push 0x4ad1386c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b48c
push 0x4ad1385c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad1b49b
push 0x4ad13850
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad1b4aa
mov dword [ebp - 0x1c45c], ebx
jmp 0x4ad0bb1b
mov eax, dword [ebp - 0x1c4e8]
cmp eax, edi
je 0x4ad1b653
cmp eax, 0x20
je 0x4ad1b662
mov dword [0x4ad24120], eax
jmp 0x4ad0fe5c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c448], eax
jmp 0x4ad094f3
cmp dword [ebp - 0x1c4bc], 0
jne 0x4ad09521
push 0x104
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad09839
cmp eax, ebx
je 0x4ad132d3
lea eax, [ebp - 0x43c]
push eax
call fcn.4ad01b0c
push eax
push 0x104
lea eax, [ebp - 0x43c]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x1c4bc], eax
jmp 0x4ad0bb1b
push eax
push dword [ebp - 0x1c448]
call fcn.4ad02b03
mov dword [ebp - 0x1c448], eax
push esi
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad09839
cmp eax, ebx
je 0x4ad1b52d
lea edi, [ebp - 0x843c]
cmp word [ebp - 0x843c], 0x30
jne 0x4ad1b2b5
cmp word [ebp - 0x843a], 0x78
je 0x4ad1b2af
cmp word [ebp - 0x843a], 0x58
jne 0x4ad1b2b5
lea edi, [ebp - 0x8438]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1b2ba
sub eax, edx
sar eax, 1
cmp eax, 8
ja 0x4ad1b4c4
and dword [ebp - 0x1c44c], 0
jmp 0x4ad1b314
test bx, bx
je 0x4ad1b330
mov eax, dword [ebp - 0x1c44c]
shl eax, 4
lea ecx, [ebx - 0x30]
cmp cx, 9
ja 0x4ad1b2fa
movzx ecx, bx
lea eax, [eax + ecx - 0x30]
jmp 0x4ad1b30e
lea ecx, [ebx - 0x61]
cmp cx, 5
ja 0x4ad1b4de
movzx ecx, bx
lea eax, [eax + ecx - 0x57]
mov dword [ebp - 0x1c44c], eax
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
inc edi
movzx ebx, ax
inc edi
push ebx
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
pop ecx
je 0x4ad1b2da
mov eax, dword [ebp - 0x1c44c]
test eax, eax
je 0x4ad1b4de
mov dword [ebp - 0x1c44c], eax
or dword [ebp - 0x1c444], 4
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x8000
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x4000
jmp 0x4ad0bb1b
lea eax, [ebp - 0x843a]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1b380
sub eax, edx
sar eax, 1
je 0x4ad1b398
lea eax, [ebp - 0x843a]
jmp 0x4ad1b3ce
push 0
push dword [ebp - 0x1c448]
call fcn.4ad02b03
mov dword [ebp - 0x1c448], eax
push esi
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.4ad09839
cmp eax, ebx
je 0x4ad132d3
lea eax, [ebp - 0x843c]
push eax
call fcn.4ad01b0c
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x234]
mov dword [ebp - 0x1c458], eax
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1b3f5
sub eax, edx
sar eax, 1
cmp eax, 0x104
jbe 0x4ad0bb1b
lea eax, [ebp - 0x234]
jmp 0x4ad1b4ca
or dword [ebp - 0x1c444], 0x80
jmp 0x4ad0bb1b
mov eax, dword [0x4ad241b8]
test eax, eax
je 0x4ad0bb1b
push eax
call fcn.4ad1c7eb
mov dword [ebp - 0x1c464], eax
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x40
jmp 0x4ad0bb1b
or dword [ebp - 0x1c49c], ebx
mov eax, 0xfffe
and word [ebp - 0x1c498], ax
or word [ebp - 0x1c498], 3
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x20
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x100
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x800
jmp 0x4ad0bb1b
or dword [ebp - 0x1c444], 0x1000
jmp 0x4ad0bb1b
push 0x4ad1b6ac
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad13843
jmp 0x4ad1b52d
lea eax, [ebp - 0x843c]
push eax
push ebx
push 0x2362
call fcn.4ad0ab8b
add esp, 0xc
jmp 0x4ad132d3
lea eax, [ebp - 0x843c]
push eax
push 1
push 0x2362
call fcn.4ad0ab8b
add esp, 0xc
jmp 0x4ad0fe7b
call fcn.4ad1fb9d
push 0
push 0x40002397
call fcn.4ad0a0bd
pop ecx
pop ecx
cmp byte [0x4ad24081], 0
je 0x4ad1b523
push 0
push 0x400023bf
call fcn.4ad0a0bd
pop ecx
pop ecx
call fcn.4ad1fb12
jmp 0x4ad132d3
push 0x4ad1baa4
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x843c]
push eax
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.4ad01a89
lea eax, [ebp - 0xc43c]
push eax
push ebx
push 0x2375
jmp 0x4ad1b4d1
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad017fb
jmp 0x4ad09580
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad01b0c
push eax
push 0x4ad1b6a0
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.4ad01799
add esp, 0x10
jmp 0x4ad095d1
cmp eax, 2
je 0x4ad0c782
mov byte [ebp - 0x1c43d], 1
jmp 0x4ad0964a
push eax
push 0x400023d2
call fcn.4ad0ab8b
pop ecx
pop ecx
jmp 0x4ad0fe7b
lea eax, [ebp - 0x1043c]
push eax
push 1
push 0x2363
call fcn.4ad0ab8b
add esp, 0xc
jmp 0x4ad0c775
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad24120], eax
lea eax, [ebp - 0x443c]
push eax
call fcn.4ad13a1b
mov eax, esi
jmp 0x4ad097e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad24120], eax
lea eax, [ebp - 0x1c528]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
jmp 0x4ad1b5ef
lea eax, [ebp - 0x1c54c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c53c]
and eax, dword [ebp - 0x1c44c]
push eax
push dword [ebp - 0x1c47c]
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push dword [ebp - 0x1c478]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4ad097b7
mov dword [0x4ad24120], 8
jmp 0x4ad0fe5c
mov dword [0x4ad24120], 2
jmp 0x4ad0fe5c