Function at 0x40a680
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov eax, dword [0x438014]
xor eax, ebp
mov dword [esp + 0xf0], eax
cmp byte [ecx + 0x14], 0
je 0x40b271
mov esi, edx
mov dword [esp + 0xc], ecx
test byte [ecx + 0x10], 4
jne 0x40a6de
mov edx, esi
mov edi, edx
movzx eax, byte [edx]
cmp eax, 0xff
je 0x40b1ad
mov edx, edi
cmp eax, 0xeb
je 0x40b1c3
cmp edi, edx
jne 0x40a6b5
cmp edi, esi
jne 0x40b373
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], 0
mov eax, dword [0x439384]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x40a748
push 0x439384
call fcn.00414996
add esp, 4
cmp dword [0x439384], 0xffffffff
jne 0x40a748
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x439380], eax
push 0x439384
call fcn.00414996
add esp, 4
mov esi, dword [0x439380]
xor edi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], edi
mov eax, dword [0x43938c]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40ad1d
push 0x439390
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp byte [esp + 0x48], 0
mov dword [esp], esi
jne 0x40b27c
mov dword [esp + 4], 0
mov esi, dword [0x43937c]
test esi, esi
jne 0x40a7c9
mov ebx, 0xc
push ebx
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], ebx
mov dword [0x43937c], esi
cmp byte [esp + 0x48], 0
jne 0x40b2b3
cmp dword [esi + 4], 0
jne 0x40a82f
push 0x14
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x40a800
mov ecx, esi
call fcn.0040ba70
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
mov ecx, dword [esi]
mov dword [ecx + eax*4 + 4], edi
mov edx, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov dword [ecx + eax*4 + 8], ebx
inc dword [esi + 4]
mov esi, dword [0x43937c]
test esi, esi
je 0x40b266
cmp dword [esi + 4], 0
je 0x40b266
mov ebx, dword [esi]
mov edi, dword [ebx + 8]
test edi, edi
mov esi, dword [esp]
je 0x40b655
test esi, esi
je 0x40b655
cmp dword [edi + 4], 0
jne 0x40ad15
mov eax, dword [0x439384]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x40a8aa
push 0x439384
call fcn.00414996
add esp, 4
cmp dword [0x439384], 0xffffffff
jne 0x40a8aa
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov esi, dword [esp]
mov dword [0x439380], eax
push 0x439384
call fcn.00414996
add esp, 4
mov ebx, dword [0x439380]
mov eax, esi
xor edx, edx
div ebx
sub ebx, edx
test edx, edx
cmove ebx, edx
add ebx, esi
lea esi, [edi + 8]
mov dword [edi + 8], ebx
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
cmp byte [esp + 0x48], 0
jne 0x40b584
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
je 0x40b648
mov dword [edi + 4], eax
cmp dword [esi], 0
je 0x40b655
push 0x439390
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [0x43938c]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40ad65
push 0x439390
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [edi + 4]
test eax, eax
je 0x40b655
mov esi, dword [edi + 0x10]
shl esi, 7
mov edx, esi
or edx, 0x7f
mov ecx, dword [edi + 0xc]
cmp edx, ecx
jb 0x40a9c6
cmp ecx, dword [edi + 8]
jae 0x40b655
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40b117
mov eax, dword [edi + 4]
add eax, dword [edi + 0xc]
push 0x20
push 0x1000
push dword [0x4393b4]
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
je 0x40b655
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40b159
mov eax, dword [0x4393b4]
add dword [edi + 0xc], eax
mov eax, dword [edi + 4]
add esi, eax
lea eax, [esp + 0x9c]
mov dword [eax - 4], edi
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, 0x80
mov dword [eax + 0x14], ecx
mov byte [eax + 0x18], 1
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x40b384
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xa4]
test ecx, ecx
je 0x40b394
mov esi, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov bl, byte [esp + 0xb4]
mov byte [esp + 4], bl
mov dword [esp], eax
test eax, eax
mov dword [esp + 0x10], esi
je 0x40aa4d
test edx, edx
je 0x40aa4d
test esi, esi
je 0x40aa4d
cmp byte [esp + 4], 0
je 0x40aa4d
inc dword [edi + 0x10]
mov dword [esp + 0x40], ecx
mov esi, dword [esp]
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edx
mov ebx, dword [esp + 0xa8]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], eax
mov edi, dword [esp + 0xb0]
mov dword [esp + 0x58], edi
mov byte [esp + 0x60], 1
push 0x439390
mov dword [esp + 0x20], edx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], edi
mov edi, eax
mov al, byte [esp + 4]
mov byte [esp + 0x3c], al
xor esi, esi
mov dword [esp + 0x44], esi
mov byte [esp + 0x5c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test edi, edi
je 0x40b3b9
cmp dword [esp], 0
mov ebx, dword [esp + 0x14]
je 0x40b07c
test edx, edx
je 0x40b07c
test ecx, ecx
je 0x40b07c
cmp byte [esp + 4], 0
je 0x40b07c
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_EncodePointer]
lea ecx, [ebx + 4]
cmp ecx, dword [esp + 0x18]
ja 0x40b3f0
mov ecx, dword [esp]
mov dword [ecx + ebx], eax
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x30]
add ebx, 4
mov dword [esp + 0x30], ebx
mov dword [esp + 4], eax
test eax, eax
je 0x40b408
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x40b07c
test edx, edx
je 0x40b07c
test ecx, ecx
je 0x40b07c
test al, al
je 0x40b07c
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x70]
mov dword [esp], eax
add eax, edi
push eax
call dword [sym.imp.kernel32.dll_EncodePointer]
lea esi, [ebx + 4]
cmp dword [esp + 4], 0
je 0x40b415
cmp esi, dword [esp + 0x38]
ja 0x40b458
mov ecx, dword [esp + 0x28]
mov dword [ecx + ebx], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x30], esi
mov dword [esp + 4], eax
test eax, eax
je 0x40b419
mov al, byte [esp + 0x3c]
cmp dword [esp + 0x28], 0
je 0x40b070
cmp dword [esp + 0x2c], 0
je 0x40b070
cmp dword [esp + 0x24], 0
je 0x40b070
test al, al
je 0x40b070
mov dword [esp + 0x34], esi
xor eax, eax
dec eax
cmp edi, 4
ja 0x40adad
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, edi
mov ecx, dword [esp]
movzx ecx, byte [ecx + ebx]
cmp ecx, 0x65
jg 0x40ac49
lea edx, [ecx - 0x2e]
cmp edx, 0x10
ja 0x40ac3c
mov edi, 0x10101
bt edi, edx
jb 0x40b19b
add ecx, 0xffffff9c
cmp ecx, 2
jae 0x40ac6f
jmp 0x40b19b
cmp ecx, 0x66
je 0x40b248
cmp ecx, 0x67
je 0x40b257
add ecx, 0xffffff10
cmp ecx, 3
ja 0x40ac6f
cmp ecx, 1
jne 0x40b56e
test al, 0xc
jne 0x40b070
mov edx, dword [esp]
movzx eax, byte [edx + ebx]
mov ecx, eax
and cl, 0xfc
cmp cl, 0x88
jne 0x40acb4
movzx eax, byte [edx + ebx + 1]
mov edi, eax
shr edi, 6
xor edx, edx
inc edx
cmp edi, 3
jne 0x40b20b
lea edi, [edx + ebx]
inc edi
mov dword [esp + 0x70], edi
cmp edi, 5
jb 0x40ac16
jmp 0x40adb1
cmp eax, 0xa0
jg 0x40acce
cmp eax, 0xf
je 0x40b667
cmp eax, 0x33
jne 0x40ace4
jmp 0x40b692
cmp eax, 0xa1
je 0x40b203
cmp eax, 0xb8
je 0x40b203
mov ecx, eax
and cl, 0xf8
cmp cl, 0x40
je 0x40ad10
cmp eax, 0x68
je 0x40b203
cmp eax, 0x83
je 0x40b4b3
mov ecx, eax
and cl, 0xf0
cmp cl, 0x50
jne 0x40b4ca
inc ebx
mov edi, ebx
jmp 0x40aca2
lea esi, [edi + 8]
jmp 0x40a8f1
push 0x43938c
call fcn.00414996
add esp, 4
cmp dword [0x43938c], 0xffffffff
jne 0x40a77d
push 0x1000000
push 0xfa0
push 0x439390
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionEx]
mov byte [0x439388], 1
push 0x43938c
call fcn.00414996
add esp, 4
jmp 0x40a77d
push 0x43938c
call fcn.00414996
add esp, 4
cmp dword [0x43938c], 0xffffffff
jne 0x40a926
push 0x1000000
push 0xfa0
push 0x439390
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionEx]
mov byte [0x439388], 1
push 0x43938c
call fcn.00414996
add esp, 4
jmp 0x40a926
mov dword [esp + 0xc], eax
lea eax, [edi + esi]
cmp dword [esp + 4], 0
je 0x40b466
cmp eax, dword [esp + 0x38]
ja 0x40b48a
add esi, dword [esp + 0x28]
push edi
push dword [esp + 4]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0x30]
add esi, edi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
mov eax, esi
je 0x40b46a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40b070
cmp dword [esp + 0x2c], 0
je 0x40b070
cmp dword [esp + 0x24], 0
je 0x40b070
cmp byte [esp + 0x3c], 0
je 0x40b070
cmp edi, 0x64
ja 0x40b070
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x40b4eb
mov ecx, dword [esp + 0x38]
cmp esi, ecx
jae 0x40b508
mov byte [eax + esi], 0xe9
mov esi, dword [esp + 0x30]
inc esi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
je 0x40b47e
mov ecx, dword [esp + 0x38]
lea eax, [esi + 4]
cmp eax, ecx
ja 0x40b4fe
mov eax, dword [esp]
add eax, edi
mov ecx, dword [esp + 0x2c]
add ecx, esi
sub eax, ecx
add eax, 0xfffffffc
mov ecx, dword [esp + 0x28]
mov dword [ecx + esi], eax
add dword [esp + 0x30], 4
cmp byte [esp + 0x3c], 0
je 0x40b070
cmp dword [esp + 0x20], 0
je 0x40b070
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
je 0x40b070
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0xb8]
mov dword [ecx - 0x20], edx
mov eax, dword [esp]
mov dword [ecx - 0x1c], eax
mov dword [ecx - 0x18], edi
xor ebx, ebx
mov dword [ecx - 0x14], ebx
mov dword [ecx - 0x10], ebx
mov dword [ecx - 8], ebx
mov dword [ecx - 4], 0x10
mov dword [ecx - 0xc], ecx
mov byte [ecx + 0x10], 1
lea esi, [esp + 0xcc]
mov ecx, esi
push edi
push eax
call fcn.0040b940
add esp, 8
cmp dword [esi + 8], ebx
je 0x40afe9
cmp byte [esp + 0xc8], 0
je 0x40afe9
lea esi, [esp + 0xac]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x40b530
mov ecx, dword [esp + 0xac]
mov byte [ecx + eax], 0xe9
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
inc eax
mov dword [esp + 0xb0], eax
inc edi
mov dword [esp + 0xa4], edi
add edi, dword [esp + 0x9c]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 0xb4]
ja 0x40b54e
mov ecx, dword [ebp + 8]
sub ecx, edi
add ecx, 0xfffffffc
mov edx, dword [esp + 0xac]
mov dword [edx + eax], ecx
mov eax, dword [esp + 0xb0]
add eax, 4
mov dword [esp + 0xb0], eax
add dword [esp + 0xa4], 4
cmp dword [esp + 0xd4], 0
je 0x40afe9
cmp byte [esp + 0xc8], 0
je 0x40afe9
test eax, eax
je 0x40afe0
mov ecx, dword [esp + 0xa8]
add ecx, dword [esp + 0x9c]
push eax
push dword [esp + 0xb0]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
xor esi, esi
push esi
push esi
push eax
call dword [sym.imp.kernel32.dll_FlushInstructionCache]
mov eax, dword [esp + 0xb0]
add dword [esp + 0xa8], eax
mov dword [esp + 0xb0], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40b0d8
mov esi, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x40b044
mov edi, dword [0x4393b4]
lea ebx, [esi + eax*8]
lea eax, [esp + 0x74]
push eax
push dword [esi]
push edi
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
add esi, 8
cmp esi, ebx
jne 0x40b025
mov esi, dword [esp + 0xd0]
lea eax, [esp + 0xdc]
mov dword [eax - 8], 0
cmp esi, eax
jne 0x40b512
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xb8]
cmp eax, ecx
jne 0x40b521
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x40b426
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
setne bl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40b0a5
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40b0a5
lea edx, [esp + 0x24]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
cmp byte [esp + 0x60], 0
je 0x40b0c0
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40b0c0
mov ecx, dword [esp + 0x44]
test ecx, ecx
jne 0x40b3db
mov ecx, dword [esp + 0xf0]
xor ecx, ebp
call fcn.00414c00
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4393b8
call fcn.00414996
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x40b00a
lea esi, [esp + 0x74]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00414996
add esp, 4
jmp 0x40b00a
push 0x4393b8
call fcn.00414996
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x40a978
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00414996
add esp, 4
jmp 0x40a978
push 0x4393b8
call fcn.00414996
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x40a9bb
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00414996
add esp, 4
jmp 0x40a9bb
mov cl, 2
test al, 2
jne 0x40b070
or al, cl
inc ebx
jmp 0x40ac1a
cmp byte [edi + 1], 0x25
mov edx, edi
jne 0x40a6d2
mov eax, dword [edi + 2]
mov edx, dword [eax]
jmp 0x40a6d2
movsx eax, byte [edi + 1]
add eax, edi
add eax, 2
mov ecx, eax
sub ecx, edi
shl ecx, 0x18
add ecx, 0xfe000000
mov edx, edi
test ecx, ecx
jle 0x40a6d2
sar ecx, 0x18
xor edx, edx
cmp byte [edx + edi + 2], 0x90
jne 0x40b57d
inc dl
movsx edx, dl
cmp ecx, edx
jg 0x40b1e8
mov edx, eax
jmp 0x40a6d2
add ebx, 5
jmp 0x40ad11
test edi, edi
jne 0x40b494
mov ecx, eax
and ecx, 7
cmp ecx, 5
je 0x40b4a3
cmp ecx, 4
jne 0x40b6e4
mov ecx, dword [esp]
mov cl, byte [ecx + ebx + 2]
and cl, 7
xor edx, edx
cmp cl, 5
sete dl
lea ecx, [edx*4 + 1]
jmp 0x40b4a3
mov cl, 4
test al, 4
je 0x40b1a5
jmp 0x40b070
mov cl, 8
test al, 8
je 0x40b1a5
jmp 0x40b070
int3
int3
lea esi, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], esi
mov dword [ecx + 4], 0
call fcn.00413de0
mov dword [esp + 4], eax
cmp byte [esi + 8], 0
je 0x40a79e
lea ecx, [esp + 0x40]
call fcn.0042f8a0
mov edi, eax
jmp 0x40a79e
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov eax, ecx
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x40b300
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], edx
mov ecx, dword [esp + 4]
shr edx, 1
lea eax, [edx + edx*2]
lea eax, [ebx + eax*4]
cmp dword [eax], ecx
jae 0x40b2f7
add eax, 0xc
not edx
add edx, dword [esp + 8]
mov ebx, eax
mov dword [esp + 8], edx
test edx, edx
jg 0x40b2d6
jmp 0x40b300
jne 0x40b2ed
cmp dword [eax + 4], edi
jb 0x40b2e2
jmp 0x40b2ed
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax*4]
cmp ebx, eax
je 0x40b323
mov eax, dword [esp + 4]
cmp dword [ebx], eax
ja 0x40b323
cmp dword [ebx + 4], edi
jae 0x40a831
lea ecx, [esp + 0x98]
mov dword [ecx + 4], edi
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edi, ecx
push 0x14
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov dword [edi + 8], eax
mov ecx, esi
mov edx, ebx
push edi
call fcn.0042f750
add esp, 4
mov ebx, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x40a831
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x40a831
mov ecx, edi
call fcn.0041a040
test al, al
cmovne esi, edi
jmp 0x40a6de
mov dword [esp + 0x9c], 0
jmp 0x40aa01
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
mov al, byte [esp + 0xb4]
mov byte [esp + 4], al
jmp 0x40aa4a
mov dword [esp + 4], 0
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_EncodePointer]
mov ebx, dword [esp + 0x14]
add ebx, 4
mov dword [esp + 0x30], ebx
jmp 0x40ab87
lea edx, [esp + 0x44]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
jmp 0x40b0c0
mov byte [esp + 0x3c], 0
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [esp + 4], edi
mov edx, ecx
mov esi, dword [esp]
jmp 0x40ab67
mov dword [esp + 4], 0
jmp 0x40ab87
mov dword [esp + 0x30], esi
mov dword [esp + 4], 0
jmp 0x40ac02
xor esi, esi
mov dword [esp + 0x30], esi
push esi
call dword [sym.imp.kernel32.dll_EncodePointer]
cmp dword [esp + 0x20], esi
je 0x40b91c
cmp dword [esp + 0x38], 3
jbe 0x40b929
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
add dword [esp + 0x30], 4
jmp 0x40b07c
mov byte [esp + 0x3c], 0
xor eax, eax
mov esi, ebx
jmp 0x40abd9
mov dword [esp + 0x30], eax
cmp edi, 0x64
ja 0x40b070
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x40b4eb
inc eax
mov esi, eax
add esi, 4
mov dword [esp + 0x30], esi
jmp 0x40ae83
mov byte [esp + 0x3c], 0
jmp 0x40adf2
mov ecx, 2
cmp edi, 1
je 0x40b4a3
mov ecx, 5
and al, 7
xor edx, edx
cmp al, 4
sete dl
add edx, ecx
jmp 0x40ac9e
mov eax, dword [esp]
mov al, byte [eax + ebx + 1]
cmp al, 0xc0
jb 0x40b6a8
add ebx, 3
jmp 0x40ad11
cmp al, 0xff
je 0x40b6f8
cmp eax, 0xe9
je 0x40b6ec
cmp eax, 0x6a
je 0x40b6a0
jmp 0x40b070
mov eax, dword [esp + 0x34]
add ecx, eax
add ecx, 5
cmp ecx, dword [esp + 0x38]
jbe 0x40b6c8
mov byte [esp + 0x3c], 0
jmp 0x40ae83
mov byte [esp + 0x3c], 0
jmp 0x40ae5c
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x40b05a
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x40b070
xor edx, edx
inc edx
mov ecx, esi
call fcn.0042fdc0
test al, al
je 0x40b8b8
mov eax, dword [esp + 0xb0]
jmp 0x40af18
mov ecx, esi
mov edx, 4
call fcn.0042fdc0
test al, al
je 0x40b8d3
mov eax, dword [esp + 0xb0]
jmp 0x40af58
mov cl, 1
test al, 1
je 0x40b1a5
jmp 0x40b070
mov edx, edi
jmp 0x40a6d2
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.00413de0
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
cmp byte [eax + 8], 0
je 0x40b8e0
lea ecx, [esp + 0x40]
call fcn.0042f8a0
mov dword [esp], eax
mov eax, dword [0x4393b0]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40b8eb
mov ecx, dword [0x4393ac]
test ecx, ecx
je 0x40b70e
lea eax, [esp + 0x74]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
movaps xmm0, xmmword [0x432000]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 0xa0], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea edx, [esp + 0x9c]
push edx
push eax
push 0x2000
push ebx
xor eax, eax
push eax
push dword [esp + 0x1c]
call ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x40a8f1
jmp 0x40b655
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [edi + 4], 0
push 0x439390
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor ebx, ebx
jmp 0x40b0c0
mov eax, dword [esp]
mov al, byte [eax + ebx + 1]
and al, 0xfe
cmp al, 0x10
jne 0x40b070
lea eax, [ebx + 2]
lea ecx, [esp + 0x68]
mov dword [ecx + 8], eax
call fcn.0042fae0
lea edi, [ebx + eax]
add edi, 2
jmp 0x40aca2
mov eax, dword [esp]
cmp byte [eax + ebx + 1], 0xc0
jb 0x40b070
add ebx, 2
jmp 0x40ad11
mov ecx, eax
and cl, 0xc0
cmp cl, 0x40
jne 0x40b070
and al, 7
cmp al, 4
je 0x40b070
add ebx, 4
jmp 0x40ad11
mov ecx, dword [esp + 0xc]
add ecx, eax
inc ecx
mov edx, dword [esp + 0x28]
add eax, dword [esp + 0x2c]
mov esi, dword [esp]
sub esi, eax
add dword [edx + ecx], esi
jmp 0x40ae83
xor ecx, ecx
inc ecx
jmp 0x40b4a3
lea edi, [ebx + 5]
mov dword [esp + 0xc], ebx
jmp 0x40aca2
mov eax, dword [esp]
cmp byte [eax + ebx + 1], 0x25
jne 0x40b070
add ebx, 6
jmp 0x40ad11
mov eax, dword [esp]
inc eax
mov ecx, dword [esp + 4]
mov edx, ebx
mov dword [esp], eax
push eax
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.0042f8f0
add esp, 8
test eax, eax
je 0x40b64e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40a8ee
jmp 0x40a8d6
mov byte [esp + 0xc8], 0
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
jmp 0x40af41
mov byte [esp + 0xc8], 0
jmp 0x40afe9
int3
push 0x4393b0
call fcn.00414996
add esp, 4
cmp dword [0x4393b0], 0xffffffff
jne 0x40b5e0
call fcn.0042fa90
push 0x4393b0
call fcn.00414996
add esp, 4
jmp 0x40b5e0
mov dword [esp + 0x30], 4
jmp 0x40b07c
mov byte [esp + 0x3c], 0
jmp 0x40b07c